quasar | a3ef678bd307c07f299a4b4c96d414ddba54e3f00e7e81a5ed5bc949cd65e682

Analysis

max time kernel
142s
max time network
144s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
04-11-2024 18:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Client-built.exe
Size

3.1MB
MD5

52b81162360c34724757c2075a60e5af
SHA1

3fceb5947678c56b962a63853d20749f274b6db0
SHA256

a3ef678bd307c07f299a4b4c96d414ddba54e3f00e7e81a5ed5bc949cd65e682
SHA512

ea3e4b4218f5cca06102c97d85306fbd7f1697efd1546ecb3a9cf5f66a68c6354b176545c059aa78757bd7a2f9abbed2c16a16a2d1fbcee1506c9b21400c1f47
SSDEEP

49152:uv2I22SsaNYfdPBldt698dBcjHUiO10mzfioGdKiTHHB72eh2NT:uvb22SsaNYfdPBldt6+dBcjHbO1g

Score

10^/10

quasar office04 discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

Inversin-43597.portmap.host:43597

Mutex

80329fd2-f063-4b06-9c7e-8dbc6278c2a3

Attributes

encryption_key
744EA1A385FEBC6DA96387411B7000D77E66B075
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
java updater
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2372-1-0x0000000000E40000-0x0000000001164000-memory.dmp	family_quasar
behavioral1/files/0x00280000000450a8-3.dat	family_quasar

Checks computer location settings 2 TTPs 14 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Client.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000\Control Panel\International\Geo\Nation	Client.exe

Executes dropped EXE 14 IoCs

Processes:

Client.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exe

pid	Process
944	Client.exe
3888	Client.exe
1220	Client.exe
2180	Client.exe
2372	Client.exe
1516	Client.exe
2004	Client.exe
3840	Client.exe
2748	Client.exe
4416	Client.exe
2508	Client.exe
1976	Client.exe
992	Client.exe
2704	Client.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 14 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

Processes:

PING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXE

pid	Process
2916	PING.EXE
1816	PING.EXE
3856	PING.EXE
408	PING.EXE
3048	PING.EXE
2860	PING.EXE
4684	PING.EXE
2668	PING.EXE
3416	PING.EXE
4024	PING.EXE
924	PING.EXE
3544	PING.EXE
2616	PING.EXE
4672	PING.EXE

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Runs ping.exe 1 TTPs 14 IoCs

Remote System Discovery

T1018

Processes:

PING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXE

pid	Process
924	PING.EXE
3856	PING.EXE
4672	PING.EXE
2860	PING.EXE
4024	PING.EXE
3544	PING.EXE
2916	PING.EXE
408	PING.EXE
3048	PING.EXE
3416	PING.EXE
1816	PING.EXE
4684	PING.EXE
2668	PING.EXE
2616	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 15 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	Process
2616	schtasks.exe
652	schtasks.exe
2312	schtasks.exe
3244	schtasks.exe
2632	schtasks.exe
4568	schtasks.exe
2944	schtasks.exe
4624	schtasks.exe
4564	schtasks.exe
3392	schtasks.exe
2724	schtasks.exe
5104	schtasks.exe
220	schtasks.exe
1612	schtasks.exe
3092	schtasks.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

taskmgr.exe

pid	Process
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

Processes:

Client-built.exeClient.exetaskmgr.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exe

description	pid	Process
Token: SeDebugPrivilege	2372	Client-built.exe
Token: SeDebugPrivilege	944	Client.exe
Token: SeDebugPrivilege	4992	taskmgr.exe
Token: SeSystemProfilePrivilege	4992	taskmgr.exe
Token: SeCreateGlobalPrivilege	4992	taskmgr.exe
Token: SeDebugPrivilege	3888	Client.exe
Token: 33	4992	taskmgr.exe
Token: SeIncBasePriorityPrivilege	4992	taskmgr.exe
Token: SeDebugPrivilege	1220	Client.exe
Token: SeDebugPrivilege	2180	Client.exe
Token: SeDebugPrivilege	2372	Client.exe
Token: SeDebugPrivilege	1516	Client.exe
Token: SeDebugPrivilege	2004	Client.exe
Token: SeDebugPrivilege	3840	Client.exe
Token: SeDebugPrivilege	2748	Client.exe
Token: SeDebugPrivilege	4416	Client.exe
Token: SeDebugPrivilege	2508	Client.exe
Token: SeDebugPrivilege	1976	Client.exe
Token: SeDebugPrivilege	992	Client.exe
Token: SeDebugPrivilege	2704	Client.exe

Suspicious use of FindShellTrayWindow 53 IoCs

Processes:

Client.exetaskmgr.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exe

pid	Process
944	Client.exe
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe
3888	Client.exe
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe
1220	Client.exe
2180	Client.exe
2372	Client.exe
1516	Client.exe
2004	Client.exe
3840	Client.exe
2748	Client.exe
4416	Client.exe
2508	Client.exe
1976	Client.exe
992	Client.exe
2704	Client.exe

Suspicious use of SendNotifyMessage 53 IoCs

Processes:

Client.exetaskmgr.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exe

pid	Process
944	Client.exe
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe
3888	Client.exe
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe
4992	taskmgr.exe
1220	Client.exe
2180	Client.exe
2372	Client.exe
1516	Client.exe
2004	Client.exe
3840	Client.exe
2748	Client.exe
4416	Client.exe
2508	Client.exe
1976	Client.exe
992	Client.exe
2704	Client.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Client-built.exeClient.execmd.exeClient.execmd.exeClient.execmd.exeClient.execmd.exeClient.execmd.exeClient.execmd.exe

description	pid	Process	procid_target
PID 2372 wrote to memory of 4568	2372	Client-built.exe	85
PID 2372 wrote to memory of 4568	2372	Client-built.exe	85
PID 2372 wrote to memory of 944	2372	Client-built.exe	87
PID 2372 wrote to memory of 944	2372	Client-built.exe	87
PID 944 wrote to memory of 2616	944	Client.exe	88
PID 944 wrote to memory of 2616	944	Client.exe	88
PID 944 wrote to memory of 3684	944	Client.exe	90
PID 944 wrote to memory of 3684	944	Client.exe	90
PID 3684 wrote to memory of 532	3684	cmd.exe	92
PID 3684 wrote to memory of 532	3684	cmd.exe	92
PID 3684 wrote to memory of 924	3684	cmd.exe	93
PID 3684 wrote to memory of 924	3684	cmd.exe	93
PID 3684 wrote to memory of 3888	3684	cmd.exe	102
PID 3684 wrote to memory of 3888	3684	cmd.exe	102
PID 3888 wrote to memory of 5104	3888	Client.exe	103
PID 3888 wrote to memory of 5104	3888	Client.exe	103
PID 3888 wrote to memory of 1744	3888	Client.exe	105
PID 3888 wrote to memory of 1744	3888	Client.exe	105
PID 1744 wrote to memory of 1780	1744	cmd.exe	107
PID 1744 wrote to memory of 1780	1744	cmd.exe	107
PID 1744 wrote to memory of 3544	1744	cmd.exe	108
PID 1744 wrote to memory of 3544	1744	cmd.exe	108
PID 1744 wrote to memory of 1220	1744	cmd.exe	110
PID 1744 wrote to memory of 1220	1744	cmd.exe	110
PID 1220 wrote to memory of 2944	1220	Client.exe	111
PID 1220 wrote to memory of 2944	1220	Client.exe	111
PID 1220 wrote to memory of 5020	1220	Client.exe	113
PID 1220 wrote to memory of 5020	1220	Client.exe	113
PID 5020 wrote to memory of 4060	5020	cmd.exe	115
PID 5020 wrote to memory of 4060	5020	cmd.exe	115
PID 5020 wrote to memory of 2916	5020	cmd.exe	116
PID 5020 wrote to memory of 2916	5020	cmd.exe	116
PID 5020 wrote to memory of 2180	5020	cmd.exe	118
PID 5020 wrote to memory of 2180	5020	cmd.exe	118
PID 2180 wrote to memory of 4624	2180	Client.exe	119
PID 2180 wrote to memory of 4624	2180	Client.exe	119
PID 2180 wrote to memory of 4192	2180	Client.exe	121
PID 2180 wrote to memory of 4192	2180	Client.exe	121
PID 4192 wrote to memory of 2556	4192	cmd.exe	123
PID 4192 wrote to memory of 2556	4192	cmd.exe	123
PID 4192 wrote to memory of 408	4192	cmd.exe	124
PID 4192 wrote to memory of 408	4192	cmd.exe	124
PID 4192 wrote to memory of 2372	4192	cmd.exe	125
PID 4192 wrote to memory of 2372	4192	cmd.exe	125
PID 2372 wrote to memory of 220	2372	Client.exe	126
PID 2372 wrote to memory of 220	2372	Client.exe	126
PID 2372 wrote to memory of 5008	2372	Client.exe	128
PID 2372 wrote to memory of 5008	2372	Client.exe	128
PID 5008 wrote to memory of 1684	5008	cmd.exe	130
PID 5008 wrote to memory of 1684	5008	cmd.exe	130
PID 5008 wrote to memory of 2668	5008	cmd.exe	131
PID 5008 wrote to memory of 2668	5008	cmd.exe	131
PID 5008 wrote to memory of 1516	5008	cmd.exe	132
PID 5008 wrote to memory of 1516	5008	cmd.exe	132
PID 1516 wrote to memory of 1612	1516	Client.exe	133
PID 1516 wrote to memory of 1612	1516	Client.exe	133
PID 1516 wrote to memory of 4672	1516	Client.exe	135
PID 1516 wrote to memory of 4672	1516	Client.exe	135
PID 4672 wrote to memory of 1724	4672	cmd.exe	137
PID 4672 wrote to memory of 1724	4672	cmd.exe	137
PID 4672 wrote to memory of 3048	4672	cmd.exe	138
PID 4672 wrote to memory of 3048	4672	cmd.exe	138
PID 4672 wrote to memory of 2004	4672	cmd.exe	139
PID 4672 wrote to memory of 2004	4672	cmd.exe	139

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "java updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4568
- C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:944
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "java updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2616
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\B6EtU1SsXRz7.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3684
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:532
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:924
  - - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
      "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:3888
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "java updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5104
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nFV2DsyxgtFx.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1744
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:1780
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3544
      - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1220
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "java updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2944
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OOmOktsidUla.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:5020
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:4060
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2916
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2180
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "java updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4624
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yMnDZSLtWRFj.bat" "
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:4192
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:2556
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:408
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2372
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "java updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        11⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:220
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qsSGY5gJd4vf.bat" "
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:5008
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:1684
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2668
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1516
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "java updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        13⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1612
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ivtqaEIttsDi.bat" "
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:4672
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:1724
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3048
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2004
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "java updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        15⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4564
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5YbWm8n0ROOf.bat" "
        15⤵
        
        PID:3544
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:4056
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3416
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3840
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "java updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        17⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3392
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OrJF3NrJo1gV.bat" "
        17⤵
        
        PID:4812
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:236
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1816
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2748
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "java updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        19⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:652
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\r4eOJ0m62a4K.bat" "
        19⤵
        
        PID:1564
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:60
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2860
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:4416
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "java updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        21⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2632
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gHuOufPYrFj7.bat" "
        21⤵
        
        PID:3868
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:2404
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        22⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2616
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2508
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "java updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        23⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3092
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7m5Bbye0dxyE.bat" "
        23⤵
        
        PID:2464
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:4268
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        24⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3856
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1976
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "java updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        25⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2312
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FVO35TTdFssD.bat" "
        25⤵
        
        PID:1780
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        26⤵
        
        PID:3800
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        26⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4672
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        26⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:992
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "java updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        27⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3244
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7HfmxBxusPNy.bat" "
        27⤵
        
        PID:3544
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        28⤵
        
        PID:4456
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        28⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4024
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        28⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2704
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "java updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        29⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2724
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MQdMviz90e54.bat" "
        29⤵
        
        PID:644
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        30⤵
        
        PID:4700
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        30⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4684

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Client.exe.log

Filesize
2KB

MD5
7787ce173dfface746f5a9cf5477883d

SHA1
4587d870e914785b3a8fb017fec0c0f1c7ec0004

SHA256
c339149818fa8f9e5af4627715c3afe4f42bc1267df17d77a278d4c811ed8df1

SHA512
3a630053ae99114292f8cf8d45600f8fe72125795252bf76677663476bd2275be084a1af2fcb4ce30409ba1b5829b2b3ffb6795de46d2a703c3314017a86f1ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\5YbWm8n0ROOf.bat

Filesize
207B

MD5
b808a3643ce7919cec2cb27af2b8009c

SHA1
382d130fda5cb0ec41847265a23c1df7db8374e9

SHA256
60a0eafbe498e07656712a86b3ddd06f741089573b61ebbe3a5170f3a65e5b38

SHA512
17a894ee497aa1d7636f80eeab2723d9793981ec3c8df3c4b9aec9ec6cf849729ebf1815fad4c75be044513981ccc0514355bc955328c78457ab83a2c933124b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7HfmxBxusPNy.bat

Filesize
207B

MD5
7655f8f8ca9997db73334610994b615c

SHA1
4e4d14811021ff8ed426b6a49aa75f6525808a1f

SHA256
cf3c60c69fb5de5078d576f06ba1bde3fb6ec5ffe94ad92cbe3587b9ad3cbae8

SHA512
33d2856389442a640c22935af211984cd99284c57f5b354b5d4fa0a8f7a9c4e010dcecb46162e2250c996eacabad2c57073dda307a4f7e6be3950f9d913989a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7m5Bbye0dxyE.bat

Filesize
207B

MD5
5f1ea9a3d97fe184266a90ca0dd0dc5a

SHA1
f7c0c221771702864a834427742307a64ce1994a

SHA256
19517406a81554384ef08d3e786430f40b3a892b8da875e2beac31557bc3a6db

SHA512
c62d895a8b2f8a0a712069cce95a003188485faa39d349b5f7a8752b661a843522b506841b2033ac7f5dcc7f5ee6917da661ca36e14289dd74862aee53b8bae2

Download Submit
C:\Users\Admin\AppData\Local\Temp\B6EtU1SsXRz7.bat

Filesize
207B

MD5
095fb822b5213d2a341688f2ee154d6a

SHA1
e03565afcda4f099d427dcb8360f722ec692b156

SHA256
dc7d516233c4eb83830eb1d0b3fafc7ab2dad2b8f438aa0cc4c7f7a69387cece

SHA512
adc3ec215fbeb274255a0248ff0e541b4c34da1d52fbf70c9858ab5dbc2a5536dcb6f6af94af1c41d4842b68288edafe7b2fbeaf817de344e2a10c602f3cc118

Download Submit
C:\Users\Admin\AppData\Local\Temp\FVO35TTdFssD.bat

Filesize
207B

MD5
5db0fd4585242f935dbd1347d2e4381e

SHA1
c8618dc1bb95ea2b300cfad256673f24323138d9

SHA256
2203bd86c121fad13de3f57b66cd9f3210dc2fb02c2a057e2f6b4756ba30f609

SHA512
f24b4fdd1e2f5fc51181534f48610a94e10e9da32c803d9ebae249314f0344a363c173a837f443d051af4625a8a135fc9af518519873742e572ddd6e49d6a734

Download Submit
C:\Users\Admin\AppData\Local\Temp\MQdMviz90e54.bat

Filesize
207B

MD5
d487ac8ccfae2a1e269d36d39dc28c88

SHA1
489882f2d17e58d74e742990dbd7208b066d3b57

SHA256
d0dc15ef4f76382c68da636da1a1c402e4444b31f80b68cd8c8de4ccbc6746a2

SHA512
8397e0d59a16f27c506b7c45d441de83ff72c702c9fc4174e4c08657ea833f77fcdb96fbef66dcea288a3fc1e4b551fe8064cf7eab9f204226bee93a553a9b72

Download Submit
C:\Users\Admin\AppData\Local\Temp\OOmOktsidUla.bat

Filesize
207B

MD5
1ea669fa8dccc2094dc5c69c20dd17a0

SHA1
3c163abdbb4125ff9daa062e697aca46f57458a3

SHA256
a67b005dcef17b190a27ce18395ee7191b4bcd7f20c6f128821c2d69c02a793a

SHA512
29adaeea8d0ede815719a392bc0413a344ef5c7664b1b60ed5ac42e73904866fd4b1d94cd64c4a47162e18391748dc9ad4d963ba734e00e65089878e097cc8e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\OrJF3NrJo1gV.bat

Filesize
207B

MD5
f3b40248249a5d478ed5f10c7f086fac

SHA1
64717deccfeb7b1dce9cca0335ac03de61cfdbd2

SHA256
90349f01b0236b8032de71f762c75db9fe0ba68ada0e4696ae3e6d0bb62c9a5a

SHA512
d0d969858a327624f567a3d424dcf1e96b6ed78fe7412b41c500db2310906b2ff83e924e430532a6537b99de557e265d87325704ab77e55c8ae986558427ab5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\gHuOufPYrFj7.bat

Filesize
207B

MD5
c5fceb9f69a03279e38ea0cda0033c98

SHA1
6f0b38b25d134256d0d5247c06c06953b7fc1ff9

SHA256
784421327b1ecb4325a5acecdaec892caf78745f31ea71dead14c4420feaa3c4

SHA512
76229cedece965f1a2c6c1c5baff826dbb330e70c2ab7c86e9dc8459aabb76f0e537d61672786bffee84cd8cca9463ee0c7011b3ef5b73f609b622ea0915fec9

Download Submit
C:\Users\Admin\AppData\Local\Temp\ivtqaEIttsDi.bat

Filesize
207B

MD5
5832d206ba276f7f44390ad4458a8542

SHA1
e8f26ea633f8fc3b7a6685ae53f6397f28c7a5d2

SHA256
bc69678c9bd1fc4253d17eb845c1451153e615c285dc7a4d7b3c55da127ee5dc

SHA512
71de38f2e40211496a869258cab665a56d0809fe91d1d541730e003a7c90d4a0402e1506661fcb9b7e656f38be1555d9b8e478a90ac6621196662fd0486396f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nFV2DsyxgtFx.bat

Filesize
207B

MD5
1a3424f341cd13118ca97ef461f655f8

SHA1
c73db02bc9cf241d6be155b2d7fd681e4e63a917

SHA256
81617675469902a7f6b810550ddac68d5633223078dda11eeb3d4ff88d8aff54

SHA512
4186378145a36247d059b756adfc63a75870b1d52a4dcc3221e80bbf3724e8390333088617e98b7cb7aa5ff607e32c9ccda3e0f48decab0490c2ff2cbece4c82

Download Submit
C:\Users\Admin\AppData\Local\Temp\qsSGY5gJd4vf.bat

Filesize
207B

MD5
76546f03e1d265be26d0288cd24f33c0

SHA1
4ec64f457938ba126d7fb6d8c95b2afeecec70cb

SHA256
eeab1fe000047ef27f85c507241c6d4079b64b21a89b79faffec17feda38c387

SHA512
bf3c278c7d7a3deed352f88f9ec57adb20489caa30bbe72a465f27004128d1573e81b13940d6929ed627e92597a25283bca22aa8156e91b6124a963ac7598ceb

Download Submit
C:\Users\Admin\AppData\Local\Temp\r4eOJ0m62a4K.bat

Filesize
207B

MD5
c970ad54fcd55743ea12f6e8cec2a7c2

SHA1
304164e125db848a2cf4dbbbd6c5a970b1cbf08e

SHA256
bb914599254ee415e0e8f4da66cd211174a4fbdeb3e18a94888a7bad3cdd4517

SHA512
76f769f7a48a674c1a6babf917abf344bafdd2efc69e9dca304236ec90b33c45f664fa071eb4e1c78cd6c46cfbc3dbad637eae2b698037a133c818e404fbbcc4

Download Submit
C:\Users\Admin\AppData\Local\Temp\yMnDZSLtWRFj.bat

Filesize
207B

MD5
ad4b7293dae11dd5cc9cc9c8136a8d42

SHA1
3d57f8f8aa88ae66f70bfb627000d28eed87ad1a

SHA256
9d5c85f87c3c836cb5ae4c71649feaea573accb1b8b5fa11d978a66d12a9fe8b

SHA512
6890555309a89bed0cc854c80c1de05d39e51f9f46e1e0dad3c92a9c84b6b07ab926405251697b5f4e29cfb5dc38d1116188f0e8dcd0f8043c34b66b7e7925dd

Download Submit
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe

Filesize
3.1MB

MD5
52b81162360c34724757c2075a60e5af

SHA1
3fceb5947678c56b962a63853d20749f274b6db0

SHA256
a3ef678bd307c07f299a4b4c96d414ddba54e3f00e7e81a5ed5bc949cd65e682

SHA512
ea3e4b4218f5cca06102c97d85306fbd7f1697efd1546ecb3a9cf5f66a68c6354b176545c059aa78757bd7a2f9abbed2c16a16a2d1fbcee1506c9b21400c1f47

Download Submit
memory/944-9-0x000000001CC70000-0x000000001CD22000-memory.dmp

Filesize
712KB

Download
memory/944-18-0x00007FF8C0530000-0x00007FF8C0FF2000-memory.dmp

Filesize
10.8MB

Download
memory/944-6-0x00007FF8C0530000-0x00007FF8C0FF2000-memory.dmp

Filesize
10.8MB

Download
memory/944-7-0x00007FF8C0530000-0x00007FF8C0FF2000-memory.dmp

Filesize
10.8MB

Download
memory/944-8-0x000000001CB60000-0x000000001CBB0000-memory.dmp

Filesize
320KB

Download
memory/2372-1-0x0000000000E40000-0x0000000001164000-memory.dmp

Filesize
3.1MB

Download
memory/2372-2-0x00007FF8C0530000-0x00007FF8C0FF2000-memory.dmp

Filesize
10.8MB

Download
memory/2372-5-0x00007FF8C0530000-0x00007FF8C0FF2000-memory.dmp

Filesize
10.8MB

Download
memory/2372-0-0x00007FF8C0533000-0x00007FF8C0535000-memory.dmp

Filesize
8KB

Download
memory/4992-27-0x000001EBD4D60000-0x000001EBD4D61000-memory.dmp

Filesize
4KB

Download
memory/4992-22-0x000001EBD4D60000-0x000001EBD4D61000-memory.dmp

Filesize
4KB

Download
memory/4992-23-0x000001EBD4D60000-0x000001EBD4D61000-memory.dmp

Filesize
4KB

Download
memory/4992-21-0x000001EBD4D60000-0x000001EBD4D61000-memory.dmp

Filesize
4KB

Download
memory/4992-33-0x000001EBD4D60000-0x000001EBD4D61000-memory.dmp

Filesize
4KB

Download
memory/4992-32-0x000001EBD4D60000-0x000001EBD4D61000-memory.dmp

Filesize
4KB

Download
memory/4992-31-0x000001EBD4D60000-0x000001EBD4D61000-memory.dmp

Filesize
4KB

Download
memory/4992-28-0x000001EBD4D60000-0x000001EBD4D61000-memory.dmp

Filesize
4KB

Download
memory/4992-29-0x000001EBD4D60000-0x000001EBD4D61000-memory.dmp

Filesize
4KB

Download
memory/4992-30-0x000001EBD4D60000-0x000001EBD4D61000-memory.dmp

Filesize
4KB

Download