dcrat | ab0a8596473544491d7cecff452d65ab95f3c8077f161e1d2d96a6df7c09c269

Analysis

max time kernel
146s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 07:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_ab0a8596473544491d7cecff452d65ab95f3c8077f161e1d2d96a6df7c09c269.exe
Size

1.3MB
MD5

c29d4041d8dac53175a608d903463b82
SHA1

366ab2d5d36b2d8ccd76fc8aad7d9851386a7589
SHA256

ab0a8596473544491d7cecff452d65ab95f3c8077f161e1d2d96a6df7c09c269
SHA512

dbd9afd8ec62bfe7c50ca3846a12f55e1faaa9398e0e27fbee2e2e0b288e49b2510592f28ee2020813a1c437f463f82bf71c1b211bd1bd7f2260c4d9f28d4787
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 36 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4692	2368	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	384	2368	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1456	2368	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	60	2368	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3472	2368	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4004	2368	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3960	2368	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3524	2368	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1728	2368	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4480	2368	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2576	2368	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4612	2368	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3216	2368	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1436	2368	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	548	2368	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4296	2368	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4520	2368	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2312	2368	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2076	2368	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	632	2368	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4248	2368	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3684	2368	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2972	2368	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3884	2368	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3412	2368	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4684	2368	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2520	2368	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4100	2368	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2676	2368	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1692	2368	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3348	2368	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2304	2368	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1068	2368	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2532	2368	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1184	2368	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3584	2368	schtasks.exe	88

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x0007000000023cb3-9.dat	dcrat
behavioral2/memory/4816-13-0x0000000000AC0000-0x0000000000BD0000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 14 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1392	powershell.exe
2984	powershell.exe
1580	powershell.exe
2996	powershell.exe
3480	powershell.exe
3004	powershell.exe
2564	powershell.exe
3520	powershell.exe
3716	powershell.exe
5028	powershell.exe
3936	powershell.exe
4544	powershell.exe
3056	powershell.exe
1408	powershell.exe

Checks computer location settings 2 TTPs 17 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	JaffaCakes118_ab0a8596473544491d7cecff452d65ab95f3c8077f161e1d2d96a6df7c09c269.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	explorer.exe

Executes dropped EXE 16 IoCs

pid	Process
4816	DllCommonsvc.exe
4612	DllCommonsvc.exe
2284	explorer.exe
2624	explorer.exe
2156	explorer.exe
2940	explorer.exe
5092	explorer.exe
60	explorer.exe
380	explorer.exe
4368	explorer.exe
1552	explorer.exe
3876	explorer.exe
1068	explorer.exe
4372	explorer.exe
2144	explorer.exe
996	explorer.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 14 IoCs

Web Service

T1102

flow	ioc
21	raw.githubusercontent.com
38	raw.githubusercontent.com
53	raw.githubusercontent.com
45	raw.githubusercontent.com
52	raw.githubusercontent.com
55	raw.githubusercontent.com
22	raw.githubusercontent.com
39	raw.githubusercontent.com
43	raw.githubusercontent.com
54	raw.githubusercontent.com
24	raw.githubusercontent.com
40	raw.githubusercontent.com
44	raw.githubusercontent.com
51	raw.githubusercontent.com

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Defender\de-DE\a76d7bf15d8370	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\WmiPrvSE.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\24dbde2999530e	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\conhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\088424020bedd6	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Defender\uk-UA\fontdrvhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Defender\uk-UA\5b884080fd4f94	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Defender\de-DE\DllCommonsvc.exe	DllCommonsvc.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\pris\Idle.exe	DllCommonsvc.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\pris\Idle.exe	DllCommonsvc.exe
File created	C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\pris\6ccacd8608530f	DllCommonsvc.exe
File created	C:\Windows\schemas\TSWorkSpace\TrustedInstaller.exe	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_ab0a8596473544491d7cecff452d65ab95f3c8077f161e1d2d96a6df7c09c269.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	JaffaCakes118_ab0a8596473544491d7cecff452d65ab95f3c8077f161e1d2d96a6df7c09c269.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	explorer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 36 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2532	schtasks.exe
3584	schtasks.exe
2576	schtasks.exe
4612	schtasks.exe
3216	schtasks.exe
548	schtasks.exe
3472	schtasks.exe
3348	schtasks.exe
1184	schtasks.exe
1692	schtasks.exe
4692	schtasks.exe
4520	schtasks.exe
2076	schtasks.exe
4248	schtasks.exe
3412	schtasks.exe
2304	schtasks.exe
1068	schtasks.exe
384	schtasks.exe
1728	schtasks.exe
632	schtasks.exe
3884	schtasks.exe
1436	schtasks.exe
4004	schtasks.exe
3960	schtasks.exe
3524	schtasks.exe
4480	schtasks.exe
60	schtasks.exe
4684	schtasks.exe
4100	schtasks.exe
2676	schtasks.exe
1456	schtasks.exe
3684	schtasks.exe
2972	schtasks.exe
2520	schtasks.exe
4296	schtasks.exe
2312	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4816	DllCommonsvc.exe
4816	DllCommonsvc.exe
4816	DllCommonsvc.exe
4816	DllCommonsvc.exe
4816	DllCommonsvc.exe
4816	DllCommonsvc.exe
4816	DllCommonsvc.exe
1580	powershell.exe
1408	powershell.exe
3520	powershell.exe
3520	powershell.exe
3716	powershell.exe
3716	powershell.exe
3056	powershell.exe
3056	powershell.exe
3936	powershell.exe
3936	powershell.exe
1580	powershell.exe
1580	powershell.exe
3936	powershell.exe
4544	powershell.exe
4544	powershell.exe
1408	powershell.exe
1408	powershell.exe
3520	powershell.exe
3716	powershell.exe
3056	powershell.exe
4544	powershell.exe
4612	DllCommonsvc.exe
4612	DllCommonsvc.exe
4612	DllCommonsvc.exe
3480	powershell.exe
3480	powershell.exe
2984	powershell.exe
2984	powershell.exe
3004	powershell.exe
3004	powershell.exe
1392	powershell.exe
1392	powershell.exe
2996	powershell.exe
2996	powershell.exe
5028	powershell.exe
5028	powershell.exe
2564	powershell.exe
2564	powershell.exe
2564	powershell.exe
1392	powershell.exe
2284	explorer.exe
2284	explorer.exe
3480	powershell.exe
2984	powershell.exe
2996	powershell.exe
3004	powershell.exe
5028	powershell.exe
2624	explorer.exe
2156	explorer.exe
2940	explorer.exe
5092	explorer.exe
60	explorer.exe
380	explorer.exe
4368	explorer.exe
1552	explorer.exe
3876	explorer.exe
1068	explorer.exe

Suspicious use of AdjustPrivilegeToken 30 IoCs

description	pid	Process
Token: SeDebugPrivilege	4816	DllCommonsvc.exe
Token: SeDebugPrivilege	1580	powershell.exe
Token: SeDebugPrivilege	1408	powershell.exe
Token: SeDebugPrivilege	3936	powershell.exe
Token: SeDebugPrivilege	3520	powershell.exe
Token: SeDebugPrivilege	3716	powershell.exe
Token: SeDebugPrivilege	3056	powershell.exe
Token: SeDebugPrivilege	4544	powershell.exe
Token: SeDebugPrivilege	4612	DllCommonsvc.exe
Token: SeDebugPrivilege	3480	powershell.exe
Token: SeDebugPrivilege	2984	powershell.exe
Token: SeDebugPrivilege	3004	powershell.exe
Token: SeDebugPrivilege	1392	powershell.exe
Token: SeDebugPrivilege	2564	powershell.exe
Token: SeDebugPrivilege	2996	powershell.exe
Token: SeDebugPrivilege	5028	powershell.exe
Token: SeDebugPrivilege	2284	explorer.exe
Token: SeDebugPrivilege	2624	explorer.exe
Token: SeDebugPrivilege	2156	explorer.exe
Token: SeDebugPrivilege	2940	explorer.exe
Token: SeDebugPrivilege	5092	explorer.exe
Token: SeDebugPrivilege	60	explorer.exe
Token: SeDebugPrivilege	380	explorer.exe
Token: SeDebugPrivilege	4368	explorer.exe
Token: SeDebugPrivilege	1552	explorer.exe
Token: SeDebugPrivilege	3876	explorer.exe
Token: SeDebugPrivilege	1068	explorer.exe
Token: SeDebugPrivilege	4372	explorer.exe
Token: SeDebugPrivilege	2144	explorer.exe
Token: SeDebugPrivilege	996	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 3904	4656	JaffaCakes118_ab0a8596473544491d7cecff452d65ab95f3c8077f161e1d2d96a6df7c09c269.exe	83
PID 4656 wrote to memory of 3904	4656	JaffaCakes118_ab0a8596473544491d7cecff452d65ab95f3c8077f161e1d2d96a6df7c09c269.exe	83
PID 4656 wrote to memory of 3904	4656	JaffaCakes118_ab0a8596473544491d7cecff452d65ab95f3c8077f161e1d2d96a6df7c09c269.exe	83
PID 3904 wrote to memory of 2884	3904	WScript.exe	85
PID 3904 wrote to memory of 2884	3904	WScript.exe	85
PID 3904 wrote to memory of 2884	3904	WScript.exe	85
PID 2884 wrote to memory of 4816	2884	cmd.exe	87
PID 2884 wrote to memory of 4816	2884	cmd.exe	87
PID 4816 wrote to memory of 4544	4816	DllCommonsvc.exe	108
PID 4816 wrote to memory of 4544	4816	DllCommonsvc.exe	108
PID 4816 wrote to memory of 3520	4816	DllCommonsvc.exe	109
PID 4816 wrote to memory of 3520	4816	DllCommonsvc.exe	109
PID 4816 wrote to memory of 1580	4816	DllCommonsvc.exe	110
PID 4816 wrote to memory of 1580	4816	DllCommonsvc.exe	110
PID 4816 wrote to memory of 3056	4816	DllCommonsvc.exe	111
PID 4816 wrote to memory of 3056	4816	DllCommonsvc.exe	111
PID 4816 wrote to memory of 1408	4816	DllCommonsvc.exe	112
PID 4816 wrote to memory of 1408	4816	DllCommonsvc.exe	112
PID 4816 wrote to memory of 3716	4816	DllCommonsvc.exe	113
PID 4816 wrote to memory of 3716	4816	DllCommonsvc.exe	113
PID 4816 wrote to memory of 3936	4816	DllCommonsvc.exe	114
PID 4816 wrote to memory of 3936	4816	DllCommonsvc.exe	114
PID 4816 wrote to memory of 2120	4816	DllCommonsvc.exe	122
PID 4816 wrote to memory of 2120	4816	DllCommonsvc.exe	122
PID 2120 wrote to memory of 2192	2120	cmd.exe	124
PID 2120 wrote to memory of 2192	2120	cmd.exe	124
PID 2120 wrote to memory of 4612	2120	cmd.exe	133
PID 2120 wrote to memory of 4612	2120	cmd.exe	133
PID 4612 wrote to memory of 2996	4612	DllCommonsvc.exe	152
PID 4612 wrote to memory of 2996	4612	DllCommonsvc.exe	152
PID 4612 wrote to memory of 2984	4612	DllCommonsvc.exe	153
PID 4612 wrote to memory of 2984	4612	DllCommonsvc.exe	153
PID 4612 wrote to memory of 1392	4612	DllCommonsvc.exe	154
PID 4612 wrote to memory of 1392	4612	DllCommonsvc.exe	154
PID 4612 wrote to memory of 3004	4612	DllCommonsvc.exe	155
PID 4612 wrote to memory of 3004	4612	DllCommonsvc.exe	155
PID 4612 wrote to memory of 3480	4612	DllCommonsvc.exe	156
PID 4612 wrote to memory of 3480	4612	DllCommonsvc.exe	156
PID 4612 wrote to memory of 2564	4612	DllCommonsvc.exe	158
PID 4612 wrote to memory of 2564	4612	DllCommonsvc.exe	158
PID 4612 wrote to memory of 5028	4612	DllCommonsvc.exe	159
PID 4612 wrote to memory of 5028	4612	DllCommonsvc.exe	159
PID 4612 wrote to memory of 2284	4612	DllCommonsvc.exe	166
PID 4612 wrote to memory of 2284	4612	DllCommonsvc.exe	166
PID 2284 wrote to memory of 4724	2284	explorer.exe	172
PID 2284 wrote to memory of 4724	2284	explorer.exe	172
PID 4724 wrote to memory of 2340	4724	cmd.exe	174
PID 4724 wrote to memory of 2340	4724	cmd.exe	174
PID 4724 wrote to memory of 2624	4724	cmd.exe	176
PID 4724 wrote to memory of 2624	4724	cmd.exe	176
PID 2624 wrote to memory of 772	2624	explorer.exe	178
PID 2624 wrote to memory of 772	2624	explorer.exe	178
PID 772 wrote to memory of 2700	772	cmd.exe	180
PID 772 wrote to memory of 2700	772	cmd.exe	180
PID 772 wrote to memory of 2156	772	cmd.exe	184
PID 772 wrote to memory of 2156	772	cmd.exe	184
PID 2156 wrote to memory of 2192	2156	explorer.exe	187
PID 2156 wrote to memory of 2192	2156	explorer.exe	187
PID 2192 wrote to memory of 3488	2192	cmd.exe	189
PID 2192 wrote to memory of 3488	2192	cmd.exe	189
PID 2192 wrote to memory of 2940	2192	cmd.exe	191
PID 2192 wrote to memory of 2940	2192	cmd.exe	191
PID 2940 wrote to memory of 2076	2940	explorer.exe	193
PID 2940 wrote to memory of 2076	2940	explorer.exe	193

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ab0a8596473544491d7cecff452d65ab95f3c8077f161e1d2d96a6df7c09c269.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ab0a8596473544491d7cecff452d65ab95f3c8077f161e1d2d96a6df7c09c269.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3904
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2884
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4816
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4544
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\StartMenuExperienceHost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3520
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows NT\TableTextService\conhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1580
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\fontdrvhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3056
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Defender\uk-UA\fontdrvhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1408
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\upfc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3716
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\SendTo\cmd.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3936
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VWnk4att1S.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2120
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:2192
      - C:\providercommon\DllCommonsvc.exe
        
        "C:\providercommon\DllCommonsvc.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Program Files directory
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4612
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2996
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\pris\Idle.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2984
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\upfc.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1392
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Defender\de-DE\DllCommonsvc.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3004
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Multimedia Platform\WmiPrvSE.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3480
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\services.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2564
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Start Menu\explorer.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5028
        
        C:\Users\All Users\Start Menu\explorer.exe
        
        "C:\Users\All Users\Start Menu\explorer.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2284
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\F1gdtReUkn.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:4724
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:2340
        
        C:\Users\All Users\Start Menu\explorer.exe
        
        "C:\Users\All Users\Start Menu\explorer.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2624
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\IxigaWiN4Z.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:772
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:2700
        
        C:\Users\All Users\Start Menu\explorer.exe
        
        "C:\Users\All Users\Start Menu\explorer.exe"
        11⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2156
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\iMm147yiIR.bat"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:2192
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:3488
        
        C:\Users\All Users\Start Menu\explorer.exe
        
        "C:\Users\All Users\Start Menu\explorer.exe"
        13⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2940
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ZcfpJnj91J.bat"
        14⤵
        
        PID:2076
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:2392
        
        C:\Users\All Users\Start Menu\explorer.exe
        
        "C:\Users\All Users\Start Menu\explorer.exe"
        15⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5092
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\RnBkS9jGYw.bat"
        16⤵
        
        PID:3804
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:4304
        
        C:\Users\All Users\Start Menu\explorer.exe
        
        "C:\Users\All Users\Start Menu\explorer.exe"
        17⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:60
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Wqkq749RcZ.bat"
        18⤵
        
        PID:3560
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:4060
        
        C:\Users\All Users\Start Menu\explorer.exe
        
        "C:\Users\All Users\Start Menu\explorer.exe"
        19⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:380
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\IxigaWiN4Z.bat"
        20⤵
        
        PID:3960
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:2796
        
        C:\Users\All Users\Start Menu\explorer.exe
        
        "C:\Users\All Users\Start Menu\explorer.exe"
        21⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4368
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6xwNL0dL8Y.bat"
        22⤵
        
        PID:2332
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:1732
        
        C:\Users\All Users\Start Menu\explorer.exe
        
        "C:\Users\All Users\Start Menu\explorer.exe"
        23⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1552
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\kXH0MsH7jV.bat"
        24⤵
        
        PID:4960
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:2060
        
        C:\Users\All Users\Start Menu\explorer.exe
        
        "C:\Users\All Users\Start Menu\explorer.exe"
        25⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3876
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\KtkjGbmHOL.bat"
        26⤵
        
        PID:4320
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        27⤵
        
        PID:2428
        
        C:\Users\All Users\Start Menu\explorer.exe
        
        "C:\Users\All Users\Start Menu\explorer.exe"
        27⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1068
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BAdWWGXi7E.bat"
        28⤵
        
        PID:2308
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        29⤵
        
        PID:860
        
        C:\Users\All Users\Start Menu\explorer.exe
        
        "C:\Users\All Users\Start Menu\explorer.exe"
        29⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4372
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\aWJwCUxpp4.bat"
        30⤵
        
        PID:1900
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        31⤵
        
        PID:836
        
        C:\Users\All Users\Start Menu\explorer.exe
        
        "C:\Users\All Users\Start Menu\explorer.exe"
        31⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2144
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\XaHtVPtwVH.bat"
        32⤵
        
        PID:1356
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        33⤵
        
        PID:4368
        
        C:\Users\All Users\Start Menu\explorer.exe
        
        "C:\Users\All Users\Start Menu\explorer.exe"
        33⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 6 /tr "'C:\providercommon\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\providercommon\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 6 /tr "'C:\providercommon\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:60

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\TableTextService\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\providercommon\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\providercommon\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\providercommon\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Defender\uk-UA\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\uk-UA\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Defender\uk-UA\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 8 /tr "'C:\providercommon\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\providercommon\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 14 /tr "'C:\providercommon\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 11 /tr "'C:\Users\Default\SendTo\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Users\Default\SendTo\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 12 /tr "'C:\Users\Default\SendTo\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\pris\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\pris\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\pris\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Users\Default User\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Defender\de-DE\DllCommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\de-DE\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Defender\de-DE\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\providercommon\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\providercommon\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\providercommon\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\Start Menu\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\All Users\Start Menu\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\Start Menu\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\DllCommonsvc.exe.log

Filesize
1KB

MD5
7f3c0ae41f0d9ae10a8985a2c327b8fb

SHA1
d58622bf6b5071beacf3b35bb505bde2000983e3

SHA256
519fceae4d0dd4d09edd1b81bcdfa8aeab4b59eee77a4cd4b6295ce8e591a900

SHA512
8a8fd17eef071f86e672cba0d8fc2cfed6118aff816100b9d7c06eb96443c04c04bc5692259c8d7ecb1563e877921939c61726605af4f969e3f586f0913ed125

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\explorer.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
2e907f77659a6601fcc408274894da2e

SHA1
9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

SHA256
385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

SHA512
34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d3e9c29fe44e90aae6ed30ccf799ca8

SHA1
c7974ef72264bbdf13a2793ccf1aed11bc565dce

SHA256
2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

SHA512
60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d42b6da621e8df5674e26b799c8e2aa

SHA1
ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

SHA256
5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

SHA512
53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e58749a7a1826f6ea62df1e2ef63a32b

SHA1
c0bca21658b8be4f37b71eec9578bfefa44f862d

SHA256
0e1f0e684adb40a5d0668df5fed007c9046137d7ae16a1f2f343b139d5f9bc93

SHA512
4cf45b2b11ab31e7f67fff286b29d50ed28cd6043091144c5c0f1348b5f5916ed7479cf985595e6f096b586ab93b4b5dce612f688049b8366a2dd91863e98b70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
4c557aa00dc4a6ff86db4be1735e9d30

SHA1
7c155ad08e280926832bdad0aa948843de2ce5a2

SHA256
aad198f453bdcef5e479c7e622c005782f94d0b391798245284aad9506fa7e48

SHA512
2c311b272941308197e3f2fe9d961dda9682dfd514cc48bc63b156afb0d18cace8635f0d080b9f77ed43e67b551232a6fb5b86e88c2414f8bd2f32cbe5521ae2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3c625954a51c4bbd8141206b00f6fc0a

SHA1
4128cb2f9d2984844e303e2e330e448334e5c273

SHA256
952515feb4929cfad2435c679a5fad19242e938e8a7c97afebb1f3d996bd3ec4

SHA512
3f7c4ea0551de5b6237ca13419413e6e73e85632e9bb09b5354d6310b5969f9c3a2dc27142e75e8572c2c65b2bc7615269fad27dcea2f91c389b6758e2630517

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
0521c91b3359c0fad3f5f74a5a5e2859

SHA1
5c21c58d829b512e7eadeabf367c3c7832d30eae

SHA256
b7f4de9dbd9136bee32677c7bcc4161b51064d3bde43755dece7cee3614c5ec2

SHA512
0323f87c8e6c122daf791a51cebef7374b81f84792a678b41f49582a354879efb76e46e9b1c43f5a8d5ff3354234efb9ab674dbb1f9ea9905a030bb2e8258c9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\6xwNL0dL8Y.bat

Filesize
207B

MD5
f46e646fb4719fced0a5aa9397cae907

SHA1
e29669522bd2a4429144491103fb50bfcb7ccd6e

SHA256
4559b5ba141bd733a1d12deedde18d47dd94d35b6bf0183497587c94a54a8fc4

SHA512
5f836588839c19217f6fffa8ab9ad6c54b2c0d1e5c2f77c6165a9c40db346b3a70f85013232c8845a635a4da6d672d16643f1b9039c0fe981e7c709770b00b79

Download Submit
C:\Users\Admin\AppData\Local\Temp\BAdWWGXi7E.bat

Filesize
207B

MD5
1037d5c5404b9bae9f4d5d0ba2ab5726

SHA1
3094c29c50375f1c3e224b360accc303c983406e

SHA256
cd089b97dfc882bca1f3beea0cc466412e7dce731c1c909f641722439cc397dc

SHA512
29ad13ee10ecd64eea208925468dfa4f4122b7a3ba79f577ba7eb31b7ffd2dd5b2cd49a537bf4db12823c86384f7b036d9b2b6107dc0a7d54149fbdc2646775e

Download Submit
C:\Users\Admin\AppData\Local\Temp\F1gdtReUkn.bat

Filesize
207B

MD5
97f457494ab2ef51979fd7ec311a5744

SHA1
b3475d2a74b71702ad8d42fee812931979170101

SHA256
19cb098382a35ce5600d2ac10a31185f1f7dde9224b63d54779c4069bf51b5f8

SHA512
b9e9f127d1fe94651e965a4ebd680c99c38936866b754914c3200084cad5e5a754804241dba286180ee411ff7e980999c1a95775cf2202d531efd0f6c16bc72b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IxigaWiN4Z.bat

Filesize
207B

MD5
c84634e1e7c99228e0dfa4517a2f6776

SHA1
cc03df95fa43e3c334856e78a66708ba3d2a8a0f

SHA256
8a60359fcbb0be9124c31ad71617bf64c90919bc4d3a425627940944a3681cc7

SHA512
bca87fb32e68ba8eb83f96299efca4140c1ba70bd0afe068c59c9f0dabd808a834b5a001b6697ad05e3bc1d6dbb08fc3d43fc6813b65ef8aa7d108715b58d289

Download Submit
C:\Users\Admin\AppData\Local\Temp\KtkjGbmHOL.bat

Filesize
207B

MD5
8163e0820ebf0588ef43839afa96d446

SHA1
1737d2a340347b81d88da1251e211187424e0076

SHA256
101137f2c117804ede3898e0e55362a709e2170653d7bcffd9a288e124422274

SHA512
ce053d38e82d7157d4af19fb8b62ea1e46ff8b007eb75ac0c24583f5e8c88fe028eabc1dc1b398afb300f20b8d17926ddf1ba8f564953685c4a137fd4cd69cdf

Download Submit
C:\Users\Admin\AppData\Local\Temp\RnBkS9jGYw.bat

Filesize
207B

MD5
ba0f5334d4ea4f974656907c6deb8b55

SHA1
00350fb8b8c8c2ecbcb3e68692735d82e056c648

SHA256
7899462c5e8e3466efb2f1ef789b585d0a556d044efea6d1e833224dd1ed9914

SHA512
ddb5ff2e818e730162c4ce9936d32d6f681c6a2e981d674621b9069671aa52d2671b56a65038c7d450f6fec395d07006a9cd70d956d9e28ffcd37ff196decc05

Download Submit
C:\Users\Admin\AppData\Local\Temp\VWnk4att1S.bat

Filesize
199B

MD5
4d1b88f8e585879f52d2839ca84227d5

SHA1
8a09f8430fa38cb4907f31830112a3c81ad1ef7f

SHA256
7a1e7431d9b3193fa2c309c36fed4dcb5e76aa281b819c7857b7003586215aba

SHA512
354eba8c62db5febe6aad0e9fd925bd444b3cae7619f1c7d4ebf2a8de527ddcfcb86186cd535aa48b80ddee9b252567750aeb5ca1c2603af0df77e244d0e55c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Wqkq749RcZ.bat

Filesize
207B

MD5
889ff55ef52e5fdedecb6ae470095fdd

SHA1
03c7b2855dc1bce4b8704af9c433630bbafd3540

SHA256
d8e7132246db24da1b69ee935508993be99ef68eb8e1675a8c78a09e78bc42a3

SHA512
bc1430e713c9d752979069644fb091177141f34cd533758838154de31407dfde913c7ae7bb8b1e5888362ad87f8a90a8aa03ef3f46d19b87d93c8ec32a2daf09

Download Submit
C:\Users\Admin\AppData\Local\Temp\XaHtVPtwVH.bat

Filesize
207B

MD5
1d5bdd547bd2319c58fe196f89c10e8c

SHA1
9765dd34add7b3f2f7227681a47e06d7d13362a2

SHA256
f7e01aa30a346b475f64b65e4c85a358a3ad5e7f38681042363493809e6a0577

SHA512
44f8ee52488fb0b13591def62d536a596f9ff60ebcd46232d1aabe2fce7460a7773f926d55a08aafcac37b98ebf22d2f73c0fb0df194496689231629a843ebf0

Download Submit
C:\Users\Admin\AppData\Local\Temp\ZcfpJnj91J.bat

Filesize
207B

MD5
82a9dcabaefc89ed4d145431d93872ee

SHA1
1006f43fd54544718c117189b58a80ada3bc47f6

SHA256
713c42f1fcc64b2fb60a9098a5e56736c2033572607e334efe71f6d30bb07af2

SHA512
8f46c5bb72358db262cd111be5f88fe66afde1bf5bd7a3c9906581ae96dd930cfd133511fa84245388734f69d48302ffe473049e110a083dfd43b39967c7bfa6

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kvlwcpcq.s53.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\aWJwCUxpp4.bat

Filesize
207B

MD5
bd1b202a9f3a101d510ef15386c9bb02

SHA1
ca22a0da727fa2a2cafeacf66b9afaffb2847677

SHA256
442dfae96592472cc8c2367f1df5307ed01955c9656cc694ef36bc3bcdd39788

SHA512
4be23196c1a2acc0f91dd88b5cde2113e681424eecbd3c15c183300dc1f2aac83bdfc200ae651618122a9e2f90e3084eb263cfc96d4ecc2df1e510788dcf4ea3

Download Submit
C:\Users\Admin\AppData\Local\Temp\iMm147yiIR.bat

Filesize
207B

MD5
134434afbd4beaae41249c12ea1b31a1

SHA1
1810b4ae6e08af758ce50646626dbccbf53a5b84

SHA256
d634e6c51ae6d7ba3877834efc5073a6512b824de5f5e5c1d9e877e83c7fe9db

SHA512
e8aa6334f62c7ca69d86ba55081a027a076e4ad3ecb3862876bb5bebe3d628132535d51257a9a2b7dd47e982614ea9dc790a5d00ea6bdabb59992a886f9dfadd

Download Submit
C:\Users\Admin\AppData\Local\Temp\kXH0MsH7jV.bat

Filesize
207B

MD5
db47746590eb551f9adc6412cc1eecb6

SHA1
fe493571929b1fdd99c8162af74dd70d85c78c0a

SHA256
68ff1e3c3fd6ab8767be209ec88b4c7cbc56f3417787c448d997f459a7827bf9

SHA512
a2a089fb7a83394c1019939e22f5f3d56309d4a763878b858fa26a16dbde8b2c76e5522b9ffb0ac008ecd023b3f86ff126d264a1badf34e9097af8cc189bfca6

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/60-259-0x0000000002D50000-0x0000000002D62000-memory.dmp

Filesize
72KB

Download
memory/380-266-0x000000001B350000-0x000000001B362000-memory.dmp

Filesize
72KB

Download
memory/1068-292-0x0000000001710000-0x0000000001722000-memory.dmp

Filesize
72KB

Download
memory/1392-211-0x0000015D26260000-0x0000015D263CA000-memory.dmp

Filesize
1.4MB

Download
memory/1580-37-0x000002A4B2410000-0x000002A4B2432000-memory.dmp

Filesize
136KB

Download
memory/2156-240-0x0000000002930000-0x0000000002942000-memory.dmp

Filesize
72KB

Download
memory/2564-208-0x0000023D66170000-0x0000023D662DA000-memory.dmp

Filesize
1.4MB

Download
memory/2624-237-0x000000001B9C0000-0x000000001BAC2000-memory.dmp

Filesize
1.0MB

Download
memory/2984-215-0x0000027B687B0000-0x0000027B6891A000-memory.dmp

Filesize
1.4MB

Download
memory/2996-224-0x0000027044BD0000-0x0000027044D3A000-memory.dmp

Filesize
1.4MB

Download
memory/3004-221-0x000001F67A9D0000-0x000001F67AB3A000-memory.dmp

Filesize
1.4MB

Download
memory/3480-212-0x000001B6DC370000-0x000001B6DC4DA000-memory.dmp

Filesize
1.4MB

Download
memory/4368-273-0x0000000000930000-0x0000000000942000-memory.dmp

Filesize
72KB

Download
memory/4612-117-0x000000001AC50000-0x000000001AC62000-memory.dmp

Filesize
72KB

Download
memory/4816-13-0x0000000000AC0000-0x0000000000BD0000-memory.dmp

Filesize
1.1MB

Download
memory/4816-14-0x0000000002CE0000-0x0000000002CF2000-memory.dmp

Filesize
72KB

Download
memory/4816-12-0x00007FFFA5593000-0x00007FFFA5595000-memory.dmp

Filesize
8KB

Download
memory/4816-16-0x000000001B7D0000-0x000000001B7DC000-memory.dmp

Filesize
48KB

Download
memory/4816-17-0x000000001B7E0000-0x000000001B7EC000-memory.dmp

Filesize
48KB

Download
memory/4816-15-0x000000001B7F0000-0x000000001B7FC000-memory.dmp

Filesize
48KB

Download
memory/5028-218-0x0000025CC2880000-0x0000025CC29EA000-memory.dmp

Filesize
1.4MB

Download