dcrat | 724419234c2f8392f260e6c099f033bafc4dd1523d1bd0f9055bd449cd3a2caf

Analysis

max time kernel
149s
max time network
144s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22/12/2024, 09:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_724419234c2f8392f260e6c099f033bafc4dd1523d1bd0f9055bd449cd3a2caf.exe
Size

1.3MB
MD5

918772ede71a71dacb50c1f10a6f9013
SHA1

76b45402d4973663171aeb29a71b8bbfaf2db4ee
SHA256

724419234c2f8392f260e6c099f033bafc4dd1523d1bd0f9055bd449cd3a2caf
SHA512

e05e2af32b35cecdae12a199152c720f2bac920caef0920b1545e082e30280d7fd19e40c08dd203313f9dd52436d165f6379d5fffea80181140437cc55db5a60
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 51 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1416	2856	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2900	2856	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2868	2856	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2784	2856	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1980	2856	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2628	2856	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2384	2856	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2292	2856	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1452	2856	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2372	2856	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1728	2856	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1724	2856	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2576	2856	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1828	2856	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1940	2856	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2932	2856	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2924	2856	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	548	2856	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1232	2856	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1360	2856	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3024	2856	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3000	2856	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2504	2856	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2480	2856	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2164	2856	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2056	2856	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2116	2856	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	308	2856	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1108	2856	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	692	2856	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	832	2856	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1860	2856	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1176	2856	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	840	2856	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1680	2856	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	892	2856	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2880	2856	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1460	2856	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	900	2856	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2456	2856	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2268	2856	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	332	2856	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2060	2856	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2284	2856	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2096	2856	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1216	2856	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	876	2856	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2256	2856	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2088	2856	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1040	2856	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1604	2856	schtasks.exe	35

DCRat payload 9 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0008000000016dd1-9.dat	dcrat
behavioral1/memory/872-13-0x0000000000200000-0x0000000000310000-memory.dmp	dcrat
behavioral1/memory/2940-58-0x00000000001D0000-0x00000000002E0000-memory.dmp	dcrat
behavioral1/memory/556-182-0x0000000001280000-0x0000000001390000-memory.dmp	dcrat
behavioral1/memory/3064-537-0x00000000012B0000-0x00000000013C0000-memory.dmp	dcrat
behavioral1/memory/2496-597-0x0000000000130000-0x0000000000240000-memory.dmp	dcrat
behavioral1/memory/2432-657-0x0000000000D40000-0x0000000000E50000-memory.dmp	dcrat
behavioral1/memory/2832-717-0x00000000011F0000-0x0000000001300000-memory.dmp	dcrat
behavioral1/memory/2452-778-0x0000000000240000-0x0000000000350000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 18 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1672	powershell.exe
3004	powershell.exe
1600	powershell.exe
2520	powershell.exe
2272	powershell.exe
2800	powershell.exe
2732	powershell.exe
2788	powershell.exe
2300	powershell.exe
2720	powershell.exe
1784	powershell.exe
1664	powershell.exe
2156	powershell.exe
2836	powershell.exe
2664	powershell.exe
2844	powershell.exe
1660	powershell.exe
980	powershell.exe

Executes dropped EXE 13 IoCs

pid	Process
872	DllCommonsvc.exe
2940	lsass.exe
556	lsass.exe
2844	lsass.exe
872	lsass.exe
496	lsass.exe
2900	lsass.exe
824	lsass.exe
3064	lsass.exe
2496	lsass.exe
2432	lsass.exe
2832	lsass.exe
2452	lsass.exe

Loads dropped DLL 2 IoCs

pid	Process
3056	cmd.exe
3056	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 12 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com
5	raw.githubusercontent.com
12	raw.githubusercontent.com
19	raw.githubusercontent.com
30	raw.githubusercontent.com
33	raw.githubusercontent.com
37	raw.githubusercontent.com
9	raw.githubusercontent.com
15	raw.githubusercontent.com
23	raw.githubusercontent.com
26	raw.githubusercontent.com
40	raw.githubusercontent.com

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Internet Explorer\fr-FR\6203df4a6bafc7	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Defender\es-ES\explorer.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Defender\es-ES\7a0fd90576e088	DllCommonsvc.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Idle.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\6ccacd8608530f	DllCommonsvc.exe
File created	C:\Program Files\Windows Journal\spoolsv.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Journal\f3b6ecef712a24	DllCommonsvc.exe
File created	C:\Program Files (x86)\Internet Explorer\fr-FR\lsass.exe	DllCommonsvc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\L2Schemas\OSPPSVC.exe	DllCommonsvc.exe
File created	C:\Windows\L2Schemas\1610b97d3ab4a7	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_724419234c2f8392f260e6c099f033bafc4dd1523d1bd0f9055bd449cd3a2caf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 51 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2480	schtasks.exe
1108	schtasks.exe
2060	schtasks.exe
876	schtasks.exe
3000	schtasks.exe
1176	schtasks.exe
892	schtasks.exe
2456	schtasks.exe
2900	schtasks.exe
1232	schtasks.exe
1360	schtasks.exe
3024	schtasks.exe
2096	schtasks.exe
1216	schtasks.exe
1040	schtasks.exe
2868	schtasks.exe
2628	schtasks.exe
2056	schtasks.exe
308	schtasks.exe
2784	schtasks.exe
1728	schtasks.exe
840	schtasks.exe
1680	schtasks.exe
2504	schtasks.exe
2284	schtasks.exe
2256	schtasks.exe
2576	schtasks.exe
1828	schtasks.exe
2932	schtasks.exe
2924	schtasks.exe
1860	schtasks.exe
2880	schtasks.exe
1460	schtasks.exe
1980	schtasks.exe
2384	schtasks.exe
2292	schtasks.exe
1452	schtasks.exe
2164	schtasks.exe
832	schtasks.exe
2268	schtasks.exe
332	schtasks.exe
2372	schtasks.exe
1724	schtasks.exe
1940	schtasks.exe
548	schtasks.exe
2088	schtasks.exe
1604	schtasks.exe
1416	schtasks.exe
2116	schtasks.exe
692	schtasks.exe
900	schtasks.exe

Suspicious behavior: EnumeratesProcesses 33 IoCs

pid	Process
872	DllCommonsvc.exe
872	DllCommonsvc.exe
872	DllCommonsvc.exe
1672	powershell.exe
2940	lsass.exe
1660	powershell.exe
2836	powershell.exe
2788	powershell.exe
2664	powershell.exe
980	powershell.exe
2300	powershell.exe
2844	powershell.exe
2800	powershell.exe
2732	powershell.exe
1600	powershell.exe
2272	powershell.exe
2720	powershell.exe
2156	powershell.exe
3004	powershell.exe
2520	powershell.exe
1664	powershell.exe
1784	powershell.exe
556	lsass.exe
2844	lsass.exe
872	lsass.exe
496	lsass.exe
2900	lsass.exe
824	lsass.exe
3064	lsass.exe
2496	lsass.exe
2432	lsass.exe
2832	lsass.exe
2452	lsass.exe

Suspicious use of AdjustPrivilegeToken 31 IoCs

description	pid	Process
Token: SeDebugPrivilege	872	DllCommonsvc.exe
Token: SeDebugPrivilege	1672	powershell.exe
Token: SeDebugPrivilege	2940	lsass.exe
Token: SeDebugPrivilege	1660	powershell.exe
Token: SeDebugPrivilege	2836	powershell.exe
Token: SeDebugPrivilege	2788	powershell.exe
Token: SeDebugPrivilege	980	powershell.exe
Token: SeDebugPrivilege	2664	powershell.exe
Token: SeDebugPrivilege	2300	powershell.exe
Token: SeDebugPrivilege	2844	powershell.exe
Token: SeDebugPrivilege	2800	powershell.exe
Token: SeDebugPrivilege	2732	powershell.exe
Token: SeDebugPrivilege	1600	powershell.exe
Token: SeDebugPrivilege	2272	powershell.exe
Token: SeDebugPrivilege	2720	powershell.exe
Token: SeDebugPrivilege	2156	powershell.exe
Token: SeDebugPrivilege	3004	powershell.exe
Token: SeDebugPrivilege	2520	powershell.exe
Token: SeDebugPrivilege	1664	powershell.exe
Token: SeDebugPrivilege	1784	powershell.exe
Token: SeDebugPrivilege	556	lsass.exe
Token: SeDebugPrivilege	2844	lsass.exe
Token: SeDebugPrivilege	872	lsass.exe
Token: SeDebugPrivilege	496	lsass.exe
Token: SeDebugPrivilege	2900	lsass.exe
Token: SeDebugPrivilege	824	lsass.exe
Token: SeDebugPrivilege	3064	lsass.exe
Token: SeDebugPrivilege	2496	lsass.exe
Token: SeDebugPrivilege	2432	lsass.exe
Token: SeDebugPrivilege	2832	lsass.exe
Token: SeDebugPrivilege	2452	lsass.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 1792	2080	JaffaCakes118_724419234c2f8392f260e6c099f033bafc4dd1523d1bd0f9055bd449cd3a2caf.exe	30
PID 2080 wrote to memory of 1792	2080	JaffaCakes118_724419234c2f8392f260e6c099f033bafc4dd1523d1bd0f9055bd449cd3a2caf.exe	30
PID 2080 wrote to memory of 1792	2080	JaffaCakes118_724419234c2f8392f260e6c099f033bafc4dd1523d1bd0f9055bd449cd3a2caf.exe	30
PID 2080 wrote to memory of 1792	2080	JaffaCakes118_724419234c2f8392f260e6c099f033bafc4dd1523d1bd0f9055bd449cd3a2caf.exe	30
PID 1792 wrote to memory of 3056	1792	WScript.exe	32
PID 1792 wrote to memory of 3056	1792	WScript.exe	32
PID 1792 wrote to memory of 3056	1792	WScript.exe	32
PID 1792 wrote to memory of 3056	1792	WScript.exe	32
PID 3056 wrote to memory of 872	3056	cmd.exe	34
PID 3056 wrote to memory of 872	3056	cmd.exe	34
PID 3056 wrote to memory of 872	3056	cmd.exe	34
PID 3056 wrote to memory of 872	3056	cmd.exe	34
PID 872 wrote to memory of 1672	872	DllCommonsvc.exe	87
PID 872 wrote to memory of 1672	872	DllCommonsvc.exe	87
PID 872 wrote to memory of 1672	872	DllCommonsvc.exe	87
PID 872 wrote to memory of 1784	872	DllCommonsvc.exe	88
PID 872 wrote to memory of 1784	872	DllCommonsvc.exe	88
PID 872 wrote to memory of 1784	872	DllCommonsvc.exe	88
PID 872 wrote to memory of 1664	872	DllCommonsvc.exe	90
PID 872 wrote to memory of 1664	872	DllCommonsvc.exe	90
PID 872 wrote to memory of 1664	872	DllCommonsvc.exe	90
PID 872 wrote to memory of 980	872	DllCommonsvc.exe	91
PID 872 wrote to memory of 980	872	DllCommonsvc.exe	91
PID 872 wrote to memory of 980	872	DllCommonsvc.exe	91
PID 872 wrote to memory of 2156	872	DllCommonsvc.exe	92
PID 872 wrote to memory of 2156	872	DllCommonsvc.exe	92
PID 872 wrote to memory of 2156	872	DllCommonsvc.exe	92
PID 872 wrote to memory of 1600	872	DllCommonsvc.exe	93
PID 872 wrote to memory of 1600	872	DllCommonsvc.exe	93
PID 872 wrote to memory of 1600	872	DllCommonsvc.exe	93
PID 872 wrote to memory of 2520	872	DllCommonsvc.exe	94
PID 872 wrote to memory of 2520	872	DllCommonsvc.exe	94
PID 872 wrote to memory of 2520	872	DllCommonsvc.exe	94
PID 872 wrote to memory of 1660	872	DllCommonsvc.exe	95
PID 872 wrote to memory of 1660	872	DllCommonsvc.exe	95
PID 872 wrote to memory of 1660	872	DllCommonsvc.exe	95
PID 872 wrote to memory of 2800	872	DllCommonsvc.exe	96
PID 872 wrote to memory of 2800	872	DllCommonsvc.exe	96
PID 872 wrote to memory of 2800	872	DllCommonsvc.exe	96
PID 872 wrote to memory of 2272	872	DllCommonsvc.exe	97
PID 872 wrote to memory of 2272	872	DllCommonsvc.exe	97
PID 872 wrote to memory of 2272	872	DllCommonsvc.exe	97
PID 872 wrote to memory of 2720	872	DllCommonsvc.exe	98
PID 872 wrote to memory of 2720	872	DllCommonsvc.exe	98
PID 872 wrote to memory of 2720	872	DllCommonsvc.exe	98
PID 872 wrote to memory of 2844	872	DllCommonsvc.exe	100
PID 872 wrote to memory of 2844	872	DllCommonsvc.exe	100
PID 872 wrote to memory of 2844	872	DllCommonsvc.exe	100
PID 872 wrote to memory of 2300	872	DllCommonsvc.exe	101
PID 872 wrote to memory of 2300	872	DllCommonsvc.exe	101
PID 872 wrote to memory of 2300	872	DllCommonsvc.exe	101
PID 872 wrote to memory of 2732	872	DllCommonsvc.exe	103
PID 872 wrote to memory of 2732	872	DllCommonsvc.exe	103
PID 872 wrote to memory of 2732	872	DllCommonsvc.exe	103
PID 872 wrote to memory of 3004	872	DllCommonsvc.exe	104
PID 872 wrote to memory of 3004	872	DllCommonsvc.exe	104
PID 872 wrote to memory of 3004	872	DllCommonsvc.exe	104
PID 872 wrote to memory of 2788	872	DllCommonsvc.exe	106
PID 872 wrote to memory of 2788	872	DllCommonsvc.exe	106
PID 872 wrote to memory of 2788	872	DllCommonsvc.exe	106
PID 872 wrote to memory of 2664	872	DllCommonsvc.exe	108
PID 872 wrote to memory of 2664	872	DllCommonsvc.exe	108
PID 872 wrote to memory of 2664	872	DllCommonsvc.exe	108
PID 872 wrote to memory of 2836	872	DllCommonsvc.exe	109

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_724419234c2f8392f260e6c099f033bafc4dd1523d1bd0f9055bd449cd3a2caf.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_724419234c2f8392f260e6c099f033bafc4dd1523d1bd0f9055bd449cd3a2caf.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1792
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3056
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:872
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1672
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\lsass.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1784
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1664
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\L2Schemas\OSPPSVC.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:980
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\cmd.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2156
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Templates\cmd.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1600
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\winlogon.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2520
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\System.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1660
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Defender\es-ES\explorer.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2800
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\sppsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2272
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Sidebar\Gadgets\Idle.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2720
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\taskhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2844
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Journal\spoolsv.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2300
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\audiodg.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2732
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Internet Explorer\fr-FR\lsass.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3004
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2788
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\System.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2664
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\Idle.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2836
    - - C:\providercommon\lsass.exe
        
        "C:\providercommon\lsass.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2940
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\LkcfmFI5TJ.bat"
        6⤵
        
        PID:2028
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:2920
        
        C:\providercommon\lsass.exe
        
        "C:\providercommon\lsass.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:556
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\vlZZCFJNsh.bat"
        8⤵
        
        PID:2864
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:760
        
        C:\providercommon\lsass.exe
        
        "C:\providercommon\lsass.exe"
        9⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2844
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0Sh6ipYOoX.bat"
        10⤵
        
        PID:2872
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:3052
        
        C:\providercommon\lsass.exe
        
        "C:\providercommon\lsass.exe"
        11⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:872
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\J2mXRZwkCj.bat"
        12⤵
        
        PID:1232
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:2288
        
        C:\providercommon\lsass.exe
        
        "C:\providercommon\lsass.exe"
        13⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:496
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\vbXk1H8t4K.bat"
        14⤵
        
        PID:620
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:1940
        
        C:\providercommon\lsass.exe
        
        "C:\providercommon\lsass.exe"
        15⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2900
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\FBiR4PpyYA.bat"
        16⤵
        
        PID:1748
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:1096
        
        C:\providercommon\lsass.exe
        
        "C:\providercommon\lsass.exe"
        17⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:824
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\OTxxDhnLNa.bat"
        18⤵
        
        PID:2212
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:3004
        
        C:\providercommon\lsass.exe
        
        "C:\providercommon\lsass.exe"
        19⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3064
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\wLA3izB53h.bat"
        20⤵
        
        PID:1668
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:2824
        
        C:\providercommon\lsass.exe
        
        "C:\providercommon\lsass.exe"
        21⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2496
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\SzaURWjxsM.bat"
        22⤵
        
        PID:596
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:1780
        
        C:\providercommon\lsass.exe
        
        "C:\providercommon\lsass.exe"
        23⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2432
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\7Xe7C8pmPD.bat"
        24⤵
        
        PID:1928
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:3040
        
        C:\providercommon\lsass.exe
        
        "C:\providercommon\lsass.exe"
        25⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2832
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\lAZRwHYzWc.bat"
        26⤵
        
        PID:2576
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        27⤵
        
        PID:2604
        
        C:\providercommon\lsass.exe
        
        "C:\providercommon\lsass.exe"
        27⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\providercommon\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\providercommon\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\providercommon\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 14 /tr "'C:\Windows\L2Schemas\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Windows\L2Schemas\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 5 /tr "'C:\Windows\L2Schemas\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 7 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 7 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\Templates\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Users\Admin\Templates\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\Templates\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Default User\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Defender\es-ES\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\es-ES\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Defender\es-ES\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\providercommon\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\providercommon\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\providercommon\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Sidebar\Gadgets\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Gadgets\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Sidebar\Gadgets\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 6 /tr "'C:\providercommon\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\providercommon\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 13 /tr "'C:\providercommon\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Journal\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Windows Journal\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Journal\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 8 /tr "'C:\providercommon\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\providercommon\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 14 /tr "'C:\providercommon\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Internet Explorer\fr-FR\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\fr-FR\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Internet Explorer\fr-FR\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\providercommon\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\providercommon\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\providercommon\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Default User\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
371c9bc661ff0331e5e031274402f2c0

SHA1
1a5afff8441cf4ad823be83dad5aa3114d16cdf1

SHA256
29e04b9e5937eb0daacd749602366c9768b87fba0ce03e56115c9c35073c0891

SHA512
0e5f7560b3d9a9bd1c77be2e0d2f4959787ed225acf019413acc4c5f46b86ac144cf83570b5fe073b70265941546a6dbfde966e05d3ebfb8c47c12c45aa44234

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a7e7409ac684c427e519348ab43953cc

SHA1
f15a13558ceceb396d7b221eb92ac19a386cc694

SHA256
f85f8473e50c3b2bee7c349026be2cf5e7970ffcfda84cc2168067517446c809

SHA512
236a8ff6ff3d3b502fef86f83ed8245a514385dd167e4959173d22f55f3179902e66e3a4af067e4af2418a840dd50d0e80f72353cabfbf3bd14413996c903e5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e05a1fda7cd1158cd708343b331f39b9

SHA1
68c927e682a3c5865f4e7e8f79affe859228f2a1

SHA256
836c584525a8b739854f27e3ab36967fd71ff1968e067010cb28dc2c9fe66c34

SHA512
2ee8c67acce2e2f9273be1a4d56f606e8d801cf4023a56ddb2152899342f66f5ad9a3611c5ffafef1870f17b738e9007a06695accf73eaec31e5f31abb4496ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ad8d297856b2fa75d14a928700b78f59

SHA1
a263c6d11576fa45d712ef32c6a951e623285f88

SHA256
6ae2d10d9d472726c108fd95f458ea74aec5ec696a72133b98139eec07ac952d

SHA512
ea9363239f3a35eee0ca1c7896902b463c2ed3282bb8e93264ce865fd84ff0fac233ed2d42c57bcf681216ab082395a9e3b2988de937a82b2ca859611d0f17c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5a0625d083ff70f4e4095528a2c6cdd8

SHA1
cb0df0870284e590b49bf17aea128b35a645a8af

SHA256
6e852e05c63a0bfaaf1f18a6845455c0ab1e3c46454ae289fc853f27fa8e983e

SHA512
81d5aad7fd4e718b83534d03c28c3621ce9105d1280919ee8fc35548ff9e2d81a3654494ee059c41f6bace8c36faa15d7035c17d5f810c83cc2a8497b042ad2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b752a13b3a3eaf458a6751b5345c7c25

SHA1
74abbd76fe1c132ed49ef48c1c63d7538dd7583c

SHA256
775cba9998dc2940b14b56249c689e5f6913e597f8bbf0a61f30f98f45a8e7df

SHA512
067023b3c821a04ff74a947db52d6118940d7375633f9772800661c4f68118963b83fdd5d8d1b6cf4171e5158818e821c59a413955a9acfce8dd7bbc65343281

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
984876f3b8949e596c1474c546d79961

SHA1
de4d7918d640a8dc00fac5fcc7f91fa732fd85f4

SHA256
712c85178e0e55f721de77ef598bd5d9f1e7c12a6220457ada93759129e0ba6d

SHA512
16064dc69dbfc7742ac9c94220536455e199abf6a126ef7b3c253d6caaae870664814872cf4d55a5eb4d5bb284ab2a28cd0721ec7fd99a3a449a2d4d2e8ab8ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1be0f8db85c9bcb39248aacadc01ae68

SHA1
e1ded78885b212af76a7babf8d1a235c8789c616

SHA256
f3047b5fdd5b4eb647a7acbed25954355b304ebc3ab3078bd6efc6e12043f080

SHA512
57b3890d9afbec3b7c98991e2baf5117c6a8abf14e729b37a80cd758364c086dd5b9b1f03892ae838f8ed39d44fdb5f661987b92ef0c0a4f74b75ac130aa6405

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1ef85280b91426f07cf20903e5e9a4af

SHA1
8f54b1fc850e9df79696f2b1592e88cbbcc9571c

SHA256
28e3b26812be786120af736c2ac0b10d46bad68e6903264305f102c7ada58a66

SHA512
f75cd6fb90770c2566b1340edc9285f19578994b19d543583cf363cc67bf259e20e11c7fd29a04635cb1c85f458e73de899d2b85558ecde783d58f7b7cad9d23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3942bd398d56b5da31dd94c22d0e2f94

SHA1
fb83b3eaf6b42ac298ab8cfc95a0678341448437

SHA256
6deef47ed475d861145ebfc30f766f8587fe1d7ffe6611293c97cf0e07952483

SHA512
79dbc3b271a604859c256f6385010f6edf1ff88222905bbac353df0f2ca6e55fc9eb72b09b041d6c20e46987c45e442490da256b74b721b1200bc8284eabe9cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\0Sh6ipYOoX.bat

Filesize
192B

MD5
37683b3598a20c7adb74165f4fe3bcaf

SHA1
19b221306de43b3bfdca73b32837b3ed416aab9f

SHA256
7a051ee0dfea0e5d2ec1db2e4e2cdca9e23a0905158dd3e2604cfb986d04d4b2

SHA512
b1cef35716a1c7fe6bad446233f81c004960f884c398bcc60658ec48795e7449462ff0eac7c9f4bf5314546006940f3b32ef667d1dbee49d2952853128a87447

Download Submit
C:\Users\Admin\AppData\Local\Temp\7Xe7C8pmPD.bat

Filesize
192B

MD5
d7b96729b594d6e2aa84425f8f03983a

SHA1
b3d3fbac82acd0d67e02878e0b57fa3f250dad5d

SHA256
2d5ae03e3987f7645c203f258d801d308624129a2fc7c6cd2295380d7cf7241b

SHA512
044f07fe55db6af9d4d808be4b3f75fcefdcb64e15b882cae3b72854d2b4681358bfb007e827ba13b4645900cf7a2025c75aa333082d3e371fed8949a29cbeed

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF8C2.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\FBiR4PpyYA.bat

Filesize
192B

MD5
050bbe5ae7f96646dde1250c58131007

SHA1
c26490098fb86043e69ba3dd5920d780e0c681fc

SHA256
1eb6dcee6584df4d805e481efb5e033ff26c269d35d770b9d6861ae4915fef9a

SHA512
dc456f6b2cf6d9ad56154d404bd68439c876af906a37140f433cf574719fa8b495608283ba53fcb3317c3d18745d0f8c9adbe769d0849965dbb0b15ffe55ebd3

Download Submit
C:\Users\Admin\AppData\Local\Temp\J2mXRZwkCj.bat

Filesize
192B

MD5
e66e59307de61d1c5f39d1642a0e1bee

SHA1
1bd8a0a870bf9d8c3ade7c69d57d858b5f2fc808

SHA256
8c849e84c453b1d6142e06113732cf488e83915c2355a51af730d1f1765d451e

SHA512
768f6d0b7259931351b8bcff772d874548ce7f1537cee143b60e151ce2ea13c0965c01fad22a65654ed1bfc78d8c78cad0ef39f78e0a699c88483d787e992534

Download Submit
C:\Users\Admin\AppData\Local\Temp\LkcfmFI5TJ.bat

Filesize
192B

MD5
fc364e239db37322dbee4116cb2cef65

SHA1
a8c2479cf944ae1d9b0ee343be97553186568f7e

SHA256
44f307aef333972c228c5821fe68cabcf83675d1cfe73efa8d052c695d3d0f45

SHA512
6de48390e2eead8230e0e226009cc9dd814bf5310434a397df6e6924d60c11f85578881c4d89be9c504ac2b21b4a26917a4c7ae19504a6f09272521fafc5d49f

Download Submit
C:\Users\Admin\AppData\Local\Temp\OTxxDhnLNa.bat

Filesize
192B

MD5
b2e5684971bccae0ecb5e3c18a8cfab6

SHA1
bf1712f73aa0fd140af54d4865c3ef9dd5a52bd9

SHA256
3a011d7ee7ffd81487f3316c21b3724664ea10ce0a2e5c19dfa31b0a23bbf37d

SHA512
d5505b2be7e6143285b427cafd50d0ec22a696f4a1798c809f70ac0b29408ed57c54e9e9adab744fe8ee2ea3d60d7c6b7b4400ddce56096e90cc023879eaaa7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\SzaURWjxsM.bat

Filesize
192B

MD5
b0fda4560b1aff5851da1264adfad862

SHA1
470df756d077b30a3fe1c519262877ccf36a4495

SHA256
588bdb9792eded9cedef0e111c64882ca0833b8e3b7a191bf2c0553439469c5f

SHA512
6ef319bc4e00da7ce46866a7deaa169e1c6b51e89d119e9894268dc61ffffee4163d1bd5bdf8af5e63f40e1866033620b946df88e4380ef30c323de2adc2e94b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF923.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\lAZRwHYzWc.bat

Filesize
192B

MD5
156f1708af7a6822f7ec5807454d0538

SHA1
7df95ea7125cb720ddc662680c59bbaa96d1a223

SHA256
cda8e0b879995e01ab23724cb58137a9166cf14f65abb91de136dd5a7c03e229

SHA512
27ed17fc57e3a72935f3e14abec6b3825018430f6f1c2fb08919251f8e6375bdf0c7bdd04790e73c04dfdb9adc18dbac9dd73d14abc0b7b3f79b61fcd340628d

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbXk1H8t4K.bat

Filesize
192B

MD5
78525c1335442392b7cc9f4e2f7f08d1

SHA1
acfe92d7b7fc98e96311c48142acfbfcb15945c2

SHA256
5d756207e43d40234e39bab4d3a3abec212e801da38529d81b4a4cfdb3c25db5

SHA512
8bf962b0bf6a80438ed63d67ee8cad75c55b3c732b3e9aee3bb87fb8fb5ed3c218009f36d217448796a70b851b34b538c2b02f3d211d6a4a8277459106a2186f

Download Submit
C:\Users\Admin\AppData\Local\Temp\vlZZCFJNsh.bat

Filesize
192B

MD5
7c922427632bcf1675d44bf67e04adb5

SHA1
1537a69e425832f3ae95a5ce6541cf1bf43ab6e1

SHA256
91b433c0185385b343738c524b6df23d5b7fe3f43eb0990414722514b87e44a1

SHA512
f5302d6e1b44cd9a34bebc35327b38c640fbad64708185136a282510abecd4d5681700cda1b92cf425b6320b6dd71e527d8f38f6784b1885466cb627256219a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\wLA3izB53h.bat

Filesize
192B

MD5
6b1b450aa53ac61cf8925fc80c513ca7

SHA1
e9392c670e697be3c801301444f7e059e13363e3

SHA256
4cc6696c49c21ec404193095ff85131f5e18ca461261783fa14b2d96206d0526

SHA512
73ced311057c0120134798c942f587b2a83fd571713a934614414515b0e23aa0eed48d8735b38ce04cca805647150c4752cfc496bab7bfb95817bf712270fb16

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
67084ee3eea41ea70587efce39279a72

SHA1
f8c4245973c0ee60a81a16f17f3b2a0cec7dbfb7

SHA256
c14482ed62e2c40551a56739b91036cba06b05919b2aff8f41e1d0c906142282

SHA512
8994e68198533b85c75174190109f604798b53915c4285abab1f5975fd889608f735e032f5eb5315c2d3893307411807269acd3f303c331fac3fdd2e962bc46c

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
memory/556-182-0x0000000001280000-0x0000000001390000-memory.dmp

Filesize
1.1MB

Download
memory/872-14-0x0000000000450000-0x0000000000462000-memory.dmp

Filesize
72KB

Download
memory/872-17-0x00000000004A0000-0x00000000004AC000-memory.dmp

Filesize
48KB

Download
memory/872-13-0x0000000000200000-0x0000000000310000-memory.dmp

Filesize
1.1MB

Download
memory/872-16-0x0000000000460000-0x000000000046C000-memory.dmp

Filesize
48KB

Download
memory/872-15-0x0000000000480000-0x000000000048C000-memory.dmp

Filesize
48KB

Download
memory/1660-98-0x000000001B5E0000-0x000000001B8C2000-memory.dmp

Filesize
2.9MB

Download
memory/1660-101-0x0000000001E30000-0x0000000001E38000-memory.dmp

Filesize
32KB

Download
memory/1672-64-0x000000001B540000-0x000000001B822000-memory.dmp

Filesize
2.9MB

Download
memory/1672-65-0x0000000002890000-0x0000000002898000-memory.dmp

Filesize
32KB

Download
memory/2432-657-0x0000000000D40000-0x0000000000E50000-memory.dmp

Filesize
1.1MB

Download
memory/2452-778-0x0000000000240000-0x0000000000350000-memory.dmp

Filesize
1.1MB

Download
memory/2496-597-0x0000000000130000-0x0000000000240000-memory.dmp

Filesize
1.1MB

Download
memory/2832-717-0x00000000011F0000-0x0000000001300000-memory.dmp

Filesize
1.1MB

Download
memory/2832-718-0x00000000003C0000-0x00000000003D2000-memory.dmp

Filesize
72KB

Download
memory/2940-89-0x00000000001C0000-0x00000000001D2000-memory.dmp

Filesize
72KB

Download
memory/2940-58-0x00000000001D0000-0x00000000002E0000-memory.dmp

Filesize
1.1MB

Download
memory/3064-537-0x00000000012B0000-0x00000000013C0000-memory.dmp

Filesize
1.1MB

Download