dcrat | 9bcf44dc096701632aa4e9208f0842b23e7a9e54e0d6c465e7c378837f8f0c75

Analysis

max time kernel
300s
max time network
293s
platform
windows10-1703_x64
resource
win10-20230621-en
resource tags

arch:x64arch:x86image:win10-20230621-enlocale:en-usos:windows10-1703-x64system
submitted
30/06/2023, 03:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9bcf44dc096701632aa4e9208f0842b23e7a9e54e0d6c465e7c378837f8f0c75.exe
Size

1.3MB
MD5

7d8075e87956466cbf89f1a3f2978233
SHA1

6d6e3f34cabc35251471cedca4987bcebee5d1f4
SHA256

9bcf44dc096701632aa4e9208f0842b23e7a9e54e0d6c465e7c378837f8f0c75
SHA512

67425ebe69bbf9dc1af517a8efb2c2728ff233cad578543ccf13f24cd29c43b2bd64afc1e2fd900c552c06fc82d3e8552b7e18ff37eddcee5831d16add0835af
SSDEEP

24576:U2G/nvxW3Ww0t3rZDceHt0L3/LoiXbt6R62BNerH5YVrb:UbA303rxceHaLv36UkvVr

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 33 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3076	4628	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4128	4628	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3652	4628	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4132	4628	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1316	4628	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2328	4628	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2852	4628	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3892	4628	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3676	4628	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4804	4628	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4784	4628	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1300	4628	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4508	4628	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4816	4628	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4824	4628	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3708	4628	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4736	4628	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4760	4628	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4732	4628	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3248	4628	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3784	4628	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1860	4628	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	448	4628	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	804	4628	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4616	4628	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	816	4628	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3852	4628	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4432	4628	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4408	4628	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4464	4628	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4476	4628	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4308	4628	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4976	4628	schtasks.exe	70

DCRat payload 28 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x000700000001aef4-133.dat	dcrat
behavioral2/files/0x000700000001aef4-134.dat	dcrat
behavioral2/memory/2880-135-0x0000000000410000-0x0000000000520000-memory.dmp	dcrat
behavioral2/files/0x000600000001aef8-143.dat	dcrat
behavioral2/files/0x000600000001aef8-563.dat	dcrat
behavioral2/files/0x000600000001aef8-562.dat	dcrat
behavioral2/files/0x000600000001aef8-740.dat	dcrat
behavioral2/files/0x000600000001aef8-748.dat	dcrat
behavioral2/files/0x000600000001aef8-756.dat	dcrat
behavioral2/files/0x000600000001aef8-763.dat	dcrat
behavioral2/files/0x000600000001aef8-770.dat	dcrat
behavioral2/files/0x000600000001aef8-777.dat	dcrat
behavioral2/files/0x000600000001aef8-784.dat	dcrat
behavioral2/files/0x000600000001aef8-791.dat	dcrat
behavioral2/files/0x000600000001aef8-798.dat	dcrat
behavioral2/files/0x000600000001aef8-805.dat	dcrat
behavioral2/files/0x000600000001aef8-812.dat	dcrat
behavioral2/files/0x000600000001aef8-819.dat	dcrat
behavioral2/files/0x000600000001aef8-828.dat	dcrat
behavioral2/files/0x000600000001aef8-835.dat	dcrat
behavioral2/files/0x000600000001aef8-842.dat	dcrat
behavioral2/files/0x000600000001aef8-849.dat	dcrat
behavioral2/files/0x000600000001aef8-856.dat	dcrat
behavioral2/files/0x000600000001aef8-863.dat	dcrat
behavioral2/files/0x000600000001aef8-870.dat	dcrat
behavioral2/files/0x000600000001aef8-877.dat	dcrat
behavioral2/files/0x000600000001aef8-885.dat	dcrat
behavioral2/files/0x000600000001aef8-893.dat	dcrat

Executes dropped EXE 26 IoCs

pid	Process
2880	PortcontainerHost.exe
1216	taskhostw.exe
3260	taskhostw.exe
2092	taskhostw.exe
3620	taskhostw.exe
3980	taskhostw.exe
3248	taskhostw.exe
4360	taskhostw.exe
872	taskhostw.exe
3368	taskhostw.exe
2424	taskhostw.exe
372	taskhostw.exe
4568	taskhostw.exe
4052	taskhostw.exe
4552	taskhostw.exe
1648	taskhostw.exe
1388	taskhostw.exe
2108	taskhostw.exe
316	taskhostw.exe
4408	taskhostw.exe
2236	taskhostw.exe
208	taskhostw.exe
4216	taskhostw.exe
5072	taskhostw.exe
4768	taskhostw.exe
3652	taskhostw.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Photo Viewer\OfficeClickToRun.exe	PortcontainerHost.exe
File created	C:\Program Files\Windows Photo Viewer\e6c9b481da804f	PortcontainerHost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 33 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4760	schtasks.exe
448	schtasks.exe
804	schtasks.exe
1316	schtasks.exe
3892	schtasks.exe
4132	schtasks.exe
4616	schtasks.exe
4432	schtasks.exe
4464	schtasks.exe
4476	schtasks.exe
3076	schtasks.exe
3652	schtasks.exe
4736	schtasks.exe
4408	schtasks.exe
4308	schtasks.exe
4824	schtasks.exe
4732	schtasks.exe
1300	schtasks.exe
4508	schtasks.exe
4816	schtasks.exe
816	schtasks.exe
4804	schtasks.exe
4784	schtasks.exe
3852	schtasks.exe
4128	schtasks.exe
1860	schtasks.exe
3676	schtasks.exe
3708	schtasks.exe
3248	schtasks.exe
3784	schtasks.exe
4976	schtasks.exe
2328	schtasks.exe
2852	schtasks.exe

Modifies registry class 26 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1032500962-593345068-3128969974-1000_Classes\Local Settings	PortcontainerHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1032500962-593345068-3128969974-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-1032500962-593345068-3128969974-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-1032500962-593345068-3128969974-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-1032500962-593345068-3128969974-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-1032500962-593345068-3128969974-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-1032500962-593345068-3128969974-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-1032500962-593345068-3128969974-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-1032500962-593345068-3128969974-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-1032500962-593345068-3128969974-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-1032500962-593345068-3128969974-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-1032500962-593345068-3128969974-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-1032500962-593345068-3128969974-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-1032500962-593345068-3128969974-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-1032500962-593345068-3128969974-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-1032500962-593345068-3128969974-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-1032500962-593345068-3128969974-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-1032500962-593345068-3128969974-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-1032500962-593345068-3128969974-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-1032500962-593345068-3128969974-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-1032500962-593345068-3128969974-1000_Classes\Local Settings	9bcf44dc096701632aa4e9208f0842b23e7a9e54e0d6c465e7c378837f8f0c75.exe
Key created	\REGISTRY\USER\S-1-5-21-1032500962-593345068-3128969974-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-1032500962-593345068-3128969974-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-1032500962-593345068-3128969974-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-1032500962-593345068-3128969974-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-1032500962-593345068-3128969974-1000_Classes\Local Settings	taskhostw.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2880	PortcontainerHost.exe
2880	PortcontainerHost.exe
2880	PortcontainerHost.exe
2880	PortcontainerHost.exe
2880	PortcontainerHost.exe
2880	PortcontainerHost.exe
2880	PortcontainerHost.exe
2880	PortcontainerHost.exe
2880	PortcontainerHost.exe
4932	powershell.exe
4428	powershell.exe
4368	powershell.exe
4688	powershell.exe
4948	powershell.exe
4272	powershell.exe
4932	powershell.exe
4932	powershell.exe
4864	powershell.exe
4864	powershell.exe
4856	powershell.exe
4856	powershell.exe
4288	powershell.exe
4288	powershell.exe
4908	powershell.exe
4908	powershell.exe
4940	powershell.exe
4940	powershell.exe
4448	powershell.exe
4448	powershell.exe
4940	powershell.exe
4288	powershell.exe
4688	powershell.exe
4688	powershell.exe
4368	powershell.exe
4368	powershell.exe
4948	powershell.exe
4948	powershell.exe
4932	powershell.exe
4428	powershell.exe
4428	powershell.exe
4856	powershell.exe
4272	powershell.exe
4272	powershell.exe
4864	powershell.exe
4940	powershell.exe
4908	powershell.exe
4448	powershell.exe
4288	powershell.exe
4688	powershell.exe
4948	powershell.exe
4368	powershell.exe
4428	powershell.exe
4856	powershell.exe
4272	powershell.exe
4448	powershell.exe
4908	powershell.exe
4864	powershell.exe
1216	taskhostw.exe
1216	taskhostw.exe
3260	taskhostw.exe
2092	taskhostw.exe
3620	taskhostw.exe
3980	taskhostw.exe
3248	taskhostw.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2880	PortcontainerHost.exe
Token: SeDebugPrivilege	4932	powershell.exe
Token: SeDebugPrivilege	4288	powershell.exe
Token: SeDebugPrivilege	4428	powershell.exe
Token: SeDebugPrivilege	4368	powershell.exe
Token: SeDebugPrivilege	4688	powershell.exe
Token: SeDebugPrivilege	4948	powershell.exe
Token: SeDebugPrivilege	4272	powershell.exe
Token: SeDebugPrivilege	4448	powershell.exe
Token: SeDebugPrivilege	4864	powershell.exe
Token: SeDebugPrivilege	4940	powershell.exe
Token: SeDebugPrivilege	4856	powershell.exe
Token: SeDebugPrivilege	4908	powershell.exe
Token: SeIncreaseQuotaPrivilege	4932	powershell.exe
Token: SeSecurityPrivilege	4932	powershell.exe
Token: SeTakeOwnershipPrivilege	4932	powershell.exe
Token: SeLoadDriverPrivilege	4932	powershell.exe
Token: SeSystemProfilePrivilege	4932	powershell.exe
Token: SeSystemtimePrivilege	4932	powershell.exe
Token: SeProfSingleProcessPrivilege	4932	powershell.exe
Token: SeIncBasePriorityPrivilege	4932	powershell.exe
Token: SeCreatePagefilePrivilege	4932	powershell.exe
Token: SeBackupPrivilege	4932	powershell.exe
Token: SeRestorePrivilege	4932	powershell.exe
Token: SeShutdownPrivilege	4932	powershell.exe
Token: SeDebugPrivilege	4932	powershell.exe
Token: SeSystemEnvironmentPrivilege	4932	powershell.exe
Token: SeRemoteShutdownPrivilege	4932	powershell.exe
Token: SeUndockPrivilege	4932	powershell.exe
Token: SeManageVolumePrivilege	4932	powershell.exe
Token: 33	4932	powershell.exe
Token: 34	4932	powershell.exe
Token: 35	4932	powershell.exe
Token: 36	4932	powershell.exe
Token: SeIncreaseQuotaPrivilege	4940	powershell.exe
Token: SeSecurityPrivilege	4940	powershell.exe
Token: SeTakeOwnershipPrivilege	4940	powershell.exe
Token: SeLoadDriverPrivilege	4940	powershell.exe
Token: SeSystemProfilePrivilege	4940	powershell.exe
Token: SeSystemtimePrivilege	4940	powershell.exe
Token: SeProfSingleProcessPrivilege	4940	powershell.exe
Token: SeIncBasePriorityPrivilege	4940	powershell.exe
Token: SeCreatePagefilePrivilege	4940	powershell.exe
Token: SeBackupPrivilege	4940	powershell.exe
Token: SeRestorePrivilege	4940	powershell.exe
Token: SeShutdownPrivilege	4940	powershell.exe
Token: SeDebugPrivilege	4940	powershell.exe
Token: SeSystemEnvironmentPrivilege	4940	powershell.exe
Token: SeRemoteShutdownPrivilege	4940	powershell.exe
Token: SeUndockPrivilege	4940	powershell.exe
Token: SeManageVolumePrivilege	4940	powershell.exe
Token: 33	4940	powershell.exe
Token: 34	4940	powershell.exe
Token: 35	4940	powershell.exe
Token: 36	4940	powershell.exe
Token: SeIncreaseQuotaPrivilege	4288	powershell.exe
Token: SeSecurityPrivilege	4288	powershell.exe
Token: SeTakeOwnershipPrivilege	4288	powershell.exe
Token: SeLoadDriverPrivilege	4288	powershell.exe
Token: SeSystemProfilePrivilege	4288	powershell.exe
Token: SeSystemtimePrivilege	4288	powershell.exe
Token: SeProfSingleProcessPrivilege	4288	powershell.exe
Token: SeIncBasePriorityPrivilege	4288	powershell.exe
Token: SeCreatePagefilePrivilege	4288	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1824 wrote to memory of 2280	1824	9bcf44dc096701632aa4e9208f0842b23e7a9e54e0d6c465e7c378837f8f0c75.exe	66
PID 1824 wrote to memory of 2280	1824	9bcf44dc096701632aa4e9208f0842b23e7a9e54e0d6c465e7c378837f8f0c75.exe	66
PID 1824 wrote to memory of 2280	1824	9bcf44dc096701632aa4e9208f0842b23e7a9e54e0d6c465e7c378837f8f0c75.exe	66
PID 2280 wrote to memory of 2540	2280	WScript.exe	67
PID 2280 wrote to memory of 2540	2280	WScript.exe	67
PID 2280 wrote to memory of 2540	2280	WScript.exe	67
PID 2540 wrote to memory of 2880	2540	cmd.exe	69
PID 2540 wrote to memory of 2880	2540	cmd.exe	69
PID 2880 wrote to memory of 4932	2880	PortcontainerHost.exe	104
PID 2880 wrote to memory of 4932	2880	PortcontainerHost.exe	104
PID 2880 wrote to memory of 4368	2880	PortcontainerHost.exe	119
PID 2880 wrote to memory of 4368	2880	PortcontainerHost.exe	119
PID 2880 wrote to memory of 4940	2880	PortcontainerHost.exe	118
PID 2880 wrote to memory of 4940	2880	PortcontainerHost.exe	118
PID 2880 wrote to memory of 4428	2880	PortcontainerHost.exe	117
PID 2880 wrote to memory of 4428	2880	PortcontainerHost.exe	117
PID 2880 wrote to memory of 4948	2880	PortcontainerHost.exe	116
PID 2880 wrote to memory of 4948	2880	PortcontainerHost.exe	116
PID 2880 wrote to memory of 4448	2880	PortcontainerHost.exe	114
PID 2880 wrote to memory of 4448	2880	PortcontainerHost.exe	114
PID 2880 wrote to memory of 4864	2880	PortcontainerHost.exe	113
PID 2880 wrote to memory of 4864	2880	PortcontainerHost.exe	113
PID 2880 wrote to memory of 4908	2880	PortcontainerHost.exe	112
PID 2880 wrote to memory of 4908	2880	PortcontainerHost.exe	112
PID 2880 wrote to memory of 4856	2880	PortcontainerHost.exe	110
PID 2880 wrote to memory of 4856	2880	PortcontainerHost.exe	110
PID 2880 wrote to memory of 4288	2880	PortcontainerHost.exe	109
PID 2880 wrote to memory of 4288	2880	PortcontainerHost.exe	109
PID 2880 wrote to memory of 4272	2880	PortcontainerHost.exe	106
PID 2880 wrote to memory of 4272	2880	PortcontainerHost.exe	106
PID 2880 wrote to memory of 4688	2880	PortcontainerHost.exe	107
PID 2880 wrote to memory of 4688	2880	PortcontainerHost.exe	107
PID 2880 wrote to memory of 924	2880	PortcontainerHost.exe	128
PID 2880 wrote to memory of 924	2880	PortcontainerHost.exe	128
PID 924 wrote to memory of 1500	924	cmd.exe	130
PID 924 wrote to memory of 1500	924	cmd.exe	130
PID 924 wrote to memory of 1216	924	cmd.exe	132
PID 924 wrote to memory of 1216	924	cmd.exe	132
PID 1216 wrote to memory of 1972	1216	taskhostw.exe	133
PID 1216 wrote to memory of 1972	1216	taskhostw.exe	133
PID 1972 wrote to memory of 644	1972	cmd.exe	135
PID 1972 wrote to memory of 644	1972	cmd.exe	135
PID 1972 wrote to memory of 3260	1972	cmd.exe	136
PID 1972 wrote to memory of 3260	1972	cmd.exe	136
PID 3260 wrote to memory of 3792	3260	taskhostw.exe	137
PID 3260 wrote to memory of 3792	3260	taskhostw.exe	137
PID 3792 wrote to memory of 3344	3792	cmd.exe	139
PID 3792 wrote to memory of 3344	3792	cmd.exe	139
PID 3792 wrote to memory of 2092	3792	cmd.exe	140
PID 3792 wrote to memory of 2092	3792	cmd.exe	140
PID 2092 wrote to memory of 5044	2092	taskhostw.exe	141
PID 2092 wrote to memory of 5044	2092	taskhostw.exe	141
PID 5044 wrote to memory of 964	5044	cmd.exe	143
PID 5044 wrote to memory of 964	5044	cmd.exe	143
PID 5044 wrote to memory of 3620	5044	cmd.exe	144
PID 5044 wrote to memory of 3620	5044	cmd.exe	144
PID 3620 wrote to memory of 4212	3620	taskhostw.exe	145
PID 3620 wrote to memory of 4212	3620	taskhostw.exe	145
PID 4212 wrote to memory of 3804	4212	cmd.exe	147
PID 4212 wrote to memory of 3804	4212	cmd.exe	147
PID 4212 wrote to memory of 3980	4212	cmd.exe	148
PID 4212 wrote to memory of 3980	4212	cmd.exe	148
PID 3980 wrote to memory of 4280	3980	taskhostw.exe	149
PID 3980 wrote to memory of 4280	3980	taskhostw.exe	149

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\9bcf44dc096701632aa4e9208f0842b23e7a9e54e0d6c465e7c378837f8f0c75.exe
"C:\Users\Admin\AppData\Local\Temp\9bcf44dc096701632aa4e9208f0842b23e7a9e54e0d6c465e7c378837f8f0c75.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\PortrefHostnetdhcp\hnwaZdn68w0TGMITAOZTO.vbe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2280
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\PortrefHostnetdhcp\ETJ15A7MdhSmTzkpI.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2540
  - - C:\PortrefHostnetdhcp\PortcontainerHost.exe
      "C:\PortrefHostnetdhcp\PortcontainerHost.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2880
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\PortrefHostnetdhcp\PortcontainerHost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4932
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\explorer.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4272
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\PortrefHostnetdhcp\smss.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4688
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\PortrefHostnetdhcp\sihost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4288
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Photo Viewer\OfficeClickToRun.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4856
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\PrintHood\fontdrvhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4908
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Downloads\dllhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4864
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\conhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4448
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Favorites\conhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4948
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\spoolsv.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4428
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\taskhostw.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4940
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\PortrefHostnetdhcp\explorer.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4368
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Bd8KMUYi0v.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:924
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:1500
      - C:\odt\taskhostw.exe
        
        "C:\odt\taskhostw.exe"
        6⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1216
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\j8BV8simza.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1972
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:644
        
        C:\odt\taskhostw.exe
        
        "C:\odt\taskhostw.exe"
        8⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3260
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\KLWAYFjljO.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:3792
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:3344
        
        C:\odt\taskhostw.exe
        
        "C:\odt\taskhostw.exe"
        10⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2092
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\or7X1gMNi7.bat"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:5044
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:964
        
        C:\odt\taskhostw.exe
        
        "C:\odt\taskhostw.exe"
        12⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3620
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\JGN3MoCgVZ.bat"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:4212
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:3804
        
        C:\odt\taskhostw.exe
        
        "C:\odt\taskhostw.exe"
        14⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3980
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\IPU7rAfrPc.bat"
        15⤵
        
        PID:4280
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:768
        
        C:\odt\taskhostw.exe
        
        "C:\odt\taskhostw.exe"
        16⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        
        PID:3248
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ktiZWDSHsI.bat"
        17⤵
        
        PID:2900
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:4940
        
        C:\odt\taskhostw.exe
        
        "C:\odt\taskhostw.exe"
        18⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4360
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\IPU7rAfrPc.bat"
        19⤵
        
        PID:4428
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:1504
        
        C:\odt\taskhostw.exe
        
        "C:\odt\taskhostw.exe"
        20⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:872
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\2mwtwHUJyt.bat"
        21⤵
        
        PID:1832
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:4408
        
        C:\odt\taskhostw.exe
        
        "C:\odt\taskhostw.exe"
        22⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3368
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\veDg5wW3gS.bat"
        23⤵
        
        PID:3788
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:2236
        
        C:\odt\taskhostw.exe
        
        "C:\odt\taskhostw.exe"
        24⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2424
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5ixwcMXCIg.bat"
        25⤵
        
        PID:4604
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:1096
        
        C:\odt\taskhostw.exe
        
        "C:\odt\taskhostw.exe"
        26⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:372
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Y23Kn3rQqK.bat"
        27⤵
        
        PID:200
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        28⤵
        
        PID:4876
        
        C:\odt\taskhostw.exe
        
        "C:\odt\taskhostw.exe"
        28⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4568
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BcPyovVCSH.bat"
        29⤵
        
        PID:3292
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        30⤵
        
        PID:4172
        
        C:\odt\taskhostw.exe
        
        "C:\odt\taskhostw.exe"
        30⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4052
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\d5cQTyHbvx.bat"
        31⤵
        
        PID:3408
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        32⤵
        
        PID:4768
        
        C:\odt\taskhostw.exe
        
        "C:\odt\taskhostw.exe"
        32⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4552
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ixgWq8OOYW.bat"
        33⤵
        
        PID:4212
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        34⤵
        
        PID:3652
        
        C:\odt\taskhostw.exe
        
        "C:\odt\taskhostw.exe"
        34⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1648
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ktiZWDSHsI.bat"
        35⤵
        
        PID:5012
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        36⤵
        
        PID:2328
        
        C:\odt\taskhostw.exe
        
        "C:\odt\taskhostw.exe"
        36⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1388
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\XBBOHPKclM.bat"
        37⤵
        
        PID:4932
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        38⤵
        
        PID:2644
        
        C:\odt\taskhostw.exe
        
        "C:\odt\taskhostw.exe"
        38⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2108
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\JGN3MoCgVZ.bat"
        39⤵
        
        PID:2116
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        40⤵
        
        PID:4316
        
        C:\odt\taskhostw.exe
        
        "C:\odt\taskhostw.exe"
        40⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:316
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\wpigNgqS7W.bat"
        41⤵
        
        PID:1460
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        42⤵
        
        PID:820
        
        C:\odt\taskhostw.exe
        
        "C:\odt\taskhostw.exe"
        42⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4408
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\srJhtCwLGi.bat"
        43⤵
        
        PID:2596
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        44⤵
        
        PID:1820
        
        C:\odt\taskhostw.exe
        
        "C:\odt\taskhostw.exe"
        44⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2236
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\XIXHPi7vyc.bat"
        45⤵
        
        PID:1640
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        46⤵
        
        PID:1316
        
        C:\odt\taskhostw.exe
        
        "C:\odt\taskhostw.exe"
        46⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:208
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\c0TJHXkWh8.bat"
        47⤵
        
        PID:2648
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        48⤵
        
        PID:4964
        
        C:\odt\taskhostw.exe
        
        "C:\odt\taskhostw.exe"
        48⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4216
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\or7X1gMNi7.bat"
        49⤵
        
        PID:616
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        50⤵
        
        PID:2516
        
        C:\odt\taskhostw.exe
        
        "C:\odt\taskhostw.exe"
        50⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5072
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\7ezzJRb6cS.bat"
        51⤵
        
        PID:2160
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        52⤵
        
        PID:1224
        
        C:\odt\taskhostw.exe
        
        "C:\odt\taskhostw.exe"
        52⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4768
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\TBzEQtkdDl.bat"
        53⤵
        
        PID:2536
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        54⤵
        
        PID:4552
        
        C:\odt\taskhostw.exe
        
        "C:\odt\taskhostw.exe"
        54⤵
        Executes dropped EXE
        
        PID:3652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\PortrefHostnetdhcp\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\PortrefHostnetdhcp\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\PortrefHostnetdhcp\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 10 /tr "'C:\odt\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\odt\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 11 /tr "'C:\odt\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\odt\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\odt\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\odt\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Favorites\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Users\Default\Favorites\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\Users\Default\Favorites\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Users\Default User\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Downloads\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Public\Downloads\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Downloads\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Users\Default\PrintHood\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Default\PrintHood\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Users\Default\PrintHood\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Photo Viewer\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Photo Viewer\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 8 /tr "'C:\PortrefHostnetdhcp\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\PortrefHostnetdhcp\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 10 /tr "'C:\PortrefHostnetdhcp\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\odt\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\odt\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\odt\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\PortrefHostnetdhcp\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\PortrefHostnetdhcp\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\PortrefHostnetdhcp\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4976

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PortrefHostnetdhcp\ETJ15A7MdhSmTzkpI.bat

Filesize
45B

MD5
a1015752e9451d4a39d23d12d6ab9298

SHA1
5791a577cae9ae7859fac2de03e3603f4c1c928a

SHA256
02b58b7a916b7bf49e2ad2e6a49256f7a3ee6294276e3892b221d0b6ebaa96e4

SHA512
64302aef161853b57c4756020fbbf5e22905c3b9ad7491ea277a6fd1518ce1cd61a4f0b3d7b5d23ff747927d1ef1ec55d22e1e544f2866498a08bb0b5a8273c6

Download Submit
C:\PortrefHostnetdhcp\PortcontainerHost.exe

Filesize
1.0MB

MD5
53fe63742a4ace1a43288113da3f1f72

SHA1
3ad210a0dd948955134883ccd69a0cf2a6e71365

SHA256
5fc11059b96d7de3cda9670d792802b8ce7550c1622327488b2ed47e108aac2b

SHA512
4cb339acde55dd93e04f318cf74be7412f2578d0b4b530585adff5adf7db85e67bb7a71aff9bacfccd5dbbaf9ae03d836281ee803d2500438e5fc9bd56863fbf

Download Submit
C:\PortrefHostnetdhcp\PortcontainerHost.exe

Filesize
1.0MB

MD5
53fe63742a4ace1a43288113da3f1f72

SHA1
3ad210a0dd948955134883ccd69a0cf2a6e71365

SHA256
5fc11059b96d7de3cda9670d792802b8ce7550c1622327488b2ed47e108aac2b

SHA512
4cb339acde55dd93e04f318cf74be7412f2578d0b4b530585adff5adf7db85e67bb7a71aff9bacfccd5dbbaf9ae03d836281ee803d2500438e5fc9bd56863fbf

Download Submit
C:\PortrefHostnetdhcp\hnwaZdn68w0TGMITAOZTO.vbe

Filesize
212B

MD5
bde97ed07894e00778b57a73d72bca2d

SHA1
b3605af19aacee441a720f6ee869411e817b5bcc

SHA256
a1cb8fd63b500692c499bf765334778b4cda2603d62b9964d6e8cca3178cb38e

SHA512
b9acf4642e19f64e9611d2fa18101473589999cd10041b27013e295e72e07754d6ed2990ec51dde1f83ff5ebc66f134bc4c19f0a10d9cf1b684f7b06b2d22404

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
ad5cd538ca58cb28ede39c108acb5785

SHA1
1ae910026f3dbe90ed025e9e96ead2b5399be877

SHA256
c9e6cb04d6c893458d5a7e12eb575cf97c3172f5e312b1f63a667cbbc5f0c033

SHA512
c066c5d9b276a68fa636647bb29aea05bfa2292217bc77f5324d9c1d93117772ee8277e1f7cff91ec8d6b7c05ca078f929cecfdbb09582522a9067f54740af13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\taskhostw.exe.log

Filesize
1KB

MD5
d63ff49d7c92016feb39812e4db10419

SHA1
2307d5e35ca9864ffefc93acf8573ea995ba189b

SHA256
375076241775962f3edc08a8c72832a00920b427a4f3332528d91d21e909fa12

SHA512
00f8c8d0336d6575b956876183199624d6f4d2056f2c0aa633a6f17c516f22ee648062d9bc419254d84c459323e9424f0da8aed9dd4e16c2926e5ba30e797d8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
ca227cb5d202e7a945d8e30e87d29ebf

SHA1
cd685e03a4e756c7b23ff7d4586db8befc6684a8

SHA256
3b04f76e98ba697415b4f1361621f7a77fea0d44170ef8b3c4ebb5c281d95bd9

SHA512
3e60f4b6f89659ade9a43c78a7bfeb1415d0da713d0354baafbe54da0f35cec2815d48c4c6c55c045458f375c234e5b229a13ea169d9e3e1fbec60cc8b7fcf5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
c53c2cca15aed66dd63973b77ce41376

SHA1
dc75681f0ee393cf84c2749d40a494b265f4c133

SHA256
f3b4e569740cd1804793fc1064c3ba97aed95b7f7649ab172b667d9bcac953a0

SHA512
59d9b43a719aeefccbfc8867798b1e1ad907f6ddff908ff21830f73be5a22f27d65e5f223e9f6a18cae578093318b9e4aaf75396dd7b1d53d9524a7208161b5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
ca227cb5d202e7a945d8e30e87d29ebf

SHA1
cd685e03a4e756c7b23ff7d4586db8befc6684a8

SHA256
3b04f76e98ba697415b4f1361621f7a77fea0d44170ef8b3c4ebb5c281d95bd9

SHA512
3e60f4b6f89659ade9a43c78a7bfeb1415d0da713d0354baafbe54da0f35cec2815d48c4c6c55c045458f375c234e5b229a13ea169d9e3e1fbec60cc8b7fcf5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
78d5e55c39f5e22f6fbec60148690870

SHA1
ed2364c4373422bac43f57054bd721c189bef3f9

SHA256
97742652dd2cc95ab2f1eba611f18c887f9c0c82771c1bcb3f9f753a1c466469

SHA512
9c92f0b1a299ae86ca89138098f3a83939f76d8a8c07a5d79f4a9c18cf341d165d558168a8d2c8fb1f28c1be49cb8f3599ef30bda92c10be5686debdb7268e8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
78d5e55c39f5e22f6fbec60148690870

SHA1
ed2364c4373422bac43f57054bd721c189bef3f9

SHA256
97742652dd2cc95ab2f1eba611f18c887f9c0c82771c1bcb3f9f753a1c466469

SHA512
9c92f0b1a299ae86ca89138098f3a83939f76d8a8c07a5d79f4a9c18cf341d165d558168a8d2c8fb1f28c1be49cb8f3599ef30bda92c10be5686debdb7268e8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
ca9b4d4fa67d74eca737c3ee2c2c8ee0

SHA1
5ec7de55a059faaa44ece67663001876eb7b08ea

SHA256
7903336af2e29bb00b6265388a42979075064c8b81483955f1355be6a8acb0e0

SHA512
35d4c09cbe21ad8b6828385016785a15cfae3a77382fd5692d36703cb6873a4c2dbc66efee000436173de3ff5ca3a904cf78af4bfbd824a51d4e98b9bb669f83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
2a628efa1a2fb8adb031fa6a3aeaa657

SHA1
9145bf64b61035baba156a9b9ff516d70c3fbedd

SHA256
ed1daf7c02301e2faf4f6011a3b45210d53bee305b1156fe71e6fbe36a1cb5ba

SHA512
88013b438416562ab453010eef7d0d5c027d6b538acd5c906595b98abd6f1e5222911bb5743295929883eae6c40f766ba623ca147fd9bdec4202fcaa1268b5fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
2a628efa1a2fb8adb031fa6a3aeaa657

SHA1
9145bf64b61035baba156a9b9ff516d70c3fbedd

SHA256
ed1daf7c02301e2faf4f6011a3b45210d53bee305b1156fe71e6fbe36a1cb5ba

SHA512
88013b438416562ab453010eef7d0d5c027d6b538acd5c906595b98abd6f1e5222911bb5743295929883eae6c40f766ba623ca147fd9bdec4202fcaa1268b5fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
8543f9f40c1dc8f3f1b0ed01ae8d596b

SHA1
17afdb1160bc13ceee8bd55239149e672ffc674b

SHA256
f7204f573f08345d88d7ebeb821612a574f7e5bd1444c78fb2144d408a3e26ec

SHA512
94be59f77d14e89eb06c47744e9074cedc0f758fb217440af69d96293e2eff6dba710992b2a3eba94dfff70bbd6734658c45f0c2f6d06731378f659244d208a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
f6db1f52b9a0b82062170ecba456cd69

SHA1
2e3c772b2b7d725ed2cc0e5dfd0e5dc04616618d

SHA256
7d3b8db33e434a561f4f32e794e92ed7b4903e2ea3f314ad529dc29075f0c520

SHA512
2ff7ebef694794bb9cf151cd8d5a33b2d4776d8b8d58ec56086d48ab593a17fae04af82070379d5324ee2550b44ec16ead33f4e714278427ba7a3a75a47b62b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
f6db1f52b9a0b82062170ecba456cd69

SHA1
2e3c772b2b7d725ed2cc0e5dfd0e5dc04616618d

SHA256
7d3b8db33e434a561f4f32e794e92ed7b4903e2ea3f314ad529dc29075f0c520

SHA512
2ff7ebef694794bb9cf151cd8d5a33b2d4776d8b8d58ec56086d48ab593a17fae04af82070379d5324ee2550b44ec16ead33f4e714278427ba7a3a75a47b62b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\2mwtwHUJyt.bat

Filesize
185B

MD5
f02754479a1557ce1130ee6f797ee7dd

SHA1
fc4abbf22a859538a54f9db2c7d50da9e1619656

SHA256
41b4fb915f22b9c2d9e8be2f1a8d02ed76d7181c0844d170b1b68c833b99c855

SHA512
adbc34920c19762c1eb96dc151ac2114796366d26ddaea5440748adb3666529bfc07bde9251032c4d790f5818ac0e5c8fbfa54be0f895552ffa7b79edc1a833b

Download Submit
C:\Users\Admin\AppData\Local\Temp\5ixwcMXCIg.bat

Filesize
185B

MD5
f6b7df44d9efb9c3696e90b39f866357

SHA1
f3348887a40bb544fef72e675131e549c87b653d

SHA256
8933f5c7fa35be54c9cbc7e486e5e9a8896fec7a8a17e50b59d78ee142768bf1

SHA512
ed0c9d2dd890d81b4340c7411149449684f91173d8ecd2d657a801c388cb94b7197233970d1d670eb78dc84a15fc657c7d74936c9b45cace7be8e91ac91e5449

Download Submit
C:\Users\Admin\AppData\Local\Temp\BcPyovVCSH.bat

Filesize
185B

MD5
228ab12ddb9a211a2903f555a54b9f66

SHA1
579cc20b76eaf3fb937dbbcb6a0710eb6572481b

SHA256
abb815dbe8a788144ed0beb39860f7f81406b0baba4a01f9e4d1752ec57c4704

SHA512
ddf3a36d6c836569f2b5ea15ef05671b4a4e13ecba0f7d7a9c8ba4abef58e7ece0065ad5aac2a8a29afa85c0df76bbd9daebf4fecd67a0b6e5efb832daa9c07f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Bd8KMUYi0v.bat

Filesize
185B

MD5
d9f280095a5e205bc273e29e3b128c8f

SHA1
ee9056e9116d0514bd0ec941285fc4f918971f6b

SHA256
c340ae9802d457d0d19604817b59df0ee51ba496ae1a15cdc87d21c53970bc16

SHA512
83863be720394ba74eefd0bd19b92efb2dcc37b9b104316561342967661d9f37cf5cdcc19e05a1bf4473283d307013058689daba8ecef1b626f5fe51bafb5b67

Download Submit
C:\Users\Admin\AppData\Local\Temp\IPU7rAfrPc.bat

Filesize
185B

MD5
98fc251b05e1370cad89db473b0871aa

SHA1
62557264dc07c8e69dc2bd10fdaad2af47306902

SHA256
383d858041468d79b643fe4a5abe46368564caf56f7bf2989254dfebd8f7a697

SHA512
8426404b86729352976809643416fb8c4bd8a0bead2c8f1308ea74358eb56d712d8a29e222a2fff70ad2c8609c2a1d72f352f3030aabd2f0ae3d15b9c31a0efa

Download Submit
C:\Users\Admin\AppData\Local\Temp\IPU7rAfrPc.bat

Filesize
185B

MD5
98fc251b05e1370cad89db473b0871aa

SHA1
62557264dc07c8e69dc2bd10fdaad2af47306902

SHA256
383d858041468d79b643fe4a5abe46368564caf56f7bf2989254dfebd8f7a697

SHA512
8426404b86729352976809643416fb8c4bd8a0bead2c8f1308ea74358eb56d712d8a29e222a2fff70ad2c8609c2a1d72f352f3030aabd2f0ae3d15b9c31a0efa

Download Submit
C:\Users\Admin\AppData\Local\Temp\JGN3MoCgVZ.bat

Filesize
185B

MD5
f12e94375ca202a87ced23ea19540001

SHA1
26c337b8f68b3b4b168ef8f5c3965c6662d8c094

SHA256
6cf34362db26d9e8f68a7effa3cbfc3c6f34ea66df907fa50489efbb7f917bd8

SHA512
49a7897909064fc960d05047fbeea96419e7f32672c23a899987d9b39d4b5a09ecd9bda48732a18f216ba034c9f77415208bd353c0b5e1ebbccca108b5bc9724

Download Submit
C:\Users\Admin\AppData\Local\Temp\JGN3MoCgVZ.bat

Filesize
185B

MD5
f12e94375ca202a87ced23ea19540001

SHA1
26c337b8f68b3b4b168ef8f5c3965c6662d8c094

SHA256
6cf34362db26d9e8f68a7effa3cbfc3c6f34ea66df907fa50489efbb7f917bd8

SHA512
49a7897909064fc960d05047fbeea96419e7f32672c23a899987d9b39d4b5a09ecd9bda48732a18f216ba034c9f77415208bd353c0b5e1ebbccca108b5bc9724

Download Submit
C:\Users\Admin\AppData\Local\Temp\KLWAYFjljO.bat

Filesize
185B

MD5
33a765c9920ef0c715b48cdc11d34b0a

SHA1
2cc290d577171226cc2fd2e99174ecfe2797d90d

SHA256
7b5b3988970ea5a97ee7b63872556962a35daf079cd9013c0ee2d0873563980d

SHA512
f0d5dc94766bcab1ab9bdca4d4cea39d2e16a87b0310f0ca2f170bd2144b0d848fbf08d4c450ecce69a2b28126d450af1b5c5e04377a249bb71dfb6d1082b021

Download Submit
C:\Users\Admin\AppData\Local\Temp\XBBOHPKclM.bat

Filesize
185B

MD5
e7abfa9e86dfb6c168a0e235d26eb132

SHA1
c3260e41da105882ab915cec871e5c0460d790a0

SHA256
4692548a67ef208c1c60991ddc22f95dd3d35fd6bd8c30b50c5e049debcff7bc

SHA512
465d91176edf414e346a672a464575f09f409ad9087a866df346d85ebdac73b187662d1f31dcd3d9502c9bdcfd9a274b40033617efee840f2e6530aa7047fb3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\XIXHPi7vyc.bat

Filesize
185B

MD5
95eee9e418cc5082abef54bdecbc8285

SHA1
5b6229233578e6565ba826170b5de54672beaf7d

SHA256
7ff6ede9bfdb58aa5a3fb444e8645d955921e8129f1747647078b88f026b2daf

SHA512
c7d0099eab885b26dae7e17b911f4bbdcf156ae12ee41f5a0c04985f2628fa2488c7f504e6db8121a498d00ab2d6ce0a858ec0ba5979adb91503ab27c511a530

Download Submit
C:\Users\Admin\AppData\Local\Temp\Y23Kn3rQqK.bat

Filesize
185B

MD5
9fb1b73df29d926fd40499946d6af652

SHA1
f42881fa8d9b0f3121d5cefa00860b447f36c94b

SHA256
c6152dda97b50234150cec7c1840cdb1a01554f2a3c286b68a176062ff085ba8

SHA512
814d831923bc4cd9837c399c909276640ea289994a35ee6ca1f8d8f83eaace00ba48798e8ea7790a93ed587b11a5cdb3013c03a8a48f8fc01213301ef4e8fb17

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hlsisd1u.frt.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\c0TJHXkWh8.bat

Filesize
185B

MD5
f67455d68d7c3cda4addb0b6fed6289e

SHA1
de3fc8d860bddd6a693f68e9244d8f550bd080a6

SHA256
165c9d9934081c640b6e64d8461816b010755b22d6dca1476eac0a8d5a08d30c

SHA512
dabae30753a1bf487638cbe98cbd7106475ac5036efb97bf10203cf994807ab2c237171b849972be2b1c4e5ffff8963dd161ab325e0915610aa30ec683ff079b

Download Submit
C:\Users\Admin\AppData\Local\Temp\d5cQTyHbvx.bat

Filesize
185B

MD5
ba68ba87f06855333ca3b8286853afcd

SHA1
fface6ee2bd9112e52c7123d337b0326dec30342

SHA256
2efd72948c771705b40b2ab75cc2909421d698cb2f8ef948d11c5cb4e853a61f

SHA512
5ec923f5c0a5f62c24dead731a84f19515f028b62a835f5f1d3eab611497190dcf15b370cfab7def6efbe104585e08061bf0f3086d14f406107d52e6f4053008

Download Submit
C:\Users\Admin\AppData\Local\Temp\ixgWq8OOYW.bat

Filesize
185B

MD5
45863ee3f99fb0a1628e469d5f70be51

SHA1
dec06994482ae8f41e575c8a39d4e5daa1963a80

SHA256
6422489b0b3cd15c47b74d731129c42059ed77d6f32ac5e57540713459f474ee

SHA512
521aae1b01f31cbd6db5e895da3b97cd0f106f859bc4537cf94a7c548b0b037d697578d973729bd0dcd71178784ea4f1d737c03947a44cca64f794eee63f8a62

Download Submit
C:\Users\Admin\AppData\Local\Temp\j8BV8simza.bat

Filesize
185B

MD5
cabc320759d3e59ac402ea405067232e

SHA1
86e15301190c0ee765ab639ab894de7d77bfd7d9

SHA256
3bf3b06c4201a5e60d12d3d490b0b9145a534cd3dc476d18bf1544d350bf4538

SHA512
ba28eb3d3c816be42c32488c0d9ff22ab508af21c00db2df7fae9ff14b7c40715a4256a8a064fac60576cf3e8cff27b6a72cf11801f63076e1bcf5ea1531204e

Download Submit
C:\Users\Admin\AppData\Local\Temp\ktiZWDSHsI.bat

Filesize
185B

MD5
24bf87e3c261139b115518fc89e521a3

SHA1
f5f358c9e54477624b86432448e83661a819144d

SHA256
aa4ccdd079f1e0f958b33b17c753a404c13c96d75894cdae24a36fd9ad9c3886

SHA512
6cf46327a06d4b5d050a876b209f4bf56a9b32171c85267f07cfc8597c064a33ca084f62845a011969c30b84e4fdbd3e4cff7453e308dfd3c51bb5a0996a3120

Download Submit
C:\Users\Admin\AppData\Local\Temp\ktiZWDSHsI.bat

Filesize
185B

MD5
24bf87e3c261139b115518fc89e521a3

SHA1
f5f358c9e54477624b86432448e83661a819144d

SHA256
aa4ccdd079f1e0f958b33b17c753a404c13c96d75894cdae24a36fd9ad9c3886

SHA512
6cf46327a06d4b5d050a876b209f4bf56a9b32171c85267f07cfc8597c064a33ca084f62845a011969c30b84e4fdbd3e4cff7453e308dfd3c51bb5a0996a3120

Download Submit
C:\Users\Admin\AppData\Local\Temp\or7X1gMNi7.bat

Filesize
185B

MD5
93ce05bf1c377f790a8d119cc61b8ccc

SHA1
6b15a3d47646a9cc1144ff72e00e97cf6c11dfc4

SHA256
2b84b7939a2351b32e7c16eb5da401dd4f8c5dfe1d9510e9bbb089042e8e5a8c

SHA512
b09a617a959a669b466a07268da07710f28568838aeb81ee30040c03a29bd2aecb29c3cfc7d1d2beaf242ca7a2f0ad53fcf7577ce0969da87992cf0df44b1984

Download Submit
C:\Users\Admin\AppData\Local\Temp\or7X1gMNi7.bat

Filesize
185B

MD5
93ce05bf1c377f790a8d119cc61b8ccc

SHA1
6b15a3d47646a9cc1144ff72e00e97cf6c11dfc4

SHA256
2b84b7939a2351b32e7c16eb5da401dd4f8c5dfe1d9510e9bbb089042e8e5a8c

SHA512
b09a617a959a669b466a07268da07710f28568838aeb81ee30040c03a29bd2aecb29c3cfc7d1d2beaf242ca7a2f0ad53fcf7577ce0969da87992cf0df44b1984

Download Submit
C:\Users\Admin\AppData\Local\Temp\srJhtCwLGi.bat

Filesize
185B

MD5
85874c0b27680a4837134a4c26fac469

SHA1
7c8a663d70a6d0d65a3ca3482d855ff0264d0a70

SHA256
b0d89d931fc11626852210c3db9da4f2b4c096fa1ec079e23fa35a888ebbf96b

SHA512
a71a5f9013aa9fad0c3f88626cd785b4f69e42d9501bc9b85f2da85f9ac74cfcf89daa21decbc58bc99b395b2b2ac5fae16944044afd89e6b8934700d01bf884

Download Submit
C:\Users\Admin\AppData\Local\Temp\veDg5wW3gS.bat

Filesize
185B

MD5
447f55d440cd1bf9887138ee9d43126f

SHA1
ceacd9eaa988b2a34a261ced9a674f1dcb92895d

SHA256
339d4e1ed2f473b5006a7b36ea306a2ca0866b544ba5c6f8bc002da54ac4e621

SHA512
d9717123d7edd23a412293d1334146b6ab93bd1cc6c65be448b1f961147812339fde3ff0fcf2afde4862dc95062e2205fac095a38afa95a4e492a9895517ac25

Download Submit
C:\Users\Admin\AppData\Local\Temp\wpigNgqS7W.bat

Filesize
185B

MD5
33e5686c6ade8395d01ef67cf84ba928

SHA1
0e07c4b401d987e55b82cdce72f8f2cf88639716

SHA256
4ba3f77dfb19cbb864855fd5f3c2f67dc4d87bb4675ab724881ae81030c13983

SHA512
f3ca3639faa0ff57fa4a15a18ef098c37b3371ae805a9fa4ad4726e53867a89257b202ad199a640f607ccccc0d5dff5dcf7ff1aab758d6c707f31ee584ea69c5

Download Submit
C:\odt\taskhostw.exe

Filesize
1.0MB

MD5
53fe63742a4ace1a43288113da3f1f72

SHA1
3ad210a0dd948955134883ccd69a0cf2a6e71365

SHA256
5fc11059b96d7de3cda9670d792802b8ce7550c1622327488b2ed47e108aac2b

SHA512
4cb339acde55dd93e04f318cf74be7412f2578d0b4b530585adff5adf7db85e67bb7a71aff9bacfccd5dbbaf9ae03d836281ee803d2500438e5fc9bd56863fbf

Download Submit
C:\odt\taskhostw.exe

Filesize
1.0MB

MD5
53fe63742a4ace1a43288113da3f1f72

SHA1
3ad210a0dd948955134883ccd69a0cf2a6e71365

SHA256
5fc11059b96d7de3cda9670d792802b8ce7550c1622327488b2ed47e108aac2b

SHA512
4cb339acde55dd93e04f318cf74be7412f2578d0b4b530585adff5adf7db85e67bb7a71aff9bacfccd5dbbaf9ae03d836281ee803d2500438e5fc9bd56863fbf

Download Submit
C:\odt\taskhostw.exe

Filesize
1.0MB

MD5
53fe63742a4ace1a43288113da3f1f72

SHA1
3ad210a0dd948955134883ccd69a0cf2a6e71365

SHA256
5fc11059b96d7de3cda9670d792802b8ce7550c1622327488b2ed47e108aac2b

SHA512
4cb339acde55dd93e04f318cf74be7412f2578d0b4b530585adff5adf7db85e67bb7a71aff9bacfccd5dbbaf9ae03d836281ee803d2500438e5fc9bd56863fbf

Download Submit
C:\odt\taskhostw.exe

Filesize
1.0MB

MD5
53fe63742a4ace1a43288113da3f1f72

SHA1
3ad210a0dd948955134883ccd69a0cf2a6e71365

SHA256
5fc11059b96d7de3cda9670d792802b8ce7550c1622327488b2ed47e108aac2b

SHA512
4cb339acde55dd93e04f318cf74be7412f2578d0b4b530585adff5adf7db85e67bb7a71aff9bacfccd5dbbaf9ae03d836281ee803d2500438e5fc9bd56863fbf

Download Submit
C:\odt\taskhostw.exe

Filesize
1.0MB

MD5
53fe63742a4ace1a43288113da3f1f72

SHA1
3ad210a0dd948955134883ccd69a0cf2a6e71365

SHA256
5fc11059b96d7de3cda9670d792802b8ce7550c1622327488b2ed47e108aac2b

SHA512
4cb339acde55dd93e04f318cf74be7412f2578d0b4b530585adff5adf7db85e67bb7a71aff9bacfccd5dbbaf9ae03d836281ee803d2500438e5fc9bd56863fbf

Download Submit
C:\odt\taskhostw.exe

Filesize
1.0MB

MD5
53fe63742a4ace1a43288113da3f1f72

SHA1
3ad210a0dd948955134883ccd69a0cf2a6e71365

SHA256
5fc11059b96d7de3cda9670d792802b8ce7550c1622327488b2ed47e108aac2b

SHA512
4cb339acde55dd93e04f318cf74be7412f2578d0b4b530585adff5adf7db85e67bb7a71aff9bacfccd5dbbaf9ae03d836281ee803d2500438e5fc9bd56863fbf

Download Submit
C:\odt\taskhostw.exe

Filesize
1.0MB

MD5
53fe63742a4ace1a43288113da3f1f72

SHA1
3ad210a0dd948955134883ccd69a0cf2a6e71365

SHA256
5fc11059b96d7de3cda9670d792802b8ce7550c1622327488b2ed47e108aac2b

SHA512
4cb339acde55dd93e04f318cf74be7412f2578d0b4b530585adff5adf7db85e67bb7a71aff9bacfccd5dbbaf9ae03d836281ee803d2500438e5fc9bd56863fbf

Download Submit
C:\odt\taskhostw.exe

Filesize
1.0MB

MD5
53fe63742a4ace1a43288113da3f1f72

SHA1
3ad210a0dd948955134883ccd69a0cf2a6e71365

SHA256
5fc11059b96d7de3cda9670d792802b8ce7550c1622327488b2ed47e108aac2b

SHA512
4cb339acde55dd93e04f318cf74be7412f2578d0b4b530585adff5adf7db85e67bb7a71aff9bacfccd5dbbaf9ae03d836281ee803d2500438e5fc9bd56863fbf

Download Submit
C:\odt\taskhostw.exe

Filesize
1.0MB

MD5
53fe63742a4ace1a43288113da3f1f72

SHA1
3ad210a0dd948955134883ccd69a0cf2a6e71365

SHA256
5fc11059b96d7de3cda9670d792802b8ce7550c1622327488b2ed47e108aac2b

SHA512
4cb339acde55dd93e04f318cf74be7412f2578d0b4b530585adff5adf7db85e67bb7a71aff9bacfccd5dbbaf9ae03d836281ee803d2500438e5fc9bd56863fbf

Download Submit
C:\odt\taskhostw.exe

Filesize
1.0MB

MD5
53fe63742a4ace1a43288113da3f1f72

SHA1
3ad210a0dd948955134883ccd69a0cf2a6e71365

SHA256
5fc11059b96d7de3cda9670d792802b8ce7550c1622327488b2ed47e108aac2b

SHA512
4cb339acde55dd93e04f318cf74be7412f2578d0b4b530585adff5adf7db85e67bb7a71aff9bacfccd5dbbaf9ae03d836281ee803d2500438e5fc9bd56863fbf

Download Submit
C:\odt\taskhostw.exe

Filesize
1.0MB

MD5
53fe63742a4ace1a43288113da3f1f72

SHA1
3ad210a0dd948955134883ccd69a0cf2a6e71365

SHA256
5fc11059b96d7de3cda9670d792802b8ce7550c1622327488b2ed47e108aac2b

SHA512
4cb339acde55dd93e04f318cf74be7412f2578d0b4b530585adff5adf7db85e67bb7a71aff9bacfccd5dbbaf9ae03d836281ee803d2500438e5fc9bd56863fbf

Download Submit
C:\odt\taskhostw.exe

Filesize
1.0MB

MD5
53fe63742a4ace1a43288113da3f1f72

SHA1
3ad210a0dd948955134883ccd69a0cf2a6e71365

SHA256
5fc11059b96d7de3cda9670d792802b8ce7550c1622327488b2ed47e108aac2b

SHA512
4cb339acde55dd93e04f318cf74be7412f2578d0b4b530585adff5adf7db85e67bb7a71aff9bacfccd5dbbaf9ae03d836281ee803d2500438e5fc9bd56863fbf

Download Submit
C:\odt\taskhostw.exe

Filesize
1.0MB

MD5
53fe63742a4ace1a43288113da3f1f72

SHA1
3ad210a0dd948955134883ccd69a0cf2a6e71365

SHA256
5fc11059b96d7de3cda9670d792802b8ce7550c1622327488b2ed47e108aac2b

SHA512
4cb339acde55dd93e04f318cf74be7412f2578d0b4b530585adff5adf7db85e67bb7a71aff9bacfccd5dbbaf9ae03d836281ee803d2500438e5fc9bd56863fbf

Download Submit
C:\odt\taskhostw.exe

Filesize
1.0MB

MD5
53fe63742a4ace1a43288113da3f1f72

SHA1
3ad210a0dd948955134883ccd69a0cf2a6e71365

SHA256
5fc11059b96d7de3cda9670d792802b8ce7550c1622327488b2ed47e108aac2b

SHA512
4cb339acde55dd93e04f318cf74be7412f2578d0b4b530585adff5adf7db85e67bb7a71aff9bacfccd5dbbaf9ae03d836281ee803d2500438e5fc9bd56863fbf

Download Submit
C:\odt\taskhostw.exe

Filesize
1.0MB

MD5
53fe63742a4ace1a43288113da3f1f72

SHA1
3ad210a0dd948955134883ccd69a0cf2a6e71365

SHA256
5fc11059b96d7de3cda9670d792802b8ce7550c1622327488b2ed47e108aac2b

SHA512
4cb339acde55dd93e04f318cf74be7412f2578d0b4b530585adff5adf7db85e67bb7a71aff9bacfccd5dbbaf9ae03d836281ee803d2500438e5fc9bd56863fbf

Download Submit
C:\odt\taskhostw.exe

Filesize
1.0MB

MD5
53fe63742a4ace1a43288113da3f1f72

SHA1
3ad210a0dd948955134883ccd69a0cf2a6e71365

SHA256
5fc11059b96d7de3cda9670d792802b8ce7550c1622327488b2ed47e108aac2b

SHA512
4cb339acde55dd93e04f318cf74be7412f2578d0b4b530585adff5adf7db85e67bb7a71aff9bacfccd5dbbaf9ae03d836281ee803d2500438e5fc9bd56863fbf

Download Submit
C:\odt\taskhostw.exe

Filesize
1.0MB

MD5
53fe63742a4ace1a43288113da3f1f72

SHA1
3ad210a0dd948955134883ccd69a0cf2a6e71365

SHA256
5fc11059b96d7de3cda9670d792802b8ce7550c1622327488b2ed47e108aac2b

SHA512
4cb339acde55dd93e04f318cf74be7412f2578d0b4b530585adff5adf7db85e67bb7a71aff9bacfccd5dbbaf9ae03d836281ee803d2500438e5fc9bd56863fbf

Download Submit
C:\odt\taskhostw.exe

Filesize
1.0MB

MD5
53fe63742a4ace1a43288113da3f1f72

SHA1
3ad210a0dd948955134883ccd69a0cf2a6e71365

SHA256
5fc11059b96d7de3cda9670d792802b8ce7550c1622327488b2ed47e108aac2b

SHA512
4cb339acde55dd93e04f318cf74be7412f2578d0b4b530585adff5adf7db85e67bb7a71aff9bacfccd5dbbaf9ae03d836281ee803d2500438e5fc9bd56863fbf

Download Submit
C:\odt\taskhostw.exe

Filesize
1.0MB

MD5
53fe63742a4ace1a43288113da3f1f72

SHA1
3ad210a0dd948955134883ccd69a0cf2a6e71365

SHA256
5fc11059b96d7de3cda9670d792802b8ce7550c1622327488b2ed47e108aac2b

SHA512
4cb339acde55dd93e04f318cf74be7412f2578d0b4b530585adff5adf7db85e67bb7a71aff9bacfccd5dbbaf9ae03d836281ee803d2500438e5fc9bd56863fbf

Download Submit
C:\odt\taskhostw.exe

Filesize
1.0MB

MD5
53fe63742a4ace1a43288113da3f1f72

SHA1
3ad210a0dd948955134883ccd69a0cf2a6e71365

SHA256
5fc11059b96d7de3cda9670d792802b8ce7550c1622327488b2ed47e108aac2b

SHA512
4cb339acde55dd93e04f318cf74be7412f2578d0b4b530585adff5adf7db85e67bb7a71aff9bacfccd5dbbaf9ae03d836281ee803d2500438e5fc9bd56863fbf

Download Submit
C:\odt\taskhostw.exe

Filesize
1.0MB

MD5
53fe63742a4ace1a43288113da3f1f72

SHA1
3ad210a0dd948955134883ccd69a0cf2a6e71365

SHA256
5fc11059b96d7de3cda9670d792802b8ce7550c1622327488b2ed47e108aac2b

SHA512
4cb339acde55dd93e04f318cf74be7412f2578d0b4b530585adff5adf7db85e67bb7a71aff9bacfccd5dbbaf9ae03d836281ee803d2500438e5fc9bd56863fbf

Download Submit
C:\odt\taskhostw.exe

Filesize
1.0MB

MD5
53fe63742a4ace1a43288113da3f1f72

SHA1
3ad210a0dd948955134883ccd69a0cf2a6e71365

SHA256
5fc11059b96d7de3cda9670d792802b8ce7550c1622327488b2ed47e108aac2b

SHA512
4cb339acde55dd93e04f318cf74be7412f2578d0b4b530585adff5adf7db85e67bb7a71aff9bacfccd5dbbaf9ae03d836281ee803d2500438e5fc9bd56863fbf

Download Submit
C:\odt\taskhostw.exe

Filesize
1.0MB

MD5
53fe63742a4ace1a43288113da3f1f72

SHA1
3ad210a0dd948955134883ccd69a0cf2a6e71365

SHA256
5fc11059b96d7de3cda9670d792802b8ce7550c1622327488b2ed47e108aac2b

SHA512
4cb339acde55dd93e04f318cf74be7412f2578d0b4b530585adff5adf7db85e67bb7a71aff9bacfccd5dbbaf9ae03d836281ee803d2500438e5fc9bd56863fbf

Download Submit
C:\odt\taskhostw.exe

Filesize
1.0MB

MD5
53fe63742a4ace1a43288113da3f1f72

SHA1
3ad210a0dd948955134883ccd69a0cf2a6e71365

SHA256
5fc11059b96d7de3cda9670d792802b8ce7550c1622327488b2ed47e108aac2b

SHA512
4cb339acde55dd93e04f318cf74be7412f2578d0b4b530585adff5adf7db85e67bb7a71aff9bacfccd5dbbaf9ae03d836281ee803d2500438e5fc9bd56863fbf

Download Submit
C:\odt\taskhostw.exe

Filesize
1.0MB

MD5
53fe63742a4ace1a43288113da3f1f72

SHA1
3ad210a0dd948955134883ccd69a0cf2a6e71365

SHA256
5fc11059b96d7de3cda9670d792802b8ce7550c1622327488b2ed47e108aac2b

SHA512
4cb339acde55dd93e04f318cf74be7412f2578d0b4b530585adff5adf7db85e67bb7a71aff9bacfccd5dbbaf9ae03d836281ee803d2500438e5fc9bd56863fbf

Download Submit
memory/372-806-0x000000001AE50000-0x000000001AE60000-memory.dmp

Filesize
64KB

Download
memory/872-785-0x00000000014D0000-0x00000000014E0000-memory.dmp

Filesize
64KB

Download
memory/1216-618-0x00000000013F0000-0x0000000001400000-memory.dmp

Filesize
64KB

Download
memory/2092-749-0x000000001B040000-0x000000001B050000-memory.dmp

Filesize
64KB

Download
memory/2092-753-0x000000001B040000-0x000000001B050000-memory.dmp

Filesize
64KB

Download
memory/2424-799-0x000000001B460000-0x000000001B470000-memory.dmp

Filesize
64KB

Download
memory/2880-136-0x0000000000C30000-0x0000000000C40000-memory.dmp

Filesize
64KB

Download
memory/2880-137-0x0000000002560000-0x000000000256C000-memory.dmp

Filesize
48KB

Download
memory/2880-140-0x000000001B0C0000-0x000000001B0CC000-memory.dmp

Filesize
48KB

Download
memory/2880-139-0x000000001B0B0000-0x000000001B0C2000-memory.dmp

Filesize
72KB

Download
memory/2880-138-0x000000001B0A0000-0x000000001B0AC000-memory.dmp

Filesize
48KB

Download
memory/2880-135-0x0000000000410000-0x0000000000520000-memory.dmp

Filesize
1.1MB

Download
memory/3248-771-0x0000000000D20000-0x0000000000D30000-memory.dmp

Filesize
64KB

Download
memory/3260-742-0x000000001AD80000-0x000000001AD90000-memory.dmp

Filesize
64KB

Download
memory/3368-792-0x0000000000FF0000-0x0000000001000000-memory.dmp

Filesize
64KB

Download
memory/3620-757-0x00000000009D0000-0x00000000009E0000-memory.dmp

Filesize
64KB

Download
memory/3980-764-0x0000000002570000-0x0000000002580000-memory.dmp

Filesize
64KB

Download
memory/4052-820-0x00000000026E0000-0x00000000026F2000-memory.dmp

Filesize
72KB

Download
memory/4272-673-0x000001F36BB20000-0x000001F36BB30000-memory.dmp

Filesize
64KB

Download
memory/4272-228-0x000001F36BB20000-0x000001F36BB30000-memory.dmp

Filesize
64KB

Download
memory/4272-556-0x000001F36BB20000-0x000001F36BB30000-memory.dmp

Filesize
64KB

Download
memory/4272-229-0x000001F36BB20000-0x000001F36BB30000-memory.dmp

Filesize
64KB

Download
memory/4288-374-0x000001A768950000-0x000001A768960000-memory.dmp

Filesize
64KB

Download
memory/4288-201-0x000001A768950000-0x000001A768960000-memory.dmp

Filesize
64KB

Download
memory/4288-209-0x000001A768950000-0x000001A768960000-memory.dmp

Filesize
64KB

Download
memory/4360-778-0x000000001B400000-0x000000001B410000-memory.dmp

Filesize
64KB

Download
memory/4368-219-0x00000203171E0000-0x00000203171F0000-memory.dmp

Filesize
64KB

Download
memory/4368-498-0x00000203171E0000-0x00000203171F0000-memory.dmp

Filesize
64KB

Download
memory/4368-217-0x00000203171E0000-0x00000203171F0000-memory.dmp

Filesize
64KB

Download
memory/4428-210-0x000001B62B900000-0x000001B62B910000-memory.dmp

Filesize
64KB

Download
memory/4428-487-0x000001B62B900000-0x000001B62B910000-memory.dmp

Filesize
64KB

Download
memory/4428-287-0x000001B62B900000-0x000001B62B910000-memory.dmp

Filesize
64KB

Download
memory/4448-276-0x000002340A830000-0x000002340A840000-memory.dmp

Filesize
64KB

Download
memory/4448-304-0x000002340A830000-0x000002340A840000-memory.dmp

Filesize
64KB

Download
memory/4448-612-0x000002340A830000-0x000002340A840000-memory.dmp

Filesize
64KB

Download
memory/4568-813-0x000000001BDE0000-0x000000001BDF0000-memory.dmp

Filesize
64KB

Download
memory/4688-223-0x00000209FF6D0000-0x00000209FF6E0000-memory.dmp

Filesize
64KB

Download
memory/4688-379-0x00000209FF6D0000-0x00000209FF6E0000-memory.dmp

Filesize
64KB

Download
memory/4688-674-0x00000209FF6D0000-0x00000209FF6E0000-memory.dmp

Filesize
64KB

Download
memory/4688-291-0x00000209FF6D0000-0x00000209FF6E0000-memory.dmp

Filesize
64KB

Download
memory/4856-554-0x000001FD43880000-0x000001FD43890000-memory.dmp

Filesize
64KB

Download
memory/4856-225-0x000001FD43880000-0x000001FD43890000-memory.dmp

Filesize
64KB

Download
memory/4856-226-0x000001FD43880000-0x000001FD43890000-memory.dmp

Filesize
64KB

Download
memory/4864-601-0x0000022913370000-0x0000022913380000-memory.dmp

Filesize
64KB

Download
memory/4864-233-0x0000022913370000-0x0000022913380000-memory.dmp

Filesize
64KB

Download
memory/4864-231-0x0000022913370000-0x0000022913380000-memory.dmp

Filesize
64KB

Download
memory/4864-675-0x0000022913370000-0x0000022913380000-memory.dmp

Filesize
64KB

Download
memory/4908-234-0x0000024FF2DD0000-0x0000024FF2DE0000-memory.dmp

Filesize
64KB

Download
memory/4908-607-0x0000024FF2DD0000-0x0000024FF2DE0000-memory.dmp

Filesize
64KB

Download
memory/4908-676-0x0000024FF2DD0000-0x0000024FF2DE0000-memory.dmp

Filesize
64KB

Download
memory/4908-232-0x0000024FF2DD0000-0x0000024FF2DE0000-memory.dmp

Filesize
64KB

Download
memory/4932-364-0x00000184FF110000-0x00000184FF120000-memory.dmp

Filesize
64KB

Download
memory/4932-187-0x00000184FF110000-0x00000184FF120000-memory.dmp

Filesize
64KB

Download
memory/4932-193-0x00000184FF110000-0x00000184FF120000-memory.dmp

Filesize
64KB

Download
memory/4932-227-0x00000184FF7E0000-0x00000184FF802000-memory.dmp

Filesize
136KB

Download
memory/4932-239-0x00000184FF990000-0x00000184FFA06000-memory.dmp

Filesize
472KB

Download
memory/4932-678-0x00000184FF110000-0x00000184FF120000-memory.dmp

Filesize
64KB

Download
memory/4940-230-0x000002D4F39E0000-0x000002D4F39F0000-memory.dmp

Filesize
64KB

Download
memory/4940-314-0x000002D4F39E0000-0x000002D4F39F0000-memory.dmp

Filesize
64KB

Download
memory/4940-369-0x000002D4F39E0000-0x000002D4F39F0000-memory.dmp

Filesize
64KB

Download
memory/4940-677-0x000002D4F39E0000-0x000002D4F39F0000-memory.dmp

Filesize
64KB

Download
memory/4948-224-0x0000013DAC330000-0x0000013DAC340000-memory.dmp

Filesize
64KB

Download
memory/4948-301-0x0000013DAC330000-0x0000013DAC340000-memory.dmp

Filesize
64KB

Download
memory/4948-385-0x0000013DAC330000-0x0000013DAC340000-memory.dmp

Filesize
64KB

Download