259208c74418d531a4c3dc79b27be551309088b90eb32ca5914c53532a3c898e

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/04/2026, 23:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
x259208c74418d531a4c3dc79b27be551309088b90eb32ca5914c53532a3c898e.exe
Size 1.7MB
Sample260419-23mvmagy31
SHA256 259208c74418d531a4c3dc79b27be551309088b90eb32ca5914c53532a3c898e
MD5 73ccaef6dc01cdf9f593d4a92fc79831
SHA1 7db0ac1ae3fec058882cb631b08fda85ff5dc07e
SHA512 2f34363e54f5adf884a6d99fd0489f5c9b259d8d54eb311aec8c923ffb14ec4b0877e40db3598f5ef044bfec3f2a6934b19b77c03e65f01db770483c3ec4cc2b
SSDEEP 49152:AkQTA7IwMtuvMDVPG4JdXeR4aT6LQ+d3mY/4qxTsx3scG:AaRuRD9JdOR4m+lmY/4rx8cG
TLSH
T1F88523197181D333C2FB003085C58FB55A2566224F7566EFFBE89B662F202F4BB661C9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Process spawned unexpected child process 57 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4560	4600	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2956	4600	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2872	4600	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4472	4600	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5020	4600	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2544	4600	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1220	4600	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3836	4600	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3084	4600	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3884	4600	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4684	4600	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3492	4600	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4352	4600	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3404	4600	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2712	4600	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4796	4600	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	960	4600	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3240	4600	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4256	4600	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4808	4600	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4688	4600	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3520	4600	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3244	4600	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2316	4600	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1296	4600	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4248	4600	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2528	4600	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4920	4600	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4972	4600	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4732	4600	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4832	4600	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1924	4600	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4748	4600	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4680	4600	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5076	4600	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2032	4600	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2824	4600	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	812	4600	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1796	4600	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1856	4600	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1984	4600	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4248	4600	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5304	4600	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5796	4600	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5528	4600	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5104	4600	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1820	4600	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5612	4600	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5332	4600	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5892	4600	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6260	4600	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6616	4600	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6132	4600	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6152	4600	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7204	4600	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6576	4600	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7848	4600	schtasks.exe	86

UAC bypass 3 TTPs 3 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	x259208c74418d531a4c3dc79b27be551309088b90eb32ca5914c53532a3c898e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	x259208c74418d531a4c3dc79b27be551309088b90eb32ca5914c53532a3c898e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	x259208c74418d531a4c3dc79b27be551309088b90eb32ca5914c53532a3c898e.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	x259208c74418d531a4c3dc79b27be551309088b90eb32ca5914c53532a3c898e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	x259208c74418d531a4c3dc79b27be551309088b90eb32ca5914c53532a3c898e.exe

SmartAssembly .NET packer 6 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral1/memory/4896-5235-0x00000000066C0000-0x00000000066D0000-memory.dmp	SmartAssembly
behavioral1/memory/4896-5239-0x0000000006710000-0x000000000671A000-memory.dmp	SmartAssembly
behavioral1/memory/4896-5244-0x00000000067F0000-0x00000000067FC000-memory.dmp	SmartAssembly
behavioral1/memory/4896-5247-0x0000000006860000-0x000000000686C000-memory.dmp	SmartAssembly
behavioral1/memory/4896-5245-0x0000000006820000-0x000000000682A000-memory.dmp	SmartAssembly
behavioral1/memory/4896-5250-0x0000000005060000-0x0000000005070000-memory.dmp	SmartAssembly

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Provisioning\StartMenuExperienceHost.exe	x259208c74418d531a4c3dc79b27be551309088b90eb32ca5914c53532a3c898e.exe
File opened for modification	C:\Windows\Provisioning\StartMenuExperienceHost.exe	x259208c74418d531a4c3dc79b27be551309088b90eb32ca5914c53532a3c898e.exe
File created	C:\Windows\Provisioning\55b276f4edf653	x259208c74418d531a4c3dc79b27be551309088b90eb32ca5914c53532a3c898e.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x259208c74418d531a4c3dc79b27be551309088b90eb32ca5914c53532a3c898e.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 57 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2956	schtasks.exe
960	schtasks.exe
4688	schtasks.exe
5076	schtasks.exe
2824	schtasks.exe
4248	schtasks.exe
3836	schtasks.exe
3492	schtasks.exe
2032	schtasks.exe
6616	schtasks.exe
3404	schtasks.exe
5020	schtasks.exe
4352	schtasks.exe
1296	schtasks.exe
2544	schtasks.exe
4732	schtasks.exe
4808	schtasks.exe
1924	schtasks.exe
4748	schtasks.exe
6152	schtasks.exe
4920	schtasks.exe
5892	schtasks.exe
6132	schtasks.exe
4256	schtasks.exe
3244	schtasks.exe
2528	schtasks.exe
4972	schtasks.exe
4832	schtasks.exe
5304	schtasks.exe
1796	schtasks.exe
6576	schtasks.exe
7848	schtasks.exe
1820	schtasks.exe
6260	schtasks.exe
4472	schtasks.exe
4680	schtasks.exe
3884	schtasks.exe
4796	schtasks.exe
812	schtasks.exe
4560	schtasks.exe
4248	schtasks.exe
5796	schtasks.exe
5612	schtasks.exe
3520	schtasks.exe
5104	schtasks.exe
7204	schtasks.exe
3084	schtasks.exe
1220	schtasks.exe
2712	schtasks.exe
2316	schtasks.exe
2872	schtasks.exe
4684	schtasks.exe
3240	schtasks.exe
1856	schtasks.exe
1984	schtasks.exe
5528	schtasks.exe
5332	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4896	x259208c74418d531a4c3dc79b27be551309088b90eb32ca5914c53532a3c898e.exe
4896	x259208c74418d531a4c3dc79b27be551309088b90eb32ca5914c53532a3c898e.exe
4896	x259208c74418d531a4c3dc79b27be551309088b90eb32ca5914c53532a3c898e.exe
4896	x259208c74418d531a4c3dc79b27be551309088b90eb32ca5914c53532a3c898e.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4896	x259208c74418d531a4c3dc79b27be551309088b90eb32ca5914c53532a3c898e.exe

System policy modification 1 TTPs 3 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	x259208c74418d531a4c3dc79b27be551309088b90eb32ca5914c53532a3c898e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	x259208c74418d531a4c3dc79b27be551309088b90eb32ca5914c53532a3c898e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	x259208c74418d531a4c3dc79b27be551309088b90eb32ca5914c53532a3c898e.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\x259208c74418d531a4c3dc79b27be551309088b90eb32ca5914c53532a3c898e.exe
"C:\Users\Admin\AppData\Local\Temp\x259208c74418d531a4c3dc79b27be551309088b90eb32ca5914c53532a3c898e.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:4896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 10 /tr "'C:\Windows\Provisioning\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Windows\Provisioning\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 7 /tr "'C:\Windows\Provisioning\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Windows\es-ES\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\es-ES\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Windows\es-ES\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\All Users\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Portable Devices\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Portable Devices\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Portable Devices\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Portable Devices\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Users\Default\Favorites\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Default\Favorites\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Favorites\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\Default User\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Pictures\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Public\Pictures\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Users\Public\Pictures\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Portable Devices\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Portable Devices\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5076

C:\Recovery\WindowsRE\TextInputHost.exe
"C:\Recovery\WindowsRE\TextInputHost.exe"
1⤵
PID:3964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Users\Default\My Documents\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\Default\My Documents\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Users\Default\My Documents\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5796

C:\Windows\Provisioning\StartMenuExperienceHost.exe
"C:\Windows\Provisioning\StartMenuExperienceHost.exe"
1⤵
PID:4080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5104

C:\Windows\es-ES\smss.exe
"C:\Windows\es-ES\smss.exe"
1⤵
PID:5216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Default User\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5892

C:\Users\Public\Pictures\dllhost.exe
"C:\Users\Public\Pictures\dllhost.exe"
1⤵
PID:2804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6132

C:\Users\Default User\lsass.exe
"C:\Users\Default User\lsass.exe"
1⤵
PID:5356

C:\Program Files (x86)\Windows Portable Devices\wininit.exe
"C:\Program Files (x86)\Windows Portable Devices\wininit.exe"
1⤵
PID:3872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Photo Viewer\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6260

C:\Users\Default\Favorites\RuntimeBroker.exe
"C:\Users\Default\Favorites\RuntimeBroker.exe"
1⤵
PID:6896

C:\Program Files (x86)\Windows Portable Devices\RuntimeBroker.exe
"C:\Program Files (x86)\Windows Portable Devices\RuntimeBroker.exe"
1⤵
PID:1716

C:\Users\All Users\smss.exe
"C:\Users\All Users\smss.exe"
1⤵
PID:6292

C:\Recovery\WindowsRE\lsass.exe
"C:\Recovery\WindowsRE\lsass.exe"
1⤵
PID:5588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Photo Viewer\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6152

C:\Program Files\Windows Portable Devices\wininit.exe
"C:\Program Files\Windows Portable Devices\wininit.exe"
1⤵
PID:6548

C:\Recovery\WindowsRE\SearchApp.exe
"C:\Recovery\WindowsRE\SearchApp.exe"
1⤵
PID:6184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Users\Default\Application Data\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Default\Application Data\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:7204

C:\Users\Default\My Documents\sppsvc.exe
"C:\Users\Default\My Documents\sppsvc.exe"
1⤵
PID:5312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Application Data\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:7848

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\OfficeClickToRun.exe
"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\OfficeClickToRun.exe"
1⤵
PID:7908

C:\Users\Default User\RuntimeBroker.exe
"C:\Users\Default User\RuntimeBroker.exe"
1⤵
PID:11168

C:\Recovery\WindowsRE\WmiPrvSE.exe
"C:\Recovery\WindowsRE\WmiPrvSE.exe"
1⤵
PID:5708

C:\Recovery\WindowsRE\SppExtComObj.exe
"C:\Recovery\WindowsRE\SppExtComObj.exe"
1⤵
PID:6212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

OfficeClickToRun.exe

Path C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\OfficeClickToRun.exe
Size 1.1MB
SHA256 bb7c2daff1cd33354a69f3ca2c8afc89984161b75e299ba94f65e53e7b999767
MD5 d89d060adf1412f23b058e25883bba6e
SHA1 443e3a78742dab60508d124a3c0b25b1a8410195
SHA512 d24239c46767676907a753d4656a476490b37cbe9ecfc0a7eb029b99ebc08bcd234e1680206e6a763e243b9055681041bcc159d22ea1abb0853211b1135ec2f9
SSDEEP 24576:Ak70TrcqgBukmO0ZthkvMjHVOKG4s0T+gLaEXeR4aiO/64RpuZ:AkQTA7IwMtuvMDVPG4JdXeR4aT6LZ
TLSH
T11B3522157180C373C5F7103189D5CA745A2671B10B7AA5EFBAE8ABB22F202E5B7261CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RuntimeBroker.exe

Path C:\Program Files (x86)\Windows Portable Devices\RuntimeBroker.exe
Size 1.7MB
SHA256 259208c74418d531a4c3dc79b27be551309088b90eb32ca5914c53532a3c898e
MD5 73ccaef6dc01cdf9f593d4a92fc79831
SHA1 7db0ac1ae3fec058882cb631b08fda85ff5dc07e
SHA512 2f34363e54f5adf884a6d99fd0489f5c9b259d8d54eb311aec8c923ffb14ec4b0877e40db3598f5ef044bfec3f2a6934b19b77c03e65f01db770483c3ec4cc2b
SSDEEP 49152:AkQTA7IwMtuvMDVPG4JdXeR4aT6LQ+d3mY/4qxTsx3scG:AaRuRD9JdOR4m+lmY/4rx8cG
TLSH
T1F88523197181D333C2FB003085C58FB55A2566224F7566EFFBE89B662F202F4BB661C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchApp.exe

Path C:\Recovery\WindowsRE\SearchApp.exe
Size 1.6MB
SHA256 6b153617f175d32e9ce1fddf5dc88933f4806354692ba8cf567557e0b55efaca
MD5 ce2024e959b6abb1ed36bf7362aa1ede
SHA1 d8b00f387892c5d075bab9e65f5ebb1d52d84268
SHA512 10e0a8a67a6c68dce7cf6395635b8750900b0ae8893dbf7a83a23711a0c81d2282645d3a258c911d9189e6b80d3ad9c8f905e584bfba9f35273e19157bc9283c
SSDEEP 49152:AkQTA7IwMtuvMDVPG4JdXeR4aT6LQ+d3mY/4qxTsxa:AaRuRD9JdOR4m+lmY/4rxa
TLSH
T18B7523157181D333C2BB103185C18FB59A2576260F7666DFFBE89B662F202F4BB261C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RuntimeBroker.exe

Path C:\Users\Default User\RuntimeBroker.exe
Size 384KB
SHA256 d57ef1bc3cab2f136fac1633bba5871e26533021c231f363ebcfc010ff851dc1
MD5 67701d04da5a1d534de3e0b067f166fd
SHA1 26d63ff88d728ac1982cda3809c16cc4f8761f9e
SHA512 9e3e2c92d81f76df6a9dffa1abf83e06a1deb0de30a1131b95dff75fca13d4f30da868fcfd2b9af6317e636ac2694b9e266cc0470313c5297bcd2ac579d47169
SSDEEP 6144:CDKW1Lgbdl0TBBvjc/xUSsSAgutvhQcw0tSIXf20vhe/ShQxFVVglgBUpoeR1:Eh1Lk70Tnvjc5UgAgux61IP20vhe/ShX
TLSH
T1E184F1217180C2B3C5B7013144EACB35AE3A7035076A95D7B6ED6BBA5F213E0A7351CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RuntimeBroker.exe

Path C:\Users\Default\RuntimeBroker.exe
Size 960KB
SHA256 791845d4ae2febe34e88c5773868475420e861f06dc0c26ed5aa5af2076a923a
MD5 1e0e081a3f4f9fef62af926461405913
SHA1 fcc16bd947cca60cb9152a31c1424a0b07c4256c
SHA512 329d7ab6aae6906413d097904d99e3901db29575621e1f2d4a4ba3a5a9c4926dfd602fc029927ff60f1ea78417e6168ee90a13b4c36ab16707bde48ae94daf09
SSDEEP 24576:Ak70TrcqgBukmO0ZthkvMjHVOKG4s0T+gLaEXeR4aiO/6A:AkQTA7IwMtuvMDVPG4JdXeR4aT6A
TLSH
T10E252215B180D273C5BB113188D5CB355F2275B10BB9A5EBBAE86BB26F102E4A7321CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4896-86-0x0000000005070000-0x00000000052E4000-memory.dmp

Download

memory/4896-126-0x0000000005070000-0x00000000052E4000-memory.dmp

Download

memory/4896-3-0x0000000005570000-0x0000000005B14000-memory.dmp

Download

memory/4896-4-0x0000000005070000-0x00000000052EA000-memory.dmp

Download

memory/4896-5-0x0000000005070000-0x00000000052E4000-memory.dmp

Download

memory/4896-10-0x0000000005070000-0x00000000052E4000-memory.dmp

Download

memory/4896-42-0x0000000005070000-0x00000000052E4000-memory.dmp

Download

memory/4896-44-0x0000000005070000-0x00000000052E4000-memory.dmp

Download

memory/4896-48-0x0000000005070000-0x00000000052E4000-memory.dmp

Download

memory/4896-66-0x0000000005070000-0x00000000052E4000-memory.dmp

Download

memory/4896-80-0x0000000005070000-0x00000000052E4000-memory.dmp

Download

memory/4896-78-0x0000000005070000-0x00000000052E4000-memory.dmp

Download

memory/4896-76-0x0000000005070000-0x00000000052E4000-memory.dmp

Download

memory/4896-74-0x0000000005070000-0x00000000052E4000-memory.dmp

Download

memory/4896-72-0x0000000005070000-0x00000000052E4000-memory.dmp

Download

memory/4896-70-0x0000000005070000-0x00000000052E4000-memory.dmp

Download

memory/4896-68-0x0000000005070000-0x00000000052E4000-memory.dmp

Download

memory/4896-64-0x0000000005070000-0x00000000052E4000-memory.dmp

Download

memory/4896-62-0x0000000005070000-0x00000000052E4000-memory.dmp

Download

memory/4896-60-0x0000000005070000-0x00000000052E4000-memory.dmp

Download

memory/4896-128-0x0000000005070000-0x00000000052E4000-memory.dmp

Download

memory/4896-56-0x0000000005070000-0x00000000052E4000-memory.dmp

Download

memory/4896-52-0x0000000005070000-0x00000000052E4000-memory.dmp

Download

memory/4896-50-0x0000000005070000-0x00000000052E4000-memory.dmp

Download

memory/4896-46-0x0000000005070000-0x00000000052E4000-memory.dmp

Download

memory/4896-54-0x0000000005070000-0x00000000052E4000-memory.dmp

Download

memory/4896-40-0x0000000005070000-0x00000000052E4000-memory.dmp

Download

memory/4896-38-0x0000000005070000-0x00000000052E4000-memory.dmp

Download

memory/4896-36-0x0000000005070000-0x00000000052E4000-memory.dmp

Download

memory/4896-34-0x0000000005070000-0x00000000052E4000-memory.dmp

Download

memory/4896-32-0x0000000005070000-0x00000000052E4000-memory.dmp

Download

memory/4896-30-0x0000000005070000-0x00000000052E4000-memory.dmp

Download

memory/4896-28-0x0000000005070000-0x00000000052E4000-memory.dmp

Download

memory/4896-26-0x0000000005070000-0x00000000052E4000-memory.dmp

Download

memory/4896-22-0x0000000005070000-0x00000000052E4000-memory.dmp

Download

memory/4896-24-0x0000000005070000-0x00000000052E4000-memory.dmp

Download

memory/4896-18-0x0000000005070000-0x00000000052E4000-memory.dmp

Download

memory/4896-14-0x0000000005070000-0x00000000052E4000-memory.dmp

Download

memory/4896-12-0x0000000005070000-0x00000000052E4000-memory.dmp

Download

memory/4896-8-0x0000000005070000-0x00000000052E4000-memory.dmp

Download

memory/4896-7-0x0000000005070000-0x00000000052E4000-memory.dmp

Download

memory/4896-20-0x0000000005070000-0x00000000052E4000-memory.dmp

Download

memory/4896-16-0x0000000005070000-0x00000000052E4000-memory.dmp

Download

memory/4896-84-0x0000000005070000-0x00000000052E4000-memory.dmp

Download

memory/4896-1-0x00000000052F0000-0x000000000556C000-memory.dmp

Download

memory/4896-118-0x0000000005070000-0x00000000052E4000-memory.dmp

Download

memory/4896-2-0x0000000005060000-0x0000000005070000-memory.dmp

Download

memory/4896-130-0x0000000005070000-0x00000000052E4000-memory.dmp

Download

memory/4896-58-0x0000000005070000-0x00000000052E4000-memory.dmp

Download

memory/4896-124-0x0000000005070000-0x00000000052E4000-memory.dmp

Download

memory/4896-122-0x0000000005070000-0x00000000052E4000-memory.dmp

Download

memory/4896-120-0x0000000005070000-0x00000000052E4000-memory.dmp

Download

memory/4896-116-0x0000000005070000-0x00000000052E4000-memory.dmp

Download

memory/4896-112-0x0000000005070000-0x00000000052E4000-memory.dmp

Download

memory/4896-110-0x0000000005070000-0x00000000052E4000-memory.dmp

Download

memory/4896-104-0x0000000005070000-0x00000000052E4000-memory.dmp

Download

memory/4896-102-0x0000000005070000-0x00000000052E4000-memory.dmp

Download

memory/4896-100-0x0000000005070000-0x00000000052E4000-memory.dmp

Download

memory/4896-96-0x0000000005070000-0x00000000052E4000-memory.dmp

Download

memory/4896-94-0x0000000005070000-0x00000000052E4000-memory.dmp

Download

memory/4896-92-0x0000000005070000-0x00000000052E4000-memory.dmp

Download

memory/4896-90-0x0000000005070000-0x00000000052E4000-memory.dmp

Download

memory/4896-82-0x0000000005070000-0x00000000052E4000-memory.dmp

Download

memory/4896-114-0x0000000005070000-0x00000000052E4000-memory.dmp

Download

memory/4896-108-0x0000000005070000-0x00000000052E4000-memory.dmp

Download

memory/4896-106-0x0000000005070000-0x00000000052E4000-memory.dmp

Download

memory/4896-98-0x0000000005070000-0x00000000052E4000-memory.dmp

Download

memory/4896-89-0x0000000005070000-0x00000000052E4000-memory.dmp

Download

memory/4896-1571-0x0000000005060000-0x0000000005070000-memory.dmp

Download

memory/4896-1819-0x0000000005060000-0x0000000005070000-memory.dmp

Download

memory/4896-2048-0x0000000005060000-0x0000000005070000-memory.dmp

Download

memory/4896-5231-0x0000000005060000-0x0000000005070000-memory.dmp

Download

memory/4896-5232-0x0000000006180000-0x000000000619C000-memory.dmp

Download

memory/4896-5233-0x0000000006650000-0x00000000066A0000-memory.dmp

Download

memory/4896-5234-0x00000000066B0000-0x00000000066B8000-memory.dmp

Download

memory/4896-5235-0x00000000066C0000-0x00000000066D0000-memory.dmp

Download

memory/4896-5236-0x00000000066D0000-0x00000000066E6000-memory.dmp

Download

memory/4896-5237-0x0000000006700000-0x0000000006708000-memory.dmp

Download

memory/4896-5238-0x0000000006850000-0x0000000006860000-memory.dmp

Download

memory/4896-5239-0x0000000006710000-0x000000000671A000-memory.dmp

Download

memory/4896-5241-0x0000000006750000-0x0000000006762000-memory.dmp

Download

memory/4896-5240-0x0000000006740000-0x000000000674C000-memory.dmp

Download

memory/4896-5242-0x0000000006880000-0x0000000006DAC000-memory.dmp

Download

memory/4896-5243-0x00000000067E0000-0x00000000067EC000-memory.dmp

Download

memory/4896-5244-0x00000000067F0000-0x00000000067FC000-memory.dmp

Download

memory/4896-5247-0x0000000006860000-0x000000000686C000-memory.dmp

Download

memory/4896-5246-0x0000000006840000-0x0000000006848000-memory.dmp

Download

memory/4896-5245-0x0000000006820000-0x000000000682A000-memory.dmp

Download

memory/4896-5248-0x0000000007130000-0x00000000071C2000-memory.dmp

Download

memory/4896-5249-0x00000000071F0000-0x00000000071FC000-memory.dmp

Download

memory/4896-0-0x0000000005060000-0x0000000005070000-memory.dmp

Download

memory/4896-5250-0x0000000005060000-0x0000000005070000-memory.dmp

Download

memory/4896-5253-0x0000000007230000-0x0000000007296000-memory.dmp

Download

memory/4896-5855-0x0000000005060000-0x0000000005070000-memory.dmp

Download

memory/4896-6180-0x0000000005060000-0x0000000005070000-memory.dmp

Download