dcrat | d91238b4e363c8213cce8303a78d9d0670d3cc544264c70c285dcd656c960e08

Analysis

max time kernel
149s
max time network
145s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 00:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_d91238b4e363c8213cce8303a78d9d0670d3cc544264c70c285dcd656c960e08.exe
Size

1.3MB
MD5

c35463964e2c878c6e82ad5a3cac452d
SHA1

60105fc4449526aedc476da0961f6754316ce16b
SHA256

d91238b4e363c8213cce8303a78d9d0670d3cc544264c70c285dcd656c960e08
SHA512

4631e764b04cd4374def1aa9c85de2e156270f3dcb8fb726d823232c9c2571fbaaaac8b79d61c382d5a9dd754737522953089fad7b2d410c1bf38de84837c284
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 45 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	572	2520	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	264	2520	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1484	2520	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	528	2520	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2052	2520	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2588	2520	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2376	2520	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2008	2520	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2564	2520	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3012	2520	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3028	2520	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3000	2520	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2552	2520	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2556	2520	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2508	2520	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2304	2520	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3004	2520	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1160	2520	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1304	2520	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2432	2520	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2460	2520	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1956	2520	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2456	2520	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2632	2520	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2228	2520	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2280	2520	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1920	2520	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1652	2520	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1440	2520	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2348	2520	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2148	2520	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2000	2520	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1924	2520	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1344	2520	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1768	2520	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1540	2520	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2760	2520	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1744	2520	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	632	2520	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1728	2520	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1856	2520	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1268	2520	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2396	2520	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1520	2520	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1816	2520	schtasks.exe	34

DCRat payload 13 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0008000000016621-9.dat	dcrat
behavioral1/memory/2816-13-0x0000000000A20000-0x0000000000B30000-memory.dmp	dcrat
behavioral1/memory/1432-133-0x0000000000C10000-0x0000000000D20000-memory.dmp	dcrat
behavioral1/memory/2528-253-0x00000000001D0000-0x00000000002E0000-memory.dmp	dcrat
behavioral1/memory/2616-313-0x0000000000140000-0x0000000000250000-memory.dmp	dcrat
behavioral1/memory/1924-374-0x0000000000B70000-0x0000000000C80000-memory.dmp	dcrat
behavioral1/memory/840-434-0x0000000000C90000-0x0000000000DA0000-memory.dmp	dcrat
behavioral1/memory/2664-495-0x00000000010D0000-0x00000000011E0000-memory.dmp	dcrat
behavioral1/memory/2804-555-0x00000000012D0000-0x00000000013E0000-memory.dmp	dcrat
behavioral1/memory/2304-615-0x0000000000070000-0x0000000000180000-memory.dmp	dcrat
behavioral1/memory/1500-675-0x0000000000DB0000-0x0000000000EC0000-memory.dmp	dcrat
behavioral1/memory/796-735-0x0000000000330000-0x0000000000440000-memory.dmp	dcrat
behavioral1/memory/2716-795-0x0000000000CD0000-0x0000000000DE0000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 16 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2840	powershell.exe
1284	powershell.exe
2876	powershell.exe
2372	powershell.exe
2416	powershell.exe
2880	powershell.exe
2936	powershell.exe
2916	powershell.exe
1584	powershell.exe
2868	powershell.exe
2808	powershell.exe
2176	powershell.exe
2652	powershell.exe
888	powershell.exe
1036	powershell.exe
2784	powershell.exe

Executes dropped EXE 13 IoCs

pid	Process
2816	DllCommonsvc.exe
1432	Idle.exe
2116	Idle.exe
2528	Idle.exe
2616	Idle.exe
1924	Idle.exe
840	Idle.exe
2664	Idle.exe
2804	Idle.exe
2304	Idle.exe
1500	Idle.exe
796	Idle.exe
2716	Idle.exe

Loads dropped DLL 2 IoCs

pid	Process
3040	cmd.exe
3040	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 12 IoCs

Web Service

T1102

flow	ioc
24	raw.githubusercontent.com
27	raw.githubusercontent.com
31	raw.githubusercontent.com
34	raw.githubusercontent.com
4	raw.githubusercontent.com
5	raw.githubusercontent.com
9	raw.githubusercontent.com
21	raw.githubusercontent.com
37	raw.githubusercontent.com
13	raw.githubusercontent.com
17	raw.githubusercontent.com
40	raw.githubusercontent.com

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\cmd.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Google\CrashReports\conhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Portable Devices\conhost.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Portable Devices\winlogon.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Portable Devices\cc11b995f2a76d	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\24dbde2999530e	DllCommonsvc.exe
File created	C:\Program Files\7-Zip\Lang\ebf1f9fa8afd6d	DllCommonsvc.exe
File created	C:\Program Files (x86)\Google\CrashReports\088424020bedd6	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Portable Devices\088424020bedd6	DllCommonsvc.exe
File created	C:\Program Files\Google\Chrome\101b941d020240	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\WmiPrvSE.exe	DllCommonsvc.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\spoolsv.exe	DllCommonsvc.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\f3b6ecef712a24	DllCommonsvc.exe
File created	C:\Program Files\Google\Chrome\lsm.exe	DllCommonsvc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\PLA\Reports\es-ES\dllhost.exe	DllCommonsvc.exe
File created	C:\Windows\PLA\Reports\es-ES\5940a34987c991	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_d91238b4e363c8213cce8303a78d9d0670d3cc544264c70c285dcd656c960e08.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 45 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3028	schtasks.exe
3000	schtasks.exe
2556	schtasks.exe
2508	schtasks.exe
1924	schtasks.exe
1956	schtasks.exe
1652	schtasks.exe
2348	schtasks.exe
1744	schtasks.exe
1856	schtasks.exe
2396	schtasks.exe
3004	schtasks.exe
1160	schtasks.exe
2460	schtasks.exe
2280	schtasks.exe
2760	schtasks.exe
1728	schtasks.exe
1268	schtasks.exe
1484	schtasks.exe
2376	schtasks.exe
2304	schtasks.exe
2148	schtasks.exe
2000	schtasks.exe
1768	schtasks.exe
632	schtasks.exe
1816	schtasks.exe
572	schtasks.exe
264	schtasks.exe
2564	schtasks.exe
1920	schtasks.exe
1440	schtasks.exe
1344	schtasks.exe
528	schtasks.exe
2052	schtasks.exe
2552	schtasks.exe
2456	schtasks.exe
2228	schtasks.exe
1540	schtasks.exe
2588	schtasks.exe
2008	schtasks.exe
3012	schtasks.exe
1304	schtasks.exe
2432	schtasks.exe
2632	schtasks.exe
1520	schtasks.exe

Suspicious behavior: EnumeratesProcesses 33 IoCs

pid	Process
2816	DllCommonsvc.exe
2816	DllCommonsvc.exe
2816	DllCommonsvc.exe
2816	DllCommonsvc.exe
2816	DllCommonsvc.exe
2808	powershell.exe
2372	powershell.exe
2416	powershell.exe
1284	powershell.exe
2916	powershell.exe
2880	powershell.exe
2840	powershell.exe
1584	powershell.exe
2784	powershell.exe
2936	powershell.exe
1036	powershell.exe
2868	powershell.exe
2652	powershell.exe
888	powershell.exe
2176	powershell.exe
2876	powershell.exe
1432	Idle.exe
2116	Idle.exe
2528	Idle.exe
2616	Idle.exe
1924	Idle.exe
840	Idle.exe
2664	Idle.exe
2804	Idle.exe
2304	Idle.exe
1500	Idle.exe
796	Idle.exe
2716	Idle.exe

Suspicious use of AdjustPrivilegeToken 29 IoCs

description	pid	Process
Token: SeDebugPrivilege	2816	DllCommonsvc.exe
Token: SeDebugPrivilege	2808	powershell.exe
Token: SeDebugPrivilege	2372	powershell.exe
Token: SeDebugPrivilege	2416	powershell.exe
Token: SeDebugPrivilege	1284	powershell.exe
Token: SeDebugPrivilege	2916	powershell.exe
Token: SeDebugPrivilege	2880	powershell.exe
Token: SeDebugPrivilege	2840	powershell.exe
Token: SeDebugPrivilege	1584	powershell.exe
Token: SeDebugPrivilege	2784	powershell.exe
Token: SeDebugPrivilege	2936	powershell.exe
Token: SeDebugPrivilege	1036	powershell.exe
Token: SeDebugPrivilege	2868	powershell.exe
Token: SeDebugPrivilege	2652	powershell.exe
Token: SeDebugPrivilege	888	powershell.exe
Token: SeDebugPrivilege	2176	powershell.exe
Token: SeDebugPrivilege	2876	powershell.exe
Token: SeDebugPrivilege	1432	Idle.exe
Token: SeDebugPrivilege	2116	Idle.exe
Token: SeDebugPrivilege	2528	Idle.exe
Token: SeDebugPrivilege	2616	Idle.exe
Token: SeDebugPrivilege	1924	Idle.exe
Token: SeDebugPrivilege	840	Idle.exe
Token: SeDebugPrivilege	2664	Idle.exe
Token: SeDebugPrivilege	2804	Idle.exe
Token: SeDebugPrivilege	2304	Idle.exe
Token: SeDebugPrivilege	1500	Idle.exe
Token: SeDebugPrivilege	796	Idle.exe
Token: SeDebugPrivilege	2716	Idle.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2944	2868	JaffaCakes118_d91238b4e363c8213cce8303a78d9d0670d3cc544264c70c285dcd656c960e08.exe	30
PID 2868 wrote to memory of 2944	2868	JaffaCakes118_d91238b4e363c8213cce8303a78d9d0670d3cc544264c70c285dcd656c960e08.exe	30
PID 2868 wrote to memory of 2944	2868	JaffaCakes118_d91238b4e363c8213cce8303a78d9d0670d3cc544264c70c285dcd656c960e08.exe	30
PID 2868 wrote to memory of 2944	2868	JaffaCakes118_d91238b4e363c8213cce8303a78d9d0670d3cc544264c70c285dcd656c960e08.exe	30
PID 2944 wrote to memory of 3040	2944	WScript.exe	31
PID 2944 wrote to memory of 3040	2944	WScript.exe	31
PID 2944 wrote to memory of 3040	2944	WScript.exe	31
PID 2944 wrote to memory of 3040	2944	WScript.exe	31
PID 3040 wrote to memory of 2816	3040	cmd.exe	33
PID 3040 wrote to memory of 2816	3040	cmd.exe	33
PID 3040 wrote to memory of 2816	3040	cmd.exe	33
PID 3040 wrote to memory of 2816	3040	cmd.exe	33
PID 2816 wrote to memory of 1036	2816	DllCommonsvc.exe	80
PID 2816 wrote to memory of 1036	2816	DllCommonsvc.exe	80
PID 2816 wrote to memory of 1036	2816	DllCommonsvc.exe	80
PID 2816 wrote to memory of 1284	2816	DllCommonsvc.exe	81
PID 2816 wrote to memory of 1284	2816	DllCommonsvc.exe	81
PID 2816 wrote to memory of 1284	2816	DllCommonsvc.exe	81
PID 2816 wrote to memory of 2416	2816	DllCommonsvc.exe	82
PID 2816 wrote to memory of 2416	2816	DllCommonsvc.exe	82
PID 2816 wrote to memory of 2416	2816	DllCommonsvc.exe	82
PID 2816 wrote to memory of 888	2816	DllCommonsvc.exe	84
PID 2816 wrote to memory of 888	2816	DllCommonsvc.exe	84
PID 2816 wrote to memory of 888	2816	DllCommonsvc.exe	84
PID 2816 wrote to memory of 2784	2816	DllCommonsvc.exe	85
PID 2816 wrote to memory of 2784	2816	DllCommonsvc.exe	85
PID 2816 wrote to memory of 2784	2816	DllCommonsvc.exe	85
PID 2816 wrote to memory of 2372	2816	DllCommonsvc.exe	87
PID 2816 wrote to memory of 2372	2816	DllCommonsvc.exe	87
PID 2816 wrote to memory of 2372	2816	DllCommonsvc.exe	87
PID 2816 wrote to memory of 2652	2816	DllCommonsvc.exe	88
PID 2816 wrote to memory of 2652	2816	DllCommonsvc.exe	88
PID 2816 wrote to memory of 2652	2816	DllCommonsvc.exe	88
PID 2816 wrote to memory of 1584	2816	DllCommonsvc.exe	90
PID 2816 wrote to memory of 1584	2816	DllCommonsvc.exe	90
PID 2816 wrote to memory of 1584	2816	DllCommonsvc.exe	90
PID 2816 wrote to memory of 2880	2816	DllCommonsvc.exe	91
PID 2816 wrote to memory of 2880	2816	DllCommonsvc.exe	91
PID 2816 wrote to memory of 2880	2816	DllCommonsvc.exe	91
PID 2816 wrote to memory of 2176	2816	DllCommonsvc.exe	93
PID 2816 wrote to memory of 2176	2816	DllCommonsvc.exe	93
PID 2816 wrote to memory of 2176	2816	DllCommonsvc.exe	93
PID 2816 wrote to memory of 2916	2816	DllCommonsvc.exe	94
PID 2816 wrote to memory of 2916	2816	DllCommonsvc.exe	94
PID 2816 wrote to memory of 2916	2816	DllCommonsvc.exe	94
PID 2816 wrote to memory of 2936	2816	DllCommonsvc.exe	95
PID 2816 wrote to memory of 2936	2816	DllCommonsvc.exe	95
PID 2816 wrote to memory of 2936	2816	DllCommonsvc.exe	95
PID 2816 wrote to memory of 2808	2816	DllCommonsvc.exe	97
PID 2816 wrote to memory of 2808	2816	DllCommonsvc.exe	97
PID 2816 wrote to memory of 2808	2816	DllCommonsvc.exe	97
PID 2816 wrote to memory of 2876	2816	DllCommonsvc.exe	99
PID 2816 wrote to memory of 2876	2816	DllCommonsvc.exe	99
PID 2816 wrote to memory of 2876	2816	DllCommonsvc.exe	99
PID 2816 wrote to memory of 2868	2816	DllCommonsvc.exe	101
PID 2816 wrote to memory of 2868	2816	DllCommonsvc.exe	101
PID 2816 wrote to memory of 2868	2816	DllCommonsvc.exe	101
PID 2816 wrote to memory of 2840	2816	DllCommonsvc.exe	102
PID 2816 wrote to memory of 2840	2816	DllCommonsvc.exe	102
PID 2816 wrote to memory of 2840	2816	DllCommonsvc.exe	102
PID 2816 wrote to memory of 2616	2816	DllCommonsvc.exe	112
PID 2816 wrote to memory of 2616	2816	DllCommonsvc.exe	112
PID 2816 wrote to memory of 2616	2816	DllCommonsvc.exe	112
PID 2616 wrote to memory of 3024	2616	cmd.exe	114

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d91238b4e363c8213cce8303a78d9d0670d3cc544264c70c285dcd656c960e08.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d91238b4e363c8213cce8303a78d9d0670d3cc544264c70c285dcd656c960e08.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2944
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3040
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2816
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1036
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1284
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Portable Devices\winlogon.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2416
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\7-Zip\Lang\cmd.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:888
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\Idle.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2784
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Google\CrashReports\conhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2372
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2652
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\spoolsv.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1584
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2880
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\PLA\Reports\es-ES\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2176
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\conhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2916
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Cookies\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2936
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Google\Chrome\lsm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2808
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2876
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Documents\Idle.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2868
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\WmiPrvSE.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2840
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\XlxSCVjZUU.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2616
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:3024
      - C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\Idle.exe
        
        "C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\Idle.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1432
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hC9SSnetfo.bat"
        7⤵
        
        PID:760
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:632
        
        C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\Idle.exe
        
        "C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\Idle.exe"
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2116
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\KtkjGbmHOL.bat"
        9⤵
        
        PID:2540
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:2708
        
        C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\Idle.exe
        
        "C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\Idle.exe"
        10⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2528
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\bbT3NvUu3s.bat"
        11⤵
        
        PID:2816
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:2696
        
        C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\Idle.exe
        
        "C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\Idle.exe"
        12⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2616
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\15yWIDpGaf.bat"
        13⤵
        
        PID:2704
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:1624
        
        C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\Idle.exe
        
        "C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\Idle.exe"
        14⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1924
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ffEuziAK6w.bat"
        15⤵
        
        PID:2296
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:1112
        
        C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\Idle.exe
        
        "C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\Idle.exe"
        16⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:840
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\M2NHsv551y.bat"
        17⤵
        
        PID:1920
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:2124
        
        C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\Idle.exe
        
        "C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\Idle.exe"
        18⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2664
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Q3ZRkRg4YZ.bat"
        19⤵
        
        PID:2044
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:560
        
        C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\Idle.exe
        
        "C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\Idle.exe"
        20⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2804
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\etpQuxQFPn.bat"
        21⤵
        
        PID:2088
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:900
        
        C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\Idle.exe
        
        "C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\Idle.exe"
        22⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2304
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WPmuDeaX4D.bat"
        23⤵
        
        PID:3028
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:2488
        
        C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\Idle.exe
        
        "C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\Idle.exe"
        24⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1500
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\IrNnSCw4rJ.bat"
        25⤵
        
        PID:2140
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:2396
        
        C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\Idle.exe
        
        "C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\Idle.exe"
        26⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:796
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HZWv28qLDz.bat"
        27⤵
        
        PID:2256
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        28⤵
        
        PID:2808
        
        C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\Idle.exe
        
        "C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\Idle.exe"
        28⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Portable Devices\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Portable Devices\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 10 /tr "'C:\Program Files\7-Zip\Lang\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 9 /tr "'C:\Program Files\7-Zip\Lang\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Google\CrashReports\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\CrashReports\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Google\CrashReports\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\DllCommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\providercommon\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Windows\PLA\Reports\es-ES\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\PLA\Reports\es-ES\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Windows\PLA\Reports\es-ES\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Portable Devices\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Portable Devices\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Cookies\DllCommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Users\Default\Cookies\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Cookies\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 6 /tr "'C:\Program Files\Google\Chrome\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 14 /tr "'C:\Program Files\Google\Chrome\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 12 /tr "'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\DllCommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 9 /tr "'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\Documents\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\All Users\Documents\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\Documents\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
65f3ac0bb6bb32db677e8bbf644aecdc

SHA1
d5528c69c17611ee1c8ca51bfd59f02c2d4295e1

SHA256
1f5e290bc0f503a951342d2a2e8d345c94249cc1400701628ba67a0b768e74e4

SHA512
4e3a7583a49389a92ab8e4fe6b2604a23b5406c406d20e1b094514532b3f8367494b5e86e0775cf1c0fd2e33b79cc5ff62664487b97d63c53674cf46f804d635

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a9a7fa3bf11688579970729e1890590e

SHA1
fdd2516ce0e97dcb23fa3583492e54100532de3b

SHA256
41a5775bf67aa24475c8918c1f909ce7e7494fcf1f57ffb9e284aa8893cb413c

SHA512
6c07d63072705716077719e1899158efa6d63230f29b2a803fdda9c7eadc9e43d1e72f8adc61c67203cd94b9329b373f51d522233d2aa5f7bf724054cd093765

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f822866107798aaecfc1451600adf6d5

SHA1
c396e8a87c42183e21c5230aa6582a1cd67509c5

SHA256
e8dd2e0db83ce9008bad67709e064cbf592d99bf75b5aea551a3cec4eb9ea715

SHA512
73bee04d649fe2f09b51f6c0118b18fee98e5dc49f15baa870495cee02ffe61fe71b39cc06a94d47cd851f82017d02789d1232ed7d483bb4696bc416a7798996

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2c77be76395bd86271e2b3f103a3136b

SHA1
7ef184eb1bf4f5e23729b8afc562d1513c74e87f

SHA256
e8e95986cdc653ff673f4f071c5b8ec2235e67671d2993cf270082e800986f89

SHA512
f931758ef44b970bcb4e9d7660864f9c0e1e8a23a9e42e11de4de3d507937a61521774df7b36ee5430ddc5ce35b3f6f2a9825e045c265f6b5891e8d7a7b421f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
739e63cde743ebbbec0d6aed6a07f1ce

SHA1
6c0244e47ad715a6f474ca754a66f10ca89e356a

SHA256
aca3e3784edccfc6c4768f9e7e712a26a1ae09c0e08fbf5ccfa1ef3f46f28405

SHA512
4b29b2610daf6ff8ab8f08ef28713fd57cfc9b72bf4612223cfac387dfae8022ba46abaab2b6d1c764a084f88028cb86a6a1d8be3df69e17c17166be9d79a75e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7fb4ca2262c3ab0495fd842192de7708

SHA1
02f8d25093b936a76d39608b3d13a294d2ba7817

SHA256
212bb3f9c0dea40ecd3c81949f23b9c04f18aeaaa26dde616f1cd67dcf0f57ec

SHA512
8873e8b2e5398b12e02dd201ff4b71418826f94c6c79cc7d94d1ebe247bd66c448cb8f65ea719ffed9203d5daccabbb18c888c7b70c21f8d3c5a2d5ece385249

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
913637a3e7f766d10017b1d49d92fb84

SHA1
e799ffa2f1a970f216c172c1681eb6557b7fc098

SHA256
9ca2f266cccc7c6dd28cbe7c7691b0d4fcbd0cd34f58e7c9463f2b303f15a978

SHA512
0478f9c37515022c706830fbc8263eb283ab28ebb37a3b27912ade061da6f77730ebc172c9b559d1c534f5ba8cc55f18696346d6e828bd923752da77eecd488b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6f0b4df117bbaee936018ed5789c7960

SHA1
1a12dea8b5e3c0310d07515eed6ad38ee31458eb

SHA256
1d3b57382b61773ce30593cbcf0b55a6ce74edeac310938b1bee8d2e60c06f63

SHA512
45f2f8dfd4c4d50027839c7b4985c24f47711fdea88e6f20c1322b3f92dee3da3b19ff80a85a9408ab2b4b92eec86af8c571651a184f6fdb8eabf4481d107fc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
120aefdea76529d712c9dc7cc2929124

SHA1
5838f0f9f063d4e752436947e22e36bb7b4ef56d

SHA256
236ad33369a2a232a4a286003a4026c0d9ecf265d63ff0ff4120f10c6a6fd83a

SHA512
aacb31a89edfb2c596dd4ed12b96c112812d259e850d794b8d6223df8e04485f3169d440254b6bfa89b78d1b2695b7dd622eeb7f6547006462c73e45c03af158

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2afaa207e1f49257259c3c52570478d5

SHA1
a046120969c9f3262790d0966d037e1fd6947f0a

SHA256
b55511c90f7fe73f4aea9253d9553876f014390864405fe51ea00e86c936d3bb

SHA512
e10f21f700119f67d3eba5a992dac6cf92c0c34cf840201e57bb9c8b72f9c87fa5a78bde763fdd0d359cc994e60eec891eccb583e2549daa097a138ac06b0773

Download Submit
C:\Users\Admin\AppData\Local\Temp\15yWIDpGaf.bat

Filesize
222B

MD5
9869c1204cf3be215a564991ec99289b

SHA1
574e530de06fa1a43ae7f480a77c69099fdba3e2

SHA256
28fe5a42068a657bf332474c30ee978861bf9cb5dff898782b15a528d18caa28

SHA512
a2585c771c2a2532c1df891c986f0a7e057c9d385449b1d689ec575e2ea3d93662ed1bab71976627fa357a7b7c34ae258394e0e2acccb60d8e5733909333dafe

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB3E6.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\HZWv28qLDz.bat

Filesize
222B

MD5
cfa042cffc36b1f675f84f0d0b097407

SHA1
67e39c604b66f0d865ac70435a80d7bc322e3278

SHA256
ed2bae5efe54f091c684128889391c0d3f59c5427c4bdce73246a0229fd8db03

SHA512
4f6958d49a6c8b8fd4ce9dc2892db513da2a5278e3ab0ff40103187f9a551e2de478999b040d691cafd21426f775bcf96c8caa0c45177ff6d525ced33f197418

Download Submit
C:\Users\Admin\AppData\Local\Temp\IrNnSCw4rJ.bat

Filesize
222B

MD5
382781845eb0893b41a9c91b287588ae

SHA1
46526cda47beda654d62c5e197a2cac0724d81ea

SHA256
b69e921dbef3941237b601da7805fbf37b0f1d26658d6ff315d899ba85dbfb5a

SHA512
9aa227370c16fad6e32167ddab16d1a5853c24ebc4fdb3c883d547d35d8c5019646497ba811c20f4b79a77e255375f0431817d9658f26fa24106a661c91cb1d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\KtkjGbmHOL.bat

Filesize
222B

MD5
3360ac15692b6bbeb12a2e528479b4ee

SHA1
dede1604eec1ddda32b0606713679102c76f0f45

SHA256
949c64fbe07986f58289cc185f9f1fed411933641f025048506618887051e2bc

SHA512
4dd818f8dd497b9c637479ba198db790a9c0bee13688569d2ee71447c4a922dcc855d2ab9417c4459e38e75fa5c5cfa705da9a822477093269c89c3503c267e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\M2NHsv551y.bat

Filesize
222B

MD5
b73fa86e57e695272789ae14d838d765

SHA1
83bd1b7a96396c7d935d0b39868cf8386530a3eb

SHA256
c5efa5118bd1bd1b2c37cbe50caaf2393b2a306cf1ca9db881cb13d9c7705b44

SHA512
24763553750336473bbe88f07b3f2d8c4d4701e6f54edbc2de1735c5b69b1201125ba6f76b4f66997ca115fc1df9e34fa399a548bad9ed002186684ea5ec689b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Q3ZRkRg4YZ.bat

Filesize
222B

MD5
0e65697e8ec72504460722ba4a02a18d

SHA1
7ae90eb6220061bdab19197f7e7ecb7344afc934

SHA256
d7a5ed55ad7c2ff1db0e51ea4140ff1d58f1549a7fc07342f8ea8a9052a35bcb

SHA512
23b74ac1251bf083a27b5ca7c6abbd58e55a52680887c0ee5ba471ceee42f91dd8a760b93a09142267d3b1c5195c312b2d40a60cebecb4d147a4956a7897c506

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB3F9.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\WPmuDeaX4D.bat

Filesize
222B

MD5
4b390562ba09a912f04bf407e88c3fb7

SHA1
0da51f1c5d88c019d1c9faa7beba9918423fb155

SHA256
db25eff2fbf829cdb9be6caf697289a81be1ffb77456ca0f770a9979af3a4cd5

SHA512
95244320f2ea995c47b2a05845591986028d6928b6a8a30f7a45ad4b909595923bfc49b14e9ebd4918b0fefd97334fa62810fe694a715962b02a0baa60ae3f8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\XlxSCVjZUU.bat

Filesize
222B

MD5
7f8a9d11e67ce7df017ab2a594061f52

SHA1
76b9cac77525f37fb7a059231bd2841723b83624

SHA256
09b917436a60eba204d55a50c937aa3f574dd659e681b9f97e7b7e7a3df519a8

SHA512
9c807bc31deeb6de22c5e1a9759bb81674ed11b2dffb11116b961e2ec8c63cfa762f5309744573f19d379cb4c37171868ca4e26a1e7a64bf080db757eb29f04a

Download Submit
C:\Users\Admin\AppData\Local\Temp\bbT3NvUu3s.bat

Filesize
222B

MD5
7f9c048f3822fb12e1ea83caa94fcfe2

SHA1
276697175fa5824fbf6c336d83724d2dea34dea1

SHA256
904c1e6f2f5874d9acfc26f5717ece98a340f40c7d6a9c6c365eb7834283fb65

SHA512
52ba936d0f5a18e2a5d39503cc1e4903abeed0550795e6b84f7b1099bf7af3720f80198336b3ac026fd5ed3c5c5c874460d4316e6436e21cfeed40a5bacf722f

Download Submit
C:\Users\Admin\AppData\Local\Temp\etpQuxQFPn.bat

Filesize
222B

MD5
1adc2f9a80de9b68118268c7a3bde1c6

SHA1
b422c1075f5614a87769864ff3a9d8be16bf1b16

SHA256
5dc2ea1a52289c31482e8935a104cf935dc955c1b56d6fa353683476d15a6bb6

SHA512
1e69bc708b99338444b5e9e654b4bf720934ff333054ace8a534df444288c23e5275b81f03eff43c8e02e73f9db3391b26f1dea5ed979f69b42a10dcf1aaa64f

Download Submit
C:\Users\Admin\AppData\Local\Temp\ffEuziAK6w.bat

Filesize
222B

MD5
fb00e8f5c1e9e89b6af1b11516e28fd7

SHA1
53b25084f30c054e32d84f140fc0e059c390d5aa

SHA256
e8ca95c22fafd18c5c14c4f9dad7185e4e849290b2b041289b41e39014b8f8eb

SHA512
45d512a176b89ba30037d6e73a43c854b5d30eff684c76ad865fd8b347955b26a6bcb8e2d25d4962ee1c5bb209f59e2c257d4191bfe4046cb8bd39de70dc87c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\hC9SSnetfo.bat

Filesize
222B

MD5
97375e4fc1961de9663cb1756bae2239

SHA1
7748d52f8120e6f13da0f21c6e0987943a45cc1a

SHA256
bfa3b6fa9f6bd895ce00082546c2f0d228883fbcff987efb5f4d9c2fb6ad4cb3

SHA512
2ac449e197187d31a47c3816a23f7c6d69ed24310f576aaace2926d954ee284816143b0050deca8278fdfa90b82c62b7edaef8156eef245402fda4a1eb8a228a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
52eda292b0bb048f566e561d33bde6c5

SHA1
5cd1dc0436da33c23cfa31f0fa7fa52c984a3729

SHA256
1303067252a4fea9b63d1101aff7f8c07bb8e7b3ad9a4c5556b249d112d481cc

SHA512
582c0fea3cb1c4119335543930ce54d09e84e69b7ec8803742517b16284db4ea8704b7562b3762781d2f6f69e76f0a3c2bba3ab90c4eaea76801f07ca6c43e2f

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
memory/796-735-0x0000000000330000-0x0000000000440000-memory.dmp

Filesize
1.1MB

Download
memory/840-435-0x0000000000980000-0x0000000000992000-memory.dmp

Filesize
72KB

Download
memory/840-434-0x0000000000C90000-0x0000000000DA0000-memory.dmp

Filesize
1.1MB

Download
memory/1432-133-0x0000000000C10000-0x0000000000D20000-memory.dmp

Filesize
1.1MB

Download
memory/1432-134-0x0000000000440000-0x0000000000452000-memory.dmp

Filesize
72KB

Download
memory/1500-675-0x0000000000DB0000-0x0000000000EC0000-memory.dmp

Filesize
1.1MB

Download
memory/1924-374-0x0000000000B70000-0x0000000000C80000-memory.dmp

Filesize
1.1MB

Download
memory/2116-193-0x00000000003B0000-0x00000000003C2000-memory.dmp

Filesize
72KB

Download
memory/2304-615-0x0000000000070000-0x0000000000180000-memory.dmp

Filesize
1.1MB

Download
memory/2416-77-0x000000001B4F0000-0x000000001B7D2000-memory.dmp

Filesize
2.9MB

Download
memory/2528-253-0x00000000001D0000-0x00000000002E0000-memory.dmp

Filesize
1.1MB

Download
memory/2616-313-0x0000000000140000-0x0000000000250000-memory.dmp

Filesize
1.1MB

Download
memory/2616-314-0x0000000000350000-0x0000000000362000-memory.dmp

Filesize
72KB

Download
memory/2664-495-0x00000000010D0000-0x00000000011E0000-memory.dmp

Filesize
1.1MB

Download
memory/2716-795-0x0000000000CD0000-0x0000000000DE0000-memory.dmp

Filesize
1.1MB

Download
memory/2804-555-0x00000000012D0000-0x00000000013E0000-memory.dmp

Filesize
1.1MB

Download
memory/2808-84-0x0000000001EE0000-0x0000000001EE8000-memory.dmp

Filesize
32KB

Download
memory/2816-17-0x0000000000480000-0x000000000048C000-memory.dmp

Filesize
48KB

Download
memory/2816-16-0x0000000000470000-0x000000000047C000-memory.dmp

Filesize
48KB

Download
memory/2816-15-0x0000000000460000-0x000000000046C000-memory.dmp

Filesize
48KB

Download
memory/2816-14-0x0000000000440000-0x0000000000452000-memory.dmp

Filesize
72KB

Download
memory/2816-13-0x0000000000A20000-0x0000000000B30000-memory.dmp

Filesize
1.1MB

Download