dcrat | fa245486b3fd0ed56fc169c0c57cad8b5a8390bd4e6b04765148cb5d2d8e0f2e

Analysis

max time kernel
149s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 19:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Chainperfnet.exe
Size 1.1MB
Sample260809-xs1xaacl2y
SHA256 fa245486b3fd0ed56fc169c0c57cad8b5a8390bd4e6b04765148cb5d2d8e0f2e
MD5 8d94c3b91f4c437c0989338d703affc9
SHA1 8da9e1f5e0f929d74253f6c1facb3fda88a867e7
SHA512 12088116126f7a991df5461d3daec1c30961b9935ff7d2d911f9f29f110068f94506d33b095f35f1149d27d8dc7ccc891fadb8a0f6521ac3814eab01d1a6c789
SSDEEP 12288:f5h/uGl4pwiBWH+fMcwbuOHJxOpn6TKHNlYq/wpsqlohYBVpio5+KphTI+Diz6DJ:d8wiB1WHJM+KtldePVko5++DxhVEu
TLSH
T109354A117E44CE11F0091233C3EF458957B0E961AAA6E32B7DBA3B6E55123A77C0D9CB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution dcrat infostealer persistence rat

Malware Config

Signatures

Family: DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/5780-1-0x0000000000030000-0x0000000000152000-memory.dmp	dcrat
behavioral2/files/0x000d00000001c54c-40.dat	dcrat

Process spawned unexpected child process 57 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4804	4820	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3552	4820	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3020	4820	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5484	4820	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1304	4820	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1800	4820	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2852	4820	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4800	4820	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3844	4820	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3684	4820	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1516	4820	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2292	4820	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1372	4820	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2320	4820	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2004	4820	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2140	4820	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4588	4820	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1592	4820	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1948	4820	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3048	4820	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1172	4820	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	548	4820	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4456	4820	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4948	4820	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5384	4820	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4640	4820	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4476	4820	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6020	4820	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4108	4820	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1176	4820	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	900	4820	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1312	4820	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3852	4820	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5956	4820	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	748	4820	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6112	4820	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2724	4820	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1892	4820	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2684	4820	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1672	4820	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1056	4820	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2816	4820	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5288	4820	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5692	4820	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4220	4820	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5920	4820	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2920	4820	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4524	4820	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5008	4820	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5772	4820	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2576	4820	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4992	4820	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3860	4820	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1944	4820	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2632	4820	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	256	4820	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3924	4820	schtasks.exe	89

Executes dropped EXE 19 IoCs

pid	Process
904	StartMenuExperienceHost.exe
1524	StartMenuExperienceHost.exe
1840	csrss.exe
4188	dllhost.exe
1516	ShellHost.exe
4356	csrss.exe
5812	ctfmon.exe
5328	fontdrvhost.exe
1844	smss.exe
6020	RuntimeBroker.exe
2868	StartMenuExperienceHost.exe
4732	OfficeClickToRun.exe
1652	WUDFHost.exe
4144	dllhost.exe
1512	lsass.exe
2724	sihost.exe
5008	explorer.exe
3208	StartMenuExperienceHost.exe
2100	RuntimeBroker.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ipinfo.io
8	ipinfo.io

Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs

execution

Visual Basic

T1059.005

pid	Process
5384	WScript.exe
1892	WScript.exe

SmartAssembly .NET packer 1 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral2/memory/5780-11-0x0000000002350000-0x000000000235A000-memory.dmp	SmartAssembly

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsPowerShell\Modules\Pester\lsass.exe	Chainperfnet.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Pester\6203df4a6bafc7	Chainperfnet.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\480b7989c529f6	Chainperfnet.exe
File created	C:\Program Files\Windows NT\TableTextService\en-US\RuntimeBroker.exe	Chainperfnet.exe
File created	C:\Program Files\ModifiableWindowsApps\fontdrvhost.exe	Chainperfnet.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\dllhost.exe	Chainperfnet.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\55b276f4edf653	Chainperfnet.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\66fc9ff0ee96c2	Chainperfnet.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\WUDFHost.exe	Chainperfnet.exe
File created	C:\Program Files\Windows NT\TableTextService\en-US\9e8d7a4ca61bd9	Chainperfnet.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\5940a34987c991	Chainperfnet.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\StartMenuExperienceHost.exe	Chainperfnet.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\sihost.exe	Chainperfnet.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\ShellComponents\OfficeClickToRun.exe	Chainperfnet.exe
File created	C:\Windows\ImmersiveControlPanel\ConstraintIndex\886983d96e3d3e	Chainperfnet.exe
File created	C:\Windows\SystemApps\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\Images\2a08264799fbe8	Chainperfnet.exe
File created	C:\Windows\bcastdvr\ctfmon.exe	Chainperfnet.exe
File created	C:\Windows\bcastdvr\26c12092da979c	Chainperfnet.exe
File created	C:\Windows\ShellComponents\e6c9b481da804f	Chainperfnet.exe
File created	C:\Windows\ImmersiveControlPanel\ConstraintIndex\csrss.exe	Chainperfnet.exe
File created	C:\Windows\SystemApps\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\Images\ShellHost.exe	Chainperfnet.exe
File created	C:\Windows\ImmersiveControlPanel\fr-FR\lsass.exe	Chainperfnet.exe
File created	C:\Windows\Containers\csrss.exe	Chainperfnet.exe
File created	C:\Windows\Containers\886983d96e3d3e	Chainperfnet.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings	StartMenuExperienceHost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 57 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2140	schtasks.exe
3552	schtasks.exe
4588	schtasks.exe
3844	schtasks.exe
1172	schtasks.exe
4992	schtasks.exe
3924	schtasks.exe
2852	schtasks.exe
1176	schtasks.exe
2684	schtasks.exe
1672	schtasks.exe
2920	schtasks.exe
1516	schtasks.exe
6020	schtasks.exe
5008	schtasks.exe
3684	schtasks.exe
4220	schtasks.exe
5920	schtasks.exe
1800	schtasks.exe
2292	schtasks.exe
1592	schtasks.exe
1948	schtasks.exe
2576	schtasks.exe
1372	schtasks.exe
4640	schtasks.exe
1312	schtasks.exe
3852	schtasks.exe
2724	schtasks.exe
2816	schtasks.exe
2004	schtasks.exe
748	schtasks.exe
5772	schtasks.exe
2320	schtasks.exe
5288	schtasks.exe
256	schtasks.exe
3020	schtasks.exe
5484	schtasks.exe
4800	schtasks.exe
4456	schtasks.exe
4108	schtasks.exe
5692	schtasks.exe
2632	schtasks.exe
1304	schtasks.exe
3860	schtasks.exe
4804	schtasks.exe
3048	schtasks.exe
5956	schtasks.exe
1056	schtasks.exe
4524	schtasks.exe
1944	schtasks.exe
5384	schtasks.exe
6112	schtasks.exe
4948	schtasks.exe
900	schtasks.exe
548	schtasks.exe
4476	schtasks.exe
1892	schtasks.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
5780	Chainperfnet.exe
5780	Chainperfnet.exe
5780	Chainperfnet.exe
5780	Chainperfnet.exe
5780	Chainperfnet.exe
5780	Chainperfnet.exe
5780	Chainperfnet.exe
5780	Chainperfnet.exe
5780	Chainperfnet.exe
5780	Chainperfnet.exe
5780	Chainperfnet.exe
5780	Chainperfnet.exe
5780	Chainperfnet.exe
5780	Chainperfnet.exe
5780	Chainperfnet.exe
5780	Chainperfnet.exe
5780	Chainperfnet.exe
5780	Chainperfnet.exe
5780	Chainperfnet.exe
1524	StartMenuExperienceHost.exe
1524	StartMenuExperienceHost.exe
1524	StartMenuExperienceHost.exe
1524	StartMenuExperienceHost.exe
1524	StartMenuExperienceHost.exe
1524	StartMenuExperienceHost.exe
1524	StartMenuExperienceHost.exe
1524	StartMenuExperienceHost.exe
1524	StartMenuExperienceHost.exe
1524	StartMenuExperienceHost.exe
1524	StartMenuExperienceHost.exe
1524	StartMenuExperienceHost.exe
1524	StartMenuExperienceHost.exe
1524	StartMenuExperienceHost.exe
1524	StartMenuExperienceHost.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	5780	Chainperfnet.exe
Token: SeDebugPrivilege	1524	StartMenuExperienceHost.exe
Token: SeDebugPrivilege	904	StartMenuExperienceHost.exe
Token: SeDebugPrivilege	1840	csrss.exe
Token: SeDebugPrivilege	4188	dllhost.exe
Token: SeDebugPrivilege	1516	ShellHost.exe
Token: SeDebugPrivilege	4356	csrss.exe
Token: SeDebugPrivilege	5812	ctfmon.exe
Token: SeDebugPrivilege	5328	fontdrvhost.exe
Token: SeDebugPrivilege	1844	smss.exe
Token: SeDebugPrivilege	6020	RuntimeBroker.exe
Token: SeDebugPrivilege	2868	StartMenuExperienceHost.exe
Token: SeDebugPrivilege	1652	WUDFHost.exe
Token: SeDebugPrivilege	4732	OfficeClickToRun.exe
Token: SeDebugPrivilege	2724	sihost.exe
Token: SeDebugPrivilege	4144	dllhost.exe
Token: SeDebugPrivilege	1512	lsass.exe
Token: SeDebugPrivilege	5008	explorer.exe
Token: SeDebugPrivilege	3208	StartMenuExperienceHost.exe
Token: SeDebugPrivilege	2100	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5780 wrote to memory of 1524	5780	Chainperfnet.exe	157
PID 1524 wrote to memory of 5384	1524	StartMenuExperienceHost.exe	174
PID 1524 wrote to memory of 1892	1524	StartMenuExperienceHost.exe	176

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Chainperfnet.exe
"C:\Users\Admin\AppData\Local\Temp\Chainperfnet.exe"
1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5780
- C:\Recovery\WindowsRE\StartMenuExperienceHost.exe
  "C:\Recovery\WindowsRE\StartMenuExperienceHost.exe"
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1524
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\08299a63-bbe5-46b7-b1a3-b0565a86b381.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:5384
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1cd47473-36cc-4a4f-bbdb-0803607a7e6f.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:1892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Windows\ImmersiveControlPanel\ConstraintIndex\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\ImmersiveControlPanel\ConstraintIndex\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Windows\ImmersiveControlPanel\ConstraintIndex\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ShellHostS" /sc MINUTE /mo 7 /tr "'C:\Windows\SystemApps\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\Images\ShellHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ShellHost" /sc ONLOGON /tr "'C:\Windows\SystemApps\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\Images\ShellHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ShellHostS" /sc MINUTE /mo 12 /tr "'C:\Windows\SystemApps\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\Images\ShellHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows NT\TableTextService\en-US\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows NT\TableTextService\en-US\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows NT\TableTextService\en-US\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ctfmonc" /sc MINUTE /mo 14 /tr "'C:\Windows\bcastdvr\ctfmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ctfmon" /sc ONLOGON /tr "'C:\Windows\bcastdvr\ctfmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ctfmonc" /sc MINUTE /mo 9 /tr "'C:\Windows\bcastdvr\ctfmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Windows\Containers\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\Containers\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Windows\Containers\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Windows.old\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows.old\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Windows.old\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Default User\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Program Files\WindowsPowerShell\Modules\Pester\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\Modules\Pester\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Program Files\WindowsPowerShell\Modules\Pester\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Windows.old\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows.old\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Windows.old\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WUDFHostW" /sc MINUTE /mo 7 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\WUDFHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WUDFHost" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\WUDFHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WUDFHostW" /sc MINUTE /mo 11 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\WUDFHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Users\Default User\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 9 /tr "'C:\Windows\ShellComponents\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Windows\ShellComponents\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 12 /tr "'C:\Windows\ShellComponents\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:748

C:\Windows\ImmersiveControlPanel\ConstraintIndex\csrss.exe
"C:\Windows\ImmersiveControlPanel\ConstraintIndex\csrss.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1840

C:\Recovery\WindowsRE\StartMenuExperienceHost.exe
"C:\Recovery\WindowsRE\StartMenuExperienceHost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:904

C:\Program Files (x86)\Mozilla Maintenance Service\dllhost.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\dllhost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4188

C:\Windows\SystemApps\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\Images\ShellHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\Images\ShellHost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1516

C:\Windows\Containers\csrss.exe
"C:\Windows\Containers\csrss.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4356

C:\Windows\bcastdvr\ctfmon.exe
"C:\Windows\bcastdvr\ctfmon.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5812

C:\Windows.old\fontdrvhost.exe
"C:\Windows.old\fontdrvhost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5328

C:\Users\Default User\smss.exe
"C:\Users\Default User\smss.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1844

C:\Program Files\Windows NT\TableTextService\en-US\RuntimeBroker.exe
"C:\Program Files\Windows NT\TableTextService\en-US\RuntimeBroker.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6020

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\StartMenuExperienceHost.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\StartMenuExperienceHost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2868

C:\Windows\ShellComponents\OfficeClickToRun.exe
"C:\Windows\ShellComponents\OfficeClickToRun.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4732

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\WUDFHost.exe
"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\WUDFHost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1652

C:\Recovery\WindowsRE\dllhost.exe
"C:\Recovery\WindowsRE\dllhost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4144

C:\Program Files\WindowsPowerShell\Modules\Pester\lsass.exe
"C:\Program Files\WindowsPowerShell\Modules\Pester\lsass.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1512

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\sihost.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\sihost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2724

C:\Windows.old\explorer.exe
"C:\Windows.old\explorer.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5008

C:\Users\Default User\StartMenuExperienceHost.exe
"C:\Users\Default User\StartMenuExperienceHost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3208

C:\Recovery\WindowsRE\RuntimeBroker.exe
"C:\Recovery\WindowsRE\RuntimeBroker.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartMenuExperienceHost.exe

Path C:\Recovery\WindowsRE\StartMenuExperienceHost.exe
Size 1.1MB
SHA256 fa245486b3fd0ed56fc169c0c57cad8b5a8390bd4e6b04765148cb5d2d8e0f2e
MD5 8d94c3b91f4c437c0989338d703affc9
SHA1 8da9e1f5e0f929d74253f6c1facb3fda88a867e7
SHA512 12088116126f7a991df5461d3daec1c30961b9935ff7d2d911f9f29f110068f94506d33b095f35f1149d27d8dc7ccc891fadb8a0f6521ac3814eab01d1a6c789
SSDEEP 12288:f5h/uGl4pwiBWH+fMcwbuOHJxOpn6TKHNlYq/wpsqlohYBVpio5+KphTI+Diz6DJ:d8wiB1WHJM+KtldePVko5++DxhVEu
TLSH
T109354A117E44CE11F0091233C3EF458957B0E961AAA6E32B7DBA3B6E55123A77C0D9CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

08299a63-bbe5-46b7-b1a3-b0565a86b381.vbs

Path C:\Users\Admin\AppData\Local\Temp\08299a63-bbe5-46b7-b1a3-b0565a86b381.vbs
Size 725B
SHA256 c684457d76315d0628185c2c15ae5833f42e989be86264b19b23410ad875be70
MD5 17a6780445f5d30472afa6d89f7311af
SHA1 f5cf3a0e360cbb865b87ad5d553c38b5411665ac
SHA512 056ab6b784eac3db92e8bdab659ea2f48b3cf3ff15b4bdd22f629f281b05f873c8e8b958af80099ad1516c83267c1ddfa861f532e5312f744bcfe6e198aa0f7d
TLSH
T18F01C016BE0BE67064B52340D1FA457F6ED880592136BC5BB950E46C2706D2504EC4EE
MD5 SHA1 SHA512 TLSH

Submit Download

1cd47473-36cc-4a4f-bbdb-0803607a7e6f.vbs

Path C:\Users\Admin\AppData\Local\Temp\1cd47473-36cc-4a4f-bbdb-0803607a7e6f.vbs
Size 501B
SHA256 c04bfe6775c2ff2164bef534f8a9c5f0a774a3e3ead7ffe44ce239c15ce30986
MD5 e57582f63f296b9c32dd452cc917c2f1
SHA1 e6763569c4111ece08ddd7f08bdcc706d23f6666
SHA512 2ce63c3877d2d24732bd10e838187642e0124d49cebe90ce4db31bb8c13a6295140d882f66064b8b49332287684170c080e797dba0feaa4040e0311757560418
TLSH
T140F09E1DBF06C734C510034253FA958F8A6C845E7274D1996908D8DD32512390EFA1CD
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5780-12-0x0000000002370000-0x000000000237C000-memory.dmp

Download

memory/5780-10-0x0000000002330000-0x0000000002346000-memory.dmp

Download

memory/5780-6-0x00007FFA84E80000-0x00007FFA85824000-memory.dmp

Download

memory/5780-5-0x00007FFA84E80000-0x00007FFA85824000-memory.dmp

Download

memory/5780-7-0x0000000002310000-0x000000000231E000-memory.dmp

Download

memory/5780-8-0x00007FFA84E80000-0x00007FFA85824000-memory.dmp

Download

memory/5780-13-0x00007FFA84E80000-0x00007FFA85824000-memory.dmp

Download

memory/5780-15-0x00007FFA84E80000-0x00007FFA85824000-memory.dmp

Download

memory/5780-16-0x00007FFA84E80000-0x00007FFA85824000-memory.dmp

Download

memory/5780-0-0x00007FFA8500F000-0x00007FFA85010000-memory.dmp

Download

memory/5780-11-0x0000000002350000-0x000000000235A000-memory.dmp

Download

memory/5780-4-0x00007FFA84E80000-0x00007FFA85824000-memory.dmp

Download

memory/5780-23-0x00007FFA84E80000-0x00007FFA85824000-memory.dmp

Download

memory/5780-24-0x00007FFA84E80000-0x00007FFA85824000-memory.dmp

Download

memory/5780-25-0x00007FFA84E80000-0x00007FFA85824000-memory.dmp

Download

memory/5780-26-0x00007FFA84E80000-0x00007FFA85824000-memory.dmp

Download

memory/5780-9-0x0000000002320000-0x0000000002328000-memory.dmp

Download

memory/5780-3-0x00007FFA84E80000-0x00007FFA85824000-memory.dmp

Download

memory/5780-44-0x00007FFA84E80000-0x00007FFA85824000-memory.dmp

Download

memory/5780-2-0x00007FFA84E80000-0x00007FFA85824000-memory.dmp

Download

memory/5780-1-0x0000000000030000-0x0000000000152000-memory.dmp

Download