growtopia | f7ba1f62f5168638cbe3ccf0df5af38f68b55962ea3a639f6d0e2a464ab180a0

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
20-02-2024 18:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ValosploitV3_Installer/Installer.exe
Size

12.6MB
MD5

e560d8abab1b94fa698c5164b10c4fa5
SHA1

7b7e2334f06610ebcb9ac796c471961df6a6c377
SHA256

817cac7fcfdc0f48444c45be772997707761e2ca1e43e8d53f8f7e0e7a1e42b0
SHA512

cc546819fbf9cb40c8bd7c9f686b2d7e189b624fc94a8075e0a43ebcf83d28ed4fc51227c3450e94de91e2c72ce6ce68d7f5e6f8e9e390406da4bcc32470af16
SSDEEP

196608:MgINJY5ucj/+mDZR65PzwNVnQwOsayF0RjPLIp+I3U84IXrTNtNp0GIUOueu/ty:MR+59nYRzw0wlF0RjPLIECU84EJ49h

Score

10^/10

growtopia zgrat evasion persistence pyinstaller rat stealer

Malware Config

Extracted

Family

growtopia

https://discord.com/api/webhooks/1199763266872803338/8vedcXoMcyExhe1xhBm5f8ncmafWmOB3pkulE0l8g9Pel0t3ziyr2V51cLTVEjYsE4Rj

Signatures

Detect ZGRat V1 34 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3980-58-0x0000000002EE0000-0x0000000002F45000-memory.dmp	family_zgrat_v1
behavioral2/memory/3980-60-0x0000000002EE0000-0x0000000002F45000-memory.dmp	family_zgrat_v1
behavioral2/memory/3980-63-0x0000000002EE0000-0x0000000002F45000-memory.dmp	family_zgrat_v1
behavioral2/memory/3980-66-0x0000000002EE0000-0x0000000002F45000-memory.dmp	family_zgrat_v1
behavioral2/memory/3980-54-0x0000000002EE0000-0x0000000002F4C000-memory.dmp	family_zgrat_v1
behavioral2/memory/3980-90-0x0000000002EE0000-0x0000000002F45000-memory.dmp	family_zgrat_v1
behavioral2/memory/3980-104-0x0000000002EE0000-0x0000000002F45000-memory.dmp	family_zgrat_v1
behavioral2/memory/3980-108-0x0000000002EE0000-0x0000000002F45000-memory.dmp	family_zgrat_v1
behavioral2/memory/3980-122-0x0000000002EE0000-0x0000000002F45000-memory.dmp	family_zgrat_v1
behavioral2/memory/3980-124-0x0000000002EE0000-0x0000000002F45000-memory.dmp	family_zgrat_v1
behavioral2/memory/3980-127-0x0000000002EE0000-0x0000000002F45000-memory.dmp	family_zgrat_v1
behavioral2/memory/3980-129-0x0000000002EE0000-0x0000000002F45000-memory.dmp	family_zgrat_v1
behavioral2/memory/3980-147-0x0000000002EE0000-0x0000000002F45000-memory.dmp	family_zgrat_v1
behavioral2/memory/3980-149-0x0000000002EE0000-0x0000000002F45000-memory.dmp	family_zgrat_v1
behavioral2/memory/3980-151-0x0000000002EE0000-0x0000000002F45000-memory.dmp	family_zgrat_v1
behavioral2/memory/3980-143-0x0000000002EE0000-0x0000000002F45000-memory.dmp	family_zgrat_v1
behavioral2/memory/3980-153-0x0000000002EE0000-0x0000000002F45000-memory.dmp	family_zgrat_v1
behavioral2/memory/3980-155-0x0000000002EE0000-0x0000000002F45000-memory.dmp	family_zgrat_v1
behavioral2/memory/3980-157-0x0000000002EE0000-0x0000000002F45000-memory.dmp	family_zgrat_v1
behavioral2/memory/3980-159-0x0000000002EE0000-0x0000000002F45000-memory.dmp	family_zgrat_v1
behavioral2/memory/3980-161-0x0000000002EE0000-0x0000000002F45000-memory.dmp	family_zgrat_v1
behavioral2/memory/3980-83-0x0000000002EE0000-0x0000000002F45000-memory.dmp	family_zgrat_v1
behavioral2/memory/3980-163-0x0000000002EE0000-0x0000000002F45000-memory.dmp	family_zgrat_v1
behavioral2/memory/3980-165-0x0000000002EE0000-0x0000000002F45000-memory.dmp	family_zgrat_v1
behavioral2/memory/3980-167-0x0000000002EE0000-0x0000000002F45000-memory.dmp	family_zgrat_v1
behavioral2/memory/3980-169-0x0000000002EE0000-0x0000000002F45000-memory.dmp	family_zgrat_v1
behavioral2/memory/3980-171-0x0000000002EE0000-0x0000000002F45000-memory.dmp	family_zgrat_v1
behavioral2/memory/3980-173-0x0000000002EE0000-0x0000000002F45000-memory.dmp	family_zgrat_v1
behavioral2/memory/3980-175-0x0000000002EE0000-0x0000000002F45000-memory.dmp	family_zgrat_v1
behavioral2/memory/3980-177-0x0000000002EE0000-0x0000000002F45000-memory.dmp	family_zgrat_v1
behavioral2/memory/3980-182-0x0000000002EE0000-0x0000000002F45000-memory.dmp	family_zgrat_v1
behavioral2/memory/3980-199-0x0000000002EE0000-0x0000000002F45000-memory.dmp	family_zgrat_v1
behavioral2/memory/3980-201-0x0000000002EE0000-0x0000000002F45000-memory.dmp	family_zgrat_v1
behavioral2/memory/3980-196-0x0000000002EE0000-0x0000000002F45000-memory.dmp	family_zgrat_v1

Growtopia
Growtopa is an opensource modular stealer written in C#.
stealer growtopia
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Installer.exeWinErrorMgr.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	Installer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	WinErrorMgr.exe

Executes dropped EXE 8 IoCs

Processes:

Ilkdt.exeWinHostMgr.exeWinErrorMgr.exeKeyGeneratorI.exeSahyui1337.exeWinErrorMgr.exeKeyGeneratorI.exebauwrdgwodhv.exe

pid	process
3980	Ilkdt.exe
4536	WinHostMgr.exe
4400	WinErrorMgr.exe
2764	KeyGeneratorI.exe
1228	Sahyui1337.exe
2508	WinErrorMgr.exe
4992	KeyGeneratorI.exe
1436	bauwrdgwodhv.exe

Loads dropped DLL 4 IoCs

Processes:

KeyGeneratorI.exe

pid process

4992 KeyGeneratorI.exe
4992 KeyGeneratorI.exe
4992 KeyGeneratorI.exe
4992 KeyGeneratorI.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service
T1102

Processes:

flow ioc

40 discord.com
109 pastebin.com
110 pastebin.com
39 discord.com

pid	process
4992	KeyGeneratorI.exe
4992	KeyGeneratorI.exe
4992	KeyGeneratorI.exe
4992	KeyGeneratorI.exe

flow	ioc
40	discord.com
109	pastebin.com
110	pastebin.com
39	discord.com

Drops file in System32 directory 4 IoCs

Processes:

WinHostMgr.exepowershell.exebauwrdgwodhv.exe

description	ioc	process
File opened for modification	C:\Windows\system32\MRT.exe	WinHostMgr.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	bauwrdgwodhv.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

bauwrdgwodhv.exe

description	pid	process	target process
PID 1436 set thread context of 2792	1436	bauwrdgwodhv.exe	conhost.exe
PID 1436 set thread context of 4704	1436	bauwrdgwodhv.exe	explorer.exe

Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid process

3808 sc.exe
1588 sc.exe
4924 sc.exe
3848 sc.exe
208 sc.exe
3808 sc.exe
960 sc.exe
212 sc.exe
3680 sc.exe
3988 sc.exe
1916 sc.exe
1836 sc.exe
2944 sc.exe
1916 sc.exe

pid	process
3808	sc.exe
1588	sc.exe
4924	sc.exe
3848	sc.exe
208	sc.exe
3808	sc.exe
960	sc.exe
212	sc.exe
3680	sc.exe
3988	sc.exe
1916	sc.exe
1836	sc.exe
2944	sc.exe
1916	sc.exe

Detects Pyinstaller 4 IoCs

pyinstaller

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe	pyinstaller
C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe	pyinstaller
C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe	pyinstaller
C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2064 schtasks.exe

pid	process
2064	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 50 IoCs

Processes:

powershell.exeexplorer.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Sahyui1337.exepowershell.exemsedge.exemsedge.exeidentity_helper.exeWinHostMgr.execmd.exebauwrdgwodhv.exepowershell.exeexplorer.exe

pid	process
1228	Sahyui1337.exe
1228	Sahyui1337.exe
3196	powershell.exe
3196	powershell.exe
1428	msedge.exe
1428	msedge.exe
5104	msedge.exe
5104	msedge.exe
2768	identity_helper.exe
2768	identity_helper.exe
4536	WinHostMgr.exe
1720	cmd.exe
1720	cmd.exe
1720	cmd.exe
4536	WinHostMgr.exe
4536	WinHostMgr.exe
4536	WinHostMgr.exe
4536	WinHostMgr.exe
4536	WinHostMgr.exe
4536	WinHostMgr.exe
4536	WinHostMgr.exe
4536	WinHostMgr.exe
4536	WinHostMgr.exe
4536	WinHostMgr.exe
4536	WinHostMgr.exe
4536	WinHostMgr.exe
4536	WinHostMgr.exe
4536	WinHostMgr.exe
1436	bauwrdgwodhv.exe
2016	powershell.exe
2016	powershell.exe
2016	powershell.exe
1436	bauwrdgwodhv.exe
1436	bauwrdgwodhv.exe
1436	bauwrdgwodhv.exe
1436	bauwrdgwodhv.exe
1436	bauwrdgwodhv.exe
1436	bauwrdgwodhv.exe
1436	bauwrdgwodhv.exe
1436	bauwrdgwodhv.exe
1436	bauwrdgwodhv.exe
1436	bauwrdgwodhv.exe
1436	bauwrdgwodhv.exe
1436	bauwrdgwodhv.exe
4704	explorer.exe
4704	explorer.exe
4704	explorer.exe
4704	explorer.exe
4704	explorer.exe
4704	explorer.exe
4704	explorer.exe
4704	explorer.exe
4704	explorer.exe
4704	explorer.exe
4704	explorer.exe
4704	explorer.exe
4704	explorer.exe
4704	explorer.exe
4704	explorer.exe
4704	explorer.exe
4704	explorer.exe
4704	explorer.exe
4704	explorer.exe
4704	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

msedge.exe

pid process

5104 msedge.exe
5104 msedge.exe
5104 msedge.exe
5104 msedge.exe
5104 msedge.exe
5104 msedge.exe
5104 msedge.exe
5104 msedge.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

Processes:

Sahyui1337.exeIlkdt.exepowershell.execmd.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowershell.exepowercfg.exepowercfg.exepowercfg.exeexplorer.exe

description	pid	process
Token: SeDebugPrivilege	1228	Sahyui1337.exe
Token: SeDebugPrivilege	3980	Ilkdt.exe
Token: SeDebugPrivilege	3196	powershell.exe
Token: SeDebugPrivilege	1720	cmd.exe
Token: SeShutdownPrivilege	4680	powercfg.exe
Token: SeCreatePagefilePrivilege	4680	powercfg.exe
Token: SeShutdownPrivilege	440	powercfg.exe
Token: SeCreatePagefilePrivilege	440	powercfg.exe
Token: SeShutdownPrivilege	2724	powercfg.exe
Token: SeCreatePagefilePrivilege	2724	powercfg.exe
Token: SeShutdownPrivilege	384	powercfg.exe
Token: SeCreatePagefilePrivilege	384	powercfg.exe
Token: SeDebugPrivilege	2016	powershell.exe
Token: SeShutdownPrivilege	1956	powercfg.exe
Token: SeCreatePagefilePrivilege	1956	powercfg.exe
Token: SeShutdownPrivilege	4448	powercfg.exe
Token: SeCreatePagefilePrivilege	4448	powercfg.exe
Token: SeShutdownPrivilege	440	powercfg.exe
Token: SeCreatePagefilePrivilege	440	powercfg.exe
Token: SeShutdownPrivilege	1080	powercfg.exe
Token: SeCreatePagefilePrivilege	1080	powercfg.exe
Token: SeLockMemoryPrivilege	4704	explorer.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Installer.exeKeyGeneratorI.exeWinErrorMgr.exeKeyGeneratorI.exemsedge.exe

description	pid	process	target process
PID 856 wrote to memory of 3196	856	Installer.exe	powershell.exe
PID 856 wrote to memory of 3196	856	Installer.exe	powershell.exe
PID 856 wrote to memory of 3196	856	Installer.exe	powershell.exe
PID 856 wrote to memory of 3980	856	Installer.exe	Ilkdt.exe
PID 856 wrote to memory of 3980	856	Installer.exe	Ilkdt.exe
PID 856 wrote to memory of 3980	856	Installer.exe	Ilkdt.exe
PID 856 wrote to memory of 4536	856	Installer.exe	WinHostMgr.exe
PID 856 wrote to memory of 4536	856	Installer.exe	WinHostMgr.exe
PID 856 wrote to memory of 4400	856	Installer.exe	WinErrorMgr.exe
PID 856 wrote to memory of 4400	856	Installer.exe	WinErrorMgr.exe
PID 856 wrote to memory of 4400	856	Installer.exe	WinErrorMgr.exe
PID 856 wrote to memory of 2764	856	Installer.exe	KeyGeneratorI.exe
PID 856 wrote to memory of 2764	856	Installer.exe	KeyGeneratorI.exe
PID 856 wrote to memory of 1228	856	Installer.exe	Sahyui1337.exe
PID 856 wrote to memory of 1228	856	Installer.exe	Sahyui1337.exe
PID 2764 wrote to memory of 4992	2764	KeyGeneratorI.exe	KeyGeneratorI.exe
PID 2764 wrote to memory of 4992	2764	KeyGeneratorI.exe	KeyGeneratorI.exe
PID 4400 wrote to memory of 2508	4400	WinErrorMgr.exe	WinErrorMgr.exe
PID 4400 wrote to memory of 2508	4400	WinErrorMgr.exe	WinErrorMgr.exe
PID 4400 wrote to memory of 2508	4400	WinErrorMgr.exe	WinErrorMgr.exe
PID 4992 wrote to memory of 5104	4992	KeyGeneratorI.exe	msedge.exe
PID 4992 wrote to memory of 5104	4992	KeyGeneratorI.exe	msedge.exe
PID 5104 wrote to memory of 3976	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 3976	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 4684	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 4684	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 4684	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 4684	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 4684	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 4684	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 4684	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 4684	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 4684	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 4684	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 4684	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 4684	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 4684	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 4684	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 4684	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 4684	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 4684	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 4684	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 4684	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 4684	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 4684	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 4684	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 4684	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 4684	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 4684	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 4684	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 4684	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 4684	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 4684	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 4684	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 4684	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 4684	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 4684	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 4684	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 4684	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 4684	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 4684	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 4684	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 4684	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 4684	5104	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\ValosploitV3_Installer\Installer.exe
"C:\Users\Admin\AppData\Local\Temp\ValosploitV3_Installer\Installer.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:856
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAG0AbQBiACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHYAcABpACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGcAbgBpACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHIAcQB2ACMAPgA="
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3196
- C:\Users\Admin\AppData\Local\Temp\Ilkdt.exe
  "C:\Users\Admin\AppData\Local\Temp\Ilkdt.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3980
- C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe
  "C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:4536
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    PID:1720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:4188
  - - C:\Windows\system32\wusa.exe
      wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      PID:2940
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:3988
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:3808
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop wuauserv
    3⤵
    - Launches sc.exe
    PID:1588
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop bits
    3⤵
    - Launches sc.exe
    PID:3848
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop dosvc
    3⤵
    - Launches sc.exe
    PID:208
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "GMDTJRUT"
    3⤵
    - Launches sc.exe
    PID:4924
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:384
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "GMDTJRUT" binpath= "C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:1916
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2724
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
    3⤵
    PID:440
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4680
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "GMDTJRUT"
    3⤵
    - Launches sc.exe
    PID:1836
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:3808
- C:\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe
  "C:\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4400
- - C:\Users\Admin\AppData\Local\Temp\XenoManager\WinErrorMgr.exe
    "C:\Users\Admin\AppData\Local\Temp\XenoManager\WinErrorMgr.exe"
    3⤵
    - Executes dropped EXE
    PID:2508
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /Create /TN "WindowsErrorHandler" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDFC1.tmp" /F
      4⤵
      Creates scheduled task(s)
      PID:2064
- C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe
  "C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2764
- - C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe
    "C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:4992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://onepiecered.co/s?mH4q
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:5104
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff9319946f8,0x7ff931994708,0x7ff931994718
        5⤵
        
        PID:3976
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,580929628445413387,8642335819820260870,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1428
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,580929628445413387,8642335819820260870,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
        5⤵
        
        PID:4684
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,580929628445413387,8642335819820260870,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
        5⤵
        
        PID:1464
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,580929628445413387,8642335819820260870,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
        5⤵
        
        PID:956
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,580929628445413387,8642335819820260870,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
        5⤵
        
        PID:796
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,580929628445413387,8642335819820260870,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
        5⤵
        
        PID:4616
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,580929628445413387,8642335819820260870,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
        5⤵
        
        PID:436
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,580929628445413387,8642335819820260870,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5560 /prefetch:8
        5⤵
        
        PID:3848
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,580929628445413387,8642335819820260870,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5560 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2768
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,580929628445413387,8642335819820260870,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
        5⤵
        
        PID:2244
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,580929628445413387,8642335819820260870,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
        5⤵
        
        PID:3444
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,580929628445413387,8642335819820260870,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3508 /prefetch:1
        5⤵
        
        PID:3456
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,580929628445413387,8642335819820260870,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
        5⤵
        
        PID:4456
- C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe
  "C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1228

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2364

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2324

C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe
C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:1436
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2016
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:3680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1720
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:4076
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:960
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:212
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:2944
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:1916
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1080
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:2792
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:440
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1956
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4448
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe

Filesize
4.1MB

MD5
d4590c58d28d7fba8a923192711feda5

SHA1
980cb52068d314d08636d1fce02de60c70f8a518

SHA256
47a02a0934e6af733319a571a9b7d0953aba93986021cd01db0057c7c498332d

SHA512
6dabdf20bf0a45a7b4620ba526c82022ed518a72c682a860e335b33ee691c939ac304c7c78e7be26df57b436276d631d44e321791cc2d8515408308d37d8697d

Download Submit
C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe

Filesize
3.8MB

MD5
298811fc48577139b5e961f10e161821

SHA1
aea01ec9005bec877240cd48e0ccb7201c134278

SHA256
7a42072147edc5f4daec7ee46764e1422206c88c53b2d6d1340f1d326813c541

SHA512
66e8f05e3bf49519db32ca2f10fc1e5f12e4be9a512da7c4eff608edcfee3272c8af7e82f59baa2c525800c1db165a5efcd69b575274e9f3f5d5baaf11daa108

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bcaf436ee5fed204f08c14d7517436eb

SHA1
637817252f1e2ab00275cd5b5a285a22980295ff

SHA256
de776d807ae7f2e809af69746f85ea99e0771bbdaaed78a764a6035dabe7f120

SHA512
7e6cf2fdffdcf444f6ef4a50a6f9ef1dfb853301467e3f4784c9ee905c3bf159dc3ee9145d77dbf72637d5b99242525eb951b91c020e5f4e5cfcfd965443258c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
556027a5f7825b113b5e0dc4e6cd918d

SHA1
37f43086ca7f2a6b9a9481553bfcb5828115bff2

SHA256
ac490cb48c3544d6b5ef1180f67087133356b2d1cd4a756fddbecfdc3ea277c2

SHA512
54be9ba7e0b027e7d82d6f9de296ded41266a79a8d956e4374eda3e2d2ed14c8dd10cbef2131f4f62a2c47ff5d4f0f5b054a74a5a5cdf92d0b766f3a1acbcb11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
47a97d9a15df1d6cec60ca4ac002137b

SHA1
b05e79afb47136c7dd3692be9b0e90b02c0d58d2

SHA256
1e35e3d3c70f3cadfc63ca80ac4cbe8671da91499db7e19f67ea39bb3386dad6

SHA512
6038da655352888dbdc687be8ea8b3e0b29f1f425c98ffa8fc57b3d3b102330a94931b1e7b80969f658b8766207598e616d5c123ebd36874a820cfc739133d09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1a14a664e41b39b82c8bdc4f14c89d67

SHA1
f0570c6f401f2ce6aaaa2041d18b2a1f781e4521

SHA256
38556a25ec2f884aeb4e49c9ffff9f72e0e8629caf9b17af795dde53561a9e59

SHA512
488e2fb29bb283da7d129dd549f85ab17651a2c2409b710365ce04cd3527f792d4d771bda915f3a73c402213738185e04ca23bda3228effe57c9a9ad013e2080

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f0ba74c0fae4b6de4af47ffc56024035

SHA1
c14083c5ce2d4bfd7210bdfd54ef90e36d67c579

SHA256
c0750f483af71d77d6cead9b3dc35f31eb704dd4113dffe818a130795f50a8eb

SHA512
ebfb3574a28e74ec841f82e71191d6403cb171e0946a5f17606df88637888da0eb1dfbfad164d9d0421035eeca0c35509559dd527753939526d9674fd51a3a27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ea240f5b288dd4bf81ca73ca0e07cedc

SHA1
9d30e0b1028f4e74dff4059ebad26905937a4dc7

SHA256
ba1644fe5fb28b5ed234a86c7f9483b40eed5baca843665b57622c384f947207

SHA512
e7210ba614233c47acee815e5fe351517c19364dcc490ac0e748c919057e071070e57d37cd56781de5319439349d2c48e19e5028ad91ff407242d98fd5a9fda7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
b0ba6f0eee8f998b4d78bc4934f5fd17

SHA1
589653d624de363d3e8869c169441b143c1f39ad

SHA256
4b5ee509e727accbd11493dda2c1d512e7dbfaff66c4f5f7ea9c2d2ccd06151f

SHA512
e9a165da246c6b80fc38431538203cf03f95794184ff63f00c9500f8919a2028b803f64b670e685185eed72df0509e3185c9b434fdbf2bc7af36021d46bd08d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
669e6112278cacdcb63c212425d18168

SHA1
5bef50142fa840af11b6d02e80d5e774efb58433

SHA256
24418546b8399270ca74cd88cc07a4d5e537ae917faa45d3f961aa671e1a4d96

SHA512
9ce2e40a77e30228257b4cd01298f94b63975b37d34925d72b92c0d72410ae549a15a0a88a17980989773b97b3bb1bc20156dce330ddcb4b2a1a397cc83d3748

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
eccf3bdaf4eae708d95c9269debc709c

SHA1
039f4cc704252bfc33af10c105a2a41ac15cab9d

SHA256
762264482fec317737a964ce98b7cdc2e072bbec5e425eb690d770453cd702c5

SHA512
e4db21c262e1c65153f2b94e8d2d746635895629b54baa319b356f3273cd4a1885b630b051ed7a0614aeea7956c0990d81708afcdfc23081bacf662d77729905

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
6666d85f0d001872c5c626030171749a

SHA1
de6613b32bb6f9b5138e95ef54852cc4daedec25

SHA256
177208fbc7d3400051a4b7b98904dec4aebad9543d8d673e9f385b756899570a

SHA512
f59504856e1bdbf35d29a976c83216de42ace82f0120796a5139475c679c7859784aaeb7adf88634efdffdddcbea97b140952b12f10a013cd7908f8e5aef48fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ilkdt.exe

Filesize
191KB

MD5
e004a568b841c74855f1a8a5d43096c7

SHA1
b90fd74593ae9b5a48cb165b6d7602507e1aeca4

SHA256
d49013d6be0f0e727c0b53bce1d3fed00656c7a2836ceef0a9d4cb816a5878db

SHA512
402dd4d4c57fb6f5c7a531b7210a897dfe41d68df99ae4d605944f6e5b2cecaafa3fe27562fe45e7e216a7c9e29e63139d4382310b41f04a35ad56115fbed2af

Download Submit
C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe

Filesize
316KB

MD5
675d9e9ab252981f2f919cf914d9681d

SHA1
7485f5c9da283475136df7fa8b62756efbb5dd17

SHA256
0f055835332ef8e368185ae461e7c9eacdeb3d600ea550d605b09a20e0856e2d

SHA512
9dd936705fd43ebe8be17fcf77173eaaf16046f5880f8fe48fc68ded91ef6202ba65c605980bd2e330d2c7f463f772750a1bd96246fffdc9cb6bf8e1b00a2ccb

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe

Filesize
42KB

MD5
d499e979a50c958f1a67f0e2a28af43d

SHA1
1e5fa0824554c31f19ce01a51edb9bed86f67cf0

SHA256
bc3d545c541e42420ce2c2eabc7e5afab32c869a1adb20adb11735957d0d0b0e

SHA512
668047f178d82bebefeb8c2e7731d34ff24dc755dacd3362b43d8b44c6b148fc51af0d0ab2d0a67f0344ab6158b883fe568e4eeb0e34152108735574f0e1e763

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe

Filesize
2.6MB

MD5
473aa58ba305e7aba8c35dd7c8bd0c53

SHA1
0fe22e1c981b0e62ae328af5de356946ba8677cf

SHA256
fb5b8cf97c6329c0b259faa2662908eaf230d5b24a26b24423d2fe3a8641e32d

SHA512
468479b5378d6e163c3a93bdfeafef8dc00510be834c77bdef98dda70b65ec56aa63b0e70d2798513208c70c4f608501e584a4963f626d77936f121572afe59f

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe

Filesize
2.6MB

MD5
5a7a3c43bea04a929f306ded49acc618

SHA1
66af91947bae38f2b0615302355b0c44e8d68ee5

SHA256
4517ed0d82e1d47cfcdcdd5f42dbd91cfcfda563280871c109b3d536d2701278

SHA512
8a1808ab1d3a57a2f1e2ec035f5a7ef6600053af032a623b5ba49727935cda865e8d5f08ac53ef491b8d68f82ff3b7d99e2487c693190202382345492a7ce4e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe

Filesize
1.3MB

MD5
ee87b615fd8626e4704208d1fde8e03d

SHA1
5c2800c868e96bdc347194ccb9bb3f5004ddd6a9

SHA256
294df5a2a8090a1e4385ef54ef8757b54f19637125cc87a8124bd5359ac160de

SHA512
4014ba67b74a6a1f4a7c5c774da690ac39982658805635f2cba38ac7c8fb88446d47c745da1c063507c2104aca64cde9d84328bb53fa8776db5460890a81be96

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI27642\VCRUNTIME140.dll

Filesize
116KB

MD5
be8dbe2dc77ebe7f88f910c61aec691a

SHA1
a19f08bb2b1c1de5bb61daf9f2304531321e0e40

SHA256
4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

SHA512
0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI27642\_bz2.pyd

Filesize
82KB

MD5
90f58f625a6655f80c35532a087a0319

SHA1
d4a7834201bd796dc786b0eb923f8ec5d60f719b

SHA256
bd8621fcc901fa1de3961d93184f61ea71068c436794af2a4449738ccf949946

SHA512
b5bb1ecc195700ad7bea5b025503edd3770b1f845f9beee4b067235c4e63496d6e0b19bdd2a42a1b6591d1131a2dc9f627b2ae8036e294300bb6983ecd644dc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI27642\_decimal.pyd

Filesize
247KB

MD5
f78f9855d2a7ca940b6be51d68b80bf2

SHA1
fd8af3dbd7b0ea3de2274517c74186cb7cd81a05

SHA256
d4ae192bbd4627fc9487a2c1cd9869d1b461c20cfd338194e87f5cf882bbed12

SHA512
6b68c434a6f8c436d890d3c1229d332bd878e5777c421799f84d79679e998b95d2d4a013b09f50c5de4c6a85fcceb796f3c486e36a10cbac509a0da8d8102b18

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI27642\_hashlib.pyd

Filesize
64KB

MD5
8baeb2bd6e52ba38f445ef71ef43a6b8

SHA1
4132f9cd06343ef8b5b60dc8a62be049aa3270c2

SHA256
6c50c9801a5caf0bb52b384f9a0d5a4aa182ca835f293a39e8999cf6edf2f087

SHA512
804a4e19ea622646cea9e0f8c1e284b7f2d02f3620199fa6930dbdadc654fa137c1e12757f87c3a1a71ceff9244aa2f598ee70d345469ca32a0400563fe3aa65

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI27642\_lzma.pyd

Filesize
155KB

MD5
cf8de1137f36141afd9ff7c52a3264ee

SHA1
afde95a1d7a545d913387624ef48c60f23cf4a3f

SHA256
22d10e2d6ad3e3ed3c49eb79ab69a81aaa9d16aeca7f948da2fe80877f106c16

SHA512
821985ff5bc421bd16b2fa5f77f1f4bf8472d0d1564bc5768e4dbe866ec52865a98356bb3ef23a380058acd0a25cd5a40a1e0dae479f15863e48c4482c89a03f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI27642\_socket.pyd

Filesize
81KB

MD5
439b3ad279befa65bb40ecebddd6228b

SHA1
d3ea91ae7cad9e1ebec11c5d0517132bbc14491e

SHA256
24017d664af20ee3b89514539345caac83eca34825fcf066a23e8a4c99f73e6d

SHA512
a335e1963bb21b34b21aef6b0b14ba8908a5343b88f65294618e029e3d4d0143ea978a5fd76d2df13a918ffab1e2d7143f5a1a91a35e0cc1145809b15af273bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI27642\base_library.zip

Filesize
712KB

MD5
d3b92a8e844991017db041c08015609b

SHA1
3ceee19d1ffc86873d599059e47fd7c2bdf5d3bf

SHA256
1623fb9c48a4eaec7d4ed04df9d7ef0929dce34ca2599a406e2d8c0b54d6563e

SHA512
9085ecf6f3167b8cfbd2f1802378a2b0cd9157eb81b0663fe272c8cf4f6028506ed77be4ad7aaa83f9c56219adcf7c835e27b67462fa0c0fc2f48a4e9329d3d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI27642\libcrypto-3.dll

Filesize
625KB

MD5
2d5a8e5294fed34263c911552eee1b20

SHA1
fa449c76fc562d21da1c00c3e303a7d7f21295cb

SHA256
ad29f985da85d98a8f798fac4590f88068c3ec8a8341050c9628c1e04f9043d8

SHA512
68d0e23c53576e487cc9a9eef2b70e26282a629a7be411d64ccc573dcebebfe83241d8bbbe047ec677d7f67c3569ae2761b73259c7ec3afacc1d060ddfa58259

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI27642\python312.dll

Filesize
955KB

MD5
a2e45927051c9ae842efff4baf419151

SHA1
3edb31e58d9b93dd507e77d2d34c826b7e3143b9

SHA256
fa28eb076f69452c3d8b3b76d1189d0cad6f6c7c7a6c0c644ec7104ab76c367f

SHA512
d00eeb3f306ed2afa97961fb6789c56afd6061430253fe29ddf040966b1269a2958f2125f67f7e8c7eca92bdb6eb723fd8e4381d54302767d01866f1e1175621

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI27642\python312.dll

Filesize
868KB

MD5
1f42150a650d093cec7ec4e911a43d6f

SHA1
959b058c484a2266d41175785b0b07d416d6c294

SHA256
b64c7d3f8da192736b124acb87e263023bf29b9f92b37bfcd2f28a56c7977cff

SHA512
f08803720de2462af4d6c45471a7de39493e39ee91541e707ad917cae7a8f26716c96e4482cd87496f5314badc58c6f40206bce8d7716f3942c773931372294a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI27642\select.pyd

Filesize
29KB

MD5
e1604afe8244e1ce4c316c64ea3aa173

SHA1
99704d2c0fa2687997381b65ff3b1b7194220a73

SHA256
74cca85600e7c17ea6532b54842e26d3cae9181287cdf5a4a3c50af4dab785e5

SHA512
7bf35b1a9da9f1660f238c2959b3693b7d9d2da40cf42c6f9eba2164b73047340d0adff8995049a2fe14e149eba05a5974eee153badd9e8450f961207f0b3d42

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI27642\unicodedata.pyd

Filesize
708KB

MD5
1b645c5c5034395d2ecf8b49b3d79fda

SHA1
da0090fa487816337fc01ac1fa2ab26293dcbe0c

SHA256
d212ade33a70a683ba080c04273d94db6c9aefe207aae47f2bca4e8002fc69cc

SHA512
935e56abc754cae12e405bfbf16cc856deda752ccf1c7536d64680c090d0adc20b1857f8e74245958df431bf83b242f3059e5e7ced8df82ba83f5984639d7fa4

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ihkwdiis.bhu.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpDFC1.tmp

Filesize
1KB

MD5
7f673f709ab0e7278e38f0fd8e745cd4

SHA1
ac504108a274b7051e3b477bcd51c9d1a4a01c2c

SHA256
da5ab3278aaa04fbd51272a617aef9b903ca53c358fac48fc0f558e257e063a4

SHA512
e932ccbd9d3ec6ee129f0dab82710904b84e657532c5b623d3c7b3b4ce45732caf8ff5d7b39095cf99ecf97d4e40dd9d755eb2b89c8ede629b287c29e41d1132

Download Submit
C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe

Filesize
1.7MB

MD5
facb78858af0e62dcab56fb19ee15b4d

SHA1
efe8dc95ccbb31742d01341a1e73a8c7e49f7877

SHA256
47363b1a47ade33f9c3d283ffad06941761954e5bd7ab857ddac2058912c241c

SHA512
9d68bb8fabfb44d9d44d6bc9bd49e1daabd5ed26a3ca3cbb5eb9545663a9c57836f746bbca7ab3265426749fcd7a1f11f0742aee5905dd22b779a7e24e3a2ad0

Download Submit
C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe

Filesize
1.9MB

MD5
f9e0c0a5b2230faf5bf8d20dae0e9702

SHA1
3d45251686e5c9485b3371258c357aa41cfca567

SHA256
30963ddbcb9d4c1e16c21abaec37eaebc3c8db2a50d64e1d49c65a2dd63f4b15

SHA512
f2b5bf9c10b258353e665868105f01abf2eb7aab45d0b7c91a01a906e94cb114b1dba0771ce3ed55bf5aa8a88ce6974af5e5c2be5b8b8a1e301997c87a6bd060

Download Submit
C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe

Filesize
187KB

MD5
f07808442ed1e169cce16fa5cc942835

SHA1
dd3e17a14bcc70a9f0af05dfc62b4513fc60c07a

SHA256
265b9c1feeadc427376b8b62b2c2afecc91b7b358bbb8109952da4ed53e135e1

SHA512
cd613a11760845a57c24c8c50c6970e6f6024b48a301ef166e88cea42de38e0d59a09e16a8f4b7ca1b0f288afb09f5dc71fe09eff4a8461177cbdddfcde28147

Download Submit
C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe

Filesize
817KB

MD5
371a40b5983e426329437e53f64ddcc8

SHA1
dbc87afb2be5ad9e37f3acd899119a2a4b900962

SHA256
cdfd910f45bf03c783791711259f76e5912b089892e191fc200795fc81cea667

SHA512
ef52ea95a6d16203ca0f8eb5501a5bb189457e403ebb1117613ed81ad79f54ae0f19191ab90b005562862225f10fd1d4e5f80489a63de3f0631a7e2d7ee791e4

Download Submit
\??\pipe\LOCAL\crashpad_5104_SZWAXNDGIOPJONNY

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1228-84-0x00007FF930E30000-0x00007FF9318F1000-memory.dmp

Filesize
10.8MB

Download
memory/1228-144-0x00007FF930E30000-0x00007FF9318F1000-memory.dmp

Filesize
10.8MB

Download
memory/1228-86-0x0000023C1EA80000-0x0000023C1EA90000-memory.dmp

Filesize
64KB

Download
memory/1228-53-0x0000023C044A0000-0x0000023C044F4000-memory.dmp

Filesize
336KB

Download
memory/1720-1840-0x0000011FCA460000-0x0000011FCA470000-memory.dmp

Filesize
64KB

Download
memory/1720-1841-0x0000011FCA460000-0x0000011FCA470000-memory.dmp

Filesize
64KB

Download
memory/1720-1846-0x00007FF92EB00000-0x00007FF92F5C1000-memory.dmp

Filesize
10.8MB

Download
memory/1720-1839-0x00007FF92EB00000-0x00007FF92F5C1000-memory.dmp

Filesize
10.8MB

Download
memory/1720-1834-0x0000011FCA3A0000-0x0000011FCA3C2000-memory.dmp

Filesize
136KB

Download
memory/2016-1871-0x0000014B68A80000-0x0000014B68A9C000-memory.dmp

Filesize
112KB

Download
memory/2016-1878-0x0000014B68CF0000-0x0000014B68CF6000-memory.dmp

Filesize
24KB

Download
memory/2016-1859-0x00007FF92EC40000-0x00007FF92F701000-memory.dmp

Filesize
10.8MB

Download
memory/2016-1888-0x00007FF92EC40000-0x00007FF92F701000-memory.dmp

Filesize
10.8MB

Download
memory/2016-1861-0x0000014B68650000-0x0000014B68660000-memory.dmp

Filesize
64KB

Download
memory/2016-1880-0x0000014B68650000-0x0000014B68660000-memory.dmp

Filesize
64KB

Download
memory/2016-1879-0x0000014B68D00000-0x0000014B68D0A000-memory.dmp

Filesize
40KB

Download
memory/2016-1872-0x0000014B68AA0000-0x0000014B68B55000-memory.dmp

Filesize
724KB

Download
memory/2016-1873-0x0000014B68B60000-0x0000014B68B6A000-memory.dmp

Filesize
40KB

Download
memory/2016-1874-0x0000014B68CD0000-0x0000014B68CEC000-memory.dmp

Filesize
112KB

Download
memory/2016-1875-0x0000014B68CB0000-0x0000014B68CBA000-memory.dmp

Filesize
40KB

Download
memory/2016-1877-0x0000014B68CC0000-0x0000014B68CC8000-memory.dmp

Filesize
32KB

Download
memory/2016-1876-0x0000014B68D10000-0x0000014B68D2A000-memory.dmp

Filesize
104KB

Download
memory/2016-1860-0x0000014B68650000-0x0000014B68660000-memory.dmp

Filesize
64KB

Download
memory/2508-1843-0x00000000731C0000-0x0000000073970000-memory.dmp

Filesize
7.7MB

Download
memory/2508-106-0x00000000731C0000-0x0000000073970000-memory.dmp

Filesize
7.7MB

Download
memory/2508-110-0x00000000056A0000-0x00000000056B0000-memory.dmp

Filesize
64KB

Download
memory/3196-112-0x0000000005890000-0x00000000058F6000-memory.dmp

Filesize
408KB

Download
memory/3196-266-0x0000000007470000-0x0000000007481000-memory.dmp

Filesize
68KB

Download
memory/3196-37-0x00000000731C0000-0x0000000073970000-memory.dmp

Filesize
7.7MB

Download
memory/3196-57-0x00000000029D0000-0x00000000029E0000-memory.dmp

Filesize
64KB

Download
memory/3196-59-0x00000000029D0000-0x00000000029E0000-memory.dmp

Filesize
64KB

Download
memory/3196-34-0x0000000002960000-0x0000000002996000-memory.dmp

Filesize
216KB

Download
memory/3196-56-0x0000000005140000-0x0000000005768000-memory.dmp

Filesize
6.2MB

Download
memory/3196-121-0x0000000005A70000-0x0000000005AD6000-memory.dmp

Filesize
408KB

Download
memory/3196-125-0x0000000005AE0000-0x0000000005E34000-memory.dmp

Filesize
3.3MB

Download
memory/3196-142-0x0000000005F40000-0x0000000005F5E000-memory.dmp

Filesize
120KB

Download
memory/3196-146-0x0000000005F80000-0x0000000005FCC000-memory.dmp

Filesize
304KB

Download
memory/3196-181-0x0000000073BF0000-0x0000000073C3C000-memory.dmp

Filesize
304KB

Download
memory/3196-98-0x00000000057C0000-0x00000000057E2000-memory.dmp

Filesize
136KB

Download
memory/3196-180-0x0000000006EC0000-0x0000000006EF2000-memory.dmp

Filesize
200KB

Download
memory/3196-192-0x0000000006EA0000-0x0000000006EBE000-memory.dmp

Filesize
120KB

Download
memory/3196-197-0x0000000007110000-0x00000000071B3000-memory.dmp

Filesize
652KB

Download
memory/3196-194-0x00000000029D0000-0x00000000029E0000-memory.dmp

Filesize
64KB

Download
memory/3196-345-0x00000000731C0000-0x0000000073970000-memory.dmp

Filesize
7.7MB

Download
memory/3196-325-0x0000000007590000-0x0000000007598000-memory.dmp

Filesize
32KB

Download
memory/3196-318-0x00000000075B0000-0x00000000075CA000-memory.dmp

Filesize
104KB

Download
memory/3196-311-0x00000000074C0000-0x00000000074D4000-memory.dmp

Filesize
80KB

Download
memory/3196-179-0x000000007F800000-0x000000007F810000-memory.dmp

Filesize
64KB

Download
memory/3196-211-0x00000000078B0000-0x0000000007F2A000-memory.dmp

Filesize
6.5MB

Download
memory/3196-213-0x0000000007270000-0x000000000728A000-memory.dmp

Filesize
104KB

Download
memory/3196-219-0x00000000072F0000-0x00000000072FA000-memory.dmp

Filesize
40KB

Download
memory/3196-239-0x00000000074F0000-0x0000000007586000-memory.dmp

Filesize
600KB

Download
memory/3196-304-0x00000000074B0000-0x00000000074BE000-memory.dmp

Filesize
56KB

Download
memory/3980-157-0x0000000002EE0000-0x0000000002F45000-memory.dmp

Filesize
404KB

Download
memory/3980-171-0x0000000002EE0000-0x0000000002F45000-memory.dmp

Filesize
404KB

Download
memory/3980-161-0x0000000002EE0000-0x0000000002F45000-memory.dmp

Filesize
404KB

Download
memory/3980-83-0x0000000002EE0000-0x0000000002F45000-memory.dmp

Filesize
404KB

Download
memory/3980-196-0x0000000002EE0000-0x0000000002F45000-memory.dmp

Filesize
404KB

Download
memory/3980-201-0x0000000002EE0000-0x0000000002F45000-memory.dmp

Filesize
404KB

Download
memory/3980-199-0x0000000002EE0000-0x0000000002F45000-memory.dmp

Filesize
404KB

Download
memory/3980-182-0x0000000002EE0000-0x0000000002F45000-memory.dmp

Filesize
404KB

Download
memory/3980-165-0x0000000002EE0000-0x0000000002F45000-memory.dmp

Filesize
404KB

Download
memory/3980-1797-0x00000000731C0000-0x0000000073970000-memory.dmp

Filesize
7.7MB

Download
memory/3980-155-0x0000000002EE0000-0x0000000002F45000-memory.dmp

Filesize
404KB

Download
memory/3980-153-0x0000000002EE0000-0x0000000002F45000-memory.dmp

Filesize
404KB

Download
memory/3980-143-0x0000000002EE0000-0x0000000002F45000-memory.dmp

Filesize
404KB

Download
memory/3980-151-0x0000000002EE0000-0x0000000002F45000-memory.dmp

Filesize
404KB

Download
memory/3980-149-0x0000000002EE0000-0x0000000002F45000-memory.dmp

Filesize
404KB

Download
memory/3980-177-0x0000000002EE0000-0x0000000002F45000-memory.dmp

Filesize
404KB

Download
memory/3980-147-0x0000000002EE0000-0x0000000002F45000-memory.dmp

Filesize
404KB

Download
memory/3980-175-0x0000000002EE0000-0x0000000002F45000-memory.dmp

Filesize
404KB

Download
memory/3980-129-0x0000000002EE0000-0x0000000002F45000-memory.dmp

Filesize
404KB

Download
memory/3980-127-0x0000000002EE0000-0x0000000002F45000-memory.dmp

Filesize
404KB

Download
memory/3980-173-0x0000000002EE0000-0x0000000002F45000-memory.dmp

Filesize
404KB

Download
memory/3980-159-0x0000000002EE0000-0x0000000002F45000-memory.dmp

Filesize
404KB

Download
memory/3980-124-0x0000000002EE0000-0x0000000002F45000-memory.dmp

Filesize
404KB

Download
memory/3980-122-0x0000000002EE0000-0x0000000002F45000-memory.dmp

Filesize
404KB

Download
memory/3980-108-0x0000000002EE0000-0x0000000002F45000-memory.dmp

Filesize
404KB

Download
memory/3980-104-0x0000000002EE0000-0x0000000002F45000-memory.dmp

Filesize
404KB

Download
memory/3980-38-0x0000000000CB0000-0x0000000000CE6000-memory.dmp

Filesize
216KB

Download
memory/3980-90-0x0000000002EE0000-0x0000000002F45000-memory.dmp

Filesize
404KB

Download
memory/3980-169-0x0000000002EE0000-0x0000000002F45000-memory.dmp

Filesize
404KB

Download
memory/3980-54-0x0000000002EE0000-0x0000000002F4C000-memory.dmp

Filesize
432KB

Download
memory/3980-66-0x0000000002EE0000-0x0000000002F45000-memory.dmp

Filesize
404KB

Download
memory/3980-65-0x00000000731C0000-0x0000000073970000-memory.dmp

Filesize
7.7MB

Download
memory/3980-163-0x0000000002EE0000-0x0000000002F45000-memory.dmp

Filesize
404KB

Download
memory/3980-63-0x0000000002EE0000-0x0000000002F45000-memory.dmp

Filesize
404KB

Download
memory/3980-62-0x0000000001440000-0x0000000001450000-memory.dmp

Filesize
64KB

Download
memory/3980-60-0x0000000002EE0000-0x0000000002F45000-memory.dmp

Filesize
404KB

Download
memory/3980-167-0x0000000002EE0000-0x0000000002F45000-memory.dmp

Filesize
404KB

Download
memory/3980-58-0x0000000002EE0000-0x0000000002F45000-memory.dmp

Filesize
404KB

Download
memory/4400-55-0x00000000731C0000-0x0000000073970000-memory.dmp

Filesize
7.7MB

Download
memory/4400-30-0x0000000000A70000-0x0000000000A80000-memory.dmp

Filesize
64KB

Download
memory/4400-105-0x00000000731C0000-0x0000000073970000-memory.dmp

Filesize
7.7MB

Download
memory/4704-1912-0x0000000001A30000-0x0000000001A50000-memory.dmp

Filesize
128KB

Download
memory/4704-1942-0x0000000001B50000-0x0000000001B70000-memory.dmp

Filesize
128KB

Download
memory/4704-1970-0x0000000001B50000-0x0000000001B70000-memory.dmp

Filesize
128KB

Download