dcrat | d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0

Analysis

max time kernel
32s
max time network
28s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
31-12-2024 17:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe
Size

1.7MB
MD5

6307524bb031c6046e35387966560610
SHA1

d5d11bb96b66a4d6b918e80f9a35de9d131e2460
SHA256

d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0
SHA512

1a4cad8c180677a824015923de749b6529793a4da3447b18e5cabba9a55a9e15b46ee7468095d70321b37dfa3d8593876688a7aa84269497d091eaf668a94a4e
SSDEEP

24576:N3QwuLyEbVoCtPreIjNLoN/VNGeSQDx1m17zezKOkCzeJGFUJ:NgwuuEpdDLNwVMeXDL0fdSzAG

Score

10^/10

dcrat execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 57 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2708	2568	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2596	2568	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2552	2568	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1500	2568	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3040	2568	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2028	2568	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	332	2568	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	920	2568	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	568	2568	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2092	2568	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2096	2568	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2384	2568	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1976	2568	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2528	2568	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2104	2568	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2792	2568	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2876	2568	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2868	2568	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1032	2568	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2632	2568	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	556	2568	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3024	2568	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2372	2568	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1900	2568	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1796	2568	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2960	2568	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2320	2568	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1036	2568	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2188	2568	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2140	2568	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1600	2568	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1848	2568	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1752	2568	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2204	2568	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2216	2568	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	660	2568	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2976	2568	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1956	2568	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	288	2568	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1460	2568	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	980	2568	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2516	2568	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2688	2568	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2576	2568	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2616	2568	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2408	2568	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	612	2568	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2772	2568	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	588	2568	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	892	2568	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2368	2568	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1728	2568	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2164	2568	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	844	2568	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2076	2568	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2140	2568	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3040	2568	schtasks.exe	30

DCRat payload 5 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/2636-1-0x0000000000BF0000-0x0000000000DA6000-memory.dmp	dcrat
behavioral1/files/0x00060000000174ac-27.dat	dcrat
behavioral1/files/0x001700000001866d-88.dat	dcrat
behavioral1/memory/448-205-0x0000000000FF0000-0x00000000011A6000-memory.dmp	dcrat
behavioral1/memory/1428-263-0x0000000001040000-0x00000000011F6000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 24 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2964	powershell.exe
2352	powershell.exe
2468	powershell.exe
2032	powershell.exe
2996	powershell.exe
1580	powershell.exe
532	powershell.exe
2428	powershell.exe
2260	powershell.exe
1080	powershell.exe
1232	powershell.exe
2316	powershell.exe
1672	powershell.exe
2456	powershell.exe
1548	powershell.exe
1588	powershell.exe
2672	powershell.exe
2396	powershell.exe
1464	powershell.exe
872	powershell.exe
1944	powershell.exe
2780	powershell.exe
1844	powershell.exe
2188	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe

Executes dropped EXE 3 IoCs

pid	Process
448	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe
1428	wininit.exe
1544	wininit.exe

Drops file in Program Files directory 21 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Internet Explorer\en-US\1610b97d3ab4a7	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe
File created	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\09558147590e73	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\en-US\OSPPSVC.exe	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe
File opened for modification	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\RCX6BCE.tmp	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe
File opened for modification	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe
File opened for modification	C:\Program Files\MSBuild\RCX7045.tmp	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe
File created	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe
File created	C:\Program Files\MSBuild\dwm.exe	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\en-US\RCX69C9.tmp	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe
File opened for modification	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\RCX6BCF.tmp	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe
File opened for modification	C:\Program Files\MSBuild\RCX7046.tmp	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe
File opened for modification	C:\Program Files\MSBuild\dwm.exe	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe
File created	C:\Program Files\Windows Defender\en-US\6cb0b6c459d5d3	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe
File created	C:\Program Files (x86)\Internet Explorer\en-US\OSPPSVC.exe	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\en-US\RCX69CA.tmp	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe
File created	C:\Program Files\Windows Defender\en-US\dwm.exe	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe
File opened for modification	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\Idle.exe	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe
File opened for modification	C:\Program Files\Windows Defender\en-US\dwm.exe	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe
File created	C:\Program Files\MSBuild\6cb0b6c459d5d3	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\Idle.exe	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\6ccacd8608530f	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\AppCompat\Programs\d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe
File created	C:\Windows\AppCompat\Programs\d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe
File created	C:\Windows\AppCompat\Programs\09558147590e73	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 57 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2868	schtasks.exe
1752	schtasks.exe
844	schtasks.exe
2092	schtasks.exe
1796	schtasks.exe
2076	schtasks.exe
2140	schtasks.exe
1976	schtasks.exe
2384	schtasks.exe
660	schtasks.exe
1460	schtasks.exe
2708	schtasks.exe
556	schtasks.exe
1900	schtasks.exe
612	schtasks.exe
3040	schtasks.exe
1036	schtasks.exe
2216	schtasks.exe
920	schtasks.exe
2140	schtasks.exe
1032	schtasks.exe
3040	schtasks.exe
568	schtasks.exe
3024	schtasks.exe
288	schtasks.exe
980	schtasks.exe
2772	schtasks.exe
1500	schtasks.exe
2372	schtasks.exe
1848	schtasks.exe
2028	schtasks.exe
2616	schtasks.exe
588	schtasks.exe
2368	schtasks.exe
2792	schtasks.exe
892	schtasks.exe
2164	schtasks.exe
2976	schtasks.exe
2632	schtasks.exe
2576	schtasks.exe
2104	schtasks.exe
2876	schtasks.exe
2960	schtasks.exe
2096	schtasks.exe
332	schtasks.exe
2528	schtasks.exe
2516	schtasks.exe
2408	schtasks.exe
2596	schtasks.exe
1600	schtasks.exe
2204	schtasks.exe
1956	schtasks.exe
1728	schtasks.exe
2188	schtasks.exe
2320	schtasks.exe
2688	schtasks.exe
2552	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2636	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe
2636	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe
2636	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe
2636	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe
2636	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe
2636	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe
2636	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe
2636	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe
2636	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe
2636	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe
2636	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe
2636	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe
2636	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe
2636	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe
2636	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe
2636	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe
2636	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe
2636	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe
2636	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe
2636	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe
2636	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe
2636	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe
2636	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe
2636	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe
2636	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe
2636	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe
2636	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe
2636	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe
2636	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe
2636	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe
2636	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe
1672	powershell.exe
2456	powershell.exe
2032	powershell.exe
1580	powershell.exe
1588	powershell.exe
2468	powershell.exe
1944	powershell.exe
1548	powershell.exe
2352	powershell.exe
2672	powershell.exe
872	powershell.exe
448	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe
448	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe
448	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe
448	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe
448	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe
448	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe
448	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe
448	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe
448	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe
448	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe
448	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe
448	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe
448	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe
448	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe
448	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe
448	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe
448	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe
448	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe
448	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe
448	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe
448	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe
448	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeDebugPrivilege	2636	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe
Token: SeDebugPrivilege	1672	powershell.exe
Token: SeDebugPrivilege	2456	powershell.exe
Token: SeDebugPrivilege	2032	powershell.exe
Token: SeDebugPrivilege	1580	powershell.exe
Token: SeDebugPrivilege	1588	powershell.exe
Token: SeDebugPrivilege	2468	powershell.exe
Token: SeDebugPrivilege	1944	powershell.exe
Token: SeDebugPrivilege	1548	powershell.exe
Token: SeDebugPrivilege	2352	powershell.exe
Token: SeDebugPrivilege	2672	powershell.exe
Token: SeDebugPrivilege	872	powershell.exe
Token: SeDebugPrivilege	448	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe
Token: SeDebugPrivilege	2316	powershell.exe
Token: SeDebugPrivilege	532	powershell.exe
Token: SeDebugPrivilege	1844	powershell.exe
Token: SeDebugPrivilege	2260	powershell.exe
Token: SeDebugPrivilege	2188	powershell.exe
Token: SeDebugPrivilege	2428	powershell.exe
Token: SeDebugPrivilege	2780	powershell.exe
Token: SeDebugPrivilege	1080	powershell.exe
Token: SeDebugPrivilege	1232	powershell.exe
Token: SeDebugPrivilege	1464	powershell.exe
Token: SeDebugPrivilege	2396	powershell.exe
Token: SeDebugPrivilege	1428	wininit.exe
Token: SeDebugPrivilege	2964	powershell.exe
Token: SeDebugPrivilege	1544	wininit.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2636 wrote to memory of 1672	2636	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe	61
PID 2636 wrote to memory of 1672	2636	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe	61
PID 2636 wrote to memory of 1672	2636	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe	61
PID 2636 wrote to memory of 872	2636	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe	62
PID 2636 wrote to memory of 872	2636	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe	62
PID 2636 wrote to memory of 872	2636	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe	62
PID 2636 wrote to memory of 2456	2636	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe	63
PID 2636 wrote to memory of 2456	2636	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe	63
PID 2636 wrote to memory of 2456	2636	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe	63
PID 2636 wrote to memory of 2352	2636	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe	64
PID 2636 wrote to memory of 2352	2636	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe	64
PID 2636 wrote to memory of 2352	2636	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe	64
PID 2636 wrote to memory of 2468	2636	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe	65
PID 2636 wrote to memory of 2468	2636	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe	65
PID 2636 wrote to memory of 2468	2636	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe	65
PID 2636 wrote to memory of 2032	2636	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe	66
PID 2636 wrote to memory of 2032	2636	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe	66
PID 2636 wrote to memory of 2032	2636	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe	66
PID 2636 wrote to memory of 2996	2636	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe	67
PID 2636 wrote to memory of 2996	2636	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe	67
PID 2636 wrote to memory of 2996	2636	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe	67
PID 2636 wrote to memory of 1548	2636	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe	68
PID 2636 wrote to memory of 1548	2636	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe	68
PID 2636 wrote to memory of 1548	2636	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe	68
PID 2636 wrote to memory of 1588	2636	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe	69
PID 2636 wrote to memory of 1588	2636	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe	69
PID 2636 wrote to memory of 1588	2636	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe	69
PID 2636 wrote to memory of 1580	2636	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe	70
PID 2636 wrote to memory of 1580	2636	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe	70
PID 2636 wrote to memory of 1580	2636	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe	70
PID 2636 wrote to memory of 1944	2636	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe	71
PID 2636 wrote to memory of 1944	2636	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe	71
PID 2636 wrote to memory of 1944	2636	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe	71
PID 2636 wrote to memory of 2672	2636	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe	72
PID 2636 wrote to memory of 2672	2636	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe	72
PID 2636 wrote to memory of 2672	2636	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe	72
PID 2636 wrote to memory of 2708	2636	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe	85
PID 2636 wrote to memory of 2708	2636	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe	85
PID 2636 wrote to memory of 2708	2636	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe	85
PID 2708 wrote to memory of 2912	2708	cmd.exe	87
PID 2708 wrote to memory of 2912	2708	cmd.exe	87
PID 2708 wrote to memory of 2912	2708	cmd.exe	87
PID 2708 wrote to memory of 448	2708	cmd.exe	88
PID 2708 wrote to memory of 448	2708	cmd.exe	88
PID 2708 wrote to memory of 448	2708	cmd.exe	88
PID 448 wrote to memory of 532	448	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe	116
PID 448 wrote to memory of 532	448	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe	116
PID 448 wrote to memory of 532	448	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe	116
PID 448 wrote to memory of 2780	448	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe	117
PID 448 wrote to memory of 2780	448	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe	117
PID 448 wrote to memory of 2780	448	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe	117
PID 448 wrote to memory of 2396	448	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe	118
PID 448 wrote to memory of 2396	448	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe	118
PID 448 wrote to memory of 2396	448	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe	118
PID 448 wrote to memory of 2260	448	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe	120
PID 448 wrote to memory of 2260	448	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe	120
PID 448 wrote to memory of 2260	448	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe	120
PID 448 wrote to memory of 1464	448	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe	122
PID 448 wrote to memory of 1464	448	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe	122
PID 448 wrote to memory of 1464	448	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe	122
PID 448 wrote to memory of 2316	448	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe	123
PID 448 wrote to memory of 2316	448	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe	123
PID 448 wrote to memory of 2316	448	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe	123
PID 448 wrote to memory of 1080	448	d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe	124

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe
"C:\Users\Admin\AppData\Local\Temp\d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe"
1⤵
- Drops file in Drivers directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2636
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1672
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:872
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2456
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2352
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2468
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2032
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2996
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1548
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1588
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1580
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1944
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2672
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Uy7BwtvcyF.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2708
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:2912
- - C:\Users\Admin\AppData\Local\Temp\d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe
    "C:\Users\Admin\AppData\Local\Temp\d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:448
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:532
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:2780
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:2396
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:2260
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:1464
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:2316
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:1080
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:2428
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:2964
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:1844
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:2188
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:1232
  - - C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\wininit.exe
      "C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\wininit.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:1428
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5ebbcbf5-b9e5-406f-b3aa-f4c42f33c5da.vbs"
        5⤵
        
        PID:2688
      - C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\wininit.exe
        
        "C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\wininit.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1544
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0a0da557-2b4f-4299-a8dd-b5e2d6e5f74e.vbs"
        5⤵
        
        PID:2860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0Nd" /sc MINUTE /mo 12 /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N" /sc ONLOGON /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0Nd" /sc MINUTE /mo 6 /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\Pictures\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Users\Admin\Pictures\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\Pictures\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Users\Default\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Default\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Users\Default\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Internet Explorer\en-US\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\en-US\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Internet Explorer\en-US\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0Nd" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0Nd" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Program Files\MSBuild\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\MSBuild\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Program Files\MSBuild\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 13 /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 12 /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0Nd" /sc MINUTE /mo 5 /tr "'C:\Windows\AppCompat\Programs\d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N" /sc ONLOGON /tr "'C:\Windows\AppCompat\Programs\d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0Nd" /sc MINUTE /mo 13 /tr "'C:\Windows\AppCompat\Programs\d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0N.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Saved Games\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Users\Default\Saved Games\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Saved Games\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Defender\en-US\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\en-US\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Defender\en-US\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\csrss.exe

Filesize
1.7MB

MD5
6307524bb031c6046e35387966560610

SHA1
d5d11bb96b66a4d6b918e80f9a35de9d131e2460

SHA256
d3e9370dd204a209e52b46717cb80c7f54bd9ae353b2fea658b0261f81d30ad0

SHA512
1a4cad8c180677a824015923de749b6529793a4da3447b18e5cabba9a55a9e15b46ee7468095d70321b37dfa3d8593876688a7aa84269497d091eaf668a94a4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\0a0da557-2b4f-4299-a8dd-b5e2d6e5f74e.vbs

Filesize
535B

MD5
4045cdf0c3225a186ed4769565377942

SHA1
63b2ea50221958920549e32a614731da60403bed

SHA256
86b28dbc165cb1a054ff7be5180b2eadedadc2b28c36f596f0019184407a232e

SHA512
a8a04c27f1390e6eef832c5c95cda0288b32fb0eac4b56643a416995551aa0a812b390e422cf4caf2cc1cd77e9bcd698a2cffc9184f65b55de1b91dcd3df14ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\5ebbcbf5-b9e5-406f-b3aa-f4c42f33c5da.vbs

Filesize
759B

MD5
68843cdde3f4ce51852612dd8eec7238

SHA1
b2225d0d8368c554c93e85b059e1f9d1abb11b42

SHA256
3c77a1b28f34bb6dc171245edc5d333e70f1a98cf47eadf6697ef75d9396bc71

SHA512
a0568ba7a0b1229ec678bb04b5a91ec39f009ee2c15b3c8f708aa2cd8a5889a1b73cb104ce766930db509ca72a2d27f1dd153d01f876d9c54130f80622d992e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Uy7BwtvcyF.bat

Filesize
268B

MD5
734a582fb1dc415c3ffe8d8f411667a7

SHA1
b5b95e5cd0b1ac54bb4e3fb92516cf4b747d7d44

SHA256
ad921b3cc79edb5124ab51d8c4594fde5cc5b568ac7bd0f9b9d4546751eac5b7

SHA512
ce1f6f73a490de85fbd6aba509fd7fdf56b4f026bf12f88b383e14613b68880d756a9dff6a52fd665207eddb6b710378311866f75b4972bb4158d9842dd527a2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\7WQJXC6RO8WIIWV102T0.temp

Filesize
7KB

MD5
33c795d6df5413a8b682670cca7a55ca

SHA1
d142cc2c82d42bb3bc6bde2d4c20b0f4fe9a9ebc

SHA256
6415d70902225935d58c311246285330509be443c179bd1bdeb9ad93edb0a6d3

SHA512
03e889609b3d8fe0a76c16302edaa1219f082ca012912da371e655f77551d8072bdadf8a26fbf6a6b7e9dc0a45573593e51c4d85aa7cd6b39cdb4d78e4ceb9d8

Download Submit
C:\Users\Admin\Pictures\OSPPSVC.exe

Filesize
1.7MB

MD5
c4aa4e36cdb2637c9797fa1c1898ecb9

SHA1
f23e3babe63b4e9a7f43ae93b6773f4bf8aaa3a0

SHA256
0adb488de29c75dc5fb575a2e59c758deeb8b16a88d31cf7e04d558944e6237c

SHA512
75adc84c4cde410a83f15687196fd756d962e23fa1199e190a21ee045f47450d8916db7aee0de9da118e28b04c2cbf20a1b941bc936a18dcb6bd8e9969c678e1

Download Submit
memory/448-205-0x0000000000FF0000-0x00000000011A6000-memory.dmp

Filesize
1.7MB

Download
memory/448-206-0x0000000000720000-0x0000000000732000-memory.dmp

Filesize
72KB

Download
memory/532-255-0x000000001B660000-0x000000001B942000-memory.dmp

Filesize
2.9MB

Download
memory/1428-312-0x0000000000510000-0x0000000000522000-memory.dmp

Filesize
72KB

Download
memory/1428-263-0x0000000001040000-0x00000000011F6000-memory.dmp

Filesize
1.7MB

Download
memory/1544-323-0x0000000000630000-0x0000000000642000-memory.dmp

Filesize
72KB

Download
memory/2316-256-0x0000000001D90000-0x0000000001D98000-memory.dmp

Filesize
32KB

Download
memory/2456-173-0x000000001B830000-0x000000001BB12000-memory.dmp

Filesize
2.9MB

Download
memory/2456-175-0x0000000001CF0000-0x0000000001CF8000-memory.dmp

Filesize
32KB

Download
memory/2636-8-0x00000000022C0000-0x00000000022D0000-memory.dmp

Filesize
64KB

Download
memory/2636-10-0x00000000022D0000-0x00000000022D8000-memory.dmp

Filesize
32KB

Download
memory/2636-17-0x000000001ABE0000-0x000000001ABEC000-memory.dmp

Filesize
48KB

Download
memory/2636-14-0x000000001A700000-0x000000001A70A000-memory.dmp

Filesize
40KB

Download
memory/2636-169-0x000007FEF55D0000-0x000007FEF5FBC000-memory.dmp

Filesize
9.9MB

Download
memory/2636-15-0x000000001A710000-0x000000001A718000-memory.dmp

Filesize
32KB

Download
memory/2636-16-0x000000001ABD0000-0x000000001ABDC000-memory.dmp

Filesize
48KB

Download
memory/2636-13-0x00000000022F0000-0x00000000022FC000-memory.dmp

Filesize
48KB

Download
memory/2636-12-0x00000000022E0000-0x00000000022EC000-memory.dmp

Filesize
48KB

Download
memory/2636-20-0x000007FEF55D0000-0x000007FEF5FBC000-memory.dmp

Filesize
9.9MB

Download
memory/2636-9-0x00000000022B0000-0x00000000022BC000-memory.dmp

Filesize
48KB

Download
memory/2636-0-0x000007FEF55D3000-0x000007FEF55D4000-memory.dmp

Filesize
4KB

Download
memory/2636-7-0x0000000000B40000-0x0000000000B52000-memory.dmp

Filesize
72KB

Download
memory/2636-6-0x0000000000BD0000-0x0000000000BE6000-memory.dmp

Filesize
88KB

Download
memory/2636-4-0x0000000000B20000-0x0000000000B28000-memory.dmp

Filesize
32KB

Download
memory/2636-5-0x0000000000B30000-0x0000000000B40000-memory.dmp

Filesize
64KB

Download
memory/2636-3-0x00000000003E0000-0x00000000003FC000-memory.dmp

Filesize
112KB

Download
memory/2636-2-0x000007FEF55D0000-0x000007FEF5FBC000-memory.dmp

Filesize
9.9MB

Download
memory/2636-1-0x0000000000BF0000-0x0000000000DA6000-memory.dmp

Filesize
1.7MB

Download