lucastealer | hxxps://github[.]com/Gl0bster/PureCryptor/blob/main/Cryptor[.]exe

Analysis

max time kernel
191s
max time network
217s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
29-09-2023 15:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Gl0bster/PureCryptor/blob/main/Cryptor.exe

Score

10^/10

lucastealer stealer upx

Malware Config

Extracted

Family

lucastealer

https://api.telegram.org/bot6656071336:AAHleJy38tLJcU8izz7pqYuatRUiofd0IDo

Signatures

Luca Stealer
Info stealer written in Rust first seen in July 2022.
stealer lucastealer

Luca Stealer payload 15 IoCs

resource	yara_rule
behavioral1/memory/1660-227-0x00007FF6A87E0000-0x00007FF6A8C35000-memory.dmp	family_lucastealer
behavioral1/memory/4308-250-0x00007FF6A87E0000-0x00007FF6A8C35000-memory.dmp	family_lucastealer
behavioral1/memory/4988-251-0x00007FF6A87E0000-0x00007FF6A8C35000-memory.dmp	family_lucastealer
behavioral1/memory/1116-255-0x00007FF6A87E0000-0x00007FF6A8C35000-memory.dmp	family_lucastealer
behavioral1/memory/4644-256-0x00007FF6A87E0000-0x00007FF6A8C35000-memory.dmp	family_lucastealer
behavioral1/memory/4928-268-0x00007FF6A87E0000-0x00007FF6A8C35000-memory.dmp	family_lucastealer
behavioral1/memory/2148-269-0x00007FF6A87E0000-0x00007FF6A8C35000-memory.dmp	family_lucastealer
behavioral1/memory/3696-298-0x00007FF6A87E0000-0x00007FF6A8C35000-memory.dmp	family_lucastealer
behavioral1/memory/848-300-0x00007FF6A87E0000-0x00007FF6A8C35000-memory.dmp	family_lucastealer
behavioral1/memory/4476-303-0x00007FF6A87E0000-0x00007FF6A8C35000-memory.dmp	family_lucastealer
behavioral1/memory/5004-324-0x00007FF6A87E0000-0x00007FF6A8C35000-memory.dmp	family_lucastealer
behavioral1/memory/316-326-0x00007FF6A87E0000-0x00007FF6A8C35000-memory.dmp	family_lucastealer
behavioral1/memory/4644-327-0x00007FF6A87E0000-0x00007FF6A8C35000-memory.dmp	family_lucastealer
behavioral1/memory/1780-329-0x00007FF6A87E0000-0x00007FF6A8C35000-memory.dmp	family_lucastealer
behavioral1/memory/4364-331-0x00007FF6A87E0000-0x00007FF6A8C35000-memory.dmp	family_lucastealer

Downloads MZ/PE file

Executes dropped EXE 15 IoCs

pid	Process
1660	Cryptor.exe
4308	Cryptor.exe
4988	Cryptor.exe
1116	Cryptor.exe
4644	Cryptor.exe
4928	Cryptor.exe
2148	Cryptor.exe
3696	Cryptor.exe
848	Cryptor.exe
4476	Cryptor.exe
5004	Cryptor.exe
316	Cryptor.exe
4644	Cryptor.exe
1780	Cryptor.exe
4364	Cryptor.exe

UPX packed file 38 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0007000000023258-183.dat	upx
behavioral1/files/0x0007000000023258-224.dat	upx
behavioral1/files/0x0007000000023258-225.dat	upx
behavioral1/memory/1660-226-0x00007FF6A87E0000-0x00007FF6A8C35000-memory.dmp	upx
behavioral1/memory/1660-227-0x00007FF6A87E0000-0x00007FF6A8C35000-memory.dmp	upx
behavioral1/files/0x0007000000023258-246.dat	upx
behavioral1/memory/4308-247-0x00007FF6A87E0000-0x00007FF6A8C35000-memory.dmp	upx
behavioral1/files/0x0007000000023258-248.dat	upx
behavioral1/memory/4988-249-0x00007FF6A87E0000-0x00007FF6A8C35000-memory.dmp	upx
behavioral1/memory/4308-250-0x00007FF6A87E0000-0x00007FF6A8C35000-memory.dmp	upx
behavioral1/memory/4988-251-0x00007FF6A87E0000-0x00007FF6A8C35000-memory.dmp	upx
behavioral1/files/0x0007000000023258-252.dat	upx
behavioral1/memory/1116-253-0x00007FF6A87E0000-0x00007FF6A8C35000-memory.dmp	upx
behavioral1/files/0x0007000000023258-254.dat	upx
behavioral1/memory/1116-255-0x00007FF6A87E0000-0x00007FF6A8C35000-memory.dmp	upx
behavioral1/memory/4644-256-0x00007FF6A87E0000-0x00007FF6A8C35000-memory.dmp	upx
behavioral1/files/0x0007000000023258-265.dat	upx
behavioral1/files/0x0007000000023258-266.dat	upx
behavioral1/memory/2148-267-0x00007FF6A87E0000-0x00007FF6A8C35000-memory.dmp	upx
behavioral1/memory/4928-268-0x00007FF6A87E0000-0x00007FF6A8C35000-memory.dmp	upx
behavioral1/memory/2148-269-0x00007FF6A87E0000-0x00007FF6A8C35000-memory.dmp	upx
behavioral1/files/0x0007000000023258-297.dat	upx
behavioral1/memory/3696-298-0x00007FF6A87E0000-0x00007FF6A8C35000-memory.dmp	upx
behavioral1/files/0x0007000000023258-299.dat	upx
behavioral1/memory/848-300-0x00007FF6A87E0000-0x00007FF6A8C35000-memory.dmp	upx
behavioral1/files/0x0007000000023258-301.dat	upx
behavioral1/memory/4476-302-0x00007FF6A87E0000-0x00007FF6A8C35000-memory.dmp	upx
behavioral1/memory/4476-303-0x00007FF6A87E0000-0x00007FF6A8C35000-memory.dmp	upx
behavioral1/files/0x0007000000023258-322.dat	upx
behavioral1/files/0x0007000000023258-323.dat	upx
behavioral1/memory/5004-324-0x00007FF6A87E0000-0x00007FF6A8C35000-memory.dmp	upx
behavioral1/files/0x0007000000023258-325.dat	upx
behavioral1/memory/316-326-0x00007FF6A87E0000-0x00007FF6A8C35000-memory.dmp	upx
behavioral1/memory/4644-327-0x00007FF6A87E0000-0x00007FF6A8C35000-memory.dmp	upx
behavioral1/files/0x0007000000023258-328.dat	upx
behavioral1/memory/1780-329-0x00007FF6A87E0000-0x00007FF6A8C35000-memory.dmp	upx
behavioral1/files/0x0007000000023258-330.dat	upx
behavioral1/memory/4364-331-0x00007FF6A87E0000-0x00007FF6A8C35000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 257055.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4768	msedge.exe
4768	msedge.exe
388	msedge.exe
388	msedge.exe
2860	identity_helper.exe
2860	identity_helper.exe
2164	msedge.exe
2164	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 388 wrote to memory of 380	388	msedge.exe	27
PID 388 wrote to memory of 380	388	msedge.exe	27
PID 388 wrote to memory of 5048	388	msedge.exe	87
PID 388 wrote to memory of 5048	388	msedge.exe	87
PID 388 wrote to memory of 5048	388	msedge.exe	87
PID 388 wrote to memory of 5048	388	msedge.exe	87
PID 388 wrote to memory of 5048	388	msedge.exe	87
PID 388 wrote to memory of 5048	388	msedge.exe	87
PID 388 wrote to memory of 5048	388	msedge.exe	87
PID 388 wrote to memory of 5048	388	msedge.exe	87
PID 388 wrote to memory of 5048	388	msedge.exe	87
PID 388 wrote to memory of 5048	388	msedge.exe	87
PID 388 wrote to memory of 5048	388	msedge.exe	87
PID 388 wrote to memory of 5048	388	msedge.exe	87
PID 388 wrote to memory of 5048	388	msedge.exe	87
PID 388 wrote to memory of 5048	388	msedge.exe	87
PID 388 wrote to memory of 5048	388	msedge.exe	87
PID 388 wrote to memory of 5048	388	msedge.exe	87
PID 388 wrote to memory of 5048	388	msedge.exe	87
PID 388 wrote to memory of 5048	388	msedge.exe	87
PID 388 wrote to memory of 5048	388	msedge.exe	87
PID 388 wrote to memory of 5048	388	msedge.exe	87
PID 388 wrote to memory of 5048	388	msedge.exe	87
PID 388 wrote to memory of 5048	388	msedge.exe	87
PID 388 wrote to memory of 5048	388	msedge.exe	87
PID 388 wrote to memory of 5048	388	msedge.exe	87
PID 388 wrote to memory of 5048	388	msedge.exe	87
PID 388 wrote to memory of 5048	388	msedge.exe	87
PID 388 wrote to memory of 5048	388	msedge.exe	87
PID 388 wrote to memory of 5048	388	msedge.exe	87
PID 388 wrote to memory of 5048	388	msedge.exe	87
PID 388 wrote to memory of 5048	388	msedge.exe	87
PID 388 wrote to memory of 5048	388	msedge.exe	87
PID 388 wrote to memory of 5048	388	msedge.exe	87
PID 388 wrote to memory of 5048	388	msedge.exe	87
PID 388 wrote to memory of 5048	388	msedge.exe	87
PID 388 wrote to memory of 5048	388	msedge.exe	87
PID 388 wrote to memory of 5048	388	msedge.exe	87
PID 388 wrote to memory of 5048	388	msedge.exe	87
PID 388 wrote to memory of 5048	388	msedge.exe	87
PID 388 wrote to memory of 5048	388	msedge.exe	87
PID 388 wrote to memory of 5048	388	msedge.exe	87
PID 388 wrote to memory of 4768	388	msedge.exe	88
PID 388 wrote to memory of 4768	388	msedge.exe	88
PID 388 wrote to memory of 3992	388	msedge.exe	89
PID 388 wrote to memory of 3992	388	msedge.exe	89
PID 388 wrote to memory of 3992	388	msedge.exe	89
PID 388 wrote to memory of 3992	388	msedge.exe	89
PID 388 wrote to memory of 3992	388	msedge.exe	89
PID 388 wrote to memory of 3992	388	msedge.exe	89
PID 388 wrote to memory of 3992	388	msedge.exe	89
PID 388 wrote to memory of 3992	388	msedge.exe	89
PID 388 wrote to memory of 3992	388	msedge.exe	89
PID 388 wrote to memory of 3992	388	msedge.exe	89
PID 388 wrote to memory of 3992	388	msedge.exe	89
PID 388 wrote to memory of 3992	388	msedge.exe	89
PID 388 wrote to memory of 3992	388	msedge.exe	89
PID 388 wrote to memory of 3992	388	msedge.exe	89
PID 388 wrote to memory of 3992	388	msedge.exe	89
PID 388 wrote to memory of 3992	388	msedge.exe	89
PID 388 wrote to memory of 3992	388	msedge.exe	89
PID 388 wrote to memory of 3992	388	msedge.exe	89
PID 388 wrote to memory of 3992	388	msedge.exe	89
PID 388 wrote to memory of 3992	388	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Gl0bster/PureCryptor/blob/main/Cryptor.exe
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbf51f46f8,0x7ffbf51f4708,0x7ffbf51f4718
  2⤵
  PID:380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,12899781873540897112,18267795405070164280,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,12899781873540897112,18267795405070164280,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,12899781873540897112,18267795405070164280,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2660 /prefetch:8
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,12899781873540897112,18267795405070164280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,12899781873540897112,18267795405070164280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,12899781873540897112,18267795405070164280,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5236 /prefetch:8
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,12899781873540897112,18267795405070164280,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5236 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,12899781873540897112,18267795405070164280,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,12899781873540897112,18267795405070164280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,12899781873540897112,18267795405070164280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,12899781873540897112,18267795405070164280,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,12899781873540897112,18267795405070164280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2144,12899781873540897112,18267795405070164280,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5648 /prefetch:8
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2144,12899781873540897112,18267795405070164280,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6224 /prefetch:8
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2144,12899781873540897112,18267795405070164280,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3004 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2164
- C:\Users\Admin\Downloads\Cryptor.exe
  "C:\Users\Admin\Downloads\Cryptor.exe"
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Users\Admin\Downloads\Cryptor.exe
  "C:\Users\Admin\Downloads\Cryptor.exe"
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Users\Admin\Downloads\Cryptor.exe
  "C:\Users\Admin\Downloads\Cryptor.exe"
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Users\Admin\Downloads\Cryptor.exe
  "C:\Users\Admin\Downloads\Cryptor.exe"
  2⤵
  - Executes dropped EXE
  PID:1116
- C:\Users\Admin\Downloads\Cryptor.exe
  "C:\Users\Admin\Downloads\Cryptor.exe"
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Users\Admin\Downloads\Cryptor.exe
  "C:\Users\Admin\Downloads\Cryptor.exe"
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Users\Admin\Downloads\Cryptor.exe
  "C:\Users\Admin\Downloads\Cryptor.exe"
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Users\Admin\Downloads\Cryptor.exe
  "C:\Users\Admin\Downloads\Cryptor.exe"
  2⤵
  - Executes dropped EXE
  PID:3696
- C:\Users\Admin\Downloads\Cryptor.exe
  "C:\Users\Admin\Downloads\Cryptor.exe"
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Users\Admin\Downloads\Cryptor.exe
  "C:\Users\Admin\Downloads\Cryptor.exe"
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Users\Admin\Downloads\Cryptor.exe
  "C:\Users\Admin\Downloads\Cryptor.exe"
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Users\Admin\Downloads\Cryptor.exe
  "C:\Users\Admin\Downloads\Cryptor.exe"
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Users\Admin\Downloads\Cryptor.exe
  "C:\Users\Admin\Downloads\Cryptor.exe"
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,12899781873540897112,18267795405070164280,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5056 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4364

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3768

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3304

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1680

C:\Users\Admin\Downloads\Cryptor.exe
"C:\Users\Admin\Downloads\Cryptor.exe"
1⤵
- Executes dropped EXE
PID:1780

C:\Users\Admin\Downloads\Cryptor.exe
"C:\Users\Admin\Downloads\Cryptor.exe"
1⤵
- Executes dropped EXE
PID:4364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
db9dbef3f8b1f616429f605c1ebca2f0

SHA1
ffba76f0836c024828d4ff1982cc4240c41a8f16

SHA256
3e0297327872058355ac041a5e0fc83ed017faee0f6c0105b44bb3e5399a93a1

SHA512
4eedc387fe304f27f9d52ff5d71461c7f22147f7a8c18b8e7982acb76515528a36486a567451daafe093f9563b133c6799f2ad046e04256ccb46c83eb99e86c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
13305c73210c295559c0dbe5321a9b07

SHA1
992d4f5eb05c449002454e52655f84b096afa980

SHA256
ab80ea79e8ae329dd9500eb488dced766d3d3a3a834ffe0407789e7f897ae663

SHA512
baa52ce41f90018eb19a1167ebb37dc8b430a55b86eb75dd932ee1f991b3500ef68083656a86b8c9fb25bd6d8288e531f8b3705711a5e8639453d87c88af5bc8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
579B

MD5
106247267798fa1d7190823a5dd5c2a8

SHA1
62ff3bed0b462d3a59eb3d4aa1f0849e43612c61

SHA256
d59a10df53802434b539b56f779878466f70463da9508ef850f69c20fd590e9e

SHA512
7ce5fc8a4d2e13f265430e9ddc523bd5a4fd5c9bfd4dcb8e699429770888898b12b3d3c0313fd6c51c6638869e08286e6e16fa8894b6f606c88b42db973a83df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4d506b79b5a428c4ba74e7f9ed5e5b9b

SHA1
0011bf689ce95972752ef6b1aff6c149dd13d1ce

SHA256
db58eb024854faf843a10e746f4db9b9cf065748e1ad0409d61eefb296935245

SHA512
ce65993306ed502044842958ad2a6701ce72fe7ef25251c51e9bdef647be0ac8e40dad8f540e48b42dba1e6bd75469a42436cf56939e4e448ed2386371e48692

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0b6f88ed35b13221cb8cca8072161b38

SHA1
9cf6db396605735901ed00ee1b36b8d7f86ae271

SHA256
6c8a245862d4b603eff05af078fb3f0e5293dc9160f0ee912e4fcbb4d9b654af

SHA512
e616e8c97eb48c92933cdbcac55ead311f9714bb79c3f52f1e135bce0448eea837f04a238b4233128035292af1ba35766242471694eb2e3ad233fe02eaadfe07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
6dcb90ba1ba8e06c1d4f27ec78f6911a

SHA1
71e7834c7952aeb9f1aa6eb88e1959a1ae4985d9

SHA256
30d89e5026668c5a58bef231930a8bfb27ca099b24399a2615b210210d418416

SHA512
dc31807eaeb5221ac60d598035ca3ccab1dbeecc95caaff5e1f5a2a89ba1c83ef0a708ee0b8ed05b588ea5d50e360032a534356f84c89d3791df91d419daeff9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
672dcd62eb7d0437bff48081b6c2807c

SHA1
b5d53c11d98256019e26636d94394c2b2748319f

SHA256
eceeab6ba50155f9eaf1398a43dd2bc95582564dd48d1aacae0fd6af07641520

SHA512
c50da0b3e0eb26405df3b7cc807c078e888f0721da67c5ab851576315e90820df92db4d0bc825a5e2343171c04b55cd234dce6b2d8010dd0e99261cec0136c88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c5bc052fa206ac62dead1f9c45d6feeb

SHA1
72630dd9b9da9a23154c1eef9b041144da4a7a44

SHA256
eae2247da519b68f221a8cf74378a038ff943f895ef3e77203060fed84df3df1

SHA512
68b568c51039362055dde21d232a476859cca4851fb0aecf3e2df285a1c52003745f214bf749abe06e0ec069bb72423f4fb6142f78f3eb3b793a10d695760bc8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
da6a19f65ffa4e7d896a25e774b7b911

SHA1
a36132a1ab8ff95c7c48d1f8fb4c01990042015d

SHA256
1e7631e7416db2e17e679ab41a2d3f16117b19d51cb7d7efdc3489b8b611d09e

SHA512
534fe5cda70f6c6e356eb7ab58f9571977576ebe64280e28d7a76767a2cbb04d8596ba2877f3d692b7e26db7c29563cae0ce0ea69d018e4c9471d2e85551d975

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57fdd8.TMP

Filesize
874B

MD5
cec5c80015eb9e7993c77256cb01e681

SHA1
dd5b423daf60dfa06f0dac3ed26ad395284c8bc3

SHA256
e8a5552d2fc7190d624816d3580050d0ded9009bf776c8aa3e397f33973b3dcb

SHA512
0c4857f9e0799e77fb663fa3f25d055be7e2fe9599386cb377c35528c0b9ba09f5b420a894faf7fb978b6a6f201f497f31421a6fdb584efbd12f2ee64342de84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\dc4cd679-e175-442b-ad77-a4c969f760b5.tmp

Filesize
5KB

MD5
a9669a4e1b256a6dceaea1e6d85f41d2

SHA1
8f4963a4c193ada56646aa5338da396e5aef20fa

SHA256
c187c81a14a2b6147694bd1bfd62cc5fb3abaf95bb7e1eba689d9b611ae487c5

SHA512
0316942ed198e0bfb9bd51fd9819f13906f5bfc0e52668efaca3df25f800c45d7be38e6fa8fb51cda6617f54f1626d73007426d03d2bea74328dbc82ff0701f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a98bf6d15c93e5f2de00651564e1c0c3

SHA1
4b00a668d6baec2fe53f8d23bd4038bfdd6b51ea

SHA256
d2bfb0f26c3469c9fcc7df91edda07bc9000ff601f0e8e8da64e3d902f699d35

SHA512
0fb5a55c9179ffbb2db6a3f5f255f899cdbb866bbd04146e3ea1aef7dda890dca3597943c57e6fe4653602f7e2cbad676adedcb1ff17b6323826f637fb071f51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
10034738c375808ad9338e00aaa9aeed

SHA1
7d12372045ef165e9866bf858de4281f4068e825

SHA256
87411dc9440a6811bd6a265afbaa49f139bd4172d50014af21b94e89ffdca05a

SHA512
af913ee5f003d8e7cd59fd964136461a9f1548f479fd178c18bca2ea3da8c42cc6e3322df61cbfbe0e5f9c90c0026c687609d07264ec56723c3d9df2046ee9cb

Download Submit
C:\Users\Admin\Downloads\Cryptor.exe

Filesize
2.4MB

MD5
28727dfa612feae2550d53b2c2667a8b

SHA1
5decdf62190057c77cee932e1f7eae5c21ccb8c7

SHA256
6412a0081efe5e2dcfcfb501c0a1b87e20d8cba9677e3acda99152a1a0206eec

SHA512
bf5b9bf8ef48c795e2ae5c92d31d65e1c66d5d194d2c333f00e0968e0e2d71b1525498db86ab2f1bb9e5185c470218d969f44ab4bdce0d22d4da22d6f38e84c4

Download Submit
C:\Users\Admin\Downloads\Cryptor.exe

Filesize
2.4MB

MD5
28727dfa612feae2550d53b2c2667a8b

SHA1
5decdf62190057c77cee932e1f7eae5c21ccb8c7

SHA256
6412a0081efe5e2dcfcfb501c0a1b87e20d8cba9677e3acda99152a1a0206eec

SHA512
bf5b9bf8ef48c795e2ae5c92d31d65e1c66d5d194d2c333f00e0968e0e2d71b1525498db86ab2f1bb9e5185c470218d969f44ab4bdce0d22d4da22d6f38e84c4

Download Submit
C:\Users\Admin\Downloads\Cryptor.exe

Filesize
2.4MB

MD5
28727dfa612feae2550d53b2c2667a8b

SHA1
5decdf62190057c77cee932e1f7eae5c21ccb8c7

SHA256
6412a0081efe5e2dcfcfb501c0a1b87e20d8cba9677e3acda99152a1a0206eec

SHA512
bf5b9bf8ef48c795e2ae5c92d31d65e1c66d5d194d2c333f00e0968e0e2d71b1525498db86ab2f1bb9e5185c470218d969f44ab4bdce0d22d4da22d6f38e84c4

Download Submit
C:\Users\Admin\Downloads\Cryptor.exe

Filesize
2.4MB

MD5
28727dfa612feae2550d53b2c2667a8b

SHA1
5decdf62190057c77cee932e1f7eae5c21ccb8c7

SHA256
6412a0081efe5e2dcfcfb501c0a1b87e20d8cba9677e3acda99152a1a0206eec

SHA512
bf5b9bf8ef48c795e2ae5c92d31d65e1c66d5d194d2c333f00e0968e0e2d71b1525498db86ab2f1bb9e5185c470218d969f44ab4bdce0d22d4da22d6f38e84c4

Download Submit
C:\Users\Admin\Downloads\Cryptor.exe

Filesize
2.4MB

MD5
28727dfa612feae2550d53b2c2667a8b

SHA1
5decdf62190057c77cee932e1f7eae5c21ccb8c7

SHA256
6412a0081efe5e2dcfcfb501c0a1b87e20d8cba9677e3acda99152a1a0206eec

SHA512
bf5b9bf8ef48c795e2ae5c92d31d65e1c66d5d194d2c333f00e0968e0e2d71b1525498db86ab2f1bb9e5185c470218d969f44ab4bdce0d22d4da22d6f38e84c4

Download Submit
C:\Users\Admin\Downloads\Cryptor.exe

Filesize
2.4MB

MD5
28727dfa612feae2550d53b2c2667a8b

SHA1
5decdf62190057c77cee932e1f7eae5c21ccb8c7

SHA256
6412a0081efe5e2dcfcfb501c0a1b87e20d8cba9677e3acda99152a1a0206eec

SHA512
bf5b9bf8ef48c795e2ae5c92d31d65e1c66d5d194d2c333f00e0968e0e2d71b1525498db86ab2f1bb9e5185c470218d969f44ab4bdce0d22d4da22d6f38e84c4

Download Submit
C:\Users\Admin\Downloads\Cryptor.exe

Filesize
2.4MB

MD5
28727dfa612feae2550d53b2c2667a8b

SHA1
5decdf62190057c77cee932e1f7eae5c21ccb8c7

SHA256
6412a0081efe5e2dcfcfb501c0a1b87e20d8cba9677e3acda99152a1a0206eec

SHA512
bf5b9bf8ef48c795e2ae5c92d31d65e1c66d5d194d2c333f00e0968e0e2d71b1525498db86ab2f1bb9e5185c470218d969f44ab4bdce0d22d4da22d6f38e84c4

Download Submit
C:\Users\Admin\Downloads\Cryptor.exe

Filesize
2.4MB

MD5
28727dfa612feae2550d53b2c2667a8b

SHA1
5decdf62190057c77cee932e1f7eae5c21ccb8c7

SHA256
6412a0081efe5e2dcfcfb501c0a1b87e20d8cba9677e3acda99152a1a0206eec

SHA512
bf5b9bf8ef48c795e2ae5c92d31d65e1c66d5d194d2c333f00e0968e0e2d71b1525498db86ab2f1bb9e5185c470218d969f44ab4bdce0d22d4da22d6f38e84c4

Download Submit
C:\Users\Admin\Downloads\Cryptor.exe

Filesize
2.4MB

MD5
28727dfa612feae2550d53b2c2667a8b

SHA1
5decdf62190057c77cee932e1f7eae5c21ccb8c7

SHA256
6412a0081efe5e2dcfcfb501c0a1b87e20d8cba9677e3acda99152a1a0206eec

SHA512
bf5b9bf8ef48c795e2ae5c92d31d65e1c66d5d194d2c333f00e0968e0e2d71b1525498db86ab2f1bb9e5185c470218d969f44ab4bdce0d22d4da22d6f38e84c4

Download Submit
C:\Users\Admin\Downloads\Cryptor.exe

Filesize
2.4MB

MD5
28727dfa612feae2550d53b2c2667a8b

SHA1
5decdf62190057c77cee932e1f7eae5c21ccb8c7

SHA256
6412a0081efe5e2dcfcfb501c0a1b87e20d8cba9677e3acda99152a1a0206eec

SHA512
bf5b9bf8ef48c795e2ae5c92d31d65e1c66d5d194d2c333f00e0968e0e2d71b1525498db86ab2f1bb9e5185c470218d969f44ab4bdce0d22d4da22d6f38e84c4

Download Submit
C:\Users\Admin\Downloads\Cryptor.exe

Filesize
2.4MB

MD5
28727dfa612feae2550d53b2c2667a8b

SHA1
5decdf62190057c77cee932e1f7eae5c21ccb8c7

SHA256
6412a0081efe5e2dcfcfb501c0a1b87e20d8cba9677e3acda99152a1a0206eec

SHA512
bf5b9bf8ef48c795e2ae5c92d31d65e1c66d5d194d2c333f00e0968e0e2d71b1525498db86ab2f1bb9e5185c470218d969f44ab4bdce0d22d4da22d6f38e84c4

Download Submit
C:\Users\Admin\Downloads\Cryptor.exe

Filesize
2.4MB

MD5
28727dfa612feae2550d53b2c2667a8b

SHA1
5decdf62190057c77cee932e1f7eae5c21ccb8c7

SHA256
6412a0081efe5e2dcfcfb501c0a1b87e20d8cba9677e3acda99152a1a0206eec

SHA512
bf5b9bf8ef48c795e2ae5c92d31d65e1c66d5d194d2c333f00e0968e0e2d71b1525498db86ab2f1bb9e5185c470218d969f44ab4bdce0d22d4da22d6f38e84c4

Download Submit
C:\Users\Admin\Downloads\Cryptor.exe

Filesize
2.4MB

MD5
28727dfa612feae2550d53b2c2667a8b

SHA1
5decdf62190057c77cee932e1f7eae5c21ccb8c7

SHA256
6412a0081efe5e2dcfcfb501c0a1b87e20d8cba9677e3acda99152a1a0206eec

SHA512
bf5b9bf8ef48c795e2ae5c92d31d65e1c66d5d194d2c333f00e0968e0e2d71b1525498db86ab2f1bb9e5185c470218d969f44ab4bdce0d22d4da22d6f38e84c4

Download Submit
C:\Users\Admin\Downloads\Cryptor.exe

Filesize
2.4MB

MD5
28727dfa612feae2550d53b2c2667a8b

SHA1
5decdf62190057c77cee932e1f7eae5c21ccb8c7

SHA256
6412a0081efe5e2dcfcfb501c0a1b87e20d8cba9677e3acda99152a1a0206eec

SHA512
bf5b9bf8ef48c795e2ae5c92d31d65e1c66d5d194d2c333f00e0968e0e2d71b1525498db86ab2f1bb9e5185c470218d969f44ab4bdce0d22d4da22d6f38e84c4

Download Submit
C:\Users\Admin\Downloads\Cryptor.exe

Filesize
2.4MB

MD5
28727dfa612feae2550d53b2c2667a8b

SHA1
5decdf62190057c77cee932e1f7eae5c21ccb8c7

SHA256
6412a0081efe5e2dcfcfb501c0a1b87e20d8cba9677e3acda99152a1a0206eec

SHA512
bf5b9bf8ef48c795e2ae5c92d31d65e1c66d5d194d2c333f00e0968e0e2d71b1525498db86ab2f1bb9e5185c470218d969f44ab4bdce0d22d4da22d6f38e84c4

Download Submit
C:\Users\Admin\Downloads\Cryptor.exe

Filesize
2.4MB

MD5
28727dfa612feae2550d53b2c2667a8b

SHA1
5decdf62190057c77cee932e1f7eae5c21ccb8c7

SHA256
6412a0081efe5e2dcfcfb501c0a1b87e20d8cba9677e3acda99152a1a0206eec

SHA512
bf5b9bf8ef48c795e2ae5c92d31d65e1c66d5d194d2c333f00e0968e0e2d71b1525498db86ab2f1bb9e5185c470218d969f44ab4bdce0d22d4da22d6f38e84c4

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 257055.crdownload

Filesize
2.4MB

MD5
28727dfa612feae2550d53b2c2667a8b

SHA1
5decdf62190057c77cee932e1f7eae5c21ccb8c7

SHA256
6412a0081efe5e2dcfcfb501c0a1b87e20d8cba9677e3acda99152a1a0206eec

SHA512
bf5b9bf8ef48c795e2ae5c92d31d65e1c66d5d194d2c333f00e0968e0e2d71b1525498db86ab2f1bb9e5185c470218d969f44ab4bdce0d22d4da22d6f38e84c4

Download Submit
memory/316-326-0x00007FF6A87E0000-0x00007FF6A8C35000-memory.dmp

Filesize
4.3MB

Download
memory/848-300-0x00007FF6A87E0000-0x00007FF6A8C35000-memory.dmp

Filesize
4.3MB

Download
memory/1116-255-0x00007FF6A87E0000-0x00007FF6A8C35000-memory.dmp

Filesize
4.3MB

Download
memory/1116-253-0x00007FF6A87E0000-0x00007FF6A8C35000-memory.dmp

Filesize
4.3MB

Download
memory/1660-227-0x00007FF6A87E0000-0x00007FF6A8C35000-memory.dmp

Filesize
4.3MB

Download
memory/1660-226-0x00007FF6A87E0000-0x00007FF6A8C35000-memory.dmp

Filesize
4.3MB

Download
memory/1780-329-0x00007FF6A87E0000-0x00007FF6A8C35000-memory.dmp

Filesize
4.3MB

Download
memory/2148-267-0x00007FF6A87E0000-0x00007FF6A8C35000-memory.dmp

Filesize
4.3MB

Download
memory/2148-269-0x00007FF6A87E0000-0x00007FF6A8C35000-memory.dmp

Filesize
4.3MB

Download
memory/3696-298-0x00007FF6A87E0000-0x00007FF6A8C35000-memory.dmp

Filesize
4.3MB

Download
memory/4308-247-0x00007FF6A87E0000-0x00007FF6A8C35000-memory.dmp

Filesize
4.3MB

Download
memory/4308-250-0x00007FF6A87E0000-0x00007FF6A8C35000-memory.dmp

Filesize
4.3MB

Download
memory/4364-331-0x00007FF6A87E0000-0x00007FF6A8C35000-memory.dmp

Filesize
4.3MB

Download
memory/4476-303-0x00007FF6A87E0000-0x00007FF6A8C35000-memory.dmp

Filesize
4.3MB

Download
memory/4476-302-0x00007FF6A87E0000-0x00007FF6A8C35000-memory.dmp

Filesize
4.3MB

Download
memory/4644-256-0x00007FF6A87E0000-0x00007FF6A8C35000-memory.dmp

Filesize
4.3MB

Download
memory/4644-327-0x00007FF6A87E0000-0x00007FF6A8C35000-memory.dmp

Filesize
4.3MB

Download
memory/4928-268-0x00007FF6A87E0000-0x00007FF6A8C35000-memory.dmp

Filesize
4.3MB

Download
memory/4988-249-0x00007FF6A87E0000-0x00007FF6A8C35000-memory.dmp

Filesize
4.3MB

Download
memory/4988-251-0x00007FF6A87E0000-0x00007FF6A8C35000-memory.dmp

Filesize
4.3MB

Download
memory/5004-324-0x00007FF6A87E0000-0x00007FF6A8C35000-memory.dmp

Filesize
4.3MB

Download