dcrat | 42f5fb5c567dea693fda8f6693c5e871052ee057684696de4923964c8c133a04

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 07:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_42f5fb5c567dea693fda8f6693c5e871052ee057684696de4923964c8c133a04.exe
Size

1.3MB
MD5

2f5d14e574eb27c7292d6b64b76decbc
SHA1

e70ebe0bd2cd0e8947f13c87b2ec0c75991deaf0
SHA256

42f5fb5c567dea693fda8f6693c5e871052ee057684696de4923964c8c133a04
SHA512

ba97e1d8a15d8151d8a37d04e9814c8b015f18521eff39bfacd82ef0951e85fed09038d35469ccc5a9a2b8862003a256294ac0218ce7089d01874496d6d5e477
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 51 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2780	2348	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2624	2348	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2652	2348	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2592	2348	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2664	2348	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2768	2348	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2176	2348	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	676	2348	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	628	2348	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2360	2348	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1760	2348	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2892	2348	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2156	2348	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1116	2348	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	852	2348	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1888	2348	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	268	2348	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2688	2348	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2788	2348	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2012	2348	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1920	2348	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2180	2348	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3056	2348	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2940	2348	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2168	2348	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2228	2348	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2188	2348	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2936	2348	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1136	2348	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3000	2348	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1756	2348	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	752	2348	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1804	2348	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2240	2348	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2636	2348	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2432	2348	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1320	2348	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	900	2348	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1840	2348	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	700	2348	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2972	2348	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2896	2348	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	332	2348	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1532	2348	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1672	2348	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1984	2348	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	768	2348	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1620	2348	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2108	2348	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2120	2348	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2136	2348	schtasks.exe	35

DCRat payload 10 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0008000000016031-12.dat	dcrat
behavioral1/memory/2340-13-0x0000000000E10000-0x0000000000F20000-memory.dmp	dcrat
behavioral1/memory/1052-58-0x0000000000B40000-0x0000000000C50000-memory.dmp	dcrat
behavioral1/memory/2712-202-0x00000000003D0000-0x00000000004E0000-memory.dmp	dcrat
behavioral1/memory/1824-262-0x0000000000BE0000-0x0000000000CF0000-memory.dmp	dcrat
behavioral1/memory/2156-382-0x0000000000EF0000-0x0000000001000000-memory.dmp	dcrat
behavioral1/memory/2076-502-0x0000000000FD0000-0x00000000010E0000-memory.dmp	dcrat
behavioral1/memory/1884-562-0x0000000000280000-0x0000000000390000-memory.dmp	dcrat
behavioral1/memory/2352-622-0x00000000001D0000-0x00000000002E0000-memory.dmp	dcrat
behavioral1/memory/3052-683-0x0000000001240000-0x0000000001350000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 18 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1820	powershell.exe
2744	powershell.exe
2620	powershell.exe
2368	powershell.exe
2364	powershell.exe
2964	powershell.exe
2532	powershell.exe
2692	powershell.exe
2728	powershell.exe
2468	powershell.exe
2504	powershell.exe
2384	powershell.exe
316	powershell.exe
1264	powershell.exe
2732	powershell.exe
2604	powershell.exe
2736	powershell.exe
1768	powershell.exe

Executes dropped EXE 12 IoCs

pid	Process
2340	DllCommonsvc.exe
1052	audiodg.exe
2712	audiodg.exe
1824	audiodg.exe
1320	audiodg.exe
2156	audiodg.exe
1848	audiodg.exe
2076	audiodg.exe
1884	audiodg.exe
2352	audiodg.exe
3052	audiodg.exe
3000	audiodg.exe

Loads dropped DLL 2 IoCs

pid	Process
2320	cmd.exe
2320	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 12 IoCs

Web Service

T1102

flow	ioc
38	raw.githubusercontent.com
15	raw.githubusercontent.com
21	raw.githubusercontent.com
31	raw.githubusercontent.com
34	raw.githubusercontent.com
18	raw.githubusercontent.com
25	raw.githubusercontent.com
28	raw.githubusercontent.com
4	raw.githubusercontent.com
5	raw.githubusercontent.com
9	raw.githubusercontent.com
12	raw.githubusercontent.com

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\VideoLAN\VLC\lua\services.exe	DllCommonsvc.exe
File created	C:\Program Files\VideoLAN\VLC\lua\c5b4cb5e9653cc	DllCommonsvc.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\ShellNew\6cb0b6c459d5d3	DllCommonsvc.exe
File created	C:\Windows\AppPatch\de-DE\DllCommonsvc.exe	DllCommonsvc.exe
File created	C:\Windows\AppPatch\de-DE\a76d7bf15d8370	DllCommonsvc.exe
File created	C:\Windows\PLA\Reports\it-IT\DllCommonsvc.exe	DllCommonsvc.exe
File created	C:\Windows\PLA\Reports\it-IT\a76d7bf15d8370	DllCommonsvc.exe
File created	C:\Windows\ShellNew\dwm.exe	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_42f5fb5c567dea693fda8f6693c5e871052ee057684696de4923964c8c133a04.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 51 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2936	schtasks.exe
3000	schtasks.exe
1532	schtasks.exe
2624	schtasks.exe
2360	schtasks.exe
2788	schtasks.exe
2940	schtasks.exe
1320	schtasks.exe
900	schtasks.exe
1840	schtasks.exe
2780	schtasks.exe
2652	schtasks.exe
2168	schtasks.exe
2636	schtasks.exe
2180	schtasks.exe
2188	schtasks.exe
1136	schtasks.exe
1620	schtasks.exe
628	schtasks.exe
2892	schtasks.exe
2156	schtasks.exe
852	schtasks.exe
2012	schtasks.exe
700	schtasks.exe
1672	schtasks.exe
2136	schtasks.exe
2592	schtasks.exe
2664	schtasks.exe
2768	schtasks.exe
1888	schtasks.exe
2688	schtasks.exe
2228	schtasks.exe
2120	schtasks.exe
752	schtasks.exe
1804	schtasks.exe
1984	schtasks.exe
2176	schtasks.exe
676	schtasks.exe
1760	schtasks.exe
1116	schtasks.exe
332	schtasks.exe
1920	schtasks.exe
2240	schtasks.exe
2972	schtasks.exe
2896	schtasks.exe
768	schtasks.exe
2108	schtasks.exe
268	schtasks.exe
3056	schtasks.exe
1756	schtasks.exe
2432	schtasks.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
2340	DllCommonsvc.exe
2340	DllCommonsvc.exe
2340	DllCommonsvc.exe
2964	powershell.exe
2620	powershell.exe
2364	powershell.exe
2692	powershell.exe
1820	powershell.exe
2532	powershell.exe
316	powershell.exe
2728	powershell.exe
1264	powershell.exe
2604	powershell.exe
2736	powershell.exe
2732	powershell.exe
1052	audiodg.exe
2368	powershell.exe
1768	powershell.exe
2744	powershell.exe
2384	powershell.exe
2468	powershell.exe
2504	powershell.exe
2712	audiodg.exe
1824	audiodg.exe
1320	audiodg.exe
2156	audiodg.exe
1848	audiodg.exe
2076	audiodg.exe
1884	audiodg.exe
2352	audiodg.exe
3052	audiodg.exe
3000	audiodg.exe

Suspicious use of AdjustPrivilegeToken 30 IoCs

description	pid	Process
Token: SeDebugPrivilege	2340	DllCommonsvc.exe
Token: SeDebugPrivilege	2964	powershell.exe
Token: SeDebugPrivilege	2620	powershell.exe
Token: SeDebugPrivilege	2364	powershell.exe
Token: SeDebugPrivilege	2692	powershell.exe
Token: SeDebugPrivilege	1820	powershell.exe
Token: SeDebugPrivilege	2532	powershell.exe
Token: SeDebugPrivilege	316	powershell.exe
Token: SeDebugPrivilege	2728	powershell.exe
Token: SeDebugPrivilege	1264	powershell.exe
Token: SeDebugPrivilege	1052	audiodg.exe
Token: SeDebugPrivilege	2604	powershell.exe
Token: SeDebugPrivilege	2736	powershell.exe
Token: SeDebugPrivilege	2732	powershell.exe
Token: SeDebugPrivilege	2368	powershell.exe
Token: SeDebugPrivilege	1768	powershell.exe
Token: SeDebugPrivilege	2744	powershell.exe
Token: SeDebugPrivilege	2384	powershell.exe
Token: SeDebugPrivilege	2468	powershell.exe
Token: SeDebugPrivilege	2504	powershell.exe
Token: SeDebugPrivilege	2712	audiodg.exe
Token: SeDebugPrivilege	1824	audiodg.exe
Token: SeDebugPrivilege	1320	audiodg.exe
Token: SeDebugPrivilege	2156	audiodg.exe
Token: SeDebugPrivilege	1848	audiodg.exe
Token: SeDebugPrivilege	2076	audiodg.exe
Token: SeDebugPrivilege	1884	audiodg.exe
Token: SeDebugPrivilege	2352	audiodg.exe
Token: SeDebugPrivilege	3052	audiodg.exe
Token: SeDebugPrivilege	3000	audiodg.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 2532	1152	JaffaCakes118_42f5fb5c567dea693fda8f6693c5e871052ee057684696de4923964c8c133a04.exe	30
PID 1152 wrote to memory of 2532	1152	JaffaCakes118_42f5fb5c567dea693fda8f6693c5e871052ee057684696de4923964c8c133a04.exe	30
PID 1152 wrote to memory of 2532	1152	JaffaCakes118_42f5fb5c567dea693fda8f6693c5e871052ee057684696de4923964c8c133a04.exe	30
PID 1152 wrote to memory of 2532	1152	JaffaCakes118_42f5fb5c567dea693fda8f6693c5e871052ee057684696de4923964c8c133a04.exe	30
PID 2532 wrote to memory of 2320	2532	WScript.exe	31
PID 2532 wrote to memory of 2320	2532	WScript.exe	31
PID 2532 wrote to memory of 2320	2532	WScript.exe	31
PID 2532 wrote to memory of 2320	2532	WScript.exe	31
PID 2320 wrote to memory of 2340	2320	cmd.exe	33
PID 2320 wrote to memory of 2340	2320	cmd.exe	33
PID 2320 wrote to memory of 2340	2320	cmd.exe	33
PID 2320 wrote to memory of 2340	2320	cmd.exe	33
PID 2340 wrote to memory of 1768	2340	DllCommonsvc.exe	87
PID 2340 wrote to memory of 1768	2340	DllCommonsvc.exe	87
PID 2340 wrote to memory of 1768	2340	DllCommonsvc.exe	87
PID 2340 wrote to memory of 2504	2340	DllCommonsvc.exe	88
PID 2340 wrote to memory of 2504	2340	DllCommonsvc.exe	88
PID 2340 wrote to memory of 2504	2340	DllCommonsvc.exe	88
PID 2340 wrote to memory of 2368	2340	DllCommonsvc.exe	89
PID 2340 wrote to memory of 2368	2340	DllCommonsvc.exe	89
PID 2340 wrote to memory of 2368	2340	DllCommonsvc.exe	89
PID 2340 wrote to memory of 2384	2340	DllCommonsvc.exe	90
PID 2340 wrote to memory of 2384	2340	DllCommonsvc.exe	90
PID 2340 wrote to memory of 2384	2340	DllCommonsvc.exe	90
PID 2340 wrote to memory of 1820	2340	DllCommonsvc.exe	91
PID 2340 wrote to memory of 1820	2340	DllCommonsvc.exe	91
PID 2340 wrote to memory of 1820	2340	DllCommonsvc.exe	91
PID 2340 wrote to memory of 2364	2340	DllCommonsvc.exe	92
PID 2340 wrote to memory of 2364	2340	DllCommonsvc.exe	92
PID 2340 wrote to memory of 2364	2340	DllCommonsvc.exe	92
PID 2340 wrote to memory of 2964	2340	DllCommonsvc.exe	93
PID 2340 wrote to memory of 2964	2340	DllCommonsvc.exe	93
PID 2340 wrote to memory of 2964	2340	DllCommonsvc.exe	93
PID 2340 wrote to memory of 316	2340	DllCommonsvc.exe	94
PID 2340 wrote to memory of 316	2340	DllCommonsvc.exe	94
PID 2340 wrote to memory of 316	2340	DllCommonsvc.exe	94
PID 2340 wrote to memory of 2532	2340	DllCommonsvc.exe	95
PID 2340 wrote to memory of 2532	2340	DllCommonsvc.exe	95
PID 2340 wrote to memory of 2532	2340	DllCommonsvc.exe	95
PID 2340 wrote to memory of 1264	2340	DllCommonsvc.exe	96
PID 2340 wrote to memory of 1264	2340	DllCommonsvc.exe	96
PID 2340 wrote to memory of 1264	2340	DllCommonsvc.exe	96
PID 2340 wrote to memory of 2692	2340	DllCommonsvc.exe	97
PID 2340 wrote to memory of 2692	2340	DllCommonsvc.exe	97
PID 2340 wrote to memory of 2692	2340	DllCommonsvc.exe	97
PID 2340 wrote to memory of 2744	2340	DllCommonsvc.exe	98
PID 2340 wrote to memory of 2744	2340	DllCommonsvc.exe	98
PID 2340 wrote to memory of 2744	2340	DllCommonsvc.exe	98
PID 2340 wrote to memory of 2728	2340	DllCommonsvc.exe	99
PID 2340 wrote to memory of 2728	2340	DllCommonsvc.exe	99
PID 2340 wrote to memory of 2728	2340	DllCommonsvc.exe	99
PID 2340 wrote to memory of 2732	2340	DllCommonsvc.exe	100
PID 2340 wrote to memory of 2732	2340	DllCommonsvc.exe	100
PID 2340 wrote to memory of 2732	2340	DllCommonsvc.exe	100
PID 2340 wrote to memory of 2604	2340	DllCommonsvc.exe	101
PID 2340 wrote to memory of 2604	2340	DllCommonsvc.exe	101
PID 2340 wrote to memory of 2604	2340	DllCommonsvc.exe	101
PID 2340 wrote to memory of 2468	2340	DllCommonsvc.exe	102
PID 2340 wrote to memory of 2468	2340	DllCommonsvc.exe	102
PID 2340 wrote to memory of 2468	2340	DllCommonsvc.exe	102
PID 2340 wrote to memory of 2620	2340	DllCommonsvc.exe	103
PID 2340 wrote to memory of 2620	2340	DllCommonsvc.exe	103
PID 2340 wrote to memory of 2620	2340	DllCommonsvc.exe	103
PID 2340 wrote to memory of 2736	2340	DllCommonsvc.exe	104

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_42f5fb5c567dea693fda8f6693c5e871052ee057684696de4923964c8c133a04.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_42f5fb5c567dea693fda8f6693c5e871052ee057684696de4923964c8c133a04.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2532
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2320
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2340
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1768
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\sppsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2504
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2368
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\cmd.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2384
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1820
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ShellNew\dwm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2364
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\VideoLAN\VLC\lua\services.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2964
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\wininit.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:316
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\audiodg.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2532
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\audiodg.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1264
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\AppPatch\de-DE\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2692
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\PLA\Reports\it-IT\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2744
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\audiodg.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2728
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Videos\lsm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2732
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\services.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2604
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2468
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\services.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2620
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\taskhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2736
    - - C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\audiodg.exe
        
        "C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\audiodg.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1052
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Urxb3wPgb0.bat"
        6⤵
        
        PID:1220
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:1116
        
        C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\audiodg.exe
        
        "C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\audiodg.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2712
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\xjNnGM38uG.bat"
        8⤵
        
        PID:1392
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:2828
        
        C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\audiodg.exe
        
        "C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\audiodg.exe"
        9⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1824
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9kwbr7Wkdx.bat"
        10⤵
        
        PID:764
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:2260
        
        C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\audiodg.exe
        
        "C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\audiodg.exe"
        11⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1320
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HZWv28qLDz.bat"
        12⤵
        
        PID:1256
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:2796
        
        C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\audiodg.exe
        
        "C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\audiodg.exe"
        13⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2156
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\H7eFR6a9mI.bat"
        14⤵
        
        PID:2764
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:2432
        
        C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\audiodg.exe
        
        "C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\audiodg.exe"
        15⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1848
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0VN2lTwXPf.bat"
        16⤵
        
        PID:884
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:2656
        
        C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\audiodg.exe
        
        "C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\audiodg.exe"
        17⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2076
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5Yw7RONjUI.bat"
        18⤵
        
        PID:2792
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:2152
        
        C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\audiodg.exe
        
        "C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\audiodg.exe"
        19⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1884
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5AjNu1Vgdj.bat"
        20⤵
        
        PID:2980
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:2928
        
        C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\audiodg.exe
        
        "C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\audiodg.exe"
        21⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2352
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\QO5FEA9wo1.bat"
        22⤵
        
        PID:2660
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:1808
        
        C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\audiodg.exe
        
        "C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\audiodg.exe"
        23⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3052
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\da4noHdFs8.bat"
        24⤵
        
        PID:1760
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:2416
        
        C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\audiodg.exe
        
        "C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\audiodg.exe"
        25⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3000
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\L8pPJcA7Kt.bat"
        26⤵
        
        PID:1792
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        27⤵
        
        PID:1576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 6 /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 11 /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Windows\ShellNew\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\ShellNew\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Windows\ShellNew\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Program Files\VideoLAN\VLC\lua\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\lua\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Program Files\VideoLAN\VLC\lua\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\providercommon\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\providercommon\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\providercommon\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 6 /tr "'C:\Users\Default\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Users\Default\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 5 /tr "'C:\Users\Default\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\MSOCache\All Users\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 10 /tr "'C:\Windows\AppPatch\de-DE\DllCommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Windows\AppPatch\de-DE\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 7 /tr "'C:\Windows\AppPatch\de-DE\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 13 /tr "'C:\Windows\PLA\Reports\it-IT\DllCommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Windows\PLA\Reports\it-IT\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 14 /tr "'C:\Windows\PLA\Reports\it-IT\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 11 /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 6 /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 12 /tr "'C:\Users\Default\Videos\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Users\Default\Videos\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 10 /tr "'C:\Users\Default\Videos\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\providercommon\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\providercommon\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\providercommon\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\providercommon\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\providercommon\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\providercommon\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
20b730773cdf7f09c34e39864a720c1b

SHA1
19fe130d1ebfa20cb5abafa4e8905501618f6798

SHA256
305e0eaef46f6a63a5d12a9691f7142ee6cb43d1404160414f1e5dc037250c55

SHA512
adc0637831b3dfec3e9e10d4215e92719081cafb20828121c9ee3d9572ee95667281fb7ad4392c5fce6389076d34845387a48c98cba0701cec8e852455d59698

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6ba47de5d4902d3c16df74b3f52f8615

SHA1
b92a615fd49d847ffbe50e456a640b196fc0543f

SHA256
2b06d4695eb8eca8e8b14b30d45b8a08ee7c093a50e30e7c12c27aece6f130a8

SHA512
5b5dc17256787c1d34c69c1c5a5897c276c5a1301562f9640b2d96d58e299a17082247101797b12b791bbae50052f441f6842dbfb2b468299a8d5eb613fd3fa6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
444671e5150f0a1c5ede9bc269bd6a83

SHA1
0a8c4d26b01d2254d6bab198ff1e0837a3155871

SHA256
c2091fd5b51250de6da577bd2c7d470bb75554149fa9d1d88bc5d44baafa68d2

SHA512
42c4bede8f2a99993f742696f2405dabe6a04230d606ec5896c96169f2b22e0d87a19d4ca1d37e4397ba464b95237157b2de77e95b87cd52fac874b078dc84f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7525b9d3f45b4d7337deb03e9d7f6905

SHA1
c42528f49cdc15421766098dd57ed0b673a52201

SHA256
aed4eeace6778d25db483378dab1bfc94d4c2e698b8c764bf56ecf2d731240aa

SHA512
7f25442b1ca13fcb0190571797b3e4d5ac1e2526e1eaba77dc804b0d20eab2377e9a5468c8edc80c4e3382f966e00c03c6d7c36f1e03dfd36ac651c0387e6db6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b6f8e9628fab762fb9c71d6cb9013978

SHA1
92d1b6e249ab2152bc53612655d97e557cefa10c

SHA256
8b23a77c981e3b5b13e538d19590d3449c95d3d9fc81b44363fd61a43c3ed167

SHA512
67761f62315d7a0a66574c1525f0cd2d13b949eb8784ba86179bbac729064d7c3196ccfb7dee67127f063cf1e037581dbab13a9eece1a4a7ff87b8101e63151b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
05b8329a1d7203c2e3a587d45bdad771

SHA1
f59a2bac5d1d0a894ba81c23d4a00e0f4225c2e5

SHA256
b458621f0b3ed3363adfe0b4cfc66daee3d8f0b5316c53492f85cdbb2597274f

SHA512
dec864b659e611533b08ddf21ba4391886fa1925ffe0993d0e9fe873541eb8f4d4d796a1b3962434f9c71bd1f28893f9a54c7e8d29d230a129ede466e9a82f00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fdbd6ae5e2a3496e172bc0fda22f8c8d

SHA1
0ad9f5e795f955295c920b687d307d2ad3bef035

SHA256
0dd6589e325a330295a37810cb177bbb503736fed891d7cabe8a2020ebd45d1c

SHA512
5bb586e2c6abf3c84c1e056711aad33893e0e118b9e3ddef26ccbb4018c36e52eb1d5971bdd7b4e034cfc6025388aa1afd60782546b7301bb3cbb4ff42d38565

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e3c207d143bbde661d85148343770b92

SHA1
14a37867d672571adf6f2f15f77e4ea17bfff01c

SHA256
198171d4af50f551a819b9bddb6a671f38f8f9b2243946b8d2319a0c4ee36627

SHA512
b6f28032d4f7415a37fe3230d9495e0eceebda8d4d1b6873651b2e18a570a97f94fbad2c1d86cd207765d9080264f1b494d711c8efa2e8c322718a077d5e89f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ea70d1aee6ec3d944095bd900b66d19b

SHA1
5c851e6aefa5c3ad03a10e6a480720a795c54394

SHA256
0e3ca301ffaeaf7fec9021ac4a2fc0dacbd199ab7d4eeca43c6d2e08a9016ac0

SHA512
5f8074269b80bcb5f276971b52cf01f593971aaae22a614cee63a6c3a90282f88269a94305dcc5eb86bf4797c5dcb4c6b4cda6c494c3d48036da284f3fcd33f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ff7daed46a44e3b7e0515e866253cf51

SHA1
9c5143ac21cfe08bddb7b41bd6682e5e7331808e

SHA256
76c47bee67ae3baa4d9e2ef04befb040fe2a6005d71c6ebc4da00ef25abf2c75

SHA512
9c74c43741cdb7fef020e501880636ea5e914674fe64e425207c7268b1d21d1686f6364062c62279650bafcf5cb612dce1b79c33c81051e3cea9544acf6008c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\0VN2lTwXPf.bat

Filesize
225B

MD5
2b2b0098a4786ad85b179a752d3607ab

SHA1
475bd0e78e03d561506045ef2643e3607832f6af

SHA256
a703f972cddf6e0d442f7b25fdfdfe87cc0d42739dd733d6f225d39e56acaf19

SHA512
a0acce057af0f88026c862d6ee23057abc49114bc1a4254b07e2a19f3c06095cd0f01f32e5de55433d0bcb54fff0292f6dfe32bf14300f4aa4d541996d87fa79

Download Submit
C:\Users\Admin\AppData\Local\Temp\5AjNu1Vgdj.bat

Filesize
225B

MD5
90379e2409ec521a8ea89a500481b78c

SHA1
a829bad81c9b1fc83dcf885a7f5a829ab94e111a

SHA256
664b43013a76de04ff341f8d97966b00d6c5d6d92616aafd38852fcdab3fc884

SHA512
235483b2f5612304c8d29506fd3a42893adac36b1eaa6a421b971bd9df9205800c94dd8a3842848cf7278bdde688f7a8ab5f93ea1b8237835873dd39d38aaf8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\5Yw7RONjUI.bat

Filesize
225B

MD5
b8565715ec13436584fb61171b04eb38

SHA1
8dca5eb9eea8560b42a03365343d63a69a77b820

SHA256
f453857b6249f090346655513176fc60479211105e686cd25efc3f7916c9adb4

SHA512
42c891f27e2d66099bb7afc93c67965956ad0d580ba38e81b65da7727593297fadc36538ce936995ab95b6bc2fb31d5df78ff4f198276edc238eec80025d4937

Download Submit
C:\Users\Admin\AppData\Local\Temp\9kwbr7Wkdx.bat

Filesize
225B

MD5
0e6adadadb268ba384ba8c3b8979e359

SHA1
5843f0a1bc5b7a8f8a312ccaac4ea542876d6771

SHA256
a247a6d785c8670f164b150384336a7c2a144f688e18f192dd1db069d695a5c8

SHA512
0595f0331f48293569718b34865d38b29e22d5a0d031b6f9cdb836cbfa17d6b736b73ed64b033e272489e1bd9ea1c3347e7cd85b594b7557a1d3000092e9d1a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEA70.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\H7eFR6a9mI.bat

Filesize
225B

MD5
df433a278b69a18ceb14728abd169b86

SHA1
70eb0022c9c163f16f8bd2939d5b907eaad55339

SHA256
0b339dff3733047d5b97d973dab82689e5120c853c3f46abd40379b5bb1c113c

SHA512
750bd3129c047128292d0ded1e292e4bfbfb8ec6d476d39cec56a0674fb7ffd0953c4b7fe3bfa19e906657e405f70bfb67ee9b067da3ad51a779fbf4ba6bcfce

Download Submit
C:\Users\Admin\AppData\Local\Temp\HZWv28qLDz.bat

Filesize
225B

MD5
2108bf68cca39985dd4c3bb2e4a985f2

SHA1
1010a1725f89081e03dde5022afb453ec2c98a7a

SHA256
e6b7e9ebee3b5da739aebf7764bce193be51b290beb403268784eea0356ea356

SHA512
e88947247b0c4d99959bffdbff601b89803bcfb333dfbf659262e385185a2ae99e56e46969f06d3c2487e3033c1c7308b2f3f4d47d790910646a14aeedad2b3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\L8pPJcA7Kt.bat

Filesize
225B

MD5
076e1d2e951c37d3c9b67739bcd4d54d

SHA1
d7799971c9622cf55faa5e0ebb33ad276def7b44

SHA256
7de5028b62375f21cd988716307c363e890bc50d8c97594cf9b9aafd371f7f82

SHA512
a62c9ce97a662b8ea4be841459d9538ee2099727a13476067cb6822ecb5193b64552d3f4d447bb0642b4fb9d4e3e58d23291338d872572443985e3dfb84d7537

Download Submit
C:\Users\Admin\AppData\Local\Temp\QO5FEA9wo1.bat

Filesize
225B

MD5
61f9fc5a60e50753455749ab10f9501c

SHA1
679c8762f0452198e7330c81787c4b512128d928

SHA256
d11792275005404a49bd222502528800fff2ae06ac88598d946c430844ad0401

SHA512
30cbe6709c06b4a751d8a0d1b34689612de5df117b1e5fac4e104fecc2f13f9483ca9d4a911eca33d9d72c24af4da280e7ec8723a727745b1c130f8b24359625

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEA83.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Urxb3wPgb0.bat

Filesize
225B

MD5
9bc85db4e5c31df478333f2b9e17c15d

SHA1
402a096bc35fa2c1780bbc28afaebb883dbb5fe9

SHA256
a4b9e06703f6f7ef99c6499d82c9c9b10d34b04d9b5f91c18ce07d2c77e278df

SHA512
731ba5068037f52f188468409c6658500ea00085ba219d31b4989d3fb20b7663e643566825b3cc046551496474da6b187fbd702263e8c5128e3d98750fcd75a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\da4noHdFs8.bat

Filesize
225B

MD5
ede7cf17550b34186d08766a7c0b7cfd

SHA1
651ad1b7a14c1050a0a30c30b82d545d771b5ac3

SHA256
7b0d1e326163d6492cc543c1d805983dfcfe019d5c2eb9abbd271e282d665ab7

SHA512
38decff8240e8f5599c45ab112b12e30ffb7b96b15efb3f87a97abdbc149fdd5bb5c8f725541e9731f5d498dfb702bea57d808ce827164173a63813e77bc5a2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\xjNnGM38uG.bat

Filesize
225B

MD5
161d5931f707ccdbc2c7f8674c9d0886

SHA1
21f10dac15616dbfb9b2633062c136baa94dff86

SHA256
f89d3e6cf21979d711d2e24fcc446e476e01047ad35b44f5e4c25a4ba19132eb

SHA512
d623d0a8e7c2db0b877a2296765cc839c3595fd0c895b0b686dd42851b1f7ad9dca3da5b9ca7f957a419047d2680ac43ca3faa11a4caea20c2ed0f8cd171c2f6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
82ed3b88f5f28acda39601d35b91a2ab

SHA1
a70751ba4d3dcc9b08fff0a3a30c093c351acddb

SHA256
625f901df9d189a56a498dcabc9fdb587eeb84c292dd1192b5b64d2bd32fcc69

SHA512
793bc4e76c78bf1327feb3176a8f770e26bf8b15ebe4494a5f8a383cde0a541e69e98353a48fad7e0e2d4ddd66c9953f8d3c20930aeba5db8d3919d49cb3a4ec

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/1052-58-0x0000000000B40000-0x0000000000C50000-memory.dmp

Filesize
1.1MB

Download
memory/1320-322-0x0000000000440000-0x0000000000452000-memory.dmp

Filesize
72KB

Download
memory/1824-262-0x0000000000BE0000-0x0000000000CF0000-memory.dmp

Filesize
1.1MB

Download
memory/1884-562-0x0000000000280000-0x0000000000390000-memory.dmp

Filesize
1.1MB

Download
memory/2076-502-0x0000000000FD0000-0x00000000010E0000-memory.dmp

Filesize
1.1MB

Download
memory/2156-383-0x00000000003C0000-0x00000000003D2000-memory.dmp

Filesize
72KB

Download
memory/2156-382-0x0000000000EF0000-0x0000000001000000-memory.dmp

Filesize
1.1MB

Download
memory/2340-16-0x00000000001D0000-0x00000000001DC000-memory.dmp

Filesize
48KB

Download
memory/2340-13-0x0000000000E10000-0x0000000000F20000-memory.dmp

Filesize
1.1MB

Download
memory/2340-14-0x00000000001C0000-0x00000000001D2000-memory.dmp

Filesize
72KB

Download
memory/2340-17-0x00000000001F0000-0x00000000001FC000-memory.dmp

Filesize
48KB

Download
memory/2340-15-0x00000000001E0000-0x00000000001EC000-memory.dmp

Filesize
48KB

Download
memory/2352-622-0x00000000001D0000-0x00000000002E0000-memory.dmp

Filesize
1.1MB

Download
memory/2352-623-0x0000000000440000-0x0000000000452000-memory.dmp

Filesize
72KB

Download
memory/2712-202-0x00000000003D0000-0x00000000004E0000-memory.dmp

Filesize
1.1MB

Download
memory/2964-89-0x000000001B4E0000-0x000000001B7C2000-memory.dmp

Filesize
2.9MB

Download
memory/2964-94-0x00000000027A0000-0x00000000027A8000-memory.dmp

Filesize
32KB

Download
memory/3052-683-0x0000000001240000-0x0000000001350000-memory.dmp

Filesize
1.1MB

Download