quasar | e19ec4fa8dcc4d92b63bf6e5d4b9c519032799fec8fb7d5634adf34d954f067b

Analysis

max time kernel
150s
max time network
145s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241211-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
20-12-2024 04:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Bootstrapper.exe
Size

3.1MB
MD5

bc14ab48b3cc300a8a2c14b9fe6b185a
SHA1

3fa377bf0f2cf8a5dab914eb0f224d2ca6b90c78
SHA256

e19ec4fa8dcc4d92b63bf6e5d4b9c519032799fec8fb7d5634adf34d954f067b
SHA512

5f34a257f7cb4511359708a243b15bedcac2d65911ecd4c168a97068c6f1aa77973bd9dffa9e496828883c067205865af159710d0d40e1d0317786fca421bf10
SSDEEP

49152:3vCI22SsaNYfdPBldt698dBcjHqpgzMvbRwLoGdcETHHB72eh2NT:3vP22SsaNYfdPBldt6+dBcjHqpgzMs

Score

10^/10

quasar rat discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Rat

AMNSALKSamongus-47679.portmap.host:4782

Mutex

d3bc3858-ff4a-4aa8-97ec-67721ddcdeeb

Attributes

encryption_key
C8D618C9B5D2F91FFC94B6E9C868ECF80EB774F8
install_name
Client.exe
log_directory
ratted client
reconnect_delay
3000
startup_key
hello son
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral1/memory/1008-1-0x0000000000670000-0x0000000000994000-memory.dmp	family_quasar
behavioral1/files/0x002800000004606f-3.dat	family_quasar

Checks computer location settings 2 TTPs 14 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3226857575-536881564-1522996248-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3226857575-536881564-1522996248-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3226857575-536881564-1522996248-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3226857575-536881564-1522996248-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3226857575-536881564-1522996248-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3226857575-536881564-1522996248-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3226857575-536881564-1522996248-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3226857575-536881564-1522996248-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3226857575-536881564-1522996248-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3226857575-536881564-1522996248-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3226857575-536881564-1522996248-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3226857575-536881564-1522996248-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3226857575-536881564-1522996248-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3226857575-536881564-1522996248-1000\Control Panel\International\Geo\Nation	Client.exe

Executes dropped EXE 15 IoCs

pid	Process
1124	Client.exe
2824	Client.exe
2148	Client.exe
412	Client.exe
1828	Client.exe
4632	Client.exe
336	Client.exe
1448	Client.exe
3032	Client.exe
1496	Client.exe
3180	Client.exe
4836	Client.exe
4704	Client.exe
2716	Client.exe
2068	Client.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 14 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3500	PING.EXE
4288	PING.EXE
4212	PING.EXE
4976	PING.EXE
3580	PING.EXE
4984	PING.EXE
3108	PING.EXE
1244	PING.EXE
1944	PING.EXE
2128	PING.EXE
1172	PING.EXE
3612	PING.EXE
2296	PING.EXE
2052	PING.EXE

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3226857575-536881564-1522996248-1000_Classes\Local Settings	taskmgr.exe

Runs ping.exe 1 TTPs 14 IoCs

Remote System Discovery

T1018

pid	Process
1244	PING.EXE
3612	PING.EXE
2296	PING.EXE
4212	PING.EXE
2052	PING.EXE
1172	PING.EXE
4976	PING.EXE
3580	PING.EXE
4984	PING.EXE
3500	PING.EXE
4288	PING.EXE
1944	PING.EXE
2128	PING.EXE
3108	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 16 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4772	schtasks.exe
548	schtasks.exe
3116	schtasks.exe
3796	schtasks.exe
2512	schtasks.exe
4664	schtasks.exe
2632	schtasks.exe
940	schtasks.exe
4328	schtasks.exe
412	schtasks.exe
3676	schtasks.exe
4344	schtasks.exe
700	schtasks.exe
3508	schtasks.exe
1244	schtasks.exe
4504	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1472	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	1008	Bootstrapper.exe
Token: SeDebugPrivilege	1124	Client.exe
Token: SeDebugPrivilege	2824	Client.exe
Token: SeDebugPrivilege	2148	Client.exe
Token: SeDebugPrivilege	1472	taskmgr.exe
Token: SeSystemProfilePrivilege	1472	taskmgr.exe
Token: SeCreateGlobalPrivilege	1472	taskmgr.exe
Token: SeDebugPrivilege	412	Client.exe
Token: SeDebugPrivilege	1828	Client.exe
Token: SeDebugPrivilege	4632	Client.exe
Token: SeDebugPrivilege	336	Client.exe
Token: SeDebugPrivilege	1448	Client.exe
Token: SeDebugPrivilege	3032	Client.exe
Token: SeDebugPrivilege	1496	Client.exe
Token: SeDebugPrivilege	3180	Client.exe
Token: SeDebugPrivilege	4836	Client.exe
Token: SeDebugPrivilege	4704	Client.exe
Token: SeDebugPrivilege	2716	Client.exe
Token: SeDebugPrivilege	2068	Client.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1124	Client.exe
2824	Client.exe
2148	Client.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
412	Client.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1828	Client.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
4632	Client.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
336	Client.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1124	Client.exe
2824	Client.exe
2148	Client.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
412	Client.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1828	Client.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
4632	Client.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
336	Client.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1008 wrote to memory of 412	1008	Bootstrapper.exe	82
PID 1008 wrote to memory of 412	1008	Bootstrapper.exe	82
PID 1008 wrote to memory of 1124	1008	Bootstrapper.exe	84
PID 1008 wrote to memory of 1124	1008	Bootstrapper.exe	84
PID 1124 wrote to memory of 4772	1124	Client.exe	85
PID 1124 wrote to memory of 4772	1124	Client.exe	85
PID 1124 wrote to memory of 4468	1124	Client.exe	87
PID 1124 wrote to memory of 4468	1124	Client.exe	87
PID 4468 wrote to memory of 5116	4468	cmd.exe	89
PID 4468 wrote to memory of 5116	4468	cmd.exe	89
PID 4468 wrote to memory of 4984	4468	cmd.exe	90
PID 4468 wrote to memory of 4984	4468	cmd.exe	90
PID 4468 wrote to memory of 2824	4468	cmd.exe	97
PID 4468 wrote to memory of 2824	4468	cmd.exe	97
PID 2824 wrote to memory of 548	2824	Client.exe	98
PID 2824 wrote to memory of 548	2824	Client.exe	98
PID 2824 wrote to memory of 1688	2824	Client.exe	100
PID 2824 wrote to memory of 1688	2824	Client.exe	100
PID 1688 wrote to memory of 816	1688	cmd.exe	102
PID 1688 wrote to memory of 816	1688	cmd.exe	102
PID 1688 wrote to memory of 3500	1688	cmd.exe	104
PID 1688 wrote to memory of 3500	1688	cmd.exe	104
PID 1688 wrote to memory of 2148	1688	cmd.exe	105
PID 1688 wrote to memory of 2148	1688	cmd.exe	105
PID 2148 wrote to memory of 4664	2148	Client.exe	106
PID 2148 wrote to memory of 4664	2148	Client.exe	106
PID 2148 wrote to memory of 4600	2148	Client.exe	108
PID 2148 wrote to memory of 4600	2148	Client.exe	108
PID 4600 wrote to memory of 704	4600	cmd.exe	110
PID 4600 wrote to memory of 704	4600	cmd.exe	110
PID 4600 wrote to memory of 4288	4600	cmd.exe	111
PID 4600 wrote to memory of 4288	4600	cmd.exe	111
PID 4600 wrote to memory of 412	4600	cmd.exe	115
PID 4600 wrote to memory of 412	4600	cmd.exe	115
PID 412 wrote to memory of 700	412	Client.exe	116
PID 412 wrote to memory of 700	412	Client.exe	116
PID 412 wrote to memory of 1420	412	Client.exe	118
PID 412 wrote to memory of 1420	412	Client.exe	118
PID 1420 wrote to memory of 1000	1420	cmd.exe	120
PID 1420 wrote to memory of 1000	1420	cmd.exe	120
PID 1420 wrote to memory of 3108	1420	cmd.exe	121
PID 1420 wrote to memory of 3108	1420	cmd.exe	121
PID 1420 wrote to memory of 1828	1420	cmd.exe	122
PID 1420 wrote to memory of 1828	1420	cmd.exe	122
PID 1828 wrote to memory of 3116	1828	Client.exe	123
PID 1828 wrote to memory of 3116	1828	Client.exe	123
PID 1828 wrote to memory of 1112	1828	Client.exe	125
PID 1828 wrote to memory of 1112	1828	Client.exe	125
PID 1112 wrote to memory of 4316	1112	cmd.exe	127
PID 1112 wrote to memory of 4316	1112	cmd.exe	127
PID 1112 wrote to memory of 1244	1112	cmd.exe	128
PID 1112 wrote to memory of 1244	1112	cmd.exe	128
PID 1112 wrote to memory of 4632	1112	cmd.exe	129
PID 1112 wrote to memory of 4632	1112	cmd.exe	129
PID 4632 wrote to memory of 3676	4632	Client.exe	130
PID 4632 wrote to memory of 3676	4632	Client.exe	130
PID 4632 wrote to memory of 2612	4632	Client.exe	132
PID 4632 wrote to memory of 2612	4632	Client.exe	132
PID 2612 wrote to memory of 4904	2612	cmd.exe	134
PID 2612 wrote to memory of 4904	2612	cmd.exe	134
PID 2612 wrote to memory of 3612	2612	cmd.exe	135
PID 2612 wrote to memory of 3612	2612	cmd.exe	135
PID 2612 wrote to memory of 336	2612	cmd.exe	136
PID 2612 wrote to memory of 336	2612	cmd.exe	136

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1008
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "hello son " /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:412
- C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1124
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "hello son " /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4772
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\P7zLtwrrFFNs.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4468
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:5116
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4984
  - - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
      "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:2824
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "hello son " /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:548
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\82E5OyBkcfdq.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1688
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:816
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3500
      - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2148
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "hello son " /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4664
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PEa1lpzrJ5cn.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:4600
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:704
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4288
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:412
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "hello son " /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:700
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5nLqQPN0pU8H.bat" "
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:1420
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:1000
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3108
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1828
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "hello son " /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        11⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3116
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tj1BPakBEhVb.bat" "
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:1112
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:4316
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1244
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:4632
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "hello son " /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        13⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3676
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qPspyCYUwIBC.bat" "
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:2612
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:4904
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3612
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:336
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "hello son " /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        15⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4344
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7zpo17xE8aeV.bat" "
        15⤵
        
        PID:1116
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:2820
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1944
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1448
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "hello son " /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        17⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3508
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tTVpObGbYCuI.bat" "
        17⤵
        
        PID:4504
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:4368
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2128
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3032
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "hello son " /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        19⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3796
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\l3oquxakSc2p.bat" "
        19⤵
        
        PID:4832
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:4580
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2296
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1496
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "hello son " /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        21⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2632
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\w3htRKDRzqig.bat" "
        21⤵
        
        PID:4816
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:996
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        22⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1172
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3180
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "hello son " /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        23⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1244
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4NVdu0GSXi3i.bat" "
        23⤵
        
        PID:548
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:1912
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        24⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4976
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4836
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "hello son " /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        25⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:940
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MKlUB5TcsPwp.bat" "
        25⤵
        
        PID:1784
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        26⤵
        
        PID:2164
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        26⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3580
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        26⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4704
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "hello son " /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        27⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4328
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Gwwps6ZSxbs8.bat" "
        27⤵
        
        PID:4452
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        28⤵
        
        PID:4040
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        28⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4212
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        28⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2716
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "hello son " /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        29⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2512
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ky4zjVGqLK0y.bat" "
        29⤵
        
        PID:4632
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        30⤵
        
        PID:3248
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        30⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2052
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        30⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2068
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "hello son " /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        31⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4504

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1472

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Client.exe.log

Filesize
2KB

MD5
7787ce173dfface746f5a9cf5477883d

SHA1
4587d870e914785b3a8fb017fec0c0f1c7ec0004

SHA256
c339149818fa8f9e5af4627715c3afe4f42bc1267df17d77a278d4c811ed8df1

SHA512
3a630053ae99114292f8cf8d45600f8fe72125795252bf76677663476bd2275be084a1af2fcb4ce30409ba1b5829b2b3ffb6795de46d2a703c3314017a86f1ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\4NVdu0GSXi3i.bat

Filesize
207B

MD5
5f7e73e51192b4b530d1639118c8d6ca

SHA1
068f74fa8ec6ea9d1e210d9ebcc3f0654d441695

SHA256
2cbde6787e3186ba9544199d4a698deec9f834fd29a35d69ba7fce596af5de2f

SHA512
7c10693e84f179ff6dbf982823632075157f4856a9f3eda956bf243b2cbac59c44c00b33e2bf58daab6c90334fcd48663e07e14168a798a06c5a982e80d25c43

Download Submit
C:\Users\Admin\AppData\Local\Temp\5nLqQPN0pU8H.bat

Filesize
207B

MD5
0ae8d4159b535a75aafd5e02a31b044f

SHA1
e2623719856ed264531bb7105573f5fd2a62e213

SHA256
20b9069ee0c2f41b8f529cfba3bb0f51fa0867de93e835d362c2f9a63ff20074

SHA512
f00fc5a2d333d99cdf8a9973cfe8c81b8da7a094904b0ca5fcfb65e043f659fce95a2b854888a1530b774313845ebd9ff1ca6c3ca044cee7846ce5cd411a50b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zpo17xE8aeV.bat

Filesize
207B

MD5
30808054dc7c7df74a4fd645764e6888

SHA1
ba241f5f99b4c21f83da88fa997e742885bcffb7

SHA256
e7eef2824d3bcdaa10903c14ac1b581223f80898ae7579625fda35568f7b9346

SHA512
37c1c66fcc5c3429a5fc55a68df199c59a7f1e8e988588b1a176900f94205c2cb890bb01c2fe4691aeb904592b68b9c864862ff2185b01bb113c6e0ee79fc1f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\82E5OyBkcfdq.bat

Filesize
207B

MD5
ccfe6b25e2eec4df74f10027b84c27c5

SHA1
b9e7163b1e5e42e2b0bd0bbc5032b9150e9af811

SHA256
5bf3f89eeaf79315b1a9ef6c0c711bfb304f67b2d16b6a54fe2d1748ac5c5169

SHA512
aa44141d272878c054e3209e242e5a8b58846992a0196ffd43543db2004433be84a07e8a204d8269b59bd5143896dd503f9466b36842bb864fb1cd41686651f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Gwwps6ZSxbs8.bat

Filesize
207B

MD5
970dfc4939c48f610223f1f89c4e9b80

SHA1
7d3e6e3711fc385f665bdde07e5d121dd2791698

SHA256
1527cd7ba2e0b5debb81aab8a26997980d76acdffede3ca91c38826ac3bca0fa

SHA512
f2c10806dc4f8098165764089b57e02340c31716596794c4c2d4d430b408a0bced4a60618143bab57ba4f88e31b5685f865759b11a21a29176c120f48b613f9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\MKlUB5TcsPwp.bat

Filesize
207B

MD5
5786dc3bab8313a36a0a0a84890f7949

SHA1
90ae2e39a7c635f997a8a5245e2f770a705e85f1

SHA256
ed37f9ce166e051855d8b279f9449e839839e2cbf61e193aa46af2d204b69fd9

SHA512
67b1e409c0e9eb58c12b609f0e9c6ae2fdede78e36087f4528a97c88c89e32fb48983ec9e00876c093e7ae8ccfe093747d01694f7eebc30b3f537fe5c1bca4f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\P7zLtwrrFFNs.bat

Filesize
207B

MD5
37639dcfb7b3084d9e452db0335a292d

SHA1
2b0a94116d88ab0df81842601ff790286d21856b

SHA256
404db08ba3d86b0bfe7d5a8f291780b904f1b8495764438ac3fe9b8bcf8b4cb5

SHA512
b8bd17180ac2349f8ceddbc4d3b08909b5d78204cd3218104959304bc614ee40ecc870ca9f4a3947ced8bd2e894bb864366dce4f066c125cdff85024ac12f955

Download Submit
C:\Users\Admin\AppData\Local\Temp\PEa1lpzrJ5cn.bat

Filesize
207B

MD5
05b0bfe7cf507772f3cd792123d001d1

SHA1
d64341310d513d30fe63aefa8542b7e858c67dd4

SHA256
f3b459ecf0d88be2c6aeaa467e8ee1b07e11aa451bb097a88d6a8ebc0c06920b

SHA512
c7a613ec59d4b7639dde949d3f0e7b22594dc9dd957373ae7e07a38f37de05cc7ccfe061b06fcca680d8863f04c3394017d631784b1413e5f4c145b69740ded4

Download Submit
C:\Users\Admin\AppData\Local\Temp\ky4zjVGqLK0y.bat

Filesize
207B

MD5
c456a0e626a7be311ef8f04780ad1dae

SHA1
14a5b3e91c99316d42fc9cf5d5815d6ce525bfb2

SHA256
31b4e0c5acf6a0264a985c1ca4983c82fe27f9e5285a825ba80785b71d5b50db

SHA512
034517c9ffdf48f758a4ab9fcf3ab0948185dc8fcd537250665cdb8545b641d4c95a40f17fc4f37190bea20db125822e30033e1f43487b76dec070c1ad18fe2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\l3oquxakSc2p.bat

Filesize
207B

MD5
6a2e63505ecd53cfd3969f9cf412c282

SHA1
4ae0177b01372043dec4adbdf202ea0356feb8a3

SHA256
c2bc31f4b13ea2bccfdd9d59c50fa425df753fe93e3ede91f9ae5c3f733b1f07

SHA512
6141794131cea771c22fcc110764ab38c77a693c864ced66e0098d4a84d9e91d2526cf616009b4e88fc800b8e9568bec8ee43a833f75df281d40b35d5fecdffb

Download Submit
C:\Users\Admin\AppData\Local\Temp\qPspyCYUwIBC.bat

Filesize
207B

MD5
0f07e6dd122bbc77129f5c784667c52b

SHA1
b04fdcf83dd8e7ab6d1763912233de84ffbff9d1

SHA256
43861ef0401a3c619293afab9945317a5fc7b71190ae58a3a2c3a86024c99bb7

SHA512
5dacbe034dd2734d77972259e1f775f8e05db11ce9f2841b8c7c79f1a1afd1334cbc277a0a6a0b31c5cd55a3ac71c06c996b33ca8113fa396f1d7d3ac73803ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\tTVpObGbYCuI.bat

Filesize
207B

MD5
b87b08db3e877079720a456369e59043

SHA1
c8e961042c9b168a5fbd10e893f2d68fa9697ecb

SHA256
1515307924a5d40ced45310d1d6f47a91ef87b2a3c45a08b13db121f5ac0e445

SHA512
99befb9ba7aa82d8c49ced25d5e5488d2897f1b02d62513adcf84b8ec490253d35586f4a9cced3665f2b2949b7b6df235b6e6ae3838ecba54ecd796cc868a021

Download Submit
C:\Users\Admin\AppData\Local\Temp\tj1BPakBEhVb.bat

Filesize
207B

MD5
3a5b6585f532aa2d07745f462585028e

SHA1
2eae14b3620b0f0b32f63cb14a1a7fb904e99554

SHA256
c37db71834168305aba7a2ddefe854a2e3fe2935e9e9554b50a6defc33e5dcfc

SHA512
45f3b6d77d19aa51073e55642bbe14c3d64bcea7e5819ed293117e3efd899119e0333ba381aa4d86400517c07961ba7cc4adb01c04c8bf6e356a464159d1ddb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\w3htRKDRzqig.bat

Filesize
207B

MD5
4af1f1dcf6965b31260a8452b8f3da69

SHA1
9591d416777673156a86276597a4cf02fc8b729a

SHA256
c9e5d0223fa7ef9cd28d8e1714bf9aaeb51b0557f24a47762aa3253ccbb5e5db

SHA512
faa938444d634761ac0474a02378896ebd458297fb6ff2951872d253df71e4f405cbd5715a02f300dfb9814f04db6c579dee0923c79d7c549aa1d917f114d10c

Download Submit
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe

Filesize
3.1MB

MD5
bc14ab48b3cc300a8a2c14b9fe6b185a

SHA1
3fa377bf0f2cf8a5dab914eb0f224d2ca6b90c78

SHA256
e19ec4fa8dcc4d92b63bf6e5d4b9c519032799fec8fb7d5634adf34d954f067b

SHA512
5f34a257f7cb4511359708a243b15bedcac2d65911ecd4c168a97068c6f1aa77973bd9dffa9e496828883c067205865af159710d0d40e1d0317786fca421bf10

Download Submit
memory/1008-0-0x00007FFE597E3000-0x00007FFE597E5000-memory.dmp

Filesize
8KB

Download
memory/1008-5-0x00007FFE597E0000-0x00007FFE5A2A2000-memory.dmp

Filesize
10.8MB

Download
memory/1008-2-0x00007FFE597E0000-0x00007FFE5A2A2000-memory.dmp

Filesize
10.8MB

Download
memory/1008-1-0x0000000000670000-0x0000000000994000-memory.dmp

Filesize
3.1MB

Download
memory/1124-9-0x000000001C8C0000-0x000000001C972000-memory.dmp

Filesize
712KB

Download
memory/1124-17-0x00007FFE597E0000-0x00007FFE5A2A2000-memory.dmp

Filesize
10.8MB

Download
memory/1124-6-0x00007FFE597E0000-0x00007FFE5A2A2000-memory.dmp

Filesize
10.8MB

Download
memory/1124-7-0x00007FFE597E0000-0x00007FFE5A2A2000-memory.dmp

Filesize
10.8MB

Download
memory/1124-8-0x000000001C7B0000-0x000000001C800000-memory.dmp

Filesize
320KB

Download
memory/1472-48-0x0000022FBD2A0000-0x0000022FBD2A1000-memory.dmp

Filesize
4KB

Download
memory/1472-47-0x0000022FBD2A0000-0x0000022FBD2A1000-memory.dmp

Filesize
4KB

Download
memory/1472-44-0x0000022FBD2A0000-0x0000022FBD2A1000-memory.dmp

Filesize
4KB

Download
memory/1472-36-0x0000022FBD2A0000-0x0000022FBD2A1000-memory.dmp

Filesize
4KB

Download
memory/1472-38-0x0000022FBD2A0000-0x0000022FBD2A1000-memory.dmp

Filesize
4KB

Download
memory/1472-37-0x0000022FBD2A0000-0x0000022FBD2A1000-memory.dmp

Filesize
4KB

Download
memory/1472-46-0x0000022FBD2A0000-0x0000022FBD2A1000-memory.dmp

Filesize
4KB

Download
memory/1472-45-0x0000022FBD2A0000-0x0000022FBD2A1000-memory.dmp

Filesize
4KB

Download
memory/1472-42-0x0000022FBD2A0000-0x0000022FBD2A1000-memory.dmp

Filesize
4KB

Download
memory/1472-43-0x0000022FBD2A0000-0x0000022FBD2A1000-memory.dmp

Filesize
4KB

Download