dcrat | ac62706e70e568805eb2eeaa094fd4d481714c8979918bf836f6e03a5e8faa51

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 03:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_ac62706e70e568805eb2eeaa094fd4d481714c8979918bf836f6e03a5e8faa51.exe
Size

1.3MB
MD5

5e72eb8a46b2223b39c575e388598281
SHA1

73c0ba8480023bd1a869cc4301dd533b3a44a5c7
SHA256

ac62706e70e568805eb2eeaa094fd4d481714c8979918bf836f6e03a5e8faa51
SHA512

24509759a74f2b0ee1e7f184de2ec23d9ec39836a61cb2d258bba8996e19243f01a095b7980814ab5525ec6c2196558d9abaa282ccbda0a3401a6fde9b735d4f
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 48 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2548	2784	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2188	2784	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2648	2784	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	780	2784	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2532	2784	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2584	2784	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1796	2784	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3032	2784	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	308	2784	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1324	2784	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2732	2784	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2720	2784	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1776	2784	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1600	2784	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2340	2784	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1068	2784	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2708	2784	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	952	2784	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1972	2784	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	496	2784	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2852	2784	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2688	2784	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2612	2784	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2148	2784	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2156	2784	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2124	2784	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1244	2784	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	448	2784	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	748	2784	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2944	2784	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1332	2784	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2336	2784	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1620	2784	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1732	2784	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1684	2784	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1036	2784	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1560	2784	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1060	2784	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2200	2784	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1016	2784	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2052	2784	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2440	2784	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2344	2784	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1572	2784	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2272	2784	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3016	2784	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2176	2784	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1688	2784	schtasks.exe	35

DCRat payload 9 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0008000000016de4-9.dat	dcrat
behavioral1/memory/1944-13-0x0000000000C10000-0x0000000000D20000-memory.dmp	dcrat
behavioral1/memory/3028-136-0x00000000003B0000-0x00000000004C0000-memory.dmp	dcrat
behavioral1/memory/2844-195-0x00000000010A0000-0x00000000011B0000-memory.dmp	dcrat
behavioral1/memory/2344-374-0x0000000000040000-0x0000000000150000-memory.dmp	dcrat
behavioral1/memory/2020-435-0x0000000000200000-0x0000000000310000-memory.dmp	dcrat
behavioral1/memory/2720-495-0x0000000000E40000-0x0000000000F50000-memory.dmp	dcrat
behavioral1/memory/1384-674-0x0000000000080000-0x0000000000190000-memory.dmp	dcrat
behavioral1/memory/2272-734-0x00000000001B0000-0x00000000002C0000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 17 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2596	powershell.exe
1596	powershell.exe
3008	powershell.exe
2604	powershell.exe
2876	powershell.exe
2004	powershell.exe
2420	powershell.exe
2872	powershell.exe
2488	powershell.exe
2820	powershell.exe
2060	powershell.exe
1248	powershell.exe
2284	powershell.exe
1748	powershell.exe
1716	powershell.exe
2168	powershell.exe
1568	powershell.exe

Executes dropped EXE 12 IoCs

pid	Process
1944	DllCommonsvc.exe
3028	WmiPrvSE.exe
2844	WmiPrvSE.exe
1976	WmiPrvSE.exe
316	WmiPrvSE.exe
2344	WmiPrvSE.exe
2020	WmiPrvSE.exe
2720	WmiPrvSE.exe
2648	WmiPrvSE.exe
2668	WmiPrvSE.exe
1384	WmiPrvSE.exe
2272	WmiPrvSE.exe

Loads dropped DLL 2 IoCs

pid	Process
2960	cmd.exe
2960	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 12 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com
5	raw.githubusercontent.com
19	raw.githubusercontent.com
23	raw.githubusercontent.com
40	raw.githubusercontent.com
9	raw.githubusercontent.com
12	raw.githubusercontent.com
16	raw.githubusercontent.com
26	raw.githubusercontent.com
30	raw.githubusercontent.com
33	raw.githubusercontent.com
37	raw.githubusercontent.com

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ru-RU\wininit.exe	DllCommonsvc.exe
File created	C:\Windows\SysWOW64\ru-RU\56085415360792	DllCommonsvc.exe

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Portable Devices\wininit.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Portable Devices\56085415360792	DllCommonsvc.exe
File created	C:\Program Files\DVD Maker\fr-FR\b75386f1303e64	DllCommonsvc.exe
File created	C:\Program Files\Uninstall Information\24dbde2999530e	DllCommonsvc.exe
File created	C:\Program Files\Windows Media Player\Network Sharing\taskhost.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Media Player\Network Sharing\b75386f1303e64	DllCommonsvc.exe
File created	C:\Program Files\DVD Maker\fr-FR\taskhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\audiodg.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Google\dllhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Google\5940a34987c991	DllCommonsvc.exe
File created	C:\Program Files\Uninstall Information\WmiPrvSE.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\42af1c969fbb7b	DllCommonsvc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\de-DE\OSPPSVC.exe	DllCommonsvc.exe
File created	C:\Windows\de-DE\1610b97d3ab4a7	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_ac62706e70e568805eb2eeaa094fd4d481714c8979918bf836f6e03a5e8faa51.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 48 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1732	schtasks.exe
2440	schtasks.exe
2648	schtasks.exe
496	schtasks.exe
1244	schtasks.exe
1332	schtasks.exe
1036	schtasks.exe
2272	schtasks.exe
780	schtasks.exe
2708	schtasks.exe
1620	schtasks.exe
1684	schtasks.exe
2852	schtasks.exe
2688	schtasks.exe
748	schtasks.exe
2336	schtasks.exe
2584	schtasks.exe
3032	schtasks.exe
308	schtasks.exe
1600	schtasks.exe
2532	schtasks.exe
2200	schtasks.exe
2052	schtasks.exe
2176	schtasks.exe
1560	schtasks.exe
1016	schtasks.exe
1688	schtasks.exe
2188	schtasks.exe
1068	schtasks.exe
2148	schtasks.exe
2156	schtasks.exe
1796	schtasks.exe
2720	schtasks.exe
2124	schtasks.exe
448	schtasks.exe
2944	schtasks.exe
2340	schtasks.exe
952	schtasks.exe
1972	schtasks.exe
2612	schtasks.exe
2548	schtasks.exe
1324	schtasks.exe
2732	schtasks.exe
1776	schtasks.exe
1060	schtasks.exe
2344	schtasks.exe
1572	schtasks.exe
3016	schtasks.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
1944	DllCommonsvc.exe
2060	powershell.exe
1568	powershell.exe
1248	powershell.exe
1716	powershell.exe
3008	powershell.exe
2820	powershell.exe
2284	powershell.exe
2872	powershell.exe
2488	powershell.exe
2004	powershell.exe
2604	powershell.exe
2420	powershell.exe
1596	powershell.exe
1748	powershell.exe
2876	powershell.exe
2596	powershell.exe
3028	WmiPrvSE.exe
2844	WmiPrvSE.exe
1976	WmiPrvSE.exe
316	WmiPrvSE.exe
2344	WmiPrvSE.exe
2020	WmiPrvSE.exe
2720	WmiPrvSE.exe
2648	WmiPrvSE.exe
2668	WmiPrvSE.exe
1384	WmiPrvSE.exe
2272	WmiPrvSE.exe

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: SeDebugPrivilege	1944	DllCommonsvc.exe
Token: SeDebugPrivilege	2060	powershell.exe
Token: SeDebugPrivilege	1568	powershell.exe
Token: SeDebugPrivilege	1248	powershell.exe
Token: SeDebugPrivilege	1716	powershell.exe
Token: SeDebugPrivilege	3008	powershell.exe
Token: SeDebugPrivilege	2820	powershell.exe
Token: SeDebugPrivilege	2284	powershell.exe
Token: SeDebugPrivilege	2872	powershell.exe
Token: SeDebugPrivilege	2488	powershell.exe
Token: SeDebugPrivilege	2004	powershell.exe
Token: SeDebugPrivilege	2604	powershell.exe
Token: SeDebugPrivilege	2420	powershell.exe
Token: SeDebugPrivilege	1596	powershell.exe
Token: SeDebugPrivilege	1748	powershell.exe
Token: SeDebugPrivilege	2876	powershell.exe
Token: SeDebugPrivilege	2596	powershell.exe
Token: SeDebugPrivilege	3028	WmiPrvSE.exe
Token: SeDebugPrivilege	2844	WmiPrvSE.exe
Token: SeDebugPrivilege	1976	WmiPrvSE.exe
Token: SeDebugPrivilege	316	WmiPrvSE.exe
Token: SeDebugPrivilege	2344	WmiPrvSE.exe
Token: SeDebugPrivilege	2020	WmiPrvSE.exe
Token: SeDebugPrivilege	2720	WmiPrvSE.exe
Token: SeDebugPrivilege	2648	WmiPrvSE.exe
Token: SeDebugPrivilege	2668	WmiPrvSE.exe
Token: SeDebugPrivilege	1384	WmiPrvSE.exe
Token: SeDebugPrivilege	2272	WmiPrvSE.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 2328	3004	JaffaCakes118_ac62706e70e568805eb2eeaa094fd4d481714c8979918bf836f6e03a5e8faa51.exe	31
PID 3004 wrote to memory of 2328	3004	JaffaCakes118_ac62706e70e568805eb2eeaa094fd4d481714c8979918bf836f6e03a5e8faa51.exe	31
PID 3004 wrote to memory of 2328	3004	JaffaCakes118_ac62706e70e568805eb2eeaa094fd4d481714c8979918bf836f6e03a5e8faa51.exe	31
PID 3004 wrote to memory of 2328	3004	JaffaCakes118_ac62706e70e568805eb2eeaa094fd4d481714c8979918bf836f6e03a5e8faa51.exe	31
PID 2328 wrote to memory of 2960	2328	WScript.exe	32
PID 2328 wrote to memory of 2960	2328	WScript.exe	32
PID 2328 wrote to memory of 2960	2328	WScript.exe	32
PID 2328 wrote to memory of 2960	2328	WScript.exe	32
PID 2960 wrote to memory of 1944	2960	cmd.exe	34
PID 2960 wrote to memory of 1944	2960	cmd.exe	34
PID 2960 wrote to memory of 1944	2960	cmd.exe	34
PID 2960 wrote to memory of 1944	2960	cmd.exe	34
PID 1944 wrote to memory of 2004	1944	DllCommonsvc.exe	84
PID 1944 wrote to memory of 2004	1944	DllCommonsvc.exe	84
PID 1944 wrote to memory of 2004	1944	DllCommonsvc.exe	84
PID 1944 wrote to memory of 2168	1944	DllCommonsvc.exe	85
PID 1944 wrote to memory of 2168	1944	DllCommonsvc.exe	85
PID 1944 wrote to memory of 2168	1944	DllCommonsvc.exe	85
PID 1944 wrote to memory of 1568	1944	DllCommonsvc.exe	86
PID 1944 wrote to memory of 1568	1944	DllCommonsvc.exe	86
PID 1944 wrote to memory of 1568	1944	DllCommonsvc.exe	86
PID 1944 wrote to memory of 1716	1944	DllCommonsvc.exe	88
PID 1944 wrote to memory of 1716	1944	DllCommonsvc.exe	88
PID 1944 wrote to memory of 1716	1944	DllCommonsvc.exe	88
PID 1944 wrote to memory of 1596	1944	DllCommonsvc.exe	89
PID 1944 wrote to memory of 1596	1944	DllCommonsvc.exe	89
PID 1944 wrote to memory of 1596	1944	DllCommonsvc.exe	89
PID 1944 wrote to memory of 2872	1944	DllCommonsvc.exe	90
PID 1944 wrote to memory of 2872	1944	DllCommonsvc.exe	90
PID 1944 wrote to memory of 2872	1944	DllCommonsvc.exe	90
PID 1944 wrote to memory of 1748	1944	DllCommonsvc.exe	91
PID 1944 wrote to memory of 1748	1944	DllCommonsvc.exe	91
PID 1944 wrote to memory of 1748	1944	DllCommonsvc.exe	91
PID 1944 wrote to memory of 3008	1944	DllCommonsvc.exe	92
PID 1944 wrote to memory of 3008	1944	DllCommonsvc.exe	92
PID 1944 wrote to memory of 3008	1944	DllCommonsvc.exe	92
PID 1944 wrote to memory of 2876	1944	DllCommonsvc.exe	93
PID 1944 wrote to memory of 2876	1944	DllCommonsvc.exe	93
PID 1944 wrote to memory of 2876	1944	DllCommonsvc.exe	93
PID 1944 wrote to memory of 2284	1944	DllCommonsvc.exe	94
PID 1944 wrote to memory of 2284	1944	DllCommonsvc.exe	94
PID 1944 wrote to memory of 2284	1944	DllCommonsvc.exe	94
PID 1944 wrote to memory of 2596	1944	DllCommonsvc.exe	95
PID 1944 wrote to memory of 2596	1944	DllCommonsvc.exe	95
PID 1944 wrote to memory of 2596	1944	DllCommonsvc.exe	95
PID 1944 wrote to memory of 2420	1944	DllCommonsvc.exe	97
PID 1944 wrote to memory of 2420	1944	DllCommonsvc.exe	97
PID 1944 wrote to memory of 2420	1944	DllCommonsvc.exe	97
PID 1944 wrote to memory of 2820	1944	DllCommonsvc.exe	98
PID 1944 wrote to memory of 2820	1944	DllCommonsvc.exe	98
PID 1944 wrote to memory of 2820	1944	DllCommonsvc.exe	98
PID 1944 wrote to memory of 1248	1944	DllCommonsvc.exe	99
PID 1944 wrote to memory of 1248	1944	DllCommonsvc.exe	99
PID 1944 wrote to memory of 1248	1944	DllCommonsvc.exe	99
PID 1944 wrote to memory of 2060	1944	DllCommonsvc.exe	101
PID 1944 wrote to memory of 2060	1944	DllCommonsvc.exe	101
PID 1944 wrote to memory of 2060	1944	DllCommonsvc.exe	101
PID 1944 wrote to memory of 2488	1944	DllCommonsvc.exe	102
PID 1944 wrote to memory of 2488	1944	DllCommonsvc.exe	102
PID 1944 wrote to memory of 2488	1944	DllCommonsvc.exe	102
PID 1944 wrote to memory of 2604	1944	DllCommonsvc.exe	103
PID 1944 wrote to memory of 2604	1944	DllCommonsvc.exe	103
PID 1944 wrote to memory of 2604	1944	DllCommonsvc.exe	103
PID 1944 wrote to memory of 2992	1944	DllCommonsvc.exe	113

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ac62706e70e568805eb2eeaa094fd4d481714c8979918bf836f6e03a5e8faa51.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ac62706e70e568805eb2eeaa094fd4d481714c8979918bf836f6e03a5e8faa51.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2328
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2960
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1944
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2004
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\WMIADAP.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2168
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1568
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Google\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1716
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Uninstall Information\WmiPrvSE.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1596
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\SysWOW64\ru-RU\wininit.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2872
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\audiodg.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1748
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\WMIADAP.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3008
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\wininit.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2876
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2284
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\de-DE\OSPPSVC.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2596
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Media Player\Network Sharing\taskhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2420
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\Sample Videos\WMIADAP.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2820
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\DVD Maker\fr-FR\taskhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1248
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\audiodg.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2060
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\explorer.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2488
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\conhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2604
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5CYKGIl0rr.bat"
        5⤵
        
        PID:2992
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:952
      - C:\Program Files\Uninstall Information\WmiPrvSE.exe
        
        "C:\Program Files\Uninstall Information\WmiPrvSE.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3028
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\xghrCifyI9.bat"
        7⤵
        
        PID:2500
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:2728
        
        C:\Program Files\Uninstall Information\WmiPrvSE.exe
        
        "C:\Program Files\Uninstall Information\WmiPrvSE.exe"
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2844
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\AKY6NrPTox.bat"
        9⤵
        
        PID:2920
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:1604
        
        C:\Program Files\Uninstall Information\WmiPrvSE.exe
        
        "C:\Program Files\Uninstall Information\WmiPrvSE.exe"
        10⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1976
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0quqFCQQe7.bat"
        11⤵
        
        PID:2720
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:2080
        
        C:\Program Files\Uninstall Information\WmiPrvSE.exe
        
        "C:\Program Files\Uninstall Information\WmiPrvSE.exe"
        12⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:316
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\jhJpXqSaXt.bat"
        13⤵
        
        PID:1756
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:3032
        
        C:\Program Files\Uninstall Information\WmiPrvSE.exe
        
        "C:\Program Files\Uninstall Information\WmiPrvSE.exe"
        14⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2344
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\P6ENo64DAh.bat"
        15⤵
        
        PID:2796
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:1248
        
        C:\Program Files\Uninstall Information\WmiPrvSE.exe
        
        "C:\Program Files\Uninstall Information\WmiPrvSE.exe"
        16⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2020
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\onYrHPGvDe.bat"
        17⤵
        
        PID:2168
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:2040
        
        C:\Program Files\Uninstall Information\WmiPrvSE.exe
        
        "C:\Program Files\Uninstall Information\WmiPrvSE.exe"
        18⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2720
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\uxMZkGAiOs.bat"
        19⤵
        
        PID:324
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:1852
        
        C:\Program Files\Uninstall Information\WmiPrvSE.exe
        
        "C:\Program Files\Uninstall Information\WmiPrvSE.exe"
        20⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2648
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\RId7nS4uU7.bat"
        21⤵
        
        PID:2196
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:1408
        
        C:\Program Files\Uninstall Information\WmiPrvSE.exe
        
        "C:\Program Files\Uninstall Information\WmiPrvSE.exe"
        22⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2668
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\kz4ReWEb5Y.bat"
        23⤵
        
        PID:1996
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:2576
        
        C:\Program Files\Uninstall Information\WmiPrvSE.exe
        
        "C:\Program Files\Uninstall Information\WmiPrvSE.exe"
        24⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1384
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\yaFjl1awzE.bat"
        25⤵
        
        PID:888
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:1188
        
        C:\Program Files\Uninstall Information\WmiPrvSE.exe
        
        "C:\Program Files\Uninstall Information\WmiPrvSE.exe"
        26⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2272
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cV1vwDPsky.bat"
        27⤵
        
        PID:2564
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        28⤵
        
        PID:2980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 12 /tr "'C:\providercommon\WMIADAP.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\providercommon\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 12 /tr "'C:\providercommon\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Google\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Google\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\Program Files\Uninstall Information\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 11 /tr "'C:\Program Files\Uninstall Information\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Windows\SysWOW64\ru-RU\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\SysWOW64\ru-RU\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Windows\SysWOW64\ru-RU\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\MSOCache\All Users\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 9 /tr "'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\WMIADAP.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 7 /tr "'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Portable Devices\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Portable Devices\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\providercommon\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 5 /tr "'C:\Windows\de-DE\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Windows\de-DE\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 8 /tr "'C:\Windows\de-DE\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Media Player\Network Sharing\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\Network Sharing\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Media Player\Network Sharing\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 13 /tr "'C:\Users\Public\Videos\Sample Videos\WMIADAP.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\Users\Public\Videos\Sample Videos\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 5 /tr "'C:\Users\Public\Videos\Sample Videos\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 14 /tr "'C:\Program Files\DVD Maker\fr-FR\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files\DVD Maker\fr-FR\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 11 /tr "'C:\Program Files\DVD Maker\fr-FR\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\MSOCache\All Users\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0c8f5aadba21d386838e65022bfeafaa

SHA1
df23bdc0ed83e81abdc7f7497a1da87bffaa3336

SHA256
d4ff2c7f7629606b3311a74c101bfa154a375515f705170faa4a724cb9178037

SHA512
815a8d195b882b3739caf0c47e0f5df66addd58ef6ebbb90f5605544d222746b27e7bf6b0b0d21082ccfb3f7dda94af140a77bf41d5ae54a61a2ff22253db6e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1d6edf57a54f3b13775264525cc16913

SHA1
0ac77c3c47af6c7e77ee3655e6c74135cd630bae

SHA256
95cbbddca32748a1f58a0f7c70213dc1170abe084b911df1645cb1951219c0a3

SHA512
27f85cd8827fb62d3bc638ae0e9774b015883482ed9441d7be3c56be0a46d86f109398e7e812c6e6956e9143b59e7852e81059d411dc3e3b1d9fcc4557061a0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e9f3c7385255f1772bf44f0ab2edfc19

SHA1
b3fdd41325c5e75bc689efa32f42a10599690b5c

SHA256
8d7511d03bf2a96e04437b624e99022bc4ee7407d2b47ea3e2a5c3a3e0acf98c

SHA512
8fe1c132cc18574f5f707f17056b34e86498b24d005664db9d4a018eb0308d51b1b0731f092e7bde96d70b8ae72d8ff4db3c0fcf0408543f7c93b22fe52249f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ba94fe003ca996f7eca8cf7a07a0aa9d

SHA1
782acf525e90ced2b13a19bbdcaa813b3b155411

SHA256
1e0fb121cb16ec5be7b95a0cabde2f6feb1642f708ce35f819defa0195b63495

SHA512
690d6cf43b2dbdacdb70d64f2b146d5094e38203513bb67532f9f8ef319e74e7517e223781d4604b5305abc5c30be2d510c38bf781374e6830273d932e26cff0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d963bd8fa887476a314e985a26e2ab58

SHA1
ac756a5dc863941ebe52be382127aa1e1f6bca99

SHA256
380a2462b073b3d0dd5964cf77da02f2bd6cb5435c75c76a146fcdeec0e9cb58

SHA512
6bb2c9aaa2c8af72d280c1d257eb73c53dd667eaa53f6652ed98e23a81c75481c4f65d3c16f3f890d250b7022f80ba3b434f211efec64b4442208de85b828745

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fc81253d564f4f32085f7f16bd5574a0

SHA1
bfd20a8b0220dfed9f6b4a954c0ace94bff8f251

SHA256
7285870b63c9e88bad43f9b4e920033373eb9f2c7608cd6d8c57fe956a8303dc

SHA512
7587569bc38307c27487ac17fd179734786a582f0945369c87538258c08424c42cc98879a48f34b315bed7a4bf35cc8ad1ccfb65864867a8f58d4e839c57e31f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f34b0916a2615ab8a7c9ef1140e28a65

SHA1
a5efda3f31835fa862c00464b5c66bc9995aa559

SHA256
63b25e0f8fa3c1a85e1e91442d649408253711a1bb9e7c89c9631f2f6bc78639

SHA512
f3fdbd11f29140393b79f5fc37b9ff83e63695cacf56e43b29e591785cc24efd67c2a3be8a467caed89357a7847edbc9216177c93880cd5da7cada72bc6c6240

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0b4c3b43db973a946dd075f962875cb6

SHA1
8b09ba17cbfd9f79b6c96eb45923238dc769d1a6

SHA256
c0a10233ec875c02f23053d9b15851603904ca82f5d762f81d6bac813213e8a4

SHA512
e519cbae9176da33f4aadb7b584e0d1afa77ac82c458e62a614cbe7dfc929be68e9ef0a369fdcba7efb694c6e611cdf9c1d46ad640eede2cf137306312eb86d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
78ac7bfd61f9c499f8b6b5226bc18735

SHA1
baef92fa22d497653eabf167c9630b65b41e5bf7

SHA256
bc00ffdfa98c83a2143111c1906dd2679d40c52445e0133dfea0308003d42d23

SHA512
e24255758cf2f031b0f1fac375b2ac6e8c1711ceff0c548f891d49751cc1572537fecd1d7b3589793336e3548d246ee06f98a448e4bbc936a05eec48b6d7dbbb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2283acefa8169e6f81a0861aaad5f8e2

SHA1
df85c6d3be46b33c2326f804e0c0238dcff04035

SHA256
d63ed965bf682b0406a5ae638bb7434e952aae626ed5e2be4a553d05d1b65d90

SHA512
a1483b3d1d86f0a832ffe3b7ea2130bf601fa860e0d7b5c855811e7fe0d3d8fad6428eefd3cbe7373a9904fae5b2a2e3e1c6a40841980f1a87a7ff52b5b88264

Download Submit
C:\Users\Admin\AppData\Local\Temp\0quqFCQQe7.bat

Filesize
216B

MD5
5ed5ef9b351beda2c3c0d80efb9093dd

SHA1
f654969b1416f40e39244657d200f0384cfb2280

SHA256
c417197db7cba883d1889776ecb30c23d762d385754faa6fc39a0b02361b1237

SHA512
677b880d50943ab174b58d3bfbf8067f479f197bd5d7747ef2688c3dd7f2fce3f71b83d3fedaba6aaf770a355266d55f13631811e3822795c4e8e9396a79aa29

Download Submit
C:\Users\Admin\AppData\Local\Temp\5CYKGIl0rr.bat

Filesize
216B

MD5
cd50ef9d0f618404c3c58da204085d29

SHA1
a6ae385bb985c959822e89b6b82c27245442dafa

SHA256
f5e5c06786b33c7fda32bfd6de62eb92e07ceba7597ea816b5681aacd0389595

SHA512
56889a04f67fe2737c17c844ac9109d0aff70828e98b98452e8cd4e59d1c592eb287809b91dc00b8d24ab7de4402d35bdc67773fc2a3b71b8ffe1853377bfc84

Download Submit
C:\Users\Admin\AppData\Local\Temp\AKY6NrPTox.bat

Filesize
216B

MD5
05eb64017b6da7abe3c5b82b6c87f4ed

SHA1
c5ed316029c27cb556d6a569f5f194441f2458f6

SHA256
77b90879e92ede5c7a4542f00a549050a8457fa3e007812119c118316396af8a

SHA512
e01839772536677d1cb4fd744d71d7b0552df39aff8ec5ba154e06262f0ac651795d0e792ee6a61abdc3c61460a7e7329a516b772fbe9e32907ada1fa8566945

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab363F.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\P6ENo64DAh.bat

Filesize
216B

MD5
1e911b6a400fd473115f04641139b5e6

SHA1
c85270faa34fa70817cac279e6e5533820806fd9

SHA256
6a0189e5f09fa10b15f753fa7f12a9018f226cdcb16d01502aa28746bccc0909

SHA512
3726d12f8b8c2e64a97232b94b95bfd1f366f596d80b8735f236664f12bd76830c7ff61f59cee64f39a70aa21e4a142b7f93562ad53234e0d5f47957f97b57a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\RId7nS4uU7.bat

Filesize
216B

MD5
3306f129b79e120ef9b05343cff584e6

SHA1
0fa9ada8852d1d69d2c8082dbdf07d2e1b01e327

SHA256
117745b525ed061c245df6dcb9c5ab452a35449c26b6f492af4ea34b93174d36

SHA512
b240312f1dfb3eadf463c437c7b79f51082c2c2a26356b5ee33789bf4d24e17ebae0c93d3a713d0e5c0d1a4fb44c5a0d946ee994d98ff81c15fc80ca712ee7c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3671.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\cV1vwDPsky.bat

Filesize
216B

MD5
90d14746c2cfd40566002589f3d41237

SHA1
2015440f668fb5a9e7b6be55408642853eb96d06

SHA256
6e6b8a2ab9287353d1b2b660e3310c5f92d74ab9e217d468a12aa729910bdf5d

SHA512
18167d2e7e654231809e518caa3166700061ed6faefee98581e3d598020d8283fc57269baef2dab219d773a12f4bb05439905c1f4c2c5ffd04a40c922311d18e

Download Submit
C:\Users\Admin\AppData\Local\Temp\jhJpXqSaXt.bat

Filesize
216B

MD5
62aff29e4b88cccd5cd7a7f1fcd48399

SHA1
dbd89f21dd468a13f4f32839adff321c3dd9d9e3

SHA256
e14851aa2327883a7beb52a6b883fd570a60c04909121d7428270473d76f6435

SHA512
b5412e0062d25b5bb1eb39cf56903f8f12769b4e7ad22425c3deb3968a3548d625aa944ebb0d9c8a56e28f6241e6f902b63874852cbb754d41d42d5dd14f0e90

Download Submit
C:\Users\Admin\AppData\Local\Temp\kz4ReWEb5Y.bat

Filesize
216B

MD5
583fdd9be989c86d31ebc91b883eb4f6

SHA1
1dd060d36cf5e6108fe385fce2d90d3d709d8480

SHA256
9921208a040d76e0e7d5a5be3a069845af1f2c099b43725af7a0be64081a8853

SHA512
6b60b527a393bccd54cb3dcbfb060d88d2d42f8f814a9f864e9d64db1daee1207af7a266ee1623538ecc830d9a1b6d1313975ee12a79f85a53cfe8ce0dd71a41

Download Submit
C:\Users\Admin\AppData\Local\Temp\uxMZkGAiOs.bat

Filesize
216B

MD5
156b9b487349c788268cf1a8d35b97b2

SHA1
d843054bbc0e3fac867a51a90f76a8379b854a49

SHA256
a5a28a58e1b6ed83fdbb446128d6360e553038907eed81d90ff009dd93da5bd8

SHA512
216bf63aaadf1df742e5730c79a6835ea4cf5be084b3516e0c51e503a68d92bc5ee5f088c4267abbf40c4047f7e89dc653ab311c5278bb0b2e8a4bd2417111dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\xghrCifyI9.bat

Filesize
216B

MD5
3a391715d496262ca1e6e01c45907ec2

SHA1
feb28b1cbc70a9639131cf986b25e1ad2d051ccf

SHA256
4062de9d178c4edaf0d3f196e728a09dd87c8606a4fa5c959eaa7be7bb64fc60

SHA512
3c80de1fc9d8d08ea9066b544fe4255388299648b37b0302d225be4ed47a9763677a47c5c72687d3a4f60968725815c89b27612f132af3886c20580e74a94f7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\yaFjl1awzE.bat

Filesize
216B

MD5
102c7995dd4d94f5e8f123abfa3a219a

SHA1
e6f5fae95cb6d47a884ebf3820014f574662fbbd

SHA256
82ab303bcaaa5185efb7f2c57becc75a97cfc44028a93a888fb7ad4e7244a290

SHA512
dffcb86c5789a36aa6e47b98bc1349116a737a9cb91082454164cb8b4bf16adb78ca9cc7e9c6db93f97342731848947f460a8989ebf0b54a84ceaefd48823195

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
1368b5003889cfeafb7d798142fd2bf5

SHA1
6d39186ee16501975e052208bb2f838e7cde53f8

SHA256
8c3a5ac6864d8411eb08e418faa793218fdfa0778780426bbb278c4e2405f5c7

SHA512
f61bd9917073ce769aca1c5115470fc6cdb15c0667221e442758c890dba26477dd147837fc8184ce6bd5a0b9fe6f047b66bb945c8b5e2e707204f7202a1ef3ea

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
memory/316-314-0x00000000002C0000-0x00000000002D2000-memory.dmp

Filesize
72KB

Download
memory/1384-674-0x0000000000080000-0x0000000000190000-memory.dmp

Filesize
1.1MB

Download
memory/1944-13-0x0000000000C10000-0x0000000000D20000-memory.dmp

Filesize
1.1MB

Download
memory/1944-14-0x0000000000140000-0x0000000000152000-memory.dmp

Filesize
72KB

Download
memory/1944-15-0x0000000000160000-0x000000000016C000-memory.dmp

Filesize
48KB

Download
memory/1944-16-0x0000000000150000-0x000000000015C000-memory.dmp

Filesize
48KB

Download
memory/1944-17-0x0000000000170000-0x000000000017C000-memory.dmp

Filesize
48KB

Download
memory/2020-435-0x0000000000200000-0x0000000000310000-memory.dmp

Filesize
1.1MB

Download
memory/2020-436-0x00000000004E0000-0x00000000004F2000-memory.dmp

Filesize
72KB

Download
memory/2060-61-0x0000000001D80000-0x0000000001D88000-memory.dmp

Filesize
32KB

Download
memory/2060-60-0x000000001B6D0000-0x000000001B9B2000-memory.dmp

Filesize
2.9MB

Download
memory/2168-133-0x000007FEECAB0000-0x000007FEED44D000-memory.dmp

Filesize
9.6MB

Download
memory/2272-734-0x00000000001B0000-0x00000000002C0000-memory.dmp

Filesize
1.1MB

Download
memory/2344-375-0x00000000004C0000-0x00000000004D2000-memory.dmp

Filesize
72KB

Download
memory/2344-374-0x0000000000040000-0x0000000000150000-memory.dmp

Filesize
1.1MB

Download
memory/2720-496-0x0000000000340000-0x0000000000352000-memory.dmp

Filesize
72KB

Download
memory/2720-495-0x0000000000E40000-0x0000000000F50000-memory.dmp

Filesize
1.1MB

Download
memory/2844-195-0x00000000010A0000-0x00000000011B0000-memory.dmp

Filesize
1.1MB

Download
memory/3028-136-0x00000000003B0000-0x00000000004C0000-memory.dmp

Filesize
1.1MB

Download