dcrat | 7e2e93f62eefe7c5b5240ae2eb17b24390ba1ee5ccb8aad541d7c27a1469b69f

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 20:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_7e2e93f62eefe7c5b5240ae2eb17b24390ba1ee5ccb8aad541d7c27a1469b69f.exe
Size

1.3MB
MD5

1e3a7289f2d5e5bc19ef14741c17cee8
SHA1

c0b546f8cf03f2f519384e0925fa1ddd26a56ac6
SHA256

7e2e93f62eefe7c5b5240ae2eb17b24390ba1ee5ccb8aad541d7c27a1469b69f
SHA512

abc9c6e5d651884c23db6b09fed1600d4d0da135e10e15d95f0a4e761fb4e1b72125a966e5dfa17317b43d63b88a1090ef1a6576d2765aff5b71fffda9db9ff8
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 45 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1172	2956	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4540	2956	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4312	2956	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2672	2956	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4924	2956	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4000	2956	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	696	2956	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2160	2956	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3076	2956	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4160	2956	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2208	2956	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3280	2956	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1136	2956	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3708	2956	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2728	2956	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4216	2956	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2136	2956	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3628	2956	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2896	2956	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4064	2956	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2972	2956	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1252	2956	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	564	2956	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2616	2956	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2408	2956	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2868	2956	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1704	2956	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1352	2956	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4976	2956	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1472	2956	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3592	2956	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4028	2956	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4024	2956	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1616	2956	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1604	2956	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	888	2956	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2600	2956	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2436	2956	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3164	2956	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2104	2956	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3568	2956	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2776	2956	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1736	2956	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1072	2956	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4696	2956	schtasks.exe	86

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x0007000000023c79-10.dat	dcrat
behavioral2/memory/3264-13-0x0000000000320000-0x0000000000430000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 16 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3348	powershell.exe
2984	powershell.exe
4416	powershell.exe
3272	powershell.exe
3512	powershell.exe
2332	powershell.exe
2356	powershell.exe
3288	powershell.exe
4060	powershell.exe
3532	powershell.exe
1556	powershell.exe
5044	powershell.exe
1036	powershell.exe
1124	powershell.exe
4916	powershell.exe
1488	powershell.exe

Checks computer location settings 2 TTPs 15 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	JaffaCakes118_7e2e93f62eefe7c5b5240ae2eb17b24390ba1ee5ccb8aad541d7c27a1469b69f.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	csrss.exe

Executes dropped EXE 14 IoCs

pid	Process
3264	DllCommonsvc.exe
3716	csrss.exe
1336	csrss.exe
1084	csrss.exe
2224	csrss.exe
488	csrss.exe
4976	csrss.exe
4072	csrss.exe
1136	csrss.exe
4564	csrss.exe
3712	csrss.exe
2432	csrss.exe
228	csrss.exe
2936	csrss.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 14 IoCs

Web Service

T1102

flow	ioc
18	raw.githubusercontent.com
54	raw.githubusercontent.com
41	raw.githubusercontent.com
47	raw.githubusercontent.com
58	raw.githubusercontent.com
40	raw.githubusercontent.com
56	raw.githubusercontent.com
39	raw.githubusercontent.com
46	raw.githubusercontent.com
53	raw.githubusercontent.com
55	raw.githubusercontent.com
57	raw.githubusercontent.com
17	raw.githubusercontent.com
25	raw.githubusercontent.com

Drops file in Program Files directory 11 IoCs

description	ioc	Process
File created	C:\Program Files\ModifiableWindowsApps\OfficeClickToRun.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Defender\dllhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Common Files\Java\Java Update\explorer.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Common Files\Java\Java Update\7a0fd90576e088	DllCommonsvc.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\sihost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft.NET\RedistList\StartMenuExperienceHost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft.NET\RedistList\55b276f4edf653	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Defender\5940a34987c991	DllCommonsvc.exe
File created	C:\Program Files\Windows Mail\csrss.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Mail\886983d96e3d3e	DllCommonsvc.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\66fc9ff0ee96c2	DllCommonsvc.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\L2Schemas\5b884080fd4f94	DllCommonsvc.exe
File created	C:\Windows\L2Schemas\fontdrvhost.exe	DllCommonsvc.exe
File opened for modification	C:\Windows\L2Schemas\fontdrvhost.exe	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_7e2e93f62eefe7c5b5240ae2eb17b24390ba1ee5ccb8aad541d7c27a1469b69f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	JaffaCakes118_7e2e93f62eefe7c5b5240ae2eb17b24390ba1ee5ccb8aad541d7c27a1469b69f.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	csrss.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 45 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2160	schtasks.exe
2208	schtasks.exe
2104	schtasks.exe
696	schtasks.exe
4924	schtasks.exe
4000	schtasks.exe
2972	schtasks.exe
2616	schtasks.exe
2600	schtasks.exe
3164	schtasks.exe
2672	schtasks.exe
564	schtasks.exe
4976	schtasks.exe
3592	schtasks.exe
2436	schtasks.exe
2776	schtasks.exe
1072	schtasks.exe
3708	schtasks.exe
3076	schtasks.exe
4160	schtasks.exe
3628	schtasks.exe
3568	schtasks.exe
4312	schtasks.exe
1252	schtasks.exe
2868	schtasks.exe
1704	schtasks.exe
1352	schtasks.exe
1472	schtasks.exe
4028	schtasks.exe
888	schtasks.exe
1172	schtasks.exe
4696	schtasks.exe
2728	schtasks.exe
4216	schtasks.exe
2896	schtasks.exe
4024	schtasks.exe
1736	schtasks.exe
1136	schtasks.exe
4064	schtasks.exe
1604	schtasks.exe
4540	schtasks.exe
2136	schtasks.exe
2408	schtasks.exe
1616	schtasks.exe
3280	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3264	DllCommonsvc.exe
3264	DllCommonsvc.exe
3264	DllCommonsvc.exe
3264	DllCommonsvc.exe
3264	DllCommonsvc.exe
3264	DllCommonsvc.exe
3264	DllCommonsvc.exe
2332	powershell.exe
2332	powershell.exe
3532	powershell.exe
3532	powershell.exe
3512	powershell.exe
3512	powershell.exe
3288	powershell.exe
3288	powershell.exe
5044	powershell.exe
5044	powershell.exe
1488	powershell.exe
1488	powershell.exe
1124	powershell.exe
1124	powershell.exe
4060	powershell.exe
4060	powershell.exe
3348	powershell.exe
3348	powershell.exe
1556	powershell.exe
1556	powershell.exe
4916	powershell.exe
4916	powershell.exe
2984	powershell.exe
2984	powershell.exe
1036	powershell.exe
1036	powershell.exe
3272	powershell.exe
3272	powershell.exe
2356	powershell.exe
2356	powershell.exe
3716	csrss.exe
3716	csrss.exe
4416	powershell.exe
4416	powershell.exe
4416	powershell.exe
3532	powershell.exe
2332	powershell.exe
1036	powershell.exe
1488	powershell.exe
2984	powershell.exe
5044	powershell.exe
3288	powershell.exe
3272	powershell.exe
4916	powershell.exe
3512	powershell.exe
3348	powershell.exe
4060	powershell.exe
1556	powershell.exe
1124	powershell.exe
2356	powershell.exe
1336	csrss.exe
1084	csrss.exe
2224	csrss.exe
488	csrss.exe
4976	csrss.exe
4072	csrss.exe
1136	csrss.exe

Suspicious use of AdjustPrivilegeToken 30 IoCs

description	pid	Process
Token: SeDebugPrivilege	3264	DllCommonsvc.exe
Token: SeDebugPrivilege	2332	powershell.exe
Token: SeDebugPrivilege	3532	powershell.exe
Token: SeDebugPrivilege	2984	powershell.exe
Token: SeDebugPrivilege	3512	powershell.exe
Token: SeDebugPrivilege	3716	csrss.exe
Token: SeDebugPrivilege	3288	powershell.exe
Token: SeDebugPrivilege	5044	powershell.exe
Token: SeDebugPrivilege	3272	powershell.exe
Token: SeDebugPrivilege	1488	powershell.exe
Token: SeDebugPrivilege	2356	powershell.exe
Token: SeDebugPrivilege	1124	powershell.exe
Token: SeDebugPrivilege	1556	powershell.exe
Token: SeDebugPrivilege	1036	powershell.exe
Token: SeDebugPrivilege	3348	powershell.exe
Token: SeDebugPrivilege	4060	powershell.exe
Token: SeDebugPrivilege	4916	powershell.exe
Token: SeDebugPrivilege	4416	powershell.exe
Token: SeDebugPrivilege	1336	csrss.exe
Token: SeDebugPrivilege	1084	csrss.exe
Token: SeDebugPrivilege	2224	csrss.exe
Token: SeDebugPrivilege	488	csrss.exe
Token: SeDebugPrivilege	4976	csrss.exe
Token: SeDebugPrivilege	4072	csrss.exe
Token: SeDebugPrivilege	1136	csrss.exe
Token: SeDebugPrivilege	4564	csrss.exe
Token: SeDebugPrivilege	3712	csrss.exe
Token: SeDebugPrivilege	2432	csrss.exe
Token: SeDebugPrivilege	228	csrss.exe
Token: SeDebugPrivilege	2936	csrss.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3620 wrote to memory of 2892	3620	JaffaCakes118_7e2e93f62eefe7c5b5240ae2eb17b24390ba1ee5ccb8aad541d7c27a1469b69f.exe	82
PID 3620 wrote to memory of 2892	3620	JaffaCakes118_7e2e93f62eefe7c5b5240ae2eb17b24390ba1ee5ccb8aad541d7c27a1469b69f.exe	82
PID 3620 wrote to memory of 2892	3620	JaffaCakes118_7e2e93f62eefe7c5b5240ae2eb17b24390ba1ee5ccb8aad541d7c27a1469b69f.exe	82
PID 2892 wrote to memory of 3696	2892	WScript.exe	83
PID 2892 wrote to memory of 3696	2892	WScript.exe	83
PID 2892 wrote to memory of 3696	2892	WScript.exe	83
PID 3696 wrote to memory of 3264	3696	cmd.exe	85
PID 3696 wrote to memory of 3264	3696	cmd.exe	85
PID 3264 wrote to memory of 1556	3264	DllCommonsvc.exe	132
PID 3264 wrote to memory of 1556	3264	DllCommonsvc.exe	132
PID 3264 wrote to memory of 3512	3264	DllCommonsvc.exe	133
PID 3264 wrote to memory of 3512	3264	DllCommonsvc.exe	133
PID 3264 wrote to memory of 2332	3264	DllCommonsvc.exe	134
PID 3264 wrote to memory of 2332	3264	DllCommonsvc.exe	134
PID 3264 wrote to memory of 3348	3264	DllCommonsvc.exe	135
PID 3264 wrote to memory of 3348	3264	DllCommonsvc.exe	135
PID 3264 wrote to memory of 2984	3264	DllCommonsvc.exe	136
PID 3264 wrote to memory of 2984	3264	DllCommonsvc.exe	136
PID 3264 wrote to memory of 1124	3264	DllCommonsvc.exe	137
PID 3264 wrote to memory of 1124	3264	DllCommonsvc.exe	137
PID 3264 wrote to memory of 2356	3264	DllCommonsvc.exe	138
PID 3264 wrote to memory of 2356	3264	DllCommonsvc.exe	138
PID 3264 wrote to memory of 4916	3264	DllCommonsvc.exe	139
PID 3264 wrote to memory of 4916	3264	DllCommonsvc.exe	139
PID 3264 wrote to memory of 3288	3264	DllCommonsvc.exe	140
PID 3264 wrote to memory of 3288	3264	DllCommonsvc.exe	140
PID 3264 wrote to memory of 4060	3264	DllCommonsvc.exe	141
PID 3264 wrote to memory of 4060	3264	DllCommonsvc.exe	141
PID 3264 wrote to memory of 3532	3264	DllCommonsvc.exe	142
PID 3264 wrote to memory of 3532	3264	DllCommonsvc.exe	142
PID 3264 wrote to memory of 5044	3264	DllCommonsvc.exe	143
PID 3264 wrote to memory of 5044	3264	DllCommonsvc.exe	143
PID 3264 wrote to memory of 4416	3264	DllCommonsvc.exe	144
PID 3264 wrote to memory of 4416	3264	DllCommonsvc.exe	144
PID 3264 wrote to memory of 1488	3264	DllCommonsvc.exe	145
PID 3264 wrote to memory of 1488	3264	DllCommonsvc.exe	145
PID 3264 wrote to memory of 1036	3264	DllCommonsvc.exe	146
PID 3264 wrote to memory of 1036	3264	DllCommonsvc.exe	146
PID 3264 wrote to memory of 3272	3264	DllCommonsvc.exe	147
PID 3264 wrote to memory of 3272	3264	DllCommonsvc.exe	147
PID 3264 wrote to memory of 3716	3264	DllCommonsvc.exe	164
PID 3264 wrote to memory of 3716	3264	DllCommonsvc.exe	164
PID 3716 wrote to memory of 4200	3716	csrss.exe	168
PID 3716 wrote to memory of 4200	3716	csrss.exe	168
PID 4200 wrote to memory of 4284	4200	cmd.exe	170
PID 4200 wrote to memory of 4284	4200	cmd.exe	170
PID 4200 wrote to memory of 1336	4200	cmd.exe	172
PID 4200 wrote to memory of 1336	4200	cmd.exe	172
PID 1336 wrote to memory of 3056	1336	csrss.exe	175
PID 1336 wrote to memory of 3056	1336	csrss.exe	175
PID 3056 wrote to memory of 3568	3056	cmd.exe	177
PID 3056 wrote to memory of 3568	3056	cmd.exe	177
PID 3056 wrote to memory of 1084	3056	cmd.exe	179
PID 3056 wrote to memory of 1084	3056	cmd.exe	179
PID 1084 wrote to memory of 752	1084	csrss.exe	181
PID 1084 wrote to memory of 752	1084	csrss.exe	181
PID 752 wrote to memory of 3556	752	cmd.exe	183
PID 752 wrote to memory of 3556	752	cmd.exe	183
PID 752 wrote to memory of 2224	752	cmd.exe	184
PID 752 wrote to memory of 2224	752	cmd.exe	184
PID 2224 wrote to memory of 3276	2224	csrss.exe	185
PID 2224 wrote to memory of 3276	2224	csrss.exe	185
PID 3276 wrote to memory of 1728	3276	cmd.exe	187
PID 3276 wrote to memory of 1728	3276	cmd.exe	187

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7e2e93f62eefe7c5b5240ae2eb17b24390ba1ee5ccb8aad541d7c27a1469b69f.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7e2e93f62eefe7c5b5240ae2eb17b24390ba1ee5ccb8aad541d7c27a1469b69f.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3620
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2892
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3696
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3264
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1556
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\L2Schemas\fontdrvhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3512
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\sihost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2332
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft.NET\RedistList\StartMenuExperienceHost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3348
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\OfficeClickToRun.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2984
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\System.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1124
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2356
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\RuntimeBroker.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4916
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\ssh\sppsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3288
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Downloads\cmd.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4060
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\SendTo\conhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3532
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Downloads\sihost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5044
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\System.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4416
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Defender\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1488
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Common Files\Java\Java Update\explorer.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1036
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Mail\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3272
    - - C:\providercommon\csrss.exe
        
        "C:\providercommon\csrss.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3716
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\FBcCl1WGSV.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4200
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:4284
        
        C:\providercommon\csrss.exe
        
        "C:\providercommon\csrss.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1336
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8OW3hmLaVA.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:3056
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:3568
        
        C:\providercommon\csrss.exe
        
        "C:\providercommon\csrss.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1084
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\V9nTU0UPEK.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:752
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:3556
        
        C:\providercommon\csrss.exe
        
        "C:\providercommon\csrss.exe"
        11⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2224
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\esvfELjyVS.bat"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:3276
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:1728
        
        C:\providercommon\csrss.exe
        
        "C:\providercommon\csrss.exe"
        13⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:488
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\QHkN6qNcbm.bat"
        14⤵
        
        PID:2776
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:4416
        
        C:\providercommon\csrss.exe
        
        "C:\providercommon\csrss.exe"
        15⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4976
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\FBcCl1WGSV.bat"
        16⤵
        
        PID:3332
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:3264
        
        C:\providercommon\csrss.exe
        
        "C:\providercommon\csrss.exe"
        17⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4072
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0PvuKmrV6l.bat"
        18⤵
        
        PID:1832
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:3284
        
        C:\providercommon\csrss.exe
        
        "C:\providercommon\csrss.exe"
        19⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1136
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\H7eFR6a9mI.bat"
        20⤵
        
        PID:568
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:208
        
        C:\providercommon\csrss.exe
        
        "C:\providercommon\csrss.exe"
        21⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4564
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\dnlY2uCtHd.bat"
        22⤵
        
        PID:4880
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:4736
        
        C:\providercommon\csrss.exe
        
        "C:\providercommon\csrss.exe"
        23⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3712
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\NADK710Kqv.bat"
        24⤵
        
        PID:2276
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:3256
        
        C:\providercommon\csrss.exe
        
        "C:\providercommon\csrss.exe"
        25⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2432
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\goxiuQmrpE.bat"
        26⤵
        
        PID:1028
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        27⤵
        
        PID:1080
        
        C:\providercommon\csrss.exe
        
        "C:\providercommon\csrss.exe"
        27⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:228
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\AKY6NrPTox.bat"
        28⤵
        
        PID:3112
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        29⤵
        
        PID:2436
        
        C:\providercommon\csrss.exe
        
        "C:\providercommon\csrss.exe"
        29⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Windows\L2Schemas\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\L2Schemas\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Windows\L2Schemas\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 9 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 14 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 6 /tr "'C:\providercommon\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\providercommon\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 10 /tr "'C:\providercommon\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\providercommon\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\providercommon\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\providercommon\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\providercommon\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\providercommon\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\providercommon\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\providercommon\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\providercommon\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\providercommon\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\ssh\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\All Users\ssh\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\ssh\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Downloads\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Users\Default\Downloads\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 5 /tr "'C:\Users\Default\Downloads\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\Users\Default\SendTo\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Users\Default\SendTo\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\Users\Default\SendTo\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 14 /tr "'C:\Users\Public\Downloads\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Users\Public\Downloads\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Downloads\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Defender\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Defender\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Common Files\Java\Java Update\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Java\Java Update\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Common Files\Java\Java Update\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Mail\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Mail\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\csrss.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
2979eabc783eaca50de7be23dd4eafcf

SHA1
d709ce5f3a06b7958a67e20870bfd95b83cad2ea

SHA256
006cca90e78fbb571532a83082ac6712721a34ea4b21f490058ffb3f521f4903

SHA512
92bc433990572d9427d0c93eef9bd1cc23fa00ed60dd0c9c983d87d3421e02ce3f156c6f88fe916ef6782dbf185cbce083bc0094f8c527f302be6a37d1c53aba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
35967cf5ed9a95ec4fe527dd96567a02

SHA1
6a7439c241a30ec540d5d204e02a4cbb2a464737

SHA256
4394552922777081d43fb523126cf176d5a676602a5435713320942034f6b3cf

SHA512
419b3c336a67ef964bc166d1267cea146ed5878f98304d6e39fb9a3c0394d75693810a9ddc101cdda5e3196ad7d603df01a3260705cf9ef7cf8d4b252df01f45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e243a38635ff9a06c87c2a61a2200656

SHA1
ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc

SHA256
af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f

SHA512
4418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\0PvuKmrV6l.bat

Filesize
192B

MD5
40b3dd441f97e706f69252fbebbcfa83

SHA1
d9c179e8ad4aa2d88aeaef2c2d909d3e44e81f44

SHA256
04fe586ab65ad854b8faab4a27471d14d0dff0bad4a55b65101a1da401fe0aab

SHA512
1e5f43f70c434619bcd688f5d3d7eae10ad325efe03033707f7f948e1af64161cbd339c36b9256cd5806cd0cd393595206562eeca0bbb62b875016aa7fa64d84

Download Submit
C:\Users\Admin\AppData\Local\Temp\8OW3hmLaVA.bat

Filesize
192B

MD5
88509710d87e0d03c841094c35d06e16

SHA1
e5c42249321005704fea89b3ea3cb21593af6145

SHA256
d4bf227be3c65340090f82cc3e537773e786448de7cd31fb2897743d0b484054

SHA512
0066d08b6623d31f16224edaec00380e735e4028b9e2331fdd6a6dba07313e5f818fefb48ce6816c7d68318018e3feb22c68bf81f113275ea55ad7553b4d754a

Download Submit
C:\Users\Admin\AppData\Local\Temp\AKY6NrPTox.bat

Filesize
192B

MD5
95ce075632035ee17924bfe8605cb200

SHA1
3279d5ba3d11a7db16970a9314a516ef9aea2ca4

SHA256
d93d05be1071bb1d0dcc22122f905ca5143b2dac0eb2d94c1af7615002c793cd

SHA512
ea823dab2f6414b5eb049031c76a902083495e4386c5d5b2ba2b74d81f6e6af0943fcbe5be8052291406c7780521c1b5de9e355c0924b1b112c6921c7eb6a74b

Download Submit
C:\Users\Admin\AppData\Local\Temp\FBcCl1WGSV.bat

Filesize
192B

MD5
ecaddb8410fdb5456e60340fca39a868

SHA1
90dda725142a1643a8a09071569ca8d0935de5b1

SHA256
c0f8041ebf82d2eb3837662d13e407cc77e51e646727dcc0f7964d7ec8b6246f

SHA512
377bb0d3c2345d8e1015667d7f943b8632947fd3c69824c7fd5e1f42aabef25de8ad0f105648cb3fa20fd8b379f524c788efb6ed22e91a5ff9f4bf53f8514e9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\H7eFR6a9mI.bat

Filesize
192B

MD5
c6bf49bcf732cb150a1f8e194c79707f

SHA1
f7c32486cbb3f83b3ebfd591193da5c2ad040849

SHA256
de4a86400c3ad8d36be9caa2e297dd9de76a8d5a5f150e77095002c599255285

SHA512
55841bf2d17507ddea2c9ee3818f5a4354bd88db4cbb38ae6d4b51f9ec4563930fdd1f3c51cf26c08ba0349a83198d8a0ee7d9d6d28762ebecc8984441c6ade7

Download Submit
C:\Users\Admin\AppData\Local\Temp\NADK710Kqv.bat

Filesize
192B

MD5
624d73e407f91c0208b481babe35e4b1

SHA1
bae4e44b5fd0c8d50d5dd101a8cd96af59d9b1b4

SHA256
2cef5ba3227db5b3a6db00071ca30291ee66fce52fad728eda5e278e10e19c06

SHA512
936b6b0a44dd7c3278bf05b91d0ea067ed1b1b31c1a503a65c60b2d5a1d27aab1a9c942db35c188ca069c059907ab0ca102f46069c5e4c6ed5fe56688648a39a

Download Submit
C:\Users\Admin\AppData\Local\Temp\QHkN6qNcbm.bat

Filesize
192B

MD5
4cf1b693faf10c6189d6aac74e5fb9f9

SHA1
ff76ee09630b3e60bc9ea1886c85aa31597528fe

SHA256
c336aa595116e82e0064ca424ba88cddd867a96c79f581901cd66f7ea1cba74a

SHA512
a27596622b5d61eb6264e068144fde512dfdb12919d3f89efbc04878ab9e4581ee132392a572bd46baf8259cdd2c3b5c130324ae58f0d30cf40a82668fe99608

Download Submit
C:\Users\Admin\AppData\Local\Temp\V9nTU0UPEK.bat

Filesize
192B

MD5
ac3daa5da4457dc6275b0d1848aa1e75

SHA1
3ee0e0eb389fb98030fa834bcf6c258de263251c

SHA256
aba3859ae3059753575cd24fb84b9c39b7e350b40cb7a2788547b558a06d509b

SHA512
408e6cb1cc82ef607c3a8dc8916ca77b3502c66d209763e8824c1b652ac2ef114bc0caf2f48948051d1b1114d0abaa98f3b1a630ccc099ea804577f731406bb2

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dau5nbr3.24o.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\dnlY2uCtHd.bat

Filesize
192B

MD5
22e8766fc21680ca5410021e9bc2a0b6

SHA1
abdfa665c8bd9127befa715401402dc464bd998b

SHA256
5f66751e549d2b0e873be4a3cf172885f8b5895c4f606513d48548137773c439

SHA512
ee3df74834e74eae5c4f9e50362d6e21409027ce310e76e011ccd7d7bbd720d7e971bf5c23c884002ab69244ef87fa155c414a13e2745c89fd532d2be7e5e094

Download Submit
C:\Users\Admin\AppData\Local\Temp\esvfELjyVS.bat

Filesize
192B

MD5
8c9ab6be8e00a0c318cc39498d152865

SHA1
44d98c3bf8cfa0f51490eefe127deb29b5b8fe1d

SHA256
717dc7de1766a924737b9284bf9f2a853163790387ffb65826c2a7a72e05d9ee

SHA512
72a5f96da6537172d705d5df511dbef8050f0a82019822aefc2de76420bfcd1a6000ed8e41e4993c32938ad7caaa359715fed96dae12787ae95a48a97b4c3b0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\goxiuQmrpE.bat

Filesize
192B

MD5
21dd0f6cf3be52fc6fcce0776fc826b3

SHA1
5b8cdb6aa276346e7714a641c8fc9bc8d026476a

SHA256
f1d3998536dd14a8c0c0cf45385bada7ad43e100089e9507083874c01dbc5f96

SHA512
db3013e5c05d5984a7cc77aeab1b52fa90042dd08495b0ebd52dc8f90a9d4664d11b1e49f3ea7050264837903a811619f66edcc0fabeaf3a7ed02e36f4ab0aef

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/1036-216-0x0000026A75650000-0x0000026A757BA000-memory.dmp

Filesize
1.4MB

Download
memory/1124-238-0x000001B879EF0000-0x000001B87A05A000-memory.dmp

Filesize
1.4MB

Download
memory/1136-296-0x000000001C5F0000-0x000000001C602000-memory.dmp

Filesize
72KB

Download
memory/1488-232-0x000001F67E100000-0x000001F67E26A000-memory.dmp

Filesize
1.4MB

Download
memory/1556-222-0x000001DCAA390000-0x000001DCAA4FA000-memory.dmp

Filesize
1.4MB

Download
memory/2332-212-0x0000018F7DF30000-0x0000018F7E09A000-memory.dmp

Filesize
1.4MB

Download
memory/2356-249-0x000001FEF0F40000-0x000001FEF10AA000-memory.dmp

Filesize
1.4MB

Download
memory/2984-230-0x000002BF2F280000-0x000002BF2F3EA000-memory.dmp

Filesize
1.4MB

Download
memory/3264-13-0x0000000000320000-0x0000000000430000-memory.dmp

Filesize
1.1MB

Download
memory/3264-17-0x0000000002670000-0x000000000267C000-memory.dmp

Filesize
48KB

Download
memory/3264-16-0x0000000002660000-0x000000000266C000-memory.dmp

Filesize
48KB

Download
memory/3264-15-0x0000000002650000-0x000000000265C000-memory.dmp

Filesize
48KB

Download
memory/3264-14-0x0000000002640000-0x0000000002652000-memory.dmp

Filesize
72KB

Download
memory/3264-12-0x00007FFB07423000-0x00007FFB07425000-memory.dmp

Filesize
8KB

Download
memory/3272-235-0x000001C924770000-0x000001C9248DA000-memory.dmp

Filesize
1.4MB

Download
memory/3288-250-0x0000021EA0DC0000-0x0000021EA0F2A000-memory.dmp

Filesize
1.4MB

Download
memory/3348-223-0x00000226CF1F0000-0x00000226CF35A000-memory.dmp

Filesize
1.4MB

Download
memory/3512-243-0x000002287C1C0000-0x000002287C32A000-memory.dmp

Filesize
1.4MB

Download
memory/3532-73-0x000001D053390000-0x000001D0533B2000-memory.dmp

Filesize
136KB

Download
memory/3532-213-0x000001D06B890000-0x000001D06B9FA000-memory.dmp

Filesize
1.4MB

Download
memory/3712-309-0x000000001AFF0000-0x000000001B002000-memory.dmp

Filesize
72KB

Download
memory/4060-221-0x000001E768EE0000-0x000001E76904A000-memory.dmp

Filesize
1.4MB

Download
memory/4416-206-0x000001CB2DE50000-0x000001CB2DFBA000-memory.dmp

Filesize
1.4MB

Download
memory/4916-246-0x00000213A6A70000-0x00000213A6BDA000-memory.dmp

Filesize
1.4MB

Download
memory/4976-283-0x00000000011F0000-0x0000000001202000-memory.dmp

Filesize
72KB

Download
memory/5044-231-0x00000249FB670000-0x00000249FB7DA000-memory.dmp

Filesize
1.4MB

Download