dcrat | e012e08ac9546d02c8343e99017c8603ad36f8681c158f2bd47372d5f11d5ab3

Analysis

max time kernel
147s
max time network
142s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 12:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_e012e08ac9546d02c8343e99017c8603ad36f8681c158f2bd47372d5f11d5ab3.exe
Size

1.3MB
MD5

653ad8467de323aa015209fd177a79bf
SHA1

02c9d103be50f66def3bc744dc920be290007d92
SHA256

e012e08ac9546d02c8343e99017c8603ad36f8681c158f2bd47372d5f11d5ab3
SHA512

3872f89eb48051f2d4d5e06ea9ba170e75fdae1f6174e2b039ef34067e1a6c1f43277c72774803c371a0a81ad199ba9fb9c195ff23f3c2dcf931ed775c6110ce
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 48 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2816	2808	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2628	2808	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1920	2808	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2544	2808	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2592	2808	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	592	2808	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2192	2808	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2056	2808	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2608	2808	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2052	2808	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1792	2808	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2772	2808	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2012	2808	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1984	2808	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1996	2808	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2856	2808	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1524	2808	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1612	2808	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2948	2808	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2716	2808	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2292	2808	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2508	2808	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2140	2808	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3020	2808	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2148	2808	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	760	2808	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	876	2808	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2448	2808	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1948	2808	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1044	2808	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1152	2808	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2168	2808	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2524	2808	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1636	2808	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2904	2808	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1540	2808	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1892	2808	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	780	2808	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	696	2808	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1548	2808	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2100	2808	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2160	2808	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2400	2808	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2320	2808	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3028	2808	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1016	2808	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1820	2808	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3012	2808	schtasks.exe	35

DCRat payload 7 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0008000000016c3d-11.dat	dcrat
behavioral1/memory/2648-13-0x00000000000F0000-0x0000000000200000-memory.dmp	dcrat
behavioral1/memory/2840-128-0x0000000000080000-0x0000000000190000-memory.dmp	dcrat
behavioral1/memory/2056-187-0x0000000000EB0000-0x0000000000FC0000-memory.dmp	dcrat
behavioral1/memory/2504-248-0x00000000013D0000-0x00000000014E0000-memory.dmp	dcrat
behavioral1/memory/2992-664-0x0000000000330000-0x0000000000440000-memory.dmp	dcrat
behavioral1/memory/1964-724-0x0000000001140000-0x0000000001250000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 17 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2176	powershell.exe
2204	powershell.exe
2468	powershell.exe
2964	powershell.exe
1120	powershell.exe
1508	powershell.exe
2480	powershell.exe
2336	powershell.exe
1740	powershell.exe
1516	powershell.exe
2308	powershell.exe
1520	powershell.exe
1800	powershell.exe
2576	powershell.exe
2024	powershell.exe
2032	powershell.exe
2760	powershell.exe

Executes dropped EXE 12 IoCs

pid	Process
2648	DllCommonsvc.exe
2840	winlogon.exe
2056	winlogon.exe
2504	winlogon.exe
1732	winlogon.exe
1556	winlogon.exe
876	winlogon.exe
2572	winlogon.exe
2776	winlogon.exe
2208	winlogon.exe
2992	winlogon.exe
1964	winlogon.exe

Loads dropped DLL 2 IoCs

pid	Process
2632	cmd.exe
2632	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs

Web Service

T1102

flow	ioc
33	raw.githubusercontent.com
4	raw.githubusercontent.com
9	raw.githubusercontent.com
13	raw.githubusercontent.com
23	raw.githubusercontent.com
29	raw.githubusercontent.com
36	raw.githubusercontent.com
5	raw.githubusercontent.com
17	raw.githubusercontent.com
20	raw.githubusercontent.com
26	raw.githubusercontent.com

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Uninstall Information\6203df4a6bafc7	DllCommonsvc.exe
File created	C:\Program Files\VideoLAN\VLC\wininit.exe	DllCommonsvc.exe
File created	C:\Program Files\7-Zip\Lang\0a1fd5f707cd16	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft.NET\RedistList\6ccacd8608530f	DllCommonsvc.exe
File created	C:\Program Files (x86)\Uninstall Information\lsass.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft.NET\RedistList\Idle.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Sidebar\it-IT\taskhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Sidebar\it-IT\b75386f1303e64	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Media Player\Media Renderer\wininit.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Media Player\Media Renderer\56085415360792	DllCommonsvc.exe
File created	C:\Program Files\VideoLAN\VLC\56085415360792	DllCommonsvc.exe
File created	C:\Program Files\7-Zip\Lang\sppsvc.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\WMIADAP.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\75a57c1bdf437c	DllCommonsvc.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\Favorites\6203df4a6bafc7	DllCommonsvc.exe
File created	C:\Windows\PolicyDefinitions\System.exe	DllCommonsvc.exe
File created	C:\Windows\PolicyDefinitions\27d1bcfc3c54e0	DllCommonsvc.exe
File created	C:\Windows\ServiceProfiles\LocalService\Favorites\lsass.exe	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_e012e08ac9546d02c8343e99017c8603ad36f8681c158f2bd47372d5f11d5ab3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 48 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2948	schtasks.exe
1152	schtasks.exe
1892	schtasks.exe
592	schtasks.exe
2772	schtasks.exe
1984	schtasks.exe
2716	schtasks.exe
2140	schtasks.exe
3020	schtasks.exe
1948	schtasks.exe
1636	schtasks.exe
3012	schtasks.exe
1920	schtasks.exe
1524	schtasks.exe
1792	schtasks.exe
3028	schtasks.exe
2816	schtasks.exe
2592	schtasks.exe
2168	schtasks.exe
780	schtasks.exe
1820	schtasks.exe
2508	schtasks.exe
2448	schtasks.exe
2052	schtasks.exe
1996	schtasks.exe
2856	schtasks.exe
1612	schtasks.exe
876	schtasks.exe
1044	schtasks.exe
2544	schtasks.exe
2192	schtasks.exe
2160	schtasks.exe
1016	schtasks.exe
2012	schtasks.exe
2292	schtasks.exe
2524	schtasks.exe
696	schtasks.exe
1548	schtasks.exe
2100	schtasks.exe
2628	schtasks.exe
2056	schtasks.exe
2400	schtasks.exe
760	schtasks.exe
2904	schtasks.exe
1540	schtasks.exe
2320	schtasks.exe
2608	schtasks.exe
2148	schtasks.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
2648	DllCommonsvc.exe
2648	DllCommonsvc.exe
2648	DllCommonsvc.exe
2468	powershell.exe
2336	powershell.exe
2480	powershell.exe
1508	powershell.exe
2176	powershell.exe
2024	powershell.exe
2308	powershell.exe
2032	powershell.exe
1120	powershell.exe
1740	powershell.exe
1520	powershell.exe
2204	powershell.exe
1516	powershell.exe
2576	powershell.exe
1800	powershell.exe
2760	powershell.exe
2964	powershell.exe
2840	winlogon.exe
2056	winlogon.exe
2504	winlogon.exe
1732	winlogon.exe
1556	winlogon.exe
876	winlogon.exe
2572	winlogon.exe
2776	winlogon.exe
2208	winlogon.exe
2992	winlogon.exe
1964	winlogon.exe

Suspicious use of AdjustPrivilegeToken 29 IoCs

description	pid	Process
Token: SeDebugPrivilege	2648	DllCommonsvc.exe
Token: SeDebugPrivilege	2468	powershell.exe
Token: SeDebugPrivilege	2336	powershell.exe
Token: SeDebugPrivilege	2480	powershell.exe
Token: SeDebugPrivilege	1508	powershell.exe
Token: SeDebugPrivilege	2176	powershell.exe
Token: SeDebugPrivilege	2024	powershell.exe
Token: SeDebugPrivilege	2308	powershell.exe
Token: SeDebugPrivilege	2032	powershell.exe
Token: SeDebugPrivilege	1120	powershell.exe
Token: SeDebugPrivilege	1740	powershell.exe
Token: SeDebugPrivilege	1520	powershell.exe
Token: SeDebugPrivilege	2204	powershell.exe
Token: SeDebugPrivilege	1516	powershell.exe
Token: SeDebugPrivilege	2576	powershell.exe
Token: SeDebugPrivilege	1800	powershell.exe
Token: SeDebugPrivilege	2760	powershell.exe
Token: SeDebugPrivilege	2964	powershell.exe
Token: SeDebugPrivilege	2840	winlogon.exe
Token: SeDebugPrivilege	2056	winlogon.exe
Token: SeDebugPrivilege	2504	winlogon.exe
Token: SeDebugPrivilege	1732	winlogon.exe
Token: SeDebugPrivilege	1556	winlogon.exe
Token: SeDebugPrivilege	876	winlogon.exe
Token: SeDebugPrivilege	2572	winlogon.exe
Token: SeDebugPrivilege	2776	winlogon.exe
Token: SeDebugPrivilege	2208	winlogon.exe
Token: SeDebugPrivilege	2992	winlogon.exe
Token: SeDebugPrivilege	1964	winlogon.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 1364	2024	JaffaCakes118_e012e08ac9546d02c8343e99017c8603ad36f8681c158f2bd47372d5f11d5ab3.exe	31
PID 2024 wrote to memory of 1364	2024	JaffaCakes118_e012e08ac9546d02c8343e99017c8603ad36f8681c158f2bd47372d5f11d5ab3.exe	31
PID 2024 wrote to memory of 1364	2024	JaffaCakes118_e012e08ac9546d02c8343e99017c8603ad36f8681c158f2bd47372d5f11d5ab3.exe	31
PID 2024 wrote to memory of 1364	2024	JaffaCakes118_e012e08ac9546d02c8343e99017c8603ad36f8681c158f2bd47372d5f11d5ab3.exe	31
PID 1364 wrote to memory of 2632	1364	WScript.exe	32
PID 1364 wrote to memory of 2632	1364	WScript.exe	32
PID 1364 wrote to memory of 2632	1364	WScript.exe	32
PID 1364 wrote to memory of 2632	1364	WScript.exe	32
PID 2632 wrote to memory of 2648	2632	cmd.exe	34
PID 2632 wrote to memory of 2648	2632	cmd.exe	34
PID 2632 wrote to memory of 2648	2632	cmd.exe	34
PID 2632 wrote to memory of 2648	2632	cmd.exe	34
PID 2648 wrote to memory of 1508	2648	DllCommonsvc.exe	84
PID 2648 wrote to memory of 1508	2648	DllCommonsvc.exe	84
PID 2648 wrote to memory of 1508	2648	DllCommonsvc.exe	84
PID 2648 wrote to memory of 1516	2648	DllCommonsvc.exe	85
PID 2648 wrote to memory of 1516	2648	DllCommonsvc.exe	85
PID 2648 wrote to memory of 1516	2648	DllCommonsvc.exe	85
PID 2648 wrote to memory of 1520	2648	DllCommonsvc.exe	86
PID 2648 wrote to memory of 1520	2648	DllCommonsvc.exe	86
PID 2648 wrote to memory of 1520	2648	DllCommonsvc.exe	86
PID 2648 wrote to memory of 2336	2648	DllCommonsvc.exe	88
PID 2648 wrote to memory of 2336	2648	DllCommonsvc.exe	88
PID 2648 wrote to memory of 2336	2648	DllCommonsvc.exe	88
PID 2648 wrote to memory of 2176	2648	DllCommonsvc.exe	90
PID 2648 wrote to memory of 2176	2648	DllCommonsvc.exe	90
PID 2648 wrote to memory of 2176	2648	DllCommonsvc.exe	90
PID 2648 wrote to memory of 2480	2648	DllCommonsvc.exe	91
PID 2648 wrote to memory of 2480	2648	DllCommonsvc.exe	91
PID 2648 wrote to memory of 2480	2648	DllCommonsvc.exe	91
PID 2648 wrote to memory of 2308	2648	DllCommonsvc.exe	92
PID 2648 wrote to memory of 2308	2648	DllCommonsvc.exe	92
PID 2648 wrote to memory of 2308	2648	DllCommonsvc.exe	92
PID 2648 wrote to memory of 2024	2648	DllCommonsvc.exe	94
PID 2648 wrote to memory of 2024	2648	DllCommonsvc.exe	94
PID 2648 wrote to memory of 2024	2648	DllCommonsvc.exe	94
PID 2648 wrote to memory of 2032	2648	DllCommonsvc.exe	96
PID 2648 wrote to memory of 2032	2648	DllCommonsvc.exe	96
PID 2648 wrote to memory of 2032	2648	DllCommonsvc.exe	96
PID 2648 wrote to memory of 2468	2648	DllCommonsvc.exe	97
PID 2648 wrote to memory of 2468	2648	DllCommonsvc.exe	97
PID 2648 wrote to memory of 2468	2648	DllCommonsvc.exe	97
PID 2648 wrote to memory of 1740	2648	DllCommonsvc.exe	102
PID 2648 wrote to memory of 1740	2648	DllCommonsvc.exe	102
PID 2648 wrote to memory of 1740	2648	DllCommonsvc.exe	102
PID 2648 wrote to memory of 2760	2648	DllCommonsvc.exe	103
PID 2648 wrote to memory of 2760	2648	DllCommonsvc.exe	103
PID 2648 wrote to memory of 2760	2648	DllCommonsvc.exe	103
PID 2648 wrote to memory of 2964	2648	DllCommonsvc.exe	104
PID 2648 wrote to memory of 2964	2648	DllCommonsvc.exe	104
PID 2648 wrote to memory of 2964	2648	DllCommonsvc.exe	104
PID 2648 wrote to memory of 2576	2648	DllCommonsvc.exe	110
PID 2648 wrote to memory of 2576	2648	DllCommonsvc.exe	110
PID 2648 wrote to memory of 2576	2648	DllCommonsvc.exe	110
PID 2648 wrote to memory of 1120	2648	DllCommonsvc.exe	111
PID 2648 wrote to memory of 1120	2648	DllCommonsvc.exe	111
PID 2648 wrote to memory of 1120	2648	DllCommonsvc.exe	111
PID 2648 wrote to memory of 1800	2648	DllCommonsvc.exe	112
PID 2648 wrote to memory of 1800	2648	DllCommonsvc.exe	112
PID 2648 wrote to memory of 1800	2648	DllCommonsvc.exe	112
PID 2648 wrote to memory of 2204	2648	DllCommonsvc.exe	113
PID 2648 wrote to memory of 2204	2648	DllCommonsvc.exe	113
PID 2648 wrote to memory of 2204	2648	DllCommonsvc.exe	113
PID 2648 wrote to memory of 2776	2648	DllCommonsvc.exe	118

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e012e08ac9546d02c8343e99017c8603ad36f8681c158f2bd47372d5f11d5ab3.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e012e08ac9546d02c8343e99017c8603ad36f8681c158f2bd47372d5f11d5ab3.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1364
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2632
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2648
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1508
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\winlogon.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1516
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\Idle.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1520
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\conhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2336
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\7-Zip\Lang\sppsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2176
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft.NET\RedistList\Idle.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2480
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Media Player\Media Renderer\wininit.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2308
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\conhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2024
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\WmiPrvSE.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2032
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\WMIADAP.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2468
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Uninstall Information\lsass.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1740
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\sppsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2760
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\VideoLAN\VLC\wininit.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2964
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ServiceProfiles\LocalService\Favorites\lsass.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2576
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Sidebar\it-IT\taskhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1120
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1800
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\PolicyDefinitions\System.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2204
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\UBDT865ETH.bat"
        5⤵
        
        PID:2776
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:2200
      - C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\winlogon.exe
        
        "C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\winlogon.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2840
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\LW19r029AS.bat"
        7⤵
        
        PID:2104
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:2940
        
        C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\winlogon.exe
        
        "C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\winlogon.exe"
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2056
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WRY5ahHPmz.bat"
        9⤵
        
        PID:2640
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:2312
        
        C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\winlogon.exe
        
        "C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\winlogon.exe"
        10⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2504
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tebxeZNirC.bat"
        11⤵
        
        PID:2916
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:2816
        
        C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\winlogon.exe
        
        "C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\winlogon.exe"
        12⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1732
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\KqyXtY4PgZ.bat"
        13⤵
        
        PID:1904
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:1788
        
        C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\winlogon.exe
        
        "C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\winlogon.exe"
        14⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1556
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8tyQ25hERL.bat"
        15⤵
        
        PID:2064
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:848
        
        C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\winlogon.exe
        
        "C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\winlogon.exe"
        16⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:876
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\FBcCl1WGSV.bat"
        17⤵
        
        PID:1676
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:1268
        
        C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\winlogon.exe
        
        "C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\winlogon.exe"
        18⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2572
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\QVLs15dYuc.bat"
        19⤵
        
        PID:2752
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:1432
        
        C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\winlogon.exe
        
        "C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\winlogon.exe"
        20⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2776
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\t3iRsZx2b7.bat"
        21⤵
        
        PID:2000
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:2840
        
        C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\winlogon.exe
        
        "C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\winlogon.exe"
        22⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2208
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0WHmS6dpJ0.bat"
        23⤵
        
        PID:1364
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:1972
        
        C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\winlogon.exe
        
        "C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\winlogon.exe"
        24⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2992
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\K3fI8Bd254.bat"
        25⤵
        
        PID:920
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:3028
        
        C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\winlogon.exe
        
        "C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\winlogon.exe"
        26⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Users\Admin\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Program Files\7-Zip\Lang\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\Program Files\7-Zip\Lang\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Media Player\Media Renderer\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\Media Renderer\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Media Player\Media Renderer\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\providercommon\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\providercommon\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\providercommon\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\providercommon\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\providercommon\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 13 /tr "'C:\providercommon\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\WMIADAP.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Uninstall Information\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Uninstall Information\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Uninstall Information\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\providercommon\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\providercommon\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\providercommon\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Program Files\VideoLAN\VLC\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Program Files\VideoLAN\VLC\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Windows\ServiceProfiles\LocalService\Favorites\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\ServiceProfiles\LocalService\Favorites\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Windows\ServiceProfiles\LocalService\Favorites\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Sidebar\it-IT\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\it-IT\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Sidebar\it-IT\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Windows\PolicyDefinitions\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\PolicyDefinitions\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Windows\PolicyDefinitions\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c9e1da1f5d0ea9cfa55b27b76e804567

SHA1
db846a148341aaaec7a678ac4d7d2760a30c1ab7

SHA256
e917bd1ecd6a017d1e482e8bfa08a43397e26225f1c3f8efdeef914d83042751

SHA512
ad68fb10140131893b6c3defb91f2c9940ba6003c5d730d84673c6b007f44ac3976208e76fe73e8bf8a597618ad5641794656dd8b3e7dbbea3df5b0b58119ddc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e2135e7bf503e2017bee96b02b68b6d2

SHA1
1f211b42d068b1d50611a12a79eb4ceb81c07754

SHA256
dc94d536dd355009b6fd85955a6b1ac76e44bedbd97d1e8381fbe393973bb563

SHA512
e46de63b005a1963e9224000524cc883219920d2bb02a9b6542716c13d8990f8051b1a087702d56ff927a122db597b645ab94be40ab48c3f6482fca9797c67b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
40366b56f96229b28a16ec2e00770ed2

SHA1
03f0ab840530799ab50f745180b3df9e9450eda9

SHA256
48b44358fd1c9700a936f05fa04b9babbe36751c5bd5d3cdf1dace88d76797e2

SHA512
18f57a14ad8cc757346e5b00fe3109292d1f729ae477c1d9a3781acd66dcfe3d52c41cf65ebac1d0de14a92264796d3669caa24a84469d6f0abd7f2898c0f9e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fdd7c8cb6d2b2b2e374a55d9b5270691

SHA1
d60733563310d292e095299da3639818c076e072

SHA256
24ca12d50a0c940e81a886777ce0795c66325a85c58b7d4c8f15c1010019c368

SHA512
62e6cab4bd6cc187715eac9fb5fd4f6a9808c05a46bafc994cca3537967bf241c550a75554eac9c03624cc5bb17a5afcc2bcc8b18ce675f8631bd8740c55b1c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
75d9350e84f45ecd1e11281f454e454e

SHA1
0b4392eabde122db4913de8ed22941c5cf065b93

SHA256
f510c6087f31e70358376f7ffc0471bc5d76f2cc56a9e9bf52b2e911b46a51bb

SHA512
5b3a9224a7bf892dff4d96b9cc6906a8302fab6f4b1671c0290f22f91fc18e7dc498744292e227e64cef399cee93ae7a373e7895512f973fdb4a6c6697938467

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cf9acda8e714821f6951be93f68b8e46

SHA1
28e2e0b7ea5bb008464ac5f1ca965138d4ba69b9

SHA256
c97acd4246a2df65a629f6e2467f9b90dacbbb49c379a7c4a4553c30530c0e44

SHA512
065edf77c183efe915934774785e812294889c823046f763d1abd145f0125788e031866d783103c6a6911507554880f0d107481f874a0c76abd7deffa38da8ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5865847d602b35332ada73c338585bd4

SHA1
10da121ddcf6583458346ffec19590b662fc69c0

SHA256
a127373c3b49e724160a4205fc2b8a807bb9e95d8adac48c826d5df582453b07

SHA512
d3b75de31b1a4b3c4d368146ff174a2cdcd68e195fda9b1c111a49129601a276392a946d663f2a118ed0a510876c9b0e9b9bb347c8ffc2581af09eccbea67863

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
847ee7895c07047399908a53717d5178

SHA1
9e44ce6dcda27052b01cd0b170513beae38756b1

SHA256
fc570f01032cd3eb3d7c4010df4d1628f05cf66d382c6e4d813df1cd49da052b

SHA512
ab8f24521ca41922aa0347edcb58b9ffd6bbe6de2f606d5d443846ecaf44377e967276ee9fbb70df06a64ea42b727b535f9f550c0b77b9333248bebd8879af64

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3230b80b44fed749c984f0f36cfc9b7a

SHA1
e1c4434ade7ab27420d15f7f20defa9d8d306f60

SHA256
52d9d6ecca60ba81efbb1343ea91309c9b607b6635fbba3c6c4d7870586b6c3c

SHA512
d03322da8bf3fe4b1e0d23640f14e5c43aee3dc515b519717d5770622e90a09f98921e1076f2f5b1287b9d98bb98e200696156bb9bc3015e69d000f702260248

Download Submit
C:\Users\Admin\AppData\Local\Temp\0WHmS6dpJ0.bat

Filesize
226B

MD5
815b5d7fdb28759b30b6154c850fc320

SHA1
32e62f061a369e825daa55ad86b5acfaa79bb625

SHA256
dc9b657638dfff825a4dfc264961737037a4225def136c7791673cdb74780bb3

SHA512
9b48530f82c753ad9acf71a967c887e0af1243d741727c37ea5ace7065d914214f436945da55c27c834b4e9cf5cddbdaf2bcad5776a6de08b911241977552f8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\8tyQ25hERL.bat

Filesize
226B

MD5
318001c35dd1118d0ecc1d060ec8e7a7

SHA1
be4a0b703d9a05320ecb981c305416a833e3f6bf

SHA256
14fa2bab47f0b889dcc95e9d88c68e38a7e2c854efe462bc18932491c57bd6fd

SHA512
6c2607e4f7ef1d08d78ed14fb60184d870824d06a946c34dabf17a9b70ad621ed6f519ebdba7b7a712b802c3bca5480fadfc48341fc6f78c90bc77eda077c1f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3FFF.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\FBcCl1WGSV.bat

Filesize
226B

MD5
afe4c8492fe6c921271ef47d88fb62c6

SHA1
1463570aadc96d26f8a42afe2178d5bb7725d64a

SHA256
80518e3dbb47a9c5e0290f767fd9e427c138325d4606a940df25fc118b2a5c8c

SHA512
c841b09920133424b0de4babb3f80cd7499ba5c0ffab76f6fbc01a26fe2bf13e8512090bbe5368930dc361fb2b4ea955d28361b8ac4af814f795e74b4ab0c2c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\K3fI8Bd254.bat

Filesize
226B

MD5
671672617b991728223cb9cc7ea3af2b

SHA1
9083fc124b0fe378f2877fb9ac469605b0c49f66

SHA256
88c28703236656cf200d278b4460ca8ce76911fb93f72cf42fc69e27eb9cf5ea

SHA512
4918054fd4b2ed4dfa44a845c629168f4875ecd088d7c87e289c6b9119d1a2da14152abb843279e94ef93ed1853d932b733eb883a372fecc82109bb561859557

Download Submit
C:\Users\Admin\AppData\Local\Temp\KqyXtY4PgZ.bat

Filesize
226B

MD5
318b2f962c2d6f73e3073ba8296ebd00

SHA1
848de4ff73cce4a31df106b2704b5ecfce60908f

SHA256
e744a33bff02fbf02802531a61ab647fe2660029648444913b044d1ad95a4eee

SHA512
621839127120409de0cedc41a58d0344a2b25692bb1525c65d959a0c2dde28ba1f13670d2cafe3e07332e6a0ff513c07ad5dd78d0babd6a935e165ee04299f91

Download Submit
C:\Users\Admin\AppData\Local\Temp\LW19r029AS.bat

Filesize
226B

MD5
e263760b5c7945aa4d799666b183c199

SHA1
328b6d41b7056080c87114011f439e368e004b28

SHA256
ee759afe05666150e30f9cf4d70aff29b3fe69c9ed872e33f1dc1024a7af4707

SHA512
b826290c493bfb00fa451385f23c897472466d062aee73cbf2e42c8e1663b384689b67ccfd7d3b05f8b36e75524902bfe1ec1a09148d3fa415cebc4b37cc758e

Download Submit
C:\Users\Admin\AppData\Local\Temp\QVLs15dYuc.bat

Filesize
226B

MD5
568ca23ea40b6d4e305bd5dfc239eec2

SHA1
f9c1a45795008fa4205962384b82cdc77f9788e0

SHA256
b08a96b3babdb37b56e5633747779f2c791a97c600bd6f0de30496767830baf1

SHA512
501f8ac80527cd52222e9b878705324a9aceeeb2364483381a13c40c7e3e9ea5076bab00fce1d7319d907239385b56d7c9aa0b516400fef8ccb28a80e272d60c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4021.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\UBDT865ETH.bat

Filesize
226B

MD5
a99669977c247795e16eed7134bbe2ce

SHA1
0f548931119bf9ca24c926404548b47403d345a4

SHA256
6f6c12ef3627c5d2d377306c7fa2590f44db9c2ba9e1ee58bb0cd8262b31deb4

SHA512
396fef0993ebe407506cb0fae7c2eab9bb988baaf4b4ad848e2f3b1b6697bc25c6f72f4ad3fc1871adba0d34597e4952424c9b3f3ee35bdfd5c7645f395f5cc5

Download Submit
C:\Users\Admin\AppData\Local\Temp\WRY5ahHPmz.bat

Filesize
226B

MD5
35c48c8d213dafce654bf3fdc5afba1a

SHA1
d268de714a61cec0ecb60b25b45bb5edd929421e

SHA256
409184e0f69902392492cddc3b633f14db54f1725129ddc28dc042d1c3c0eaef

SHA512
44d1311235f07d0f00dcb1a6b2da22cd4857b64cff6fdc5e13da04c8d505afe8a79d30b92f3acb96e55c2460ac12ec0344d8a4761324436640293ec618b6ddcb

Download Submit
C:\Users\Admin\AppData\Local\Temp\t3iRsZx2b7.bat

Filesize
226B

MD5
f8425622097456b9d2b781cae22eddad

SHA1
bfca870a63b4406960f17cadba97694770dc7d59

SHA256
de8ce89f81218b3a730c129734c41b790205ea06bdffef1a24717b773c8bb021

SHA512
35d405f04ea961e3e5ec7723ed17ae9c279fad24f3439b426843ff9ad9fb38e5a44d66159fe9cc6d3c5f8743751e38b5bcc651d6fe5466f2ea2631e871f96b29

Download Submit
C:\Users\Admin\AppData\Local\Temp\tebxeZNirC.bat

Filesize
226B

MD5
a2472ce43f2db17f003dc87873c8bbff

SHA1
7667504fb9890c87e44c2214855fbb043c950216

SHA256
b3e110b3b4c5fb93d96a0c2581069201c63cec893ff2e4d21c55ce1ad835e696

SHA512
eba6af8dce8c61a4041eae8192e26ad2225dc7b797c2b21e4785961e475ad6cbb2d63613e6124733600b9560c0fc06f0b3a0f8524f13f1938bb1ffd4317de387

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ZBHTZV6QPNEH5VY36RDG.temp

Filesize
7KB

MD5
d5e02316378d7fcff4f8ed836a8c90ce

SHA1
6a8e3294ac801a5df4ccb339d0b66a477a2a6b96

SHA256
5930f985d854e3bf3a80834fd5e8f536f9a6eaa08b66d8be3e57e5fc96f3eebf

SHA512
484734335fc22a01f59242a64387e7a4a8cfc6ce979980381f5c347ab29df3cf6de4fdc59f4ed69e9123ebfea7414763e720fc6cce4baa6908a2cbef169d772f

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
memory/876-426-0x00000000004C0000-0x00000000004D2000-memory.dmp

Filesize
72KB

Download
memory/1964-724-0x0000000001140000-0x0000000001250000-memory.dmp

Filesize
1.1MB

Download
memory/2056-187-0x0000000000EB0000-0x0000000000FC0000-memory.dmp

Filesize
1.1MB

Download
memory/2056-188-0x00000000003D0000-0x00000000003E2000-memory.dmp

Filesize
72KB

Download
memory/2468-64-0x0000000001EF0000-0x0000000001EF8000-memory.dmp

Filesize
32KB

Download
memory/2468-59-0x000000001B690000-0x000000001B972000-memory.dmp

Filesize
2.9MB

Download
memory/2504-248-0x00000000013D0000-0x00000000014E0000-memory.dmp

Filesize
1.1MB

Download
memory/2572-486-0x00000000002C0000-0x00000000002D2000-memory.dmp

Filesize
72KB

Download
memory/2648-17-0x0000000000490000-0x000000000049C000-memory.dmp

Filesize
48KB

Download
memory/2648-16-0x0000000000470000-0x000000000047C000-memory.dmp

Filesize
48KB

Download
memory/2648-15-0x0000000000480000-0x000000000048C000-memory.dmp

Filesize
48KB

Download
memory/2648-14-0x0000000000460000-0x0000000000472000-memory.dmp

Filesize
72KB

Download
memory/2648-13-0x00000000000F0000-0x0000000000200000-memory.dmp

Filesize
1.1MB

Download
memory/2840-128-0x0000000000080000-0x0000000000190000-memory.dmp

Filesize
1.1MB

Download
memory/2992-664-0x0000000000330000-0x0000000000440000-memory.dmp

Filesize
1.1MB

Download