dcrat | ce7c55d9740bd7a1e60afbc8f502f1980b1abd42b41a076ca748c58f8d3dec06

Analysis

max time kernel
142s
max time network
137s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 07:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_ce7c55d9740bd7a1e60afbc8f502f1980b1abd42b41a076ca748c58f8d3dec06.exe
Size

1.3MB
MD5

56b5dd710f711c475f93a2235d13a397
SHA1

c4e366eff0b7e2db8bbb30642234bbfd83c09abc
SHA256

ce7c55d9740bd7a1e60afbc8f502f1980b1abd42b41a076ca748c58f8d3dec06
SHA512

6e3a47cf46309211b8297bc6f420fc14bf420a51d06ec82bcc453bf327fb77af5d8f20e97231dbada7d669439d119de62881edb3e2fc1dfb7ce44895a2198d1e
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 51 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2420	2832	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2888	2832	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2716	2832	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2708	2832	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2848	2832	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2680	2832	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2732	2832	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2100	2832	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2876	2832	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2116	2832	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1596	2832	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1268	2832	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2432	2832	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2124	2832	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1644	2832	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1924	2832	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1288	2832	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1248	2832	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	880	2832	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1904	2832	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2216	2832	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2668	2832	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	800	2832	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2120	2832	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2268	2832	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2776	2832	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1908	2832	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1088	2832	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2164	2832	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	440	2832	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2240	2832	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	828	2832	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1772	2832	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1532	2832	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2172	2832	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1524	2832	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2660	2832	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1692	2832	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	688	2832	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	532	2832	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1952	2832	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1316	2832	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1096	2832	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3036	2832	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1476	2832	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1972	2832	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	296	2832	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	876	2832	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2636	2832	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1588	2832	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1036	2832	schtasks.exe	34

DCRat payload 10 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0008000000016c66-10.dat	dcrat
behavioral1/memory/2064-13-0x0000000001370000-0x0000000001480000-memory.dmp	dcrat
behavioral1/memory/372-149-0x0000000001110000-0x0000000001220000-memory.dmp	dcrat
behavioral1/memory/2576-208-0x00000000013A0000-0x00000000014B0000-memory.dmp	dcrat
behavioral1/memory/372-387-0x0000000000310000-0x0000000000420000-memory.dmp	dcrat
behavioral1/memory/2008-447-0x0000000001170000-0x0000000001280000-memory.dmp	dcrat
behavioral1/memory/1816-507-0x0000000001210000-0x0000000001320000-memory.dmp	dcrat
behavioral1/memory/2576-628-0x0000000000350000-0x0000000000460000-memory.dmp	dcrat
behavioral1/memory/2088-689-0x0000000000900000-0x0000000000A10000-memory.dmp	dcrat
behavioral1/memory/2916-749-0x0000000001010000-0x0000000001120000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 18 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2476	powershell.exe
2940	powershell.exe
2480	powershell.exe
2520	powershell.exe
1364	powershell.exe
2964	powershell.exe
2912	powershell.exe
2976	powershell.exe
2904	powershell.exe
2112	powershell.exe
2416	powershell.exe
2872	powershell.exe
2928	powershell.exe
2444	powershell.exe
2468	powershell.exe
772	powershell.exe
2184	powershell.exe
2924	powershell.exe

Executes dropped EXE 12 IoCs

pid	Process
2064	DllCommonsvc.exe
372	sppsvc.exe
2576	sppsvc.exe
1708	sppsvc.exe
1908	sppsvc.exe
372	sppsvc.exe
2008	sppsvc.exe
1816	sppsvc.exe
2212	sppsvc.exe
2576	sppsvc.exe
2088	sppsvc.exe
2916	sppsvc.exe

Loads dropped DLL 2 IoCs

pid	Process
2900	cmd.exe
2900	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs

Web Service

T1102

flow	ioc
9	raw.githubusercontent.com
19	raw.githubusercontent.com
26	raw.githubusercontent.com
30	raw.githubusercontent.com
5	raw.githubusercontent.com
12	raw.githubusercontent.com
16	raw.githubusercontent.com
23	raw.githubusercontent.com
33	raw.githubusercontent.com
37	raw.githubusercontent.com
4	raw.githubusercontent.com

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Google\Temp\explorer.exe	DllCommonsvc.exe
File opened for modification	C:\Program Files (x86)\Google\Temp\explorer.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Google\Temp\7a0fd90576e088	DllCommonsvc.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\rescache\rc0005\dllhost.exe	DllCommonsvc.exe
File created	C:\Windows\Logs\HomeGroup\cmd.exe	DllCommonsvc.exe
File created	C:\Windows\Logs\HomeGroup\ebf1f9fa8afd6d	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_ce7c55d9740bd7a1e60afbc8f502f1980b1abd42b41a076ca748c58f8d3dec06.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 51 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
296	schtasks.exe
2100	schtasks.exe
1248	schtasks.exe
2668	schtasks.exe
1532	schtasks.exe
688	schtasks.exe
532	schtasks.exe
1316	schtasks.exe
2716	schtasks.exe
2876	schtasks.exe
2776	schtasks.exe
1908	schtasks.exe
828	schtasks.exe
1096	schtasks.exe
2116	schtasks.exe
1268	schtasks.exe
1644	schtasks.exe
1288	schtasks.exe
2216	schtasks.exe
800	schtasks.exe
1088	schtasks.exe
2172	schtasks.exe
2420	schtasks.exe
2680	schtasks.exe
1036	schtasks.exe
1524	schtasks.exe
1692	schtasks.exe
1952	schtasks.exe
2636	schtasks.exe
2432	schtasks.exe
1924	schtasks.exe
2848	schtasks.exe
1904	schtasks.exe
2164	schtasks.exe
2240	schtasks.exe
876	schtasks.exe
2888	schtasks.exe
2708	schtasks.exe
2120	schtasks.exe
2268	schtasks.exe
440	schtasks.exe
3036	schtasks.exe
1972	schtasks.exe
2732	schtasks.exe
880	schtasks.exe
1772	schtasks.exe
2660	schtasks.exe
1476	schtasks.exe
1588	schtasks.exe
1596	schtasks.exe
2124	schtasks.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
2064	DllCommonsvc.exe
2112	powershell.exe
2444	powershell.exe
2940	powershell.exe
2872	powershell.exe
2904	powershell.exe
772	powershell.exe
2520	powershell.exe
2184	powershell.exe
1364	powershell.exe
2924	powershell.exe
2964	powershell.exe
2476	powershell.exe
2416	powershell.exe
2976	powershell.exe
2468	powershell.exe
2480	powershell.exe
2928	powershell.exe
2912	powershell.exe
372	sppsvc.exe
2576	sppsvc.exe
1708	sppsvc.exe
1908	sppsvc.exe
372	sppsvc.exe
2008	sppsvc.exe
1816	sppsvc.exe
2212	sppsvc.exe
2576	sppsvc.exe
2088	sppsvc.exe
2916	sppsvc.exe

Suspicious use of AdjustPrivilegeToken 30 IoCs

description	pid	Process
Token: SeDebugPrivilege	2064	DllCommonsvc.exe
Token: SeDebugPrivilege	2112	powershell.exe
Token: SeDebugPrivilege	2444	powershell.exe
Token: SeDebugPrivilege	2940	powershell.exe
Token: SeDebugPrivilege	2872	powershell.exe
Token: SeDebugPrivilege	2904	powershell.exe
Token: SeDebugPrivilege	772	powershell.exe
Token: SeDebugPrivilege	2520	powershell.exe
Token: SeDebugPrivilege	2184	powershell.exe
Token: SeDebugPrivilege	1364	powershell.exe
Token: SeDebugPrivilege	2924	powershell.exe
Token: SeDebugPrivilege	2964	powershell.exe
Token: SeDebugPrivilege	2476	powershell.exe
Token: SeDebugPrivilege	2416	powershell.exe
Token: SeDebugPrivilege	2976	powershell.exe
Token: SeDebugPrivilege	2468	powershell.exe
Token: SeDebugPrivilege	2480	powershell.exe
Token: SeDebugPrivilege	2928	powershell.exe
Token: SeDebugPrivilege	2912	powershell.exe
Token: SeDebugPrivilege	372	sppsvc.exe
Token: SeDebugPrivilege	2576	sppsvc.exe
Token: SeDebugPrivilege	1708	sppsvc.exe
Token: SeDebugPrivilege	1908	sppsvc.exe
Token: SeDebugPrivilege	372	sppsvc.exe
Token: SeDebugPrivilege	2008	sppsvc.exe
Token: SeDebugPrivilege	1816	sppsvc.exe
Token: SeDebugPrivilege	2212	sppsvc.exe
Token: SeDebugPrivilege	2576	sppsvc.exe
Token: SeDebugPrivilege	2088	sppsvc.exe
Token: SeDebugPrivilege	2916	sppsvc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2580 wrote to memory of 2208	2580	JaffaCakes118_ce7c55d9740bd7a1e60afbc8f502f1980b1abd42b41a076ca748c58f8d3dec06.exe	30
PID 2580 wrote to memory of 2208	2580	JaffaCakes118_ce7c55d9740bd7a1e60afbc8f502f1980b1abd42b41a076ca748c58f8d3dec06.exe	30
PID 2580 wrote to memory of 2208	2580	JaffaCakes118_ce7c55d9740bd7a1e60afbc8f502f1980b1abd42b41a076ca748c58f8d3dec06.exe	30
PID 2580 wrote to memory of 2208	2580	JaffaCakes118_ce7c55d9740bd7a1e60afbc8f502f1980b1abd42b41a076ca748c58f8d3dec06.exe	30
PID 2208 wrote to memory of 2900	2208	WScript.exe	31
PID 2208 wrote to memory of 2900	2208	WScript.exe	31
PID 2208 wrote to memory of 2900	2208	WScript.exe	31
PID 2208 wrote to memory of 2900	2208	WScript.exe	31
PID 2900 wrote to memory of 2064	2900	cmd.exe	33
PID 2900 wrote to memory of 2064	2900	cmd.exe	33
PID 2900 wrote to memory of 2064	2900	cmd.exe	33
PID 2900 wrote to memory of 2064	2900	cmd.exe	33
PID 2064 wrote to memory of 2444	2064	DllCommonsvc.exe	86
PID 2064 wrote to memory of 2444	2064	DllCommonsvc.exe	86
PID 2064 wrote to memory of 2444	2064	DllCommonsvc.exe	86
PID 2064 wrote to memory of 2468	2064	DllCommonsvc.exe	87
PID 2064 wrote to memory of 2468	2064	DllCommonsvc.exe	87
PID 2064 wrote to memory of 2468	2064	DllCommonsvc.exe	87
PID 2064 wrote to memory of 2480	2064	DllCommonsvc.exe	88
PID 2064 wrote to memory of 2480	2064	DllCommonsvc.exe	88
PID 2064 wrote to memory of 2480	2064	DllCommonsvc.exe	88
PID 2064 wrote to memory of 2112	2064	DllCommonsvc.exe	89
PID 2064 wrote to memory of 2112	2064	DllCommonsvc.exe	89
PID 2064 wrote to memory of 2112	2064	DllCommonsvc.exe	89
PID 2064 wrote to memory of 772	2064	DllCommonsvc.exe	90
PID 2064 wrote to memory of 772	2064	DllCommonsvc.exe	90
PID 2064 wrote to memory of 772	2064	DllCommonsvc.exe	90
PID 2064 wrote to memory of 2416	2064	DllCommonsvc.exe	91
PID 2064 wrote to memory of 2416	2064	DllCommonsvc.exe	91
PID 2064 wrote to memory of 2416	2064	DllCommonsvc.exe	91
PID 2064 wrote to memory of 2184	2064	DllCommonsvc.exe	97
PID 2064 wrote to memory of 2184	2064	DllCommonsvc.exe	97
PID 2064 wrote to memory of 2184	2064	DllCommonsvc.exe	97
PID 2064 wrote to memory of 2476	2064	DllCommonsvc.exe	98
PID 2064 wrote to memory of 2476	2064	DllCommonsvc.exe	98
PID 2064 wrote to memory of 2476	2064	DllCommonsvc.exe	98
PID 2064 wrote to memory of 2520	2064	DllCommonsvc.exe	99
PID 2064 wrote to memory of 2520	2064	DllCommonsvc.exe	99
PID 2064 wrote to memory of 2520	2064	DllCommonsvc.exe	99
PID 2064 wrote to memory of 2872	2064	DllCommonsvc.exe	100
PID 2064 wrote to memory of 2872	2064	DllCommonsvc.exe	100
PID 2064 wrote to memory of 2872	2064	DllCommonsvc.exe	100
PID 2064 wrote to memory of 1364	2064	DllCommonsvc.exe	101
PID 2064 wrote to memory of 1364	2064	DllCommonsvc.exe	101
PID 2064 wrote to memory of 1364	2064	DllCommonsvc.exe	101
PID 2064 wrote to memory of 2924	2064	DllCommonsvc.exe	102
PID 2064 wrote to memory of 2924	2064	DllCommonsvc.exe	102
PID 2064 wrote to memory of 2924	2064	DllCommonsvc.exe	102
PID 2064 wrote to memory of 2928	2064	DllCommonsvc.exe	103
PID 2064 wrote to memory of 2928	2064	DllCommonsvc.exe	103
PID 2064 wrote to memory of 2928	2064	DllCommonsvc.exe	103
PID 2064 wrote to memory of 2940	2064	DllCommonsvc.exe	104
PID 2064 wrote to memory of 2940	2064	DllCommonsvc.exe	104
PID 2064 wrote to memory of 2940	2064	DllCommonsvc.exe	104
PID 2064 wrote to memory of 2964	2064	DllCommonsvc.exe	105
PID 2064 wrote to memory of 2964	2064	DllCommonsvc.exe	105
PID 2064 wrote to memory of 2964	2064	DllCommonsvc.exe	105
PID 2064 wrote to memory of 2912	2064	DllCommonsvc.exe	106
PID 2064 wrote to memory of 2912	2064	DllCommonsvc.exe	106
PID 2064 wrote to memory of 2912	2064	DllCommonsvc.exe	106
PID 2064 wrote to memory of 2976	2064	DllCommonsvc.exe	107
PID 2064 wrote to memory of 2976	2064	DllCommonsvc.exe	107
PID 2064 wrote to memory of 2976	2064	DllCommonsvc.exe	107
PID 2064 wrote to memory of 2904	2064	DllCommonsvc.exe	108

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ce7c55d9740bd7a1e60afbc8f502f1980b1abd42b41a076ca748c58f8d3dec06.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ce7c55d9740bd7a1e60afbc8f502f1980b1abd42b41a076ca748c58f8d3dec06.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2208
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2900
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2064
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2444
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Google\Temp\explorer.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2468
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\spoolsv.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2480
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\dwm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2112
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\sppsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:772
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\PrintHood\WmiPrvSE.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2416
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\cmd.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2184
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2476
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\lsm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2520
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\SendTo\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2872
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Documents\sppsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1364
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2924
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Logs\HomeGroup\cmd.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2928
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\PrintHood\lsass.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2940
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\lsass.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2964
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\lsm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2912
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\wininit.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2976
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Downloads\explorer.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2904
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WCRFb7ekcj.bat"
        5⤵
        
        PID:1184
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:1432
      - C:\Users\All Users\Documents\sppsvc.exe
        
        "C:\Users\All Users\Documents\sppsvc.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:372
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0IgHXqOu0A.bat"
        7⤵
        
        PID:1632
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:1316
        
        C:\Users\All Users\Documents\sppsvc.exe
        
        "C:\Users\All Users\Documents\sppsvc.exe"
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2576
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\x7ZYnkvAkq.bat"
        9⤵
        
        PID:2780
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:772
        
        C:\Users\All Users\Documents\sppsvc.exe
        
        "C:\Users\All Users\Documents\sppsvc.exe"
        10⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1708
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ounU5LkXKE.bat"
        11⤵
        
        PID:1964
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:1432
        
        C:\Users\All Users\Documents\sppsvc.exe
        
        "C:\Users\All Users\Documents\sppsvc.exe"
        12⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1908
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\da4noHdFs8.bat"
        13⤵
        
        PID:604
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:1028
        
        C:\Users\All Users\Documents\sppsvc.exe
        
        "C:\Users\All Users\Documents\sppsvc.exe"
        14⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:372
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VlbjwdcMOl.bat"
        15⤵
        
        PID:1692
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:832
        
        C:\Users\All Users\Documents\sppsvc.exe
        
        "C:\Users\All Users\Documents\sppsvc.exe"
        16⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2008
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Nl6pt1R060.bat"
        17⤵
        
        PID:2912
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:1708
        
        C:\Users\All Users\Documents\sppsvc.exe
        
        "C:\Users\All Users\Documents\sppsvc.exe"
        18⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1816
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BjebbrynYr.bat"
        19⤵
        
        PID:2604
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:2020
        
        C:\Users\All Users\Documents\sppsvc.exe
        
        "C:\Users\All Users\Documents\sppsvc.exe"
        20⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2212
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\V3SaMhi525.bat"
        21⤵
        
        PID:1316
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:1616
        
        C:\Users\All Users\Documents\sppsvc.exe
        
        "C:\Users\All Users\Documents\sppsvc.exe"
        22⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2576
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tebxeZNirC.bat"
        23⤵
        
        PID:1856
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:2468
        
        C:\Users\All Users\Documents\sppsvc.exe
        
        "C:\Users\All Users\Documents\sppsvc.exe"
        24⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2088
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\R5wNYqVH5b.bat"
        25⤵
        
        PID:2716
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:304
        
        C:\Users\All Users\Documents\sppsvc.exe
        
        "C:\Users\All Users\Documents\sppsvc.exe"
        26⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Google\Temp\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Temp\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Google\Temp\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\providercommon\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\providercommon\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\providercommon\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 5 /tr "'C:\Users\Default\PrintHood\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Users\Default\PrintHood\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 7 /tr "'C:\Users\Default\PrintHood\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 9 /tr "'C:\providercommon\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\providercommon\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 12 /tr "'C:\providercommon\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 7 /tr "'C:\providercommon\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\providercommon\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 5 /tr "'C:\providercommon\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Users\Default\SendTo\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default\SendTo\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Users\Default\SendTo\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\Documents\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\All Users\Documents\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Documents\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\providercommon\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 13 /tr "'C:\Windows\Logs\HomeGroup\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Windows\Logs\HomeGroup\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 6 /tr "'C:\Windows\Logs\HomeGroup\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Users\Default\PrintHood\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\Default\PrintHood\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Users\Default\PrintHood\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\providercommon\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\providercommon\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\providercommon\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\Downloads\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\Admin\Downloads\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\Downloads\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0f24c1ebcd7952a3f61cdb8f0265c21a

SHA1
1535fe9fdb6618e21dce61ea0769840b8ff83baf

SHA256
6983aff5188f045537336e12e99c86a411a0e91f82a5a3e99685ebfff27979de

SHA512
dd6994a67a0303c2249f91e81e134f806145602386becd3011b489edac3c932b305953eea79e8565d1df29ba9fe5659833c94e02c3ebf0ae8dc87698a531ea1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5d3fc5186493972444ddac3a556c9271

SHA1
2806b7cb60b9b48d5cfed32fde281249cf78e937

SHA256
58cb2c5b0ffff7d2963e054abf28b68970c3939b228c37655ace21fbbe5fa523

SHA512
735180e65306adfb0e861f55966c67bd166351f05e91a43432209c809ee099409b9cdc9ae8c9f449fcc7df6a910e6b8b0d0a207db41789dab6defddbf8d33ce2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
67ab0537185019564a2d8a8b7b7c691d

SHA1
2de2f9a16080b87389494f0e605f9aac16b04a0d

SHA256
c03ca48b481708014f65d08348036a015491f1d0e8dc5aa93ad32bcfa96bfc77

SHA512
7821ae7a8f5d31d2bd775e847af0e2328947e21858174afd204e5a256673f0b5ee8cd442c8f390afb6bd444c7f0c1cc287b84843f88581736c331f1f2302ece6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
74441432fad08febb2d91a05849c8f3c

SHA1
5c1a2b14c8e862f64ee2e9f1190551544eb4c43b

SHA256
0292a502d718eb4ebf3e0326e941da484fe8b8ac6143912f9e1de6be126c4806

SHA512
623d9bf34595699517e77bdccea3554b00583b40d8c66c4421971505174d6e1e34772ee12e475662e3b8b5d0cddce691a2bc9fdb80974cb137a6d391e88bd369

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
796db79863a2e79c757f7757a172c5ac

SHA1
5b4a46a8d61079254fb209da1538db2838ec7f46

SHA256
7eb701132ceae3ca6cbf028966fbbed25a5ebcfae0d023d5b50907a2a5be6940

SHA512
adee8306f9a16a77615b2aa6985c80e83d831742b2b3a02b21015ea3529ea0b4c5b674094b572138f67e1e004550590b9fd6608f5d89bbaabb6ce4a1eebf09c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ad40ae255f6bada1a33814930f06bd97

SHA1
af79e624bbdacc2a2abee5698b1a26579e06b2f0

SHA256
d85d814fc20487a694d564606d96e8347cbd205f6623b780bf01f62cbec13e6c

SHA512
6896d3f4a6371c466887f566acbc6e301d0bc64134857055e5510418bfc3411441794258ffc85a8ba50cf300a3530375872065be1001a9c956a9afe0d3c2c456

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5988df8450bc5312ace807e525de2116

SHA1
254738d3ef768a4338a438a06c83b7097527e316

SHA256
23cade601bfd5fcb0e1d08dafc3eb9e3b64e9c89693396fc0871e8cb564a907e

SHA512
dd137115ce5fa68a0c1cc53b88a1d5dbc9a300808b4588685a77eec001c505586ab4e56be4232cd5ed2841423dc0f804dbfe3aec55a4f57bf9ecd17df084e612

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f36867fd2d82287d2c1d1183c4e91416

SHA1
72b79d915eb1a8ae3e05436f5d198ce0597aab6d

SHA256
43683101881c4920b924e80648011210752e36851b68f4468630ecf5f8ba3879

SHA512
cf32dfce521ff3ebb2abd4f21b0ddd7c561fb18147be9e8aae5256d8a7b5fdbfec23c003fc0ffb1fcbb9c887b24220fa6e8bb2eb26f83def324ce81c9f7ea465

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
01fa4b6cf1064f115a16bc1baa7fa728

SHA1
7965664fcb8501c49cfe1e0a6450f161c008ad57

SHA256
46b424e459711c318c9a77540cb35f90d2bb8ab68604b765c2926fc98b0233b0

SHA512
d558d33b52d2f2e5cf3efa26c61f00959422a75bd278e6e895d54ec8d8981edc1784f029221c7b7ea631665ad499eb5efc3d7f9dac6101332ab6f60eaf25dcb6

Download Submit
C:\Users\Admin\AppData\Local\Temp\0IgHXqOu0A.bat

Filesize
204B

MD5
d6fcb7dff8d8d09fafd5c9d4e2ca4c09

SHA1
3ad5149525ced4b9b9869b1e615fe92472a44f1c

SHA256
aadad93ebab85bd08b107618000936a2704fb773672ca7c84afc96b27b9d06e5

SHA512
a22f298a63cc405cf4b83fff0682203f3aa79a0c36cbcefed9a2afeea87bb2e8e887a84043e39f22b2d1e0ef750b36c73f0de88ca4b28bd5c853190e5d01c613

Download Submit
C:\Users\Admin\AppData\Local\Temp\BjebbrynYr.bat

Filesize
204B

MD5
8997216ebcbc1cd2070ac20afbbdfc91

SHA1
cc7cd07aa08d2792f326c29f0dfc1733cd84b026

SHA256
a765af5b6cae2733dbd5126cb94eb46e256c460b8422e750a5054651ae22c2ea

SHA512
d6a7a57d54e59b7be00b601f644689fec0608f670561619ddeeaf8a563a3a6982967964ae4f23d68f85656b27f609acccba7114ef634b9a3aaf6bd0d28914264

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab17D6.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Nl6pt1R060.bat

Filesize
204B

MD5
9f02801eae82da1381c1b1744f4b3aea

SHA1
6c8d7e7186b0cbf18a14ad8d1f763eed850237f2

SHA256
613b9940320bbb5dd451152403f3f3b92d88aa1a593200d08f7912832644c235

SHA512
8fa40d4d487ca1fb2851dc3393fca8fcad0ee40c8a3371acf84954f00710f1e7807f27190db53bbeb550380159293ea5b206ee554d5faeb2c08663ed22373ccd

Download Submit
C:\Users\Admin\AppData\Local\Temp\R5wNYqVH5b.bat

Filesize
204B

MD5
75d0c675a3304d755c785223723f6366

SHA1
42872fe4e7374c81df597e560f5a3fcf99068c6a

SHA256
070d8747fb053dc17974dd13bb37aed9be3502a333025d5697c79b0d587e1ad7

SHA512
e99446a9502357066a2e9c9f9ee978eae9c6f6afcf21bf69146654f5602e193d93854382ed60a1b577cda2f9dc8e0a0b7924a29dcb0785171de6c437cf23faea

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1808.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\V3SaMhi525.bat

Filesize
204B

MD5
d1caccf62a240b6a9f2045d2f5215644

SHA1
f8bd29345f42efb08113ab5894e7f76074ccb107

SHA256
58c36bcf521e44153673a0d97f829c74fe25b7a9cc306eaf475ff51b372a1683

SHA512
cae99872dd09917cf567689abeb201eab655ce882727ec2b8e8c9f342b0ac5c7687aee63a36f33777a0c3b6b5c77c7642430e3f403e42c34e222192dc6b6bc20

Download Submit
C:\Users\Admin\AppData\Local\Temp\VlbjwdcMOl.bat

Filesize
204B

MD5
2e9b1f6aa58ed4f4bc3e930e693479d6

SHA1
3f43f8abea6ff802ef6b2c150c89108af1d0254d

SHA256
dc9ec6530f7b6852dd6669f4c721106de87c65e59c18c7727aa4ad2d03822fae

SHA512
f8e05349d0facbb9c001c5eeb7709f5a9a0d0a4ea96b6200742681c5a0b2df63ab88bf2670d81b68c8a72035c41983da9e6cc4ec45c8493c9651b6a79c6d371b

Download Submit
C:\Users\Admin\AppData\Local\Temp\WCRFb7ekcj.bat

Filesize
204B

MD5
33e959bc18b00bdf515935644d5fc221

SHA1
463c3577086a93ff4f10307635040cc004a271fd

SHA256
cd8f201078efb62ba3c3ff3b6d6735fdd4993a89c8323bc168608d75d98cf9e0

SHA512
1c8dc83677efbfd73b45179c29c876c728ff8bba7ac8b4639a92556e0c53ce2ca5c717a05ca0f6da57e85e8ca9aa4d75852788157b5a7308b0ed814f6b48fb8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\da4noHdFs8.bat

Filesize
204B

MD5
a08f35aeebec473c5283c1bc2472cebd

SHA1
240bf5599076f3ffa534924a868635383909816d

SHA256
abbd52ff31b7cfbeff40f9dd35b99b5b5e4100d90ff0419e9db63c7ceffa1068

SHA512
dfb28193a6bee453a6db97f4efed60c660b31d78d5e821244ad8e5dc6a03ec451deec2e1327807c72dfe5364661692ee584e17938a25600a29ebae184fe779e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\ounU5LkXKE.bat

Filesize
204B

MD5
21293bf00bac6e09e030c15fc1b75e57

SHA1
b486de630bb9baf192ecaa3bfa012b639f6f707b

SHA256
1e54966deb44807b2426713f551df56947c3ba3479b8cb9544df02cb9956aaf1

SHA512
34cb433e846f7543c002419ea9daa630ed9305ab5931d43409ee76d5e1e0f506b444bcceb59e9938943b24474c9fd1839861ae6f57a7a64371982f3c217dd451

Download Submit
C:\Users\Admin\AppData\Local\Temp\tebxeZNirC.bat

Filesize
204B

MD5
f72d7d7a95434ef03f6851579ce42dce

SHA1
e932287c582377f8a5427e0eb716a00f6bc0c7f5

SHA256
c8bfaa57a71653960c0967baf6edd50404cf6f20bc8c79384450453fa6e00146

SHA512
f436f76c28ebf9a328c62ee4a84001069e098be9088289ef5d4f4f991cb4b3bcc9c4856e9c40986ff9a29762aa6e7bcfe73b5851ce052de926331c2bb2ae5240

Download Submit
C:\Users\Admin\AppData\Local\Temp\x7ZYnkvAkq.bat

Filesize
204B

MD5
f0487e527f08c484ba03b0e2328e20ab

SHA1
eadde37c7a289dd889719aeafdd9696766dab852

SHA256
22447bca86bbbdb9e6675aa714face4816c80959eb3693eb1c154a15e56dcfee

SHA512
99914dcefbd94d6475cf4c44fea5e3486baf35e2a53ee4a960538cd08a0bce1b657f814c877937f94e519910a417abdfb5773fe91962dadb59ed3623e764ae54

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\E7ENW3AFK0OM6UQ6S2KK.temp

Filesize
7KB

MD5
ed5be27790c08aa8a8c9cc8b5678d5b0

SHA1
635e349273d5b25e93c82f0254df22b6e48aa177

SHA256
fef0b9abc3dc70bd6f1592ad9e5639e2f4d5bf365948fe3ab1e16d874c6ace70

SHA512
9a75314310843312a2134c2e5c540fc0cf534249e60e9b280be4d65236c04c02a6640cf207105a1bfd559b2737aca0e1658cea5bf922814411704a5f6f47286f

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/372-149-0x0000000001110000-0x0000000001220000-memory.dmp

Filesize
1.1MB

Download
memory/372-387-0x0000000000310000-0x0000000000420000-memory.dmp

Filesize
1.1MB

Download
memory/1816-508-0x00000000002C0000-0x00000000002D2000-memory.dmp

Filesize
72KB

Download
memory/1816-507-0x0000000001210000-0x0000000001320000-memory.dmp

Filesize
1.1MB

Download
memory/2008-447-0x0000000001170000-0x0000000001280000-memory.dmp

Filesize
1.1MB

Download
memory/2064-14-0x0000000000150000-0x0000000000162000-memory.dmp

Filesize
72KB

Download
memory/2064-17-0x00000000003F0000-0x00000000003FC000-memory.dmp

Filesize
48KB

Download
memory/2064-16-0x0000000000170000-0x000000000017C000-memory.dmp

Filesize
48KB

Download
memory/2064-13-0x0000000001370000-0x0000000001480000-memory.dmp

Filesize
1.1MB

Download
memory/2064-15-0x0000000000160000-0x000000000016C000-memory.dmp

Filesize
48KB

Download
memory/2088-689-0x0000000000900000-0x0000000000A10000-memory.dmp

Filesize
1.1MB

Download
memory/2112-61-0x0000000001EF0000-0x0000000001EF8000-memory.dmp

Filesize
32KB

Download
memory/2112-60-0x000000001B730000-0x000000001BA12000-memory.dmp

Filesize
2.9MB

Download
memory/2212-568-0x0000000000650000-0x0000000000662000-memory.dmp

Filesize
72KB

Download
memory/2576-628-0x0000000000350000-0x0000000000460000-memory.dmp

Filesize
1.1MB

Download
memory/2576-629-0x0000000000340000-0x0000000000352000-memory.dmp

Filesize
72KB

Download
memory/2576-208-0x00000000013A0000-0x00000000014B0000-memory.dmp

Filesize
1.1MB

Download
memory/2576-209-0x0000000000140000-0x0000000000152000-memory.dmp

Filesize
72KB

Download
memory/2916-749-0x0000000001010000-0x0000000001120000-memory.dmp

Filesize
1.1MB

Download