Overview

overview

10

Static

static

10

port.exe

windows10-ltsc 2021-x64

10

Analysis

  • max time kernel
    100s
  • max time network
    146s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20241023-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    30-11-2024 10:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    port.exe

  • Size

    68KB

  • MD5

    452793cc9852ff9331bef9721e3432ed

  • SHA1

    a98e522befc7646275aff5e055016976b51c15ae

  • SHA256

    346885d414b006c9e212ae9c1b9d57c433d409fde8f811abb7015ec4230d7183

  • SHA512

    928706e4106b3f90c76dbf7c91e5a2c046e4e8caa63817388c5eb338ccdc0318c4bc4572acc6ea4e331ac63224027bbe238ce763277aeaa5adf081d69e06d2d8

  • SSDEEP

    1536:loApt3frgHIscp60EbmhUogOntu6nHZOANEI:PM1cptEboJgOntJOANEI

Score
10/10
stormkittyxredxwormbackdoorcredential_accessdiscoverypersistenceratspywarestealertrojan

Malware Config

Extracted

Family

xworm

C2

more-scott.gl.at.ply.gg:4043

Attributes
  • Install_directory

    %Userprofile%

  • install_file

    USB.exe

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Signatures

  • Contains code to disable Windows Defender 1 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Xworm Payload 1 IoCs
  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty
  • StormKitty payload 1 IoCs
  • Stormkitty family
    stormkitty
  • Xred

    Xred is backdoor written in Delphi.

    backdoorxred
  • Xred family
    xred
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Drops startup file 2 IoCs
  • Executes dropped EXE 6 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 12 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 7 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Enumerates system info in registry 2 TTPs 5 IoCs
  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 54 IoCs
  • Modifies registry class 64 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 62 IoCs
  • Suspicious use of SendNotifyMessage 30 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:624
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        2⤵
          PID:664
      • C:\Windows\system32\lsass.exe
        C:\Windows\system32\lsass.exe
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:676
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
        1⤵
          PID:964
        • C:\Windows\System32\svchost.exe
          C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
          1⤵
            PID:416
          • C:\Windows\System32\svchost.exe
            C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
            1⤵
              PID:396
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
              1⤵
                PID:432
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
                1⤵
                  PID:1092
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
                  1⤵
                    PID:1100
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
                    1⤵
                      PID:1216
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
                      1⤵
                      • Drops file in System32 directory
                      PID:1260
                      • C:\Windows\system32\taskhostw.exe
                        taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
                        2⤵
                          PID:324
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
                        1⤵
                          PID:1360
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                          1⤵
                            PID:1420
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
                            1⤵
                              PID:1444
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
                              1⤵
                                PID:1476
                              • C:\Windows\System32\svchost.exe
                                C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
                                1⤵
                                  PID:1484
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
                                  1⤵
                                    PID:1564
                                    • C:\Windows\system32\sihost.exe
                                      sihost.exe
                                      2⤵
                                      • Modifies registry class
                                      PID:3032
                                  • C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
                                    1⤵
                                      PID:1632
                                    • C:\Windows\System32\svchost.exe
                                      C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
                                      1⤵
                                        PID:1660
                                      • C:\Windows\System32\svchost.exe
                                        C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
                                        1⤵
                                          PID:1724
                                        • C:\Windows\System32\svchost.exe
                                          C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                          1⤵
                                            PID:1800
                                            • C:\Windows\system32\AUDIODG.EXE
                                              C:\Windows\system32\AUDIODG.EXE 0x3f4 0x304
                                              2⤵
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:1192
                                          • C:\Windows\System32\svchost.exe
                                            C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
                                            1⤵
                                              PID:1820
                                            • C:\Windows\system32\svchost.exe
                                              C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
                                              1⤵
                                                PID:1920
                                              • C:\Windows\System32\svchost.exe
                                                C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                1⤵
                                                  PID:1928
                                                • C:\Windows\system32\svchost.exe
                                                  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                  1⤵
                                                    PID:1944
                                                  • C:\Windows\system32\svchost.exe
                                                    C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
                                                    1⤵
                                                      PID:1976
                                                    • C:\Windows\System32\svchost.exe
                                                      C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
                                                      1⤵
                                                        PID:1700
                                                      • C:\Windows\System32\spoolsv.exe
                                                        C:\Windows\System32\spoolsv.exe
                                                        1⤵
                                                          PID:2140
                                                        • C:\Windows\System32\svchost.exe
                                                          C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
                                                          1⤵
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:2244
                                                        • C:\Windows\System32\svchost.exe
                                                          C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
                                                          1⤵
                                                            PID:2352
                                                          • C:\Windows\system32\svchost.exe
                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
                                                            1⤵
                                                              PID:2492
                                                            • C:\Windows\system32\svchost.exe
                                                              C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
                                                              1⤵
                                                                PID:2500
                                                              • C:\Windows\system32\svchost.exe
                                                                C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
                                                                1⤵
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:2560
                                                              • C:\Windows\system32\svchost.exe
                                                                C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
                                                                1⤵
                                                                • Drops file in System32 directory
                                                                • Modifies data under HKEY_USERS
                                                                PID:2636
                                                              • C:\Windows\system32\svchost.exe
                                                                C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
                                                                1⤵
                                                                  PID:2680
                                                                • C:\Windows\sysmon.exe
                                                                  C:\Windows\sysmon.exe
                                                                  1⤵
                                                                    PID:2708
                                                                  • C:\Windows\System32\svchost.exe
                                                                    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
                                                                    1⤵
                                                                      PID:2752
                                                                    • C:\Windows\system32\svchost.exe
                                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
                                                                      1⤵
                                                                        PID:2768
                                                                      • C:\Windows\system32\svchost.exe
                                                                        C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                                                                        1⤵
                                                                          PID:2012
                                                                        • C:\Windows\system32\svchost.exe
                                                                          C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
                                                                          1⤵
                                                                            PID:3100
                                                                          • C:\Windows\system32\wbem\unsecapp.exe
                                                                            C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                                                            1⤵
                                                                              PID:3168
                                                                            • C:\Windows\system32\svchost.exe
                                                                              C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
                                                                              1⤵
                                                                                PID:3460
                                                                              • C:\Windows\Explorer.EXE
                                                                                C:\Windows\Explorer.EXE
                                                                                1⤵
                                                                                • Suspicious behavior: GetForegroundWindowSpam
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                • Suspicious use of FindShellTrayWindow
                                                                                • Suspicious use of SendNotifyMessage
                                                                                PID:3580
                                                                                • C:\Users\Admin\AppData\Local\Temp\port.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\port.exe"
                                                                                  2⤵
                                                                                  • Checks computer location settings
                                                                                  • Drops startup file
                                                                                  • Adds Run key to start application
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:3016
                                                                                  • C:\Users\Admin\AppData\Local\Temp\ceihti.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\ceihti.exe"
                                                                                    3⤵
                                                                                    • Checks computer location settings
                                                                                    • Executes dropped EXE
                                                                                    • Adds Run key to start application
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:2788
                                                                                    • C:\Users\Admin\AppData\Local\Temp\._cache_ceihti.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\._cache_ceihti.exe"
                                                                                      4⤵
                                                                                      • Checks computer location settings
                                                                                      • Executes dropped EXE
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:3912
                                                                                      • C:\Users\Admin\AppData\Local\Temp\MasonMBR-SLEEP.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\MasonMBR-SLEEP.exe"
                                                                                        5⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:3000
                                                                                      • C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe"
                                                                                        5⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:4476
                                                                                      • C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe"
                                                                                        5⤵
                                                                                        • Executes dropped EXE
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:3324
                                                                                      • C:\Windows\System32\schtasks.exe
                                                                                        "C:\Windows\System32\schtasks.exe" /Create /F /TN "MasonMBR" /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\\MasonMBR.exe" /RL HIGHEST
                                                                                        5⤵
                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                        PID:4904
                                                                                      • C:\Windows\system32\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp5270.tmp.bat""
                                                                                        5⤵
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:1400
                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                          6⤵
                                                                                            PID:4936
                                                                                          • C:\Windows\system32\timeout.exe
                                                                                            timeout 3
                                                                                            6⤵
                                                                                            • Delays execution with timeout.exe
                                                                                            PID:1160
                                                                                      • C:\ProgramData\Synaptics\Synaptics.exe
                                                                                        "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                                                        4⤵
                                                                                        • Executes dropped EXE
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:2208
                                                                                    • C:\Windows\SYSTEM32\taskkill.exe
                                                                                      taskkill /F /IM explorer.exe
                                                                                      3⤵
                                                                                      • Kills process with taskkill
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:2380
                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                        4⤵
                                                                                          PID:1496
                                                                                      • C:\Windows\explorer.exe
                                                                                        "C:\Windows\explorer.exe"
                                                                                        3⤵
                                                                                        • Boot or Logon Autostart Execution: Active Setup
                                                                                        • Enumerates connected drives
                                                                                        • Checks SCSI registry key(s)
                                                                                        • Modifies Internet Explorer settings
                                                                                        • Suspicious behavior: AddClipboardFormatListener
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                        • Suspicious use of SendNotifyMessage
                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                        PID:4664
                                                                                      • C:\Windows\explorer.exe
                                                                                        "C:\Windows\explorer.exe"
                                                                                        3⤵
                                                                                        • Modifies registry class
                                                                                        PID:3748
                                                                                  • C:\Windows\system32\svchost.exe
                                                                                    C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                                                                                    1⤵
                                                                                      PID:3708
                                                                                    • C:\Windows\System32\RuntimeBroker.exe
                                                                                      C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                      1⤵
                                                                                      • Modifies registry class
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:3984
                                                                                    • C:\Windows\System32\RuntimeBroker.exe
                                                                                      C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                      1⤵
                                                                                        PID:4124
                                                                                      • C:\Windows\system32\DllHost.exe
                                                                                        C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                        1⤵
                                                                                          PID:4348
                                                                                        • C:\Windows\System32\svchost.exe
                                                                                          C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
                                                                                          1⤵
                                                                                            PID:4632
                                                                                          • C:\Windows\system32\svchost.exe
                                                                                            C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
                                                                                            1⤵
                                                                                            • Modifies data under HKEY_USERS
                                                                                            PID:3320
                                                                                          • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                                                                                            "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                                                                                            1⤵
                                                                                            • Drops file in System32 directory
                                                                                            • Modifies data under HKEY_USERS
                                                                                            PID:5036
                                                                                          • C:\Windows\system32\SppExtComObj.exe
                                                                                            C:\Windows\system32\SppExtComObj.exe -Embedding
                                                                                            1⤵
                                                                                              PID:2340
                                                                                            • C:\Windows\System32\svchost.exe
                                                                                              C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                                                                                              1⤵
                                                                                                PID:4004
                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                                                                                                1⤵
                                                                                                  PID:4768
                                                                                                • C:\Windows\system32\DllHost.exe
                                                                                                  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                  1⤵
                                                                                                    PID:3356
                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                    C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                                                                                    1⤵
                                                                                                      PID:2880
                                                                                                    • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe
                                                                                                      "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXk0k6mrh4r2q0ct33a9wgbez0x7v9cz5y.mca
                                                                                                      1⤵
                                                                                                        PID:3236
                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
                                                                                                        1⤵
                                                                                                          PID:852
                                                                                                        • C:\Windows\system32\wbem\wmiprvse.exe
                                                                                                          C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                                                                          1⤵
                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                          PID:2376
                                                                                                        • C:\Windows\System32\RuntimeBroker.exe
                                                                                                          C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                          1⤵
                                                                                                            PID:3476
                                                                                                          • C:\Windows\servicing\TrustedInstaller.exe
                                                                                                            C:\Windows\servicing\TrustedInstaller.exe
                                                                                                            1⤵
                                                                                                              PID:2288
                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                              C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
                                                                                                              1⤵
                                                                                                                PID:3608
                                                                                                              • C:\Windows\System32\mousocoreworker.exe
                                                                                                                C:\Windows\System32\mousocoreworker.exe -Embedding
                                                                                                                1⤵
                                                                                                                • Checks processor information in registry
                                                                                                                • Enumerates system info in registry
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                PID:1876
                                                                                                              • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                                                                                                                "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
                                                                                                                1⤵
                                                                                                                • Checks processor information in registry
                                                                                                                • Enumerates system info in registry
                                                                                                                • Suspicious behavior: AddClipboardFormatListener
                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                PID:3740
                                                                                                              • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                1⤵
                                                                                                                  PID:4644
                                                                                                                • C:\Windows\system32\DllHost.exe
                                                                                                                  C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                                                                                                                  1⤵
                                                                                                                    PID:5028
                                                                                                                  • C:\Windows\System32\rundll32.exe
                                                                                                                    C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
                                                                                                                    1⤵
                                                                                                                      PID:2488
                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                      1⤵
                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                      PID:2924
                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                      1⤵
                                                                                                                      • Modifies Internet Explorer settings
                                                                                                                      • Modifies registry class
                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                      PID:1696
                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                      C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
                                                                                                                      1⤵
                                                                                                                        PID:4260

                                                                                                                      Network

                                                                                                                      MITRE ATT&CK Enterprise v15

                                                                                                                      Reconnaissance

                                                                                                                      Resource Development

                                                                                                                      Initial Access

                                                                                                                      Execution

                                                                                                                      Scheduled Task/Job

                                                                                                                      1
                                                                                                                      T1053

                                                                                                                      Scheduled Task

                                                                                                                      1
                                                                                                                      T1053.005

                                                                                                                      Persistence

                                                                                                                      Boot or Logon Autostart Execution

                                                                                                                      2
                                                                                                                      T1547

                                                                                                                      Active Setup

                                                                                                                      1
                                                                                                                      T1547.014

                                                                                                                      Registry Run Keys / Startup Folder

                                                                                                                      1
                                                                                                                      T1547.001

                                                                                                                      Scheduled Task/Job

                                                                                                                      1
                                                                                                                      T1053

                                                                                                                      Scheduled Task

                                                                                                                      1
                                                                                                                      T1053.005

                                                                                                                      Privilege Escalation

                                                                                                                      Boot or Logon Autostart Execution

                                                                                                                      2
                                                                                                                      T1547

                                                                                                                      Active Setup

                                                                                                                      1
                                                                                                                      T1547.014

                                                                                                                      Registry Run Keys / Startup Folder

                                                                                                                      1
                                                                                                                      T1547.001

                                                                                                                      Scheduled Task/Job

                                                                                                                      1
                                                                                                                      T1053

                                                                                                                      Scheduled Task

                                                                                                                      1
                                                                                                                      T1053.005

                                                                                                                      Defense Evasion

                                                                                                                      Modify Registry

                                                                                                                      3
                                                                                                                      T1112

                                                                                                                      Credential Access

                                                                                                                      Credentials from Password Stores

                                                                                                                      2
                                                                                                                      T1555

                                                                                                                      Credentials from Web Browsers

                                                                                                                      1
                                                                                                                      T1555.003

                                                                                                                      Windows Credential Manager

                                                                                                                      1
                                                                                                                      T1555.004

                                                                                                                      Unsecured Credentials

                                                                                                                      1
                                                                                                                      T1552

                                                                                                                      Credentials In Files

                                                                                                                      1
                                                                                                                      T1552.001

                                                                                                                      Discovery

                                                                                                                      Browser Information Discovery

                                                                                                                      1
                                                                                                                      T1217

                                                                                                                      Peripheral Device Discovery

                                                                                                                      2
                                                                                                                      T1120

                                                                                                                      Query Registry

                                                                                                                      6
                                                                                                                      T1012

                                                                                                                      System Information Discovery

                                                                                                                      6
                                                                                                                      T1082

                                                                                                                      System Location Discovery

                                                                                                                      1
                                                                                                                      T1614

                                                                                                                      System Language Discovery

                                                                                                                      1
                                                                                                                      T1614.001

                                                                                                                      Lateral Movement

                                                                                                                      Collection

                                                                                                                      Data from Local System

                                                                                                                      1
                                                                                                                      T1005

                                                                                                                      Command and Control

                                                                                                                      Exfiltration

                                                                                                                      Impact

                                                                                                                      Replay Monitor

                                                                                                                      Loading Replay Monitor...

                                                                                                                      Downloads

                                                                                                                      • C:\ProgramData\Synaptics\Synaptics.exe
                                                                                                                        Filesize

                                                                                                                        753KB

                                                                                                                        MD5

                                                                                                                        7a955442c98c67a167c9957ffbf87d62

                                                                                                                        SHA1

                                                                                                                        005ce1b56db565be9a7eaaa751cec869cf3f83b1

                                                                                                                        SHA256

                                                                                                                        44789506a8b8a64e5917a8b64bda74ef3ab1ea1d3688c7d674f34b87e5687913

                                                                                                                        SHA512

                                                                                                                        fceea074b22246bc1be09e0db1ffbbef68b2fc8a3690d2973f6277999d4acac3be90319c24305106cfdfe2bcdd8b2b90cd5e9ad8b373da2fbb6e5420be66d1e6

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A
                                                                                                                        Filesize

                                                                                                                        412B

                                                                                                                        MD5

                                                                                                                        1ae6aa1fa906292df25fa8c7c8b08419

                                                                                                                        SHA1

                                                                                                                        266742c80e512fd5f46fd18e80530f0911666c5a

                                                                                                                        SHA256

                                                                                                                        67177aede1b22d1a0dee1782900c8664e869d4df1e79a36b7aa8bec66c4a9aa9

                                                                                                                        SHA512

                                                                                                                        080d9a6cb9a6b8f45a1691a4e55a538033040a98379bd693f3e5513fed48fa02cdb674cbcb1d2966148e3cbaa54b074e00a53effccfeb03ea6e41357d229afa7

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
                                                                                                                        Filesize

                                                                                                                        414KB

                                                                                                                        MD5

                                                                                                                        ab79489e9704fc9cc9d8bee4f8e17ec5

                                                                                                                        SHA1

                                                                                                                        b2e19a89b43d537bb5b02ee9ca2418f027259c1e

                                                                                                                        SHA256

                                                                                                                        4d71760d6f3159849068b635ab4c39b9b747d899f03670533971a62d262c264e

                                                                                                                        SHA512

                                                                                                                        60d11ee023b9a045c4b59b88311f001fcf4856e27837a1ffd6ecab0203e5199ee077d85c5217e0f0b94e0bff93b14c3680816b6fbf9d42ee2eff5c23d9a13edd

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133774361376135018.txt
                                                                                                                        Filesize

                                                                                                                        82KB

                                                                                                                        MD5

                                                                                                                        de0ecd0543294977a9bb9748b29376d9

                                                                                                                        SHA1

                                                                                                                        ce0d9e2c29cacdbad4f333898582c5eae302b6e2

                                                                                                                        SHA256

                                                                                                                        14f2710c5241c4131b8b8d7646263082401a769690aeebc12b5bfad85354336e

                                                                                                                        SHA512

                                                                                                                        d29ddd02becb48526ae66743a14c41f521be68e25da8aa2d2ffa1bcb23ce74892a632988a92f67ab3345419b6bbc06bc40800f26a8057cb1e28dfcc4fda1a4ad

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\._cache_ceihti.exe
                                                                                                                        Filesize

                                                                                                                        535KB

                                                                                                                        MD5

                                                                                                                        82bf26203c5d76dfa3a591f1cb60d7b5

                                                                                                                        SHA1

                                                                                                                        93bf418f64ec701fd0d3232a00a167d04ba9a6d2

                                                                                                                        SHA256

                                                                                                                        2b6455abbf84755be4dcf840ebbfed9c480dced7bd74806bafee05465a5e752d

                                                                                                                        SHA512

                                                                                                                        6a896c274958467e18579affe68a2e0acb68ea633715920d244974765dbf577ce7558cb3dc467a69a656cb82c2f588565f71c4413b5dedc1005fba35303ed2f3

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\92585E00
                                                                                                                        Filesize

                                                                                                                        24KB

                                                                                                                        MD5

                                                                                                                        85dde7eeadf6a5361622cd07a999377b

                                                                                                                        SHA1

                                                                                                                        94191c1a3ba744dc6520c0390d2f2d1c7c0e421b

                                                                                                                        SHA256

                                                                                                                        188753e772b5a20d31c78c284ab0276a189f7d9eae106902b7f6a9b8ce51224b

                                                                                                                        SHA512

                                                                                                                        75df886215ad0e104fa1c85d11ce8d68794fd2e60855f5ebce6fe787ce5cd39c8c04b6cd4c3b217541fdfdf914221ac175e1150d2822df0305d0994306e9c90b

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\FETtbdlo.xlsm
                                                                                                                        Filesize

                                                                                                                        17KB

                                                                                                                        MD5

                                                                                                                        e566fc53051035e1e6fd0ed1823de0f9

                                                                                                                        SHA1

                                                                                                                        00bc96c48b98676ecd67e81a6f1d7754e4156044

                                                                                                                        SHA256

                                                                                                                        8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

                                                                                                                        SHA512

                                                                                                                        a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe
                                                                                                                        Filesize

                                                                                                                        61KB

                                                                                                                        MD5

                                                                                                                        2f9823efd49a6f8fc32ba52d75e620a4

                                                                                                                        SHA1

                                                                                                                        39f79bc2bba2f33f2e82da2dee4c8cf3be052b7e

                                                                                                                        SHA256

                                                                                                                        57eff2792a929b479b3e3bb9a25bbe750034dcba4213e2abb8865ff2268b53f6

                                                                                                                        SHA512

                                                                                                                        2f68ddb1d7d070f7d8675791f8ccc3b9d73236834f1bc787afdf1074d4d17601f77e53a98024a12e29119c5c38333cd7f6200a186e2ba96fc4186c86ca2cb6ad

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\MasonMBR-SLEEP.exe
                                                                                                                        Filesize

                                                                                                                        65KB

                                                                                                                        MD5

                                                                                                                        f006d2343d121bd2043925e87063fde7

                                                                                                                        SHA1

                                                                                                                        402799473ca52edb826a37e0042456032db121f3

                                                                                                                        SHA256

                                                                                                                        de93250a0f249700407cd893e1b4d6b167c5e909b4b8f09cbefbbae473f4ad93

                                                                                                                        SHA512

                                                                                                                        707c803508308fa0d002aa31187476cf1b000118f9b0d89982ab60a674de09f028ae860c3dbdad9fa902ee4e9d0771f8fa79e356bb2ae8bf4f2c57d61f3e68e0

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe
                                                                                                                        Filesize

                                                                                                                        161KB

                                                                                                                        MD5

                                                                                                                        94f1ab3a068f83b32639579ec9c5d025

                                                                                                                        SHA1

                                                                                                                        38f3d5bc5de46feb8de093d11329766b8e2054ae

                                                                                                                        SHA256

                                                                                                                        879cc20b41635709bb304e315aaa5ca4708b480a1bfc2f4935fcf2215188efb0

                                                                                                                        SHA512

                                                                                                                        44d5236a804d63302b21ca25ebc148a64605508d03c990a244c44ceb8630849da0510b7b2d0bee72e01ca6681e2d86d7e6aee8847674a26f0028d149b9abee0c

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ceihti.exe
                                                                                                                        Filesize

                                                                                                                        1.3MB

                                                                                                                        MD5

                                                                                                                        8e7ff77e00c0f1bc164dd3af58777395

                                                                                                                        SHA1

                                                                                                                        1821a02a9eecb1dbf8d3163ce54289a5a6debeba

                                                                                                                        SHA256

                                                                                                                        b0d1482a6570ed53cc1ec9aa78fdab8e769c1813838b3ca9c32e42ff1a56d66e

                                                                                                                        SHA512

                                                                                                                        aa3f9f6f7f49c002873cf675c2f9ebabbd6d8af1d043f984018c204e5349f267fdabf47a5cb31c18d75ddf5523ee93adaaeb73da9edb0d23bb086ff053eafc2a

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\tmp5270.tmp.bat
                                                                                                                        Filesize

                                                                                                                        166B

                                                                                                                        MD5

                                                                                                                        910851f0a2e434f13db4bc6723ada5b8

                                                                                                                        SHA1

                                                                                                                        c04a187f562244335ee4a9067fa4ebf270d99dc0

                                                                                                                        SHA256

                                                                                                                        fd66759be0d4c7098a47a356a15e765caeb9e22f55af18aa74fe9441fbcb6bda

                                                                                                                        SHA512

                                                                                                                        a154311a6c5949708bea033d681d28921a3b2300c6135b0156088b2427935616aee01d2d9ee7f0076c8d9eb1f2ca05cc956e1fcb739d45393662d58c3c4a7931

                                                                                                                        Download Submit

                                                                                                                      • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work
                                                                                                                        Filesize

                                                                                                                        3KB

                                                                                                                        MD5

                                                                                                                        4838ee953dab2c7a1bf57e0c6620a79d

                                                                                                                        SHA1

                                                                                                                        8c39cd200f9ffa77739ff686036d0449984f1323

                                                                                                                        SHA256

                                                                                                                        22c798e00c4793749eac39cfb6ea3dd75112fd4453a3706e839038a64504d45d

                                                                                                                        SHA512

                                                                                                                        066782b16e6e580e2861013c530d22d62c5ba0f217428cc0228ad45b855e979a86d2d04f553f3751cf7d063c6863cb7ea9c86807e7f89c7e0ae12481af65af76

                                                                                                                        Download Submit

                                                                                                                      • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work
                                                                                                                        Filesize

                                                                                                                        3KB

                                                                                                                        MD5

                                                                                                                        8e64ab95d5d2c4c1e7a757624cb1fffa

                                                                                                                        SHA1

                                                                                                                        9889f93ad60bacb07683b4a23c40aa32954646d8

                                                                                                                        SHA256

                                                                                                                        dff8902430dcae2fba05fc7f54157c4bc8a7445ed488c1d5727947a0c07075d6

                                                                                                                        SHA512

                                                                                                                        3ecc166686c1d7d61e91ec972244118980bf626a88123b87136695ac206e159933ad9f9feb3fd565713dd5d99038f427b845637c51a57497f0ac716de3a7973c

                                                                                                                        Download Submit

                                                                                                                      • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work
                                                                                                                        Filesize

                                                                                                                        3KB

                                                                                                                        MD5

                                                                                                                        c6086d02f8ce044f5fa07a98303dc7eb

                                                                                                                        SHA1

                                                                                                                        6116247e9d098b276b476c9f4c434f55d469129c

                                                                                                                        SHA256

                                                                                                                        8901d9c9aea465da4ea7aa874610a90b8cf0a71eba0e321cf9675fceee0b54a0

                                                                                                                        SHA512

                                                                                                                        1876d8fc1a8ac83aadb725100ea7a1791bd62d4d0edc1b78802e0bffe458f309a66dc97e1b9da60dd52b8cb80bf471ccb5f8480e6192c9eb2a13eac36462d27a

                                                                                                                        Download Submit

                                                                                                                      • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work
                                                                                                                        Filesize

                                                                                                                        3KB

                                                                                                                        MD5

                                                                                                                        39b9eb9d1a56bc1792c844c425bd1dec

                                                                                                                        SHA1

                                                                                                                        db5a91082fa14eeb6550cbc994d34ebd95341df9

                                                                                                                        SHA256

                                                                                                                        acade97e8a1d30477d0dc3fdfea70c2c617c369b56115ec708ed8a2cfdbc3692

                                                                                                                        SHA512

                                                                                                                        255b1c1c456b20e6e3415540ef8af58e723f965d1fa782da44a6bbc81b43d8a31c5681777ba885f91ed2dae480bc2a4023e01fe2986857b13323f0459520eb51

                                                                                                                        Download Submit

                                                                                                                      • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work
                                                                                                                        Filesize

                                                                                                                        2KB

                                                                                                                        MD5

                                                                                                                        4ac1741ceb19f5a983079b2c5f344f5d

                                                                                                                        SHA1

                                                                                                                        f1ebd93fbade2e035cd59e970787b8042cdd0f3b

                                                                                                                        SHA256

                                                                                                                        7df73f71214cdd2f2d477d6c2c65f6e4c2f5955fc669cde9c583b0ff9553ecdc

                                                                                                                        SHA512

                                                                                                                        583706069a7c0b22926fa22fc7bedcca9d6750d1542a1125b688fbb0595baf6cefc76e7b6e49c1415c782a21d0dd504c78fa36efad5f29f2fd5d69cc45ad8dcd

                                                                                                                        Download Submit

                                                                                                                      • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work
                                                                                                                        Filesize

                                                                                                                        2KB

                                                                                                                        MD5

                                                                                                                        a9124c4c97cba8a07a8204fac1696c8e

                                                                                                                        SHA1

                                                                                                                        1f27d80280e03762c7b16781608786f5a98ff434

                                                                                                                        SHA256

                                                                                                                        8ad3d28aeff847bc5fb8035cbc7c71e88a4ee547821a8e1a3ea6661ee6014b21

                                                                                                                        SHA512

                                                                                                                        537caaa75ac1e257c6b247f9680c3b9e79156ea1bcb3f1326e969a774db33b3c906800813ca6f79369c799a62f4260c91c6dd9a6cace3af25b7dbea5a73e0392

                                                                                                                        Download Submit

                                                                                                                      • memory/396-283-0x00007FF89D190000-0x00007FF89D1A0000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        64KB

                                                                                                                        Download

                                                                                                                      • memory/396-282-0x00000204C6970000-0x00000204C699B000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        172KB

                                                                                                                        Download

                                                                                                                      • memory/416-280-0x00007FF89D190000-0x00007FF89D1A0000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        64KB

                                                                                                                        Download

                                                                                                                      • memory/416-279-0x0000027EEEB60000-0x0000027EEEB8B000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        172KB

                                                                                                                        Download

                                                                                                                      • memory/432-286-0x00007FF89D190000-0x00007FF89D1A0000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        64KB

                                                                                                                        Download

                                                                                                                      • memory/432-285-0x000001C141740000-0x000001C14176B000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        172KB

                                                                                                                        Download

                                                                                                                      • memory/624-256-0x000001F04E900000-0x000001F04E92B000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        172KB

                                                                                                                        Download

                                                                                                                      • memory/624-257-0x00007FF89D190000-0x00007FF89D1A0000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        64KB

                                                                                                                        Download

                                                                                                                      • memory/624-255-0x000001F04E8D0000-0x000001F04E8F5000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        148KB

                                                                                                                        Download

                                                                                                                      • memory/664-271-0x000002043DC30000-0x000002043DC5B000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        172KB

                                                                                                                        Download

                                                                                                                      • memory/664-272-0x00007FF89D190000-0x00007FF89D1A0000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        64KB

                                                                                                                        Download

                                                                                                                      • memory/676-261-0x00007FF89D190000-0x00007FF89D1A0000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        64KB

                                                                                                                        Download

                                                                                                                      • memory/676-260-0x0000026449580000-0x00000264495AB000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        172KB

                                                                                                                        Download

                                                                                                                      • memory/964-264-0x00000209F2DA0000-0x00000209F2DCB000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        172KB

                                                                                                                        Download

                                                                                                                      • memory/964-265-0x00007FF89D190000-0x00007FF89D1A0000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        64KB

                                                                                                                        Download

                                                                                                                      • memory/1092-288-0x000002B3E6450000-0x000002B3E647B000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        172KB

                                                                                                                        Download

                                                                                                                      • memory/1092-289-0x00007FF89D190000-0x00007FF89D1A0000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        64KB

                                                                                                                        Download

                                                                                                                      • memory/1100-293-0x00007FF89D190000-0x00007FF89D1A0000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        64KB

                                                                                                                        Download

                                                                                                                      • memory/1100-291-0x0000015C7D940000-0x0000015C7D96B000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        172KB

                                                                                                                        Download

                                                                                                                      • memory/1216-292-0x000001494A890000-0x000001494A8BB000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        172KB

                                                                                                                        Download

                                                                                                                      • memory/1216-295-0x00007FF89D190000-0x00007FF89D1A0000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        64KB

                                                                                                                        Download

                                                                                                                      • memory/1260-298-0x00007FF89D190000-0x00007FF89D1A0000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        64KB

                                                                                                                        Download

                                                                                                                      • memory/1260-297-0x0000018AD3AA0000-0x0000018AD3ACB000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        172KB

                                                                                                                        Download

                                                                                                                      • memory/1360-300-0x00000265DD1D0000-0x00000265DD1FB000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        172KB

                                                                                                                        Download

                                                                                                                      • memory/1360-301-0x00007FF89D190000-0x00007FF89D1A0000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        64KB

                                                                                                                        Download

                                                                                                                      • memory/1420-305-0x00007FF89D190000-0x00007FF89D1A0000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        64KB

                                                                                                                        Download

                                                                                                                      • memory/1420-304-0x000001ACC5370000-0x000001ACC539B000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        172KB

                                                                                                                        Download

                                                                                                                      • memory/2788-152-0x0000000000400000-0x0000000000548000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        1.3MB

                                                                                                                        Download

                                                                                                                      • memory/2788-22-0x0000000000810000-0x0000000000811000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        4KB

                                                                                                                        Download

                                                                                                                      • memory/3000-221-0x0000000000C80000-0x0000000000C96000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        88KB

                                                                                                                        Download

                                                                                                                      • memory/3016-7-0x00007FF8BEA20000-0x00007FF8BF4E2000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        10.8MB

                                                                                                                        Download

                                                                                                                      • memory/3016-1-0x00000000006E0000-0x00000000006F8000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        96KB

                                                                                                                        Download

                                                                                                                      • memory/3016-856-0x000000001BEA0000-0x000000001BEAE000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        56KB

                                                                                                                        Download

                                                                                                                      • memory/3016-5-0x00007FF8BEA20000-0x00007FF8BF4E2000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        10.8MB

                                                                                                                        Download

                                                                                                                      • memory/3016-6-0x00007FF8BEA23000-0x00007FF8BEA25000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        8KB

                                                                                                                        Download

                                                                                                                      • memory/3016-556-0x0000000002860000-0x000000000286A000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        40KB

                                                                                                                        Download

                                                                                                                      • memory/3016-0-0x00007FF8BEA23000-0x00007FF8BEA25000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        8KB

                                                                                                                        Download

                                                                                                                      • memory/3016-553-0x000000001DAA0000-0x000000001DBC0000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        1.1MB

                                                                                                                        Download

                                                                                                                      • memory/3016-555-0x000000001E2F0000-0x000000001E312000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        136KB

                                                                                                                        Download

                                                                                                                      • memory/3324-231-0x0000000000DF0000-0x0000000000E06000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        88KB

                                                                                                                        Download

                                                                                                                      • memory/3324-232-0x0000000005A30000-0x0000000005AC2000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        584KB

                                                                                                                        Download

                                                                                                                      • memory/3740-155-0x00007FF89D190000-0x00007FF89D1A0000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        64KB

                                                                                                                        Download

                                                                                                                      • memory/3740-153-0x00007FF89D190000-0x00007FF89D1A0000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        64KB

                                                                                                                        Download

                                                                                                                      • memory/3740-154-0x00007FF89D190000-0x00007FF89D1A0000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        64KB

                                                                                                                        Download

                                                                                                                      • memory/3740-156-0x00007FF89D190000-0x00007FF89D1A0000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        64KB

                                                                                                                        Download

                                                                                                                      • memory/3740-157-0x00007FF89D190000-0x00007FF89D1A0000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        64KB

                                                                                                                        Download

                                                                                                                      • memory/3740-158-0x00007FF89AF40000-0x00007FF89AF50000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        64KB

                                                                                                                        Download

                                                                                                                      • memory/3740-159-0x00007FF89AF40000-0x00007FF89AF50000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        64KB

                                                                                                                        Download

                                                                                                                      • memory/3912-91-0x00000000013D0000-0x0000000001412000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        264KB

                                                                                                                        Download

                                                                                                                      • memory/3912-89-0x0000000000C70000-0x0000000000CFC000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        560KB

                                                                                                                        Download

                                                                                                                      • memory/4476-229-0x00007FF8DC260000-0x00007FF8DC31D000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        756KB

                                                                                                                        Download

                                                                                                                      • memory/4476-227-0x00007FF8DD110000-0x00007FF8DD308000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        2.0MB

                                                                                                                        Download