zgrat | 2759d31bcf93143c760e809f1097b5b7a3194cc8ce43704c6c59a20ad5c1c079

Analysis

max time kernel
162s
max time network
172s
platform
windows11-21h2_x64
resource
win11-20231215-en
resource tags

arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
submitted
14/01/2024, 18:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

VSInstaller.exe
Size

12.3MB
MD5

44c43d23bc75efb50bc6a095e17861e1
SHA1

60838d7a115c9aa23ddf39ddee322c044e359c58
SHA256

2759d31bcf93143c760e809f1097b5b7a3194cc8ce43704c6c59a20ad5c1c079
SHA512

aa0acda3a85fa11b1e03eb28f9e1186aeae8766eb1bf18523379ab8e52d486ad536ec0954d1f9972d81a107b0f779bb358dd790b21e585c8e32ff1d596e55b76
SSDEEP

393216:tg8+fg+g/6JghrmIaAlypnKRs2/xFEcKAmv:tgdgZ/lhrvRypnoxhNmv

Score

10^/10

zgrat evasion persistence pyinstaller rat

Malware Config

Signatures

Detect ZGRat V1 34 IoCs

resource	yara_rule
behavioral1/memory/4068-40-0x0000000004D30000-0x0000000004D9C000-memory.dmp	family_zgrat_v1
behavioral1/memory/4068-58-0x0000000004D30000-0x0000000004D95000-memory.dmp	family_zgrat_v1
behavioral1/memory/4068-96-0x0000000004D30000-0x0000000004D95000-memory.dmp	family_zgrat_v1
behavioral1/memory/4068-105-0x0000000004D30000-0x0000000004D95000-memory.dmp	family_zgrat_v1
behavioral1/memory/4068-112-0x0000000004D30000-0x0000000004D95000-memory.dmp	family_zgrat_v1
behavioral1/memory/4068-128-0x0000000004D30000-0x0000000004D95000-memory.dmp	family_zgrat_v1
behavioral1/memory/4068-134-0x0000000004D30000-0x0000000004D95000-memory.dmp	family_zgrat_v1
behavioral1/memory/4068-138-0x0000000004D30000-0x0000000004D95000-memory.dmp	family_zgrat_v1
behavioral1/memory/4068-142-0x0000000004D30000-0x0000000004D95000-memory.dmp	family_zgrat_v1
behavioral1/memory/4068-148-0x0000000004D30000-0x0000000004D95000-memory.dmp	family_zgrat_v1
behavioral1/memory/4068-154-0x0000000004D30000-0x0000000004D95000-memory.dmp	family_zgrat_v1
behavioral1/memory/4068-162-0x0000000004D30000-0x0000000004D95000-memory.dmp	family_zgrat_v1
behavioral1/memory/4068-164-0x0000000004D30000-0x0000000004D95000-memory.dmp	family_zgrat_v1
behavioral1/memory/4068-166-0x0000000004D30000-0x0000000004D95000-memory.dmp	family_zgrat_v1
behavioral1/memory/4068-160-0x0000000004D30000-0x0000000004D95000-memory.dmp	family_zgrat_v1
behavioral1/memory/4068-158-0x0000000004D30000-0x0000000004D95000-memory.dmp	family_zgrat_v1
behavioral1/memory/4068-156-0x0000000004D30000-0x0000000004D95000-memory.dmp	family_zgrat_v1
behavioral1/memory/4068-152-0x0000000004D30000-0x0000000004D95000-memory.dmp	family_zgrat_v1
behavioral1/memory/4068-150-0x0000000004D30000-0x0000000004D95000-memory.dmp	family_zgrat_v1
behavioral1/memory/4068-146-0x0000000004D30000-0x0000000004D95000-memory.dmp	family_zgrat_v1
behavioral1/memory/4068-144-0x0000000004D30000-0x0000000004D95000-memory.dmp	family_zgrat_v1
behavioral1/memory/4068-140-0x0000000004D30000-0x0000000004D95000-memory.dmp	family_zgrat_v1
behavioral1/memory/4068-136-0x0000000004D30000-0x0000000004D95000-memory.dmp	family_zgrat_v1
behavioral1/memory/4068-132-0x0000000004D30000-0x0000000004D95000-memory.dmp	family_zgrat_v1
behavioral1/memory/4068-130-0x0000000004D30000-0x0000000004D95000-memory.dmp	family_zgrat_v1
behavioral1/memory/4068-124-0x0000000004D30000-0x0000000004D95000-memory.dmp	family_zgrat_v1
behavioral1/memory/4068-114-0x0000000004D30000-0x0000000004D95000-memory.dmp	family_zgrat_v1
behavioral1/memory/4068-110-0x0000000004D30000-0x0000000004D95000-memory.dmp	family_zgrat_v1
behavioral1/memory/4068-102-0x0000000004D30000-0x0000000004D95000-memory.dmp	family_zgrat_v1
behavioral1/memory/4068-83-0x0000000004D30000-0x0000000004D95000-memory.dmp	family_zgrat_v1
behavioral1/memory/4068-76-0x0000000004D30000-0x0000000004D95000-memory.dmp	family_zgrat_v1
behavioral1/memory/4068-69-0x0000000004D30000-0x0000000004D95000-memory.dmp	family_zgrat_v1
behavioral1/memory/4068-61-0x0000000004D30000-0x0000000004D95000-memory.dmp	family_zgrat_v1
behavioral1/memory/4068-59-0x0000000004D30000-0x0000000004D95000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Executes dropped EXE 7 IoCs

pid	Process
4068	Ilkdt.exe
4856	powercfg.exe
4072	WinErrorMgr.exe
2444	KeyGeneratorI.exe
3240	KeyGeneratorI.exe
2616	WinErrorMgr.exe
5024	bauwrdgwodhv.exe

Loads dropped DLL 4 IoCs

pid	Process
3240	KeyGeneratorI.exe
3240	KeyGeneratorI.exe
3240	KeyGeneratorI.exe
3240	KeyGeneratorI.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
73	api.ipify.org
75	api.ipify.org

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MRT.exe	powercfg.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	bauwrdgwodhv.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 5024 set thread context of 1684	5024	bauwrdgwodhv.exe	153
PID 5024 set thread context of 5232	5024	bauwrdgwodhv.exe	151

Launches sc.exe 14 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5360	sc.exe
5544	sc.exe
4132	sc.exe
784	sc.exe
6100	sc.exe
6028	sc.exe
5196	sc.exe
852	sc.exe
4800	sc.exe
2084	sc.exe
5148	sc.exe
5848	sc.exe
1836	sc.exe
764	sc.exe

Detects Pyinstaller 4 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x0003000000024f71-38.dat	pyinstaller
behavioral1/files/0x0003000000024f71-44.dat	pyinstaller
behavioral1/files/0x0003000000024f71-46.dat	pyinstaller
behavioral1/files/0x0003000000024f71-74.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
5116	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 50 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4760	powershell.exe
4760	powershell.exe
1164	msedge.exe
1164	msedge.exe
4592	msedge.exe
4592	msedge.exe
4856	powercfg.exe
4628	msedge.exe
4628	msedge.exe
4680	powershell.exe
4680	powershell.exe
4680	powershell.exe
4856	powercfg.exe
4856	powercfg.exe
4856	powercfg.exe
4856	powercfg.exe
4856	powercfg.exe
4856	powercfg.exe
4856	powercfg.exe
4856	powercfg.exe
4856	powercfg.exe
4856	powercfg.exe
4856	powercfg.exe
4856	powercfg.exe
4856	powercfg.exe
4856	powercfg.exe
5024	bauwrdgwodhv.exe
5196	powershell.exe
5196	powershell.exe
5196	powershell.exe
4316	identity_helper.exe
4316	identity_helper.exe
5024	bauwrdgwodhv.exe
5024	bauwrdgwodhv.exe
5024	bauwrdgwodhv.exe
5024	bauwrdgwodhv.exe
5024	bauwrdgwodhv.exe
5024	bauwrdgwodhv.exe
5024	bauwrdgwodhv.exe
5024	bauwrdgwodhv.exe
5024	bauwrdgwodhv.exe
5024	bauwrdgwodhv.exe
5024	bauwrdgwodhv.exe
5024	bauwrdgwodhv.exe
5232	explorer.exe
5232	explorer.exe
5232	explorer.exe
5232	explorer.exe
5232	explorer.exe
5232	explorer.exe
5232	explorer.exe
5232	explorer.exe
5232	explorer.exe
5232	explorer.exe
5232	explorer.exe
5232	explorer.exe
5232	explorer.exe
5232	explorer.exe
5232	explorer.exe
5232	explorer.exe
5232	explorer.exe
5232	explorer.exe
5232	explorer.exe
5232	explorer.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
684	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	4068	Ilkdt.exe
Token: SeDebugPrivilege	4760	powershell.exe
Token: SeDebugPrivilege	4680	powershell.exe
Token: SeShutdownPrivilege	852	powercfg.exe
Token: SeCreatePagefilePrivilege	852	powercfg.exe
Token: SeShutdownPrivilege	1348	powercfg.exe
Token: SeCreatePagefilePrivilege	1348	powercfg.exe
Token: SeShutdownPrivilege	6056	powercfg.exe
Token: SeCreatePagefilePrivilege	6056	powercfg.exe
Token: SeShutdownPrivilege	5960	powercfg.exe
Token: SeCreatePagefilePrivilege	5960	powercfg.exe
Token: SeDebugPrivilege	5196	powershell.exe
Token: SeShutdownPrivilege	2376	powercfg.exe
Token: SeCreatePagefilePrivilege	2376	powercfg.exe
Token: SeShutdownPrivilege	6052	powercfg.exe
Token: SeCreatePagefilePrivilege	6052	powercfg.exe
Token: SeShutdownPrivilege	4856	powercfg.exe
Token: SeCreatePagefilePrivilege	4856	powercfg.exe
Token: SeShutdownPrivilege	2380	powercfg.exe
Token: SeCreatePagefilePrivilege	2380	powercfg.exe
Token: SeLockMemoryPrivilege	5232	explorer.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 4760	1200	VSInstaller.exe	80
PID 1200 wrote to memory of 4760	1200	VSInstaller.exe	80
PID 1200 wrote to memory of 4760	1200	VSInstaller.exe	80
PID 1200 wrote to memory of 4068	1200	VSInstaller.exe	82
PID 1200 wrote to memory of 4068	1200	VSInstaller.exe	82
PID 1200 wrote to memory of 4068	1200	VSInstaller.exe	82
PID 1200 wrote to memory of 4856	1200	VSInstaller.exe	158
PID 1200 wrote to memory of 4856	1200	VSInstaller.exe	158
PID 1200 wrote to memory of 4072	1200	VSInstaller.exe	86
PID 1200 wrote to memory of 4072	1200	VSInstaller.exe	86
PID 1200 wrote to memory of 4072	1200	VSInstaller.exe	86
PID 1200 wrote to memory of 2444	1200	VSInstaller.exe	84
PID 1200 wrote to memory of 2444	1200	VSInstaller.exe	84
PID 2444 wrote to memory of 3240	2444	KeyGeneratorI.exe	87
PID 2444 wrote to memory of 3240	2444	KeyGeneratorI.exe	87
PID 4072 wrote to memory of 2616	4072	WinErrorMgr.exe	98
PID 4072 wrote to memory of 2616	4072	WinErrorMgr.exe	98
PID 4072 wrote to memory of 2616	4072	WinErrorMgr.exe	98
PID 3240 wrote to memory of 4592	3240	KeyGeneratorI.exe	89
PID 3240 wrote to memory of 4592	3240	KeyGeneratorI.exe	89
PID 4592 wrote to memory of 2572	4592	msedge.exe	88
PID 4592 wrote to memory of 2572	4592	msedge.exe	88
PID 4592 wrote to memory of 2300	4592	msedge.exe	91
PID 4592 wrote to memory of 2300	4592	msedge.exe	91
PID 4592 wrote to memory of 2300	4592	msedge.exe	91
PID 4592 wrote to memory of 2300	4592	msedge.exe	91
PID 4592 wrote to memory of 2300	4592	msedge.exe	91
PID 4592 wrote to memory of 2300	4592	msedge.exe	91
PID 4592 wrote to memory of 2300	4592	msedge.exe	91
PID 4592 wrote to memory of 2300	4592	msedge.exe	91
PID 4592 wrote to memory of 2300	4592	msedge.exe	91
PID 4592 wrote to memory of 2300	4592	msedge.exe	91
PID 4592 wrote to memory of 2300	4592	msedge.exe	91
PID 4592 wrote to memory of 2300	4592	msedge.exe	91
PID 4592 wrote to memory of 2300	4592	msedge.exe	91
PID 4592 wrote to memory of 2300	4592	msedge.exe	91
PID 4592 wrote to memory of 2300	4592	msedge.exe	91
PID 4592 wrote to memory of 2300	4592	msedge.exe	91
PID 4592 wrote to memory of 2300	4592	msedge.exe	91
PID 4592 wrote to memory of 2300	4592	msedge.exe	91
PID 4592 wrote to memory of 2300	4592	msedge.exe	91
PID 4592 wrote to memory of 2300	4592	msedge.exe	91
PID 4592 wrote to memory of 2300	4592	msedge.exe	91
PID 4592 wrote to memory of 2300	4592	msedge.exe	91
PID 4592 wrote to memory of 2300	4592	msedge.exe	91
PID 4592 wrote to memory of 2300	4592	msedge.exe	91
PID 4592 wrote to memory of 2300	4592	msedge.exe	91
PID 4592 wrote to memory of 2300	4592	msedge.exe	91
PID 4592 wrote to memory of 2300	4592	msedge.exe	91
PID 4592 wrote to memory of 2300	4592	msedge.exe	91
PID 4592 wrote to memory of 2300	4592	msedge.exe	91
PID 4592 wrote to memory of 2300	4592	msedge.exe	91
PID 4592 wrote to memory of 2300	4592	msedge.exe	91
PID 4592 wrote to memory of 2300	4592	msedge.exe	91
PID 4592 wrote to memory of 2300	4592	msedge.exe	91
PID 4592 wrote to memory of 2300	4592	msedge.exe	91
PID 4592 wrote to memory of 2300	4592	msedge.exe	91
PID 4592 wrote to memory of 2300	4592	msedge.exe	91
PID 4592 wrote to memory of 2300	4592	msedge.exe	91
PID 4592 wrote to memory of 2300	4592	msedge.exe	91
PID 4592 wrote to memory of 2300	4592	msedge.exe	91
PID 4592 wrote to memory of 2300	4592	msedge.exe	91
PID 4592 wrote to memory of 1164	4592	msedge.exe	90
PID 4592 wrote to memory of 1164	4592	msedge.exe	90

C:\Users\Admin\AppData\Local\Temp\VSInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\VSInstaller.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAaQBuACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGsAbQB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGsAZgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHEAcgB5ACMAPgA="
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4760
- C:\Users\Admin\AppData\Local\Temp\Ilkdt.exe
  "C:\Users\Admin\AppData\Local\Temp\Ilkdt.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4068
- C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe
  "C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe"
  2⤵
  PID:4856
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4680
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:5196
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:5360
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:5188
  - - C:\Windows\system32\wusa.exe
      wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      PID:5460
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop wuauserv
    3⤵
    - Launches sc.exe
    PID:5544
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop dosvc
    3⤵
    - Launches sc.exe
    PID:852
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop bits
    3⤵
    - Launches sc.exe
    PID:5848
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6056
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1348
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "GMDTJRUT" binpath= "C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:4800
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "GMDTJRUT"
    3⤵
    - Launches sc.exe
    PID:4132
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:852
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5960
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "GMDTJRUT"
    3⤵
    - Launches sc.exe
    PID:2084
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:1836
- C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe
  "C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2444
- - C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe
    "C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:3240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://onepiecered.co/s?mH4q
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:4592
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1880,2001728896252443784,10837985951245635749,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1164
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1880,2001728896252443784,10837985951245635749,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1896 /prefetch:2
        5⤵
        
        PID:2300
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,2001728896252443784,10837985951245635749,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
        5⤵
        
        PID:2608
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,2001728896252443784,10837985951245635749,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
        5⤵
        
        PID:3752
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1880,2001728896252443784,10837985951245635749,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
        5⤵
        
        PID:4224
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,2001728896252443784,10837985951245635749,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4592 /prefetch:1
        5⤵
        
        PID:2880
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,2001728896252443784,10837985951245635749,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4488 /prefetch:1
        5⤵
        
        PID:1880
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,2001728896252443784,10837985951245635749,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
        5⤵
        
        PID:1592
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,2001728896252443784,10837985951245635749,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
        5⤵
        
        PID:3028
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1880,2001728896252443784,10837985951245635749,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5300 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4628
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,2001728896252443784,10837985951245635749,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
        5⤵
        
        PID:4992
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,2001728896252443784,10837985951245635749,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
        5⤵
        
        PID:228
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,2001728896252443784,10837985951245635749,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
        5⤵
        
        PID:2504
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,2001728896252443784,10837985951245635749,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6256 /prefetch:1
        5⤵
        
        PID:5552
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,2001728896252443784,10837985951245635749,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6624 /prefetch:1
        5⤵
        
        PID:5560
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,2001728896252443784,10837985951245635749,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6568 /prefetch:1
        5⤵
        
        PID:5724
    - - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1880,2001728896252443784,10837985951245635749,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6424 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4316
- C:\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe
  "C:\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4072
- - C:\Users\Admin\AppData\Local\Temp\XenoManager\WinErrorMgr.exe
    "C:\Users\Admin\AppData\Local\Temp\XenoManager\WinErrorMgr.exe"
    3⤵
    - Executes dropped EXE
    PID:2616
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /Create /TN "WindowsErrorHandler" /XML "C:\Users\Admin\AppData\Local\Temp\tmp63B6.tmp" /F
      4⤵
      Creates scheduled task(s)
      PID:5116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdfd173cb8,0x7ffdfd173cc8,0x7ffdfd173cd8
1⤵
PID:2572

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4820

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3156

C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe
C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:5024
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5196
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:5148
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5232
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:1684
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2380
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4856
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:6052
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2376
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:784
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:764
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:6100
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:6028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  PID:6140

C:\Windows\system32\wusa.exe
wusa /uninstall /kb:890830 /quiet /norestart
1⤵
PID:6108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe

Filesize
157KB

MD5
f07a962c71fd765c13740e8d6f4c477c

SHA1
990e7008544f535404e29b0c6d7204ec9fdbf9c9

SHA256
95553337982eb84efaf9f5c0affd0a8ec9b543620b340641f3bca2c4e81c22e2

SHA512
48dec12bd747a0564c01ce8390ee0d9d5be6aa1ba894847d530e91b8d3eb51ffa273660cc353e4ec1eb4d4a0ff75792d950a195acfb2870e093e8f20ca0f6841

Download Submit
C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe

Filesize
349KB

MD5
9dd60ce0ddbd881e919537986ce72eef

SHA1
49b1af2efe26520b1890efa70b3194a84402b949

SHA256
c31c893919fc424f33a84bb01423c984031d94ae635b2193dd05b5053f405d8e

SHA512
28a122fa12872ed13d9f0a4eb005bf157f9d7411edb592644972ba7f75bf00084227809f65f963e0632f01b2b391e5dfd8d8dc6061a2d9ec6556acb9a9904d88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fba38883c4ea1c000dbd9c38d017e733

SHA1
85e0906708a55073287ddfa21f757162b21c3573

SHA256
9e233584c57cb57ff648be1beaa1fff2112600fd78a0be082476c9ec5cfc5972

SHA512
a832dbfc9ed009c686cbe003fe04a67898c37f6cd3e0c19ff8a6d4af7649a8c7e36eeb2e2e4c4206752da80fbde7c26c7241a472d4098b1edc5ab4057d54f1a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
576B

MD5
02e6dda2efd21af1438e33018e61e98c

SHA1
dd837b2e57cb0dcb801749ae883045b30aebe0e5

SHA256
50aa5b0fda96ffbb1018a1c224efa537fa82d7d47fbfe0110103ea6c454ec2ed

SHA512
c9d95ea7372fb07bf37e35a17a69f99b5637601ec79ba60c99a73f3ebccaa62846701d014df690eb47197c98d95a79c57640cc0513b31915497cb51168b48309

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
2e031e9cce591cf12e94173b9473d9a5

SHA1
2fcc5733352d772a59993b8c3439171a3bef6c50

SHA256
5bf6f2537f18851107eddd7427ae1b1e90ba7facc7d3dc1fdae3ab92091b3967

SHA512
2c51f709fd4d328965386c594ffe7332a47b0047709afc7aaa41e9c98ce03719d6f51e12c1a1b54307263155f2fd920672e1a94931420f01ba256898b49574fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
2e9461135df9ca79567485a447cb2672

SHA1
5f62fa5604de534273b71bc38f83ea0187872176

SHA256
75a13fb656d84785907e91c275b19df2fb93b33d99b04c1f2b4169ff5290a597

SHA512
53063003556b71f343d1bde7ab6d495a959026e7c5b66374cbc94263d7980678ec77eaf2d7769cdb37221f99756e7e7044fd78b1533c70937fea4fe6bd3724d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2de2aa909e1da89f620811eb35a9ed42

SHA1
eb9b618d5970742db623f9a733b0d921edfd01da

SHA256
af31e4303067744b5048f3778e46c1586077cd3e0334030d5e881e8c930decd9

SHA512
5a6a93bb2bb32d5ccb8935889000820776600a9521c08f8cc8c7994e8a7d0a756c996d0ccace33b125d3c11b5284f7d6dc89ff45e5839da6005d982481accfe5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a400429a141c1e011b4ce1c7e1e67bd4

SHA1
6c56cd62eb57f7bc5066ecb1a73fb47b05c6370c

SHA256
c86e80ff7cbaf20e92241f2642b459c82149f40781033e7af24f1a21ef35bccf

SHA512
af51eae0786cf15f924a9dd8f09b279b06b6f4693845380e35fc851169a65cecb839d4fe22f07612652e172af18f8d58045e8a6368d38d9ab097be87347f69da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c813e83b93bb859ceda1342279e54b6a

SHA1
e4876173801d2d6ae7ff0a28454612e068dafe32

SHA256
4f2e1a9c0388dabb9f142755593833b071fb95e773d54d55d2930f3fe8ed95e0

SHA512
168a0b92df4773ed8802ee744575a565a25968f38c0068ab8e4ba9c86f85dbf9a884ef028f714f11023cd25c0c76a66e7ad4d37aa4918179624316aebf3ced03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
25KB

MD5
de8827d93011d8af360f82cc1f8ce73e

SHA1
87774343c086d15d6da295268cbca6fed80b621f

SHA256
511050e65ef86e0692adf41262e7be695993b28b629ba66f3e174e27d78ba6c5

SHA512
fa0527111401d82e4e05a16d1908ff9e149d396ff088d970855755ca5a8589476b19a96746c445284b803f3589f1544a02b4d67e31bb56c596a3b79f49d7948f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a6a7d8f9c8716f66614565a5767689f3

SHA1
2c98bee8dbe07f7d7bb1e3c48afb8f38a4a0742c

SHA256
b3d254dd882ecc89db09056e14449d4624a75ff3984aaac10a7edf84cd517745

SHA512
15e671920cab4500ba0028dd2de9f067480b3905f0908485a0bddbba5c66247b618e40ddd7689804e8d9724a5ec4d471c8b904ebc233381a8e7d39c15b87c335

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58d2db.TMP

Filesize
204B

MD5
87a2ea9e7c05532b69c318b838beca14

SHA1
3a6b87f1629cf63d59c5af71b160312747bcf8eb

SHA256
58f73cc5486e81fa634854df08b48d9eb4d9043f85392e9ee0d32f4b8944d0bb

SHA512
bd7e1c175eb7e32f478f320164f7de34d9670718933e64c596a9d22ee5f42a5f129ef1c8c3a21358f18b612734912278a2fef2a8d87c683162b2b36cfd5c0640

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
63ee2c64b37decdd9b6ee36a75ea9cde

SHA1
6c4caf1621508fe938c0065b049fd13ef63e5e48

SHA256
785faa87b40853eed48fbaa5759c7f8f8c7fb01b7bc689ad40b897ae020924eb

SHA512
ed186354df555c99ed40a37b48da66a34109ce8e0baae0a4df68ebde5adbfd30b5fae08a6b54b99028d1f19997d7f767c666a7d40bb98749872a7ec03432701a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
02a7c8e6388a8c11883e003a31d64f17

SHA1
28634926501618b0f4ac8807533c1e45a1da1d5c

SHA256
4e9e87be9368d88a950e4516891dab5f2dfa7a44573bb823a39a139d095282f8

SHA512
e8d5a7a9261d69503f07071d5fc495b68b1c655d34b03fa2d2a54bd555741c5ddd9f4a7479ab062f25fc430621555e670db21f92ed32e7e5d8d44a510b91fcc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
155fcbe0e4a137d737f73cba7eb1ecb0

SHA1
d9bd81d8a45f98f8f52e94384f77bd7420f11114

SHA256
d755755e0755e826c903de6f2a858bbb604012f9b243e3d9d9d2582595669088

SHA512
859dba71cd28de31f8c1f0e660c26915e876e4c54dfa15a8d7ee62d5842264824c81219f7271e51873f5578074863901ffba56896711bd9f858967721b105fd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
7d1468c5c7c0188c2979597d7e99418e

SHA1
fc66e10ceba2bb3f9653d27124fdb759a51e8ac8

SHA256
08911211f5c4409ae7522f1fa3437e81ea2678fceba285f8c2e000d0274418c1

SHA512
47f15fd2f1dd363580d9cc2ced8a9713179bf64936f0de33dcf8ac661593670f048cbb8577aa423e94b406387cc425e73c56d9f7062cb94aaaaa3a80bacbf2be

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ilkdt.exe

Filesize
191KB

MD5
e004a568b841c74855f1a8a5d43096c7

SHA1
b90fd74593ae9b5a48cb165b6d7602507e1aeca4

SHA256
d49013d6be0f0e727c0b53bce1d3fed00656c7a2836ceef0a9d4cb816a5878db

SHA512
402dd4d4c57fb6f5c7a531b7210a897dfe41d68df99ae4d605944f6e5b2cecaafa3fe27562fe45e7e216a7c9e29e63139d4382310b41f04a35ad56115fbed2af

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe

Filesize
42KB

MD5
d499e979a50c958f1a67f0e2a28af43d

SHA1
1e5fa0824554c31f19ce01a51edb9bed86f67cf0

SHA256
bc3d545c541e42420ce2c2eabc7e5afab32c869a1adb20adb11735957d0d0b0e

SHA512
668047f178d82bebefeb8c2e7731d34ff24dc755dacd3362b43d8b44c6b148fc51af0d0ab2d0a67f0344ab6158b883fe568e4eeb0e34152108735574f0e1e763

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe

Filesize
724KB

MD5
f16785993dfca9b533926cc787ba6912

SHA1
653f40d098f45e96e820ec3f25f9833d0cc8e208

SHA256
c67563c8b4e88ac490c7b17bd30dcfe7a79b4b5caf4d26edbef96835af20fbcc

SHA512
b0509e41f2c4f8c9d0c5ef1b82214f0d9606e5f4f8cfacda0715859901df2283d67334c4865284292d6dd1c9ee27b07f133e9d9fd6fe7050f018059308faddc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe

Filesize
892KB

MD5
6280ef544166edd52fefd1facbd9294d

SHA1
9d10aa4078f4c2d8bb9189f3e4d13632451a720f

SHA256
100a1dd091e7c4bb70ed649b23e697a2e5a2df3cd0dadf5f5e655cc65cb5e47c

SHA512
2ffa2b7a4d7c05b4ca5edc78e5c333003fd9200779d48610b0ae4bf1aec85ed2b6ac31643ad8fbfa822d9d5c15d470f53095f16a1815eb88f00e34d4ec5c46c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe

Filesize
553KB

MD5
4b7bb88b06f0853da4ef7a5c0491aadf

SHA1
c78da4f556d94a7a73140e4c36bc0ef833c428f7

SHA256
e628bc635948d4c6a194d6cd411ddf951782aef66c113e06e20eaad33aab6c46

SHA512
30c6aeb2f6ddef9008c031e99152649fb36119bb3ac233cb6efaaa346474eaf435e3691ff4aade03e1076e5e5512011ad267f25206d6433721d996c224704449

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24442\VCRUNTIME140.dll

Filesize
116KB

MD5
be8dbe2dc77ebe7f88f910c61aec691a

SHA1
a19f08bb2b1c1de5bb61daf9f2304531321e0e40

SHA256
4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

SHA512
0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24442\VCRUNTIME140.dll

Filesize
5KB

MD5
0848eb92d8440fdcc81c23dc1f7772f1

SHA1
a91b830f89061fe405292d854e556b7b30c3fb31

SHA256
fe13477cb0592269744bfd58c08336db84a8638d623e940d02b60cd79167d536

SHA512
d53356d70bd29d22bba500648097e7e6c6a3507ad5d950c00ea4d81ae927f691d036d03b02e26b3d9f39353fe5de20d3cb7784ccab6fbd3a38ee0b696558194a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24442\_bz2.pyd

Filesize
82KB

MD5
90f58f625a6655f80c35532a087a0319

SHA1
d4a7834201bd796dc786b0eb923f8ec5d60f719b

SHA256
bd8621fcc901fa1de3961d93184f61ea71068c436794af2a4449738ccf949946

SHA512
b5bb1ecc195700ad7bea5b025503edd3770b1f845f9beee4b067235c4e63496d6e0b19bdd2a42a1b6591d1131a2dc9f627b2ae8036e294300bb6983ecd644dc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24442\_bz2.pyd

Filesize
79KB

MD5
80c0b49cbb17ba7e0646a5044e715b1c

SHA1
8a5e8cc73da1ce523ad5e21c886583605b690765

SHA256
b90500ea9949b48b69fac5876d513f9157060bb7522dcd28c1eb6d5bc95a12df

SHA512
25bd14d59e8ea189e21c5c8651528b5a9c77bff2d6944e2ff2920c71577a6599082e5f99f9ff48bf8910d53e49f2302fc1fcdee6a7e19a9bdb77719d5f954a96

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24442\_decimal.pyd

Filesize
168KB

MD5
aeb9d388eca59117f62216ef66a01f77

SHA1
c4d0f8c6c66a469f52bfb738fcea397c65dfe39b

SHA256
0a800d0167399d5c2f00ee512f796770d2da4df3aec89924de72def85fe9830a

SHA512
2980ab880379f1159ced70932ae8a959c4c68bfb9140e763a23900fb0aca8f2b579347563c5be1a9bfb8b5f9048a75d78d75b924e20a9ea8fce31f32a3a94b4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24442\_hashlib.pyd

Filesize
64KB

MD5
8baeb2bd6e52ba38f445ef71ef43a6b8

SHA1
4132f9cd06343ef8b5b60dc8a62be049aa3270c2

SHA256
6c50c9801a5caf0bb52b384f9a0d5a4aa182ca835f293a39e8999cf6edf2f087

SHA512
804a4e19ea622646cea9e0f8c1e284b7f2d02f3620199fa6930dbdadc654fa137c1e12757f87c3a1a71ceff9244aa2f598ee70d345469ca32a0400563fe3aa65

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24442\_lzma.pyd

Filesize
15KB

MD5
b48aa06b916dce9e9b72d49b510cbff9

SHA1
773e1b5cb09acd7820c6e6c9bd3357991ff72639

SHA256
96d9109846e767a28cdc4b989bb552fd180632da1c7a62d3a4605827b7c53b6e

SHA512
4bc9615d806f3e661e8c345c7e188a80fe35c47607d324c3d47400d81ec2e68b06f2623434ee89feb65c4ea233079a6a2f6e8c9a2fbe95f204f9c9aadee2d105

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24442\_lzma.pyd

Filesize
87KB

MD5
814157980ba92b098ec1044ed9c4a45a

SHA1
9d04feaa35527a4f7cf67b66b70872334b6f02c7

SHA256
d97638a1e8cba31cf4168745947bf1520e89ef70483551b61aaa6698b15614d9

SHA512
cd9af9aa3e41da5122f9812a10dc8763f543c2775ca93e0eebeb5d388228b2a68f397b50b4b666fdaac9b8c06cda9a6ec3751a4eaee7d41f918bcdb4603445a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24442\_socket.pyd

Filesize
64KB

MD5
7eee7b9d1550294472568e320d55810d

SHA1
df0fd822e935ddd54cc394ceba37905b67e70e60

SHA256
a0af1fa29f3589a0a68b8778d75e5b30defe161247ccfcc588facdb54167bc33

SHA512
a0c400a20a45432391ff073180d492928e19a9d01f6120036db2e41e46ba6654313616420e3ac7316bdf14b7569c8366e5e86fe99ed860e2017ccff8d5f8fb61

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24442\base_library.zip

Filesize
62KB

MD5
b2e0ba602ec1a6d509b7ca47200758ca

SHA1
0a2e8615787713c8f68ac377296ce833e113c1d1

SHA256
cf6c2fdda2fc9ea0dd06e3178f1cd37bb2e86f74f95d88270bcb6c7f2b785ae6

SHA512
e1e555fa11b3d6955cc872a8a5721503420cae7f67b18ef3c9b79f0ca0a68a1bb45455b1f40be52960f7786dc7abb143142fbec59c16c08d5c9d47a4be3bf3dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24442\libcrypto-3.dll

Filesize
31KB

MD5
e23c6ddb0fc825f5355998e97419f19a

SHA1
1a6f28652e243416de5f1bfc742e64620d5cb336

SHA256
8f2ffa06e696e454673fae0b29fbadfc043a8cee63118ec526ea4afccdd4b2a8

SHA512
42ec30dd9f4984dd414971d2868b79631181cfac7ff3a6e3bf49b0d0f8217738a5e1b7096c2434fe7f6a42aa2c7f448903e9c12dc705a32b75e6dcb1f3fa6d7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24442\python312.dll

Filesize
57KB

MD5
fbe4b8deb1153a965bf5e465e8aaa620

SHA1
7c1eaa51d831b96247e1d378809a3452ffa9db60

SHA256
1d793e686727c97a0739c9eb9696a91f578c527ea7277874959664d2a369066e

SHA512
b3209f281b5f5e466e853e4fc4cd44d4094c27f89192ae96a74770b370c95b5f7134b4f832338ebe4c000e59b1fe26e26ff6d4bddd6878159c35c9a8b078400c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24442\python312.dll

Filesize
74KB

MD5
83df967d03ea0b80ae8b6466a20fc692

SHA1
d91af9e9c226d3651521a59e5898b51d144f4318

SHA256
6e84336330299a920702a7af6de8d71f2331e5431156b6cf5e1b93ad51ce0416

SHA512
d540c366f8f58ec078433c161a9c9573645a85e5f92c1bf8318b24336de281cad03ca2dda3b7e5a375453bb9b7fa9051c3f619df11fc00c32a5e024343fcea67

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24442\select.pyd

Filesize
29KB

MD5
e1604afe8244e1ce4c316c64ea3aa173

SHA1
99704d2c0fa2687997381b65ff3b1b7194220a73

SHA256
74cca85600e7c17ea6532b54842e26d3cae9181287cdf5a4a3c50af4dab785e5

SHA512
7bf35b1a9da9f1660f238c2959b3693b7d9d2da40cf42c6f9eba2164b73047340d0adff8995049a2fe14e149eba05a5974eee153badd9e8450f961207f0b3d42

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24442\unicodedata.pyd

Filesize
156KB

MD5
eaebdfd59b6746193a8c211fb8f198c1

SHA1
b972e3643e5c96f17cf2db64093f8ea73682bb0f

SHA256
956539677af4974192e7a05bc768432f437d6e53dcc3a70365ad45d1e923ca14

SHA512
bd85db6f65f1485636cd2e6c555e39348e1a193643ef33800e8e0cd392e59fc3958a4545c6ddeda00037051f89a54f5c016bac8a44b9dfd1d9bccc73835459f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_31azrxi0.epl.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe

Filesize
46KB

MD5
6f45c78d0712bd01783609866376572d

SHA1
7d60493db8ae63b9c72b688cf1f505fd4b14ff03

SHA256
a506f7ccebd016cf81b694dc5ed79788ba2fd314d5206d4d149653f0964c65fe

SHA512
261a5d6b30fe7d0ada2ecc415ee8859dacb01a468582fa12008ed703dcc62cefa7237e5fe1812872049bef5f714293e9a1f044627461f48dc0457dac81319ed1

Download Submit
C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe

Filesize
103KB

MD5
8c23c45666dfa2607b30fdbe3bede856

SHA1
1e1e163144ed4325f8f965e83788e4b806bca268

SHA256
0532bfad92569213ded64b0c04b0a98f4bc0404b20cc1ee3e661829a6011273a

SHA512
da5b527f015e7a56674e830859b15a2e372c0b2726fdd59744843568d3796b6faba4f3df539b806864c30d84303fb08bd48b54304d10c895b1d822bf1ca92e78

Download Submit
C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe

Filesize
1KB

MD5
334f70a75daeb34f75e67912d39c2a2e

SHA1
fdf5448f3b4bd39b25be323dcc4fd215396b4db9

SHA256
a6daf622b66bbfccfa4024f8a927c33b38f930145b25d448ef8593d83a422b2b

SHA512
3b0586f76a3bf142d2a00118b3144bcd41546416520b090fbb4e16d64444b1f8a0026a793f703840f11138f262b068f00a88132ebe511aa7ab06baa3b5f2adf9

Download Submit
memory/2616-99-0x0000000073430000-0x0000000073BE1000-memory.dmp

Filesize
7.7MB

Download
memory/2616-1898-0x00000000050B0000-0x00000000050C0000-memory.dmp

Filesize
64KB

Download
memory/2616-101-0x00000000050B0000-0x00000000050C0000-memory.dmp

Filesize
64KB

Download
memory/2616-1879-0x0000000073430000-0x0000000073BE1000-memory.dmp

Filesize
7.7MB

Download
memory/4068-1215-0x0000000073430000-0x0000000073BE1000-memory.dmp

Filesize
7.7MB

Download
memory/4068-148-0x0000000004D30000-0x0000000004D95000-memory.dmp

Filesize
404KB

Download
memory/4068-144-0x0000000004D30000-0x0000000004D95000-memory.dmp

Filesize
404KB

Download
memory/4068-140-0x0000000004D30000-0x0000000004D95000-memory.dmp

Filesize
404KB

Download
memory/4068-136-0x0000000004D30000-0x0000000004D95000-memory.dmp

Filesize
404KB

Download
memory/4068-132-0x0000000004D30000-0x0000000004D95000-memory.dmp

Filesize
404KB

Download
memory/4068-130-0x0000000004D30000-0x0000000004D95000-memory.dmp

Filesize
404KB

Download
memory/4068-16-0x0000000000310000-0x0000000000346000-memory.dmp

Filesize
216KB

Download
memory/4068-124-0x0000000004D30000-0x0000000004D95000-memory.dmp

Filesize
404KB

Download
memory/4068-128-0x0000000004D30000-0x0000000004D95000-memory.dmp

Filesize
404KB

Download
memory/4068-150-0x0000000004D30000-0x0000000004D95000-memory.dmp

Filesize
404KB

Download
memory/4068-152-0x0000000004D30000-0x0000000004D95000-memory.dmp

Filesize
404KB

Download
memory/4068-156-0x0000000004D30000-0x0000000004D95000-memory.dmp

Filesize
404KB

Download
memory/4068-158-0x0000000004D30000-0x0000000004D95000-memory.dmp

Filesize
404KB

Download
memory/4068-160-0x0000000004D30000-0x0000000004D95000-memory.dmp

Filesize
404KB

Download
memory/4068-166-0x0000000004D30000-0x0000000004D95000-memory.dmp

Filesize
404KB

Download
memory/4068-164-0x0000000004D30000-0x0000000004D95000-memory.dmp

Filesize
404KB

Download
memory/4068-114-0x0000000004D30000-0x0000000004D95000-memory.dmp

Filesize
404KB

Download
memory/4068-42-0x0000000073430000-0x0000000073BE1000-memory.dmp

Filesize
7.7MB

Download
memory/4068-110-0x0000000004D30000-0x0000000004D95000-memory.dmp

Filesize
404KB

Download
memory/4068-102-0x0000000004D30000-0x0000000004D95000-memory.dmp

Filesize
404KB

Download
memory/4068-162-0x0000000004D30000-0x0000000004D95000-memory.dmp

Filesize
404KB

Download
memory/4068-40-0x0000000004D30000-0x0000000004D9C000-memory.dmp

Filesize
432KB

Download
memory/4068-146-0x0000000004D30000-0x0000000004D95000-memory.dmp

Filesize
404KB

Download
memory/4068-154-0x0000000004D30000-0x0000000004D95000-memory.dmp

Filesize
404KB

Download
memory/4068-134-0x0000000004D30000-0x0000000004D95000-memory.dmp

Filesize
404KB

Download
memory/4068-112-0x0000000004D30000-0x0000000004D95000-memory.dmp

Filesize
404KB

Download
memory/4068-142-0x0000000004D30000-0x0000000004D95000-memory.dmp

Filesize
404KB

Download
memory/4068-138-0x0000000004D30000-0x0000000004D95000-memory.dmp

Filesize
404KB

Download
memory/4068-48-0x0000000004D20000-0x0000000004D30000-memory.dmp

Filesize
64KB

Download
memory/4068-58-0x0000000004D30000-0x0000000004D95000-memory.dmp

Filesize
404KB

Download
memory/4068-1888-0x0000000073430000-0x0000000073BE1000-memory.dmp

Filesize
7.7MB

Download
memory/4068-96-0x0000000004D30000-0x0000000004D95000-memory.dmp

Filesize
404KB

Download
memory/4068-105-0x0000000004D30000-0x0000000004D95000-memory.dmp

Filesize
404KB

Download
memory/4068-83-0x0000000004D30000-0x0000000004D95000-memory.dmp

Filesize
404KB

Download
memory/4068-1216-0x0000000004D20000-0x0000000004D30000-memory.dmp

Filesize
64KB

Download
memory/4068-59-0x0000000004D30000-0x0000000004D95000-memory.dmp

Filesize
404KB

Download
memory/4068-76-0x0000000004D30000-0x0000000004D95000-memory.dmp

Filesize
404KB

Download
memory/4068-61-0x0000000004D30000-0x0000000004D95000-memory.dmp

Filesize
404KB

Download
memory/4068-69-0x0000000004D30000-0x0000000004D95000-memory.dmp

Filesize
404KB

Download
memory/4072-45-0x0000000073430000-0x0000000073BE1000-memory.dmp

Filesize
7.7MB

Download
memory/4072-97-0x0000000073430000-0x0000000073BE1000-memory.dmp

Filesize
7.7MB

Download
memory/4072-32-0x0000000000D70000-0x0000000000D80000-memory.dmp

Filesize
64KB

Download
memory/4680-1154-0x000002730BE50000-0x000002730BE60000-memory.dmp

Filesize
64KB

Download
memory/4680-1152-0x000002730BE50000-0x000002730BE60000-memory.dmp

Filesize
64KB

Download
memory/4680-1149-0x000002730BE50000-0x000002730BE60000-memory.dmp

Filesize
64KB

Download
memory/4680-1147-0x00007FFDE8FB0000-0x00007FFDE9A72000-memory.dmp

Filesize
10.8MB

Download
memory/4680-1144-0x00000273244B0000-0x00000273244D2000-memory.dmp

Filesize
136KB

Download
memory/4680-1260-0x00007FFDE8FB0000-0x00007FFDE9A72000-memory.dmp

Filesize
10.8MB

Download
memory/4760-572-0x0000000007A60000-0x0000000007A68000-memory.dmp

Filesize
32KB

Download
memory/4760-82-0x0000000005600000-0x0000000005622000-memory.dmp

Filesize
136KB

Download
memory/4760-468-0x0000000007A70000-0x0000000007A8A000-memory.dmp

Filesize
104KB

Download
memory/4760-458-0x0000000007980000-0x0000000007995000-memory.dmp

Filesize
84KB

Download
memory/4760-443-0x0000000007970000-0x000000000797E000-memory.dmp

Filesize
56KB

Download
memory/4760-367-0x0000000007930000-0x0000000007941000-memory.dmp

Filesize
68KB

Download
memory/4760-347-0x00000000079B0000-0x0000000007A46000-memory.dmp

Filesize
600KB

Download
memory/4760-332-0x00000000077B0000-0x00000000077BA000-memory.dmp

Filesize
40KB

Download
memory/4760-319-0x0000000007D70000-0x00000000083EA000-memory.dmp

Filesize
6.5MB

Download
memory/4760-321-0x0000000007720000-0x000000000773A000-memory.dmp

Filesize
104KB

Download
memory/4760-104-0x0000000005F30000-0x0000000006287000-memory.dmp

Filesize
3.3MB

Download
memory/4760-286-0x000000007F400000-0x000000007F410000-memory.dmp

Filesize
64KB

Download
memory/4760-288-0x0000000074760000-0x00000000747AC000-memory.dmp

Filesize
304KB

Download
memory/4760-98-0x0000000005EC0000-0x0000000005F26000-memory.dmp

Filesize
408KB

Download
memory/4760-302-0x00000000073A0000-0x0000000007444000-memory.dmp

Filesize
656KB

Download
memory/4760-298-0x0000000005260000-0x000000000527E000-memory.dmp

Filesize
120KB

Download
memory/4760-189-0x00000000067E0000-0x000000000682C000-memory.dmp

Filesize
304KB

Download
memory/4760-30-0x0000000004EF0000-0x0000000004F26000-memory.dmp

Filesize
216KB

Download
memory/4760-285-0x00000000069B0000-0x00000000069E4000-memory.dmp

Filesize
208KB

Download
memory/4760-186-0x00000000063D0000-0x00000000063EE000-memory.dmp

Filesize
120KB

Download
memory/4760-49-0x0000000005040000-0x0000000005050000-memory.dmp

Filesize
64KB

Download
memory/4760-673-0x0000000073430000-0x0000000073BE1000-memory.dmp

Filesize
7.7MB

Download
memory/4760-33-0x0000000073430000-0x0000000073BE1000-memory.dmp

Filesize
7.7MB

Download
memory/4760-47-0x0000000005040000-0x0000000005050000-memory.dmp

Filesize
64KB

Download
memory/4760-94-0x0000000005DE0000-0x0000000005E46000-memory.dmp

Filesize
408KB

Download
memory/4760-41-0x0000000005680000-0x0000000005CAA000-memory.dmp

Filesize
6.2MB

Download
memory/4760-236-0x0000000005040000-0x0000000005050000-memory.dmp

Filesize
64KB

Download
memory/5196-1921-0x00007FF4B1720000-0x00007FF4B1730000-memory.dmp

Filesize
64KB

Download
memory/5196-1976-0x00007FFDE8FB0000-0x00007FFDE9A72000-memory.dmp

Filesize
10.8MB

Download
memory/5196-1964-0x0000019A4D410000-0x0000019A4D42C000-memory.dmp

Filesize
112KB

Download
memory/5196-1967-0x0000019A4D3F0000-0x0000019A4D3FA000-memory.dmp

Filesize
40KB

Download
memory/5196-1969-0x0000019A4D450000-0x0000019A4D46A000-memory.dmp

Filesize
104KB

Download
memory/5196-1970-0x0000019A4D400000-0x0000019A4D408000-memory.dmp

Filesize
32KB

Download
memory/5196-1972-0x0000019A4D440000-0x0000019A4D44A000-memory.dmp

Filesize
40KB

Download
memory/5196-1971-0x0000019A4D430000-0x0000019A4D436000-memory.dmp

Filesize
24KB

Download
memory/5196-1973-0x0000019A4CCB0000-0x0000019A4CCC0000-memory.dmp

Filesize
64KB

Download
memory/5196-1953-0x0000019A4D200000-0x0000019A4D20A000-memory.dmp

Filesize
40KB

Download
memory/5196-1948-0x0000019A4D230000-0x0000019A4D2E3000-memory.dmp

Filesize
716KB

Download
memory/5196-1899-0x0000019A4CCB0000-0x0000019A4CCC0000-memory.dmp

Filesize
64KB

Download
memory/5196-1922-0x0000019A4D210000-0x0000019A4D22C000-memory.dmp

Filesize
112KB

Download
memory/5196-1897-0x00007FFDE8FB0000-0x00007FFDE9A72000-memory.dmp

Filesize
10.8MB

Download
memory/5196-1901-0x0000019A4CCB0000-0x0000019A4CCC0000-memory.dmp

Filesize
64KB

Download
memory/5232-2071-0x0000000001BC0000-0x0000000001BE0000-memory.dmp

Filesize
128KB

Download
memory/5232-2016-0x0000000001A80000-0x0000000001AC0000-memory.dmp

Filesize
256KB

Download