growtopia | 571a330dfb82f72878d9ede8bdfc332544446a0160117bf37399c3b9ca0775e2

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
22-02-2024 10:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RadiumExecutor.exe
Size

12.6MB
MD5

7a17d34bac23e365863ea1da1e42e968
SHA1

b5ccab413899349d2821cc2798bce29f0118121f
SHA256

571a330dfb82f72878d9ede8bdfc332544446a0160117bf37399c3b9ca0775e2
SHA512

c021f26320c49c64831c676820d1bc7cb84ba3f49b798d4f858461eebc398a37d937de1d4cf214b973b8ac1cb693830894c4ae9b1bc7d62f2fd5d56b7d5ba4ac
SSDEEP

196608:MRvSjNRyzz9V4EAWzcNtYuZuT0ItZ/jBpOtwDc3rSlou2it3NaB+He+8:MRqjj+xV8acwWuNtZ/jetwc3SYihNqc

Score

10^/10

growtopia zgrat evasion persistence pyinstaller rat stealer

Malware Config

Extracted

Family

growtopia

https://discord.com/api/webhooks/1199763266872803338/8vedcXoMcyExhe1xhBm5f8ncmafWmOB3pkulE0l8g9Pel0t3ziyr2V51cLTVEjYsE4Rj

Signatures

Detect ZGRat V1 34 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4232-53-0x0000000002C60000-0x0000000002CCC000-memory.dmp	family_zgrat_v1
behavioral2/memory/4232-59-0x0000000002C60000-0x0000000002CC5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4232-58-0x0000000002C60000-0x0000000002CC5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4232-62-0x0000000002C60000-0x0000000002CC5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4232-85-0x0000000002C60000-0x0000000002CC5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4232-65-0x0000000002C60000-0x0000000002CC5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4232-95-0x0000000002C60000-0x0000000002CC5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4232-102-0x0000000002C60000-0x0000000002CC5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4232-108-0x0000000002C60000-0x0000000002CC5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4232-120-0x0000000002C60000-0x0000000002CC5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4232-123-0x0000000002C60000-0x0000000002CC5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4232-126-0x0000000002C60000-0x0000000002CC5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4232-145-0x0000000002C60000-0x0000000002CC5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4232-147-0x0000000002C60000-0x0000000002CC5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4232-140-0x0000000002C60000-0x0000000002CC5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4232-149-0x0000000002C60000-0x0000000002CC5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4232-151-0x0000000002C60000-0x0000000002CC5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4232-155-0x0000000002C60000-0x0000000002CC5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4232-153-0x0000000002C60000-0x0000000002CC5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4232-157-0x0000000002C60000-0x0000000002CC5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4232-159-0x0000000002C60000-0x0000000002CC5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4232-162-0x0000000002C60000-0x0000000002CC5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4232-164-0x0000000002C60000-0x0000000002CC5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4232-166-0x0000000002C60000-0x0000000002CC5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4232-168-0x0000000002C60000-0x0000000002CC5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4232-175-0x0000000002C60000-0x0000000002CC5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4232-177-0x0000000002C60000-0x0000000002CC5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4232-179-0x0000000002C60000-0x0000000002CC5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4232-181-0x0000000002C60000-0x0000000002CC5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4232-183-0x0000000002C60000-0x0000000002CC5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4232-191-0x0000000002C60000-0x0000000002CC5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4232-219-0x0000000002C60000-0x0000000002CC5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4232-201-0x0000000002C60000-0x0000000002CC5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4232-224-0x0000000002C60000-0x0000000002CC5000-memory.dmp	family_zgrat_v1

Growtopia
Growtopa is an opensource modular stealer written in C#.
stealer growtopia
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

RadiumExecutor.exeWinErrorMgr.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\Control Panel\International\Geo\Nation	RadiumExecutor.exe
Key value queried	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\Control Panel\International\Geo\Nation	WinErrorMgr.exe

Executes dropped EXE 8 IoCs

Processes:

Ilkdt.exeWinHostMgr.exeWinErrorMgr.exeKeyGeneratorI.exeSahyui1337.exeWinErrorMgr.exeKeyGeneratorI.exebauwrdgwodhv.exe

pid	process
4232	Ilkdt.exe
2412	WinHostMgr.exe
2964	WinErrorMgr.exe
1816	KeyGeneratorI.exe
4772	Sahyui1337.exe
4788	WinErrorMgr.exe
2240	KeyGeneratorI.exe
1608	bauwrdgwodhv.exe

Loads dropped DLL 4 IoCs

Processes:

KeyGeneratorI.exe

pid process

2240 KeyGeneratorI.exe
2240 KeyGeneratorI.exe
2240 KeyGeneratorI.exe
2240 KeyGeneratorI.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service
T1102

Processes:

flow ioc

185 pastebin.com
21 discord.com
22 discord.com
183 pastebin.com
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

274 api.ipify.org
278 api.ipify.org
334 api.ipify.org

pid	process
2240	KeyGeneratorI.exe
2240	KeyGeneratorI.exe
2240	KeyGeneratorI.exe
2240	KeyGeneratorI.exe

flow	ioc
185	pastebin.com
21	discord.com
22	discord.com
183	pastebin.com

flow	ioc
274	api.ipify.org
278	api.ipify.org
334	api.ipify.org

Drops file in System32 directory 4 IoCs

Processes:

WinHostMgr.exepowershell.exebauwrdgwodhv.exe

description	ioc	process
File opened for modification	C:\Windows\system32\MRT.exe	WinHostMgr.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	bauwrdgwodhv.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

bauwrdgwodhv.exe

description	pid	process	target process
PID 1608 set thread context of 5056	1608	bauwrdgwodhv.exe	conhost.exe
PID 1608 set thread context of 3540	1608	bauwrdgwodhv.exe	explorer.exe

Launches sc.exe 14 IoCs

Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid	process
4492	sc.exe
3448	sc.exe
4768	sc.exe
3748	sc.exe
4428	sc.exe
3780	sc.exe
2400	sc.exe
5056	sc.exe
4808	sc.exe
1680	sc.exe
852	sc.exe
3696	sc.exe
2596	sc.exe
2448	sc.exe

Detects Pyinstaller 4 IoCs

pyinstaller

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe	pyinstaller
C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe	pyinstaller
C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe	pyinstaller
C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

912 schtasks.exe

pid	process
912	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 50 IoCs

Processes:

powershell.exeexplorer.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-910440534-423636034-2318342392-1000\{B7354F7E-5C6D-405E-A4EE-285C6C7B623D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Sahyui1337.exepowershell.exemsedge.exemsedge.exeidentity_helper.exeWinHostMgr.exepowershell.exebauwrdgwodhv.exepowershell.exeexplorer.exe

pid	process
4772	Sahyui1337.exe
4772	Sahyui1337.exe
4012	powershell.exe
4012	powershell.exe
2664	msedge.exe
2664	msedge.exe
3324	msedge.exe
3324	msedge.exe
3048	identity_helper.exe
3048	identity_helper.exe
2412	WinHostMgr.exe
4416	powershell.exe
4416	powershell.exe
4416	powershell.exe
2412	WinHostMgr.exe
2412	WinHostMgr.exe
2412	WinHostMgr.exe
2412	WinHostMgr.exe
2412	WinHostMgr.exe
2412	WinHostMgr.exe
2412	WinHostMgr.exe
2412	WinHostMgr.exe
2412	WinHostMgr.exe
2412	WinHostMgr.exe
2412	WinHostMgr.exe
2412	WinHostMgr.exe
2412	WinHostMgr.exe
2412	WinHostMgr.exe
1608	bauwrdgwodhv.exe
2148	powershell.exe
2148	powershell.exe
2148	powershell.exe
1608	bauwrdgwodhv.exe
1608	bauwrdgwodhv.exe
1608	bauwrdgwodhv.exe
1608	bauwrdgwodhv.exe
1608	bauwrdgwodhv.exe
1608	bauwrdgwodhv.exe
1608	bauwrdgwodhv.exe
1608	bauwrdgwodhv.exe
1608	bauwrdgwodhv.exe
1608	bauwrdgwodhv.exe
1608	bauwrdgwodhv.exe
1608	bauwrdgwodhv.exe
3540	explorer.exe
3540	explorer.exe
3540	explorer.exe
3540	explorer.exe
3540	explorer.exe
3540	explorer.exe
3540	explorer.exe
3540	explorer.exe
3540	explorer.exe
3540	explorer.exe
3540	explorer.exe
3540	explorer.exe
3540	explorer.exe
3540	explorer.exe
3540	explorer.exe
3540	explorer.exe
3540	explorer.exe
3540	explorer.exe
3540	explorer.exe
3540	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

Processes:

msedge.exe

pid	process
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

Processes:

Sahyui1337.exeIlkdt.exepowershell.exepowershell.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowershell.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exeexplorer.exe

description	pid	process
Token: SeDebugPrivilege	4772	Sahyui1337.exe
Token: SeDebugPrivilege	4232	Ilkdt.exe
Token: SeDebugPrivilege	4012	powershell.exe
Token: SeDebugPrivilege	4416	powershell.exe
Token: SeShutdownPrivilege	2248	powercfg.exe
Token: SeCreatePagefilePrivilege	2248	powercfg.exe
Token: SeShutdownPrivilege	3940	powercfg.exe
Token: SeCreatePagefilePrivilege	3940	powercfg.exe
Token: SeShutdownPrivilege	828	powercfg.exe
Token: SeCreatePagefilePrivilege	828	powercfg.exe
Token: SeShutdownPrivilege	944	powercfg.exe
Token: SeCreatePagefilePrivilege	944	powercfg.exe
Token: SeDebugPrivilege	2148	powershell.exe
Token: SeShutdownPrivilege	4424	powercfg.exe
Token: SeCreatePagefilePrivilege	4424	powercfg.exe
Token: SeShutdownPrivilege	2932	powercfg.exe
Token: SeCreatePagefilePrivilege	2932	powercfg.exe
Token: SeShutdownPrivilege	4376	powercfg.exe
Token: SeCreatePagefilePrivilege	4376	powercfg.exe
Token: SeShutdownPrivilege	3964	powercfg.exe
Token: SeCreatePagefilePrivilege	3964	powercfg.exe
Token: SeLockMemoryPrivilege	3540	explorer.exe

Suspicious use of FindShellTrayWindow 27 IoCs

Processes:

msedge.exe

pid	process
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

RadiumExecutor.exeWinErrorMgr.exeKeyGeneratorI.exeKeyGeneratorI.exemsedge.exe

description	pid	process	target process
PID 1616 wrote to memory of 4012	1616	RadiumExecutor.exe	powershell.exe
PID 1616 wrote to memory of 4012	1616	RadiumExecutor.exe	powershell.exe
PID 1616 wrote to memory of 4012	1616	RadiumExecutor.exe	powershell.exe
PID 1616 wrote to memory of 4232	1616	RadiumExecutor.exe	Ilkdt.exe
PID 1616 wrote to memory of 4232	1616	RadiumExecutor.exe	Ilkdt.exe
PID 1616 wrote to memory of 4232	1616	RadiumExecutor.exe	Ilkdt.exe
PID 1616 wrote to memory of 2412	1616	RadiumExecutor.exe	WinHostMgr.exe
PID 1616 wrote to memory of 2412	1616	RadiumExecutor.exe	WinHostMgr.exe
PID 1616 wrote to memory of 2964	1616	RadiumExecutor.exe	WinErrorMgr.exe
PID 1616 wrote to memory of 2964	1616	RadiumExecutor.exe	WinErrorMgr.exe
PID 1616 wrote to memory of 2964	1616	RadiumExecutor.exe	WinErrorMgr.exe
PID 1616 wrote to memory of 1816	1616	RadiumExecutor.exe	KeyGeneratorI.exe
PID 1616 wrote to memory of 1816	1616	RadiumExecutor.exe	KeyGeneratorI.exe
PID 1616 wrote to memory of 4772	1616	RadiumExecutor.exe	Sahyui1337.exe
PID 1616 wrote to memory of 4772	1616	RadiumExecutor.exe	Sahyui1337.exe
PID 2964 wrote to memory of 4788	2964	WinErrorMgr.exe	WinErrorMgr.exe
PID 2964 wrote to memory of 4788	2964	WinErrorMgr.exe	WinErrorMgr.exe
PID 2964 wrote to memory of 4788	2964	WinErrorMgr.exe	WinErrorMgr.exe
PID 1816 wrote to memory of 2240	1816	KeyGeneratorI.exe	KeyGeneratorI.exe
PID 1816 wrote to memory of 2240	1816	KeyGeneratorI.exe	KeyGeneratorI.exe
PID 2240 wrote to memory of 3324	2240	KeyGeneratorI.exe	msedge.exe
PID 2240 wrote to memory of 3324	2240	KeyGeneratorI.exe	msedge.exe
PID 3324 wrote to memory of 1084	3324	msedge.exe	msedge.exe
PID 3324 wrote to memory of 1084	3324	msedge.exe	msedge.exe
PID 3324 wrote to memory of 1212	3324	msedge.exe	msedge.exe
PID 3324 wrote to memory of 1212	3324	msedge.exe	msedge.exe
PID 3324 wrote to memory of 1212	3324	msedge.exe	msedge.exe
PID 3324 wrote to memory of 1212	3324	msedge.exe	msedge.exe
PID 3324 wrote to memory of 1212	3324	msedge.exe	msedge.exe
PID 3324 wrote to memory of 1212	3324	msedge.exe	msedge.exe
PID 3324 wrote to memory of 1212	3324	msedge.exe	msedge.exe
PID 3324 wrote to memory of 1212	3324	msedge.exe	msedge.exe
PID 3324 wrote to memory of 1212	3324	msedge.exe	msedge.exe
PID 3324 wrote to memory of 1212	3324	msedge.exe	msedge.exe
PID 3324 wrote to memory of 1212	3324	msedge.exe	msedge.exe
PID 3324 wrote to memory of 1212	3324	msedge.exe	msedge.exe
PID 3324 wrote to memory of 1212	3324	msedge.exe	msedge.exe
PID 3324 wrote to memory of 1212	3324	msedge.exe	msedge.exe
PID 3324 wrote to memory of 1212	3324	msedge.exe	msedge.exe
PID 3324 wrote to memory of 1212	3324	msedge.exe	msedge.exe
PID 3324 wrote to memory of 1212	3324	msedge.exe	msedge.exe
PID 3324 wrote to memory of 1212	3324	msedge.exe	msedge.exe
PID 3324 wrote to memory of 1212	3324	msedge.exe	msedge.exe
PID 3324 wrote to memory of 1212	3324	msedge.exe	msedge.exe
PID 3324 wrote to memory of 1212	3324	msedge.exe	msedge.exe
PID 3324 wrote to memory of 1212	3324	msedge.exe	msedge.exe
PID 3324 wrote to memory of 1212	3324	msedge.exe	msedge.exe
PID 3324 wrote to memory of 1212	3324	msedge.exe	msedge.exe
PID 3324 wrote to memory of 1212	3324	msedge.exe	msedge.exe
PID 3324 wrote to memory of 1212	3324	msedge.exe	msedge.exe
PID 3324 wrote to memory of 1212	3324	msedge.exe	msedge.exe
PID 3324 wrote to memory of 1212	3324	msedge.exe	msedge.exe
PID 3324 wrote to memory of 1212	3324	msedge.exe	msedge.exe
PID 3324 wrote to memory of 1212	3324	msedge.exe	msedge.exe
PID 3324 wrote to memory of 1212	3324	msedge.exe	msedge.exe
PID 3324 wrote to memory of 1212	3324	msedge.exe	msedge.exe
PID 3324 wrote to memory of 1212	3324	msedge.exe	msedge.exe
PID 3324 wrote to memory of 1212	3324	msedge.exe	msedge.exe
PID 3324 wrote to memory of 1212	3324	msedge.exe	msedge.exe
PID 3324 wrote to memory of 1212	3324	msedge.exe	msedge.exe
PID 3324 wrote to memory of 1212	3324	msedge.exe	msedge.exe
PID 3324 wrote to memory of 1212	3324	msedge.exe	msedge.exe
PID 3324 wrote to memory of 1212	3324	msedge.exe	msedge.exe
PID 3324 wrote to memory of 1212	3324	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\RadiumExecutor.exe
"C:\Users\Admin\AppData\Local\Temp\RadiumExecutor.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1616
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGcAawB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHQAdwBpACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHoAbQBnACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGEAagB0ACMAPgA="
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4012
- C:\Users\Admin\AppData\Local\Temp\Ilkdt.exe
  "C:\Users\Admin\AppData\Local\Temp\Ilkdt.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4232
- C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe
  "C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:2412
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4416
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:3780
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:4996
  - - C:\Windows\system32\wusa.exe
      wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      PID:3496
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:3696
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop wuauserv
    3⤵
    - Launches sc.exe
    PID:4492
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop bits
    3⤵
    - Launches sc.exe
    PID:2596
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop dosvc
    3⤵
    - Launches sc.exe
    PID:2400
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2248
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "GMDTJRUT"
    3⤵
    - Launches sc.exe
    PID:2448
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:944
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3940
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:828
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "GMDTJRUT" binpath= "C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:5056
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:3448
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "GMDTJRUT"
    3⤵
    - Launches sc.exe
    PID:4768
- C:\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe
  "C:\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2964
- - C:\Users\Admin\AppData\Local\Temp\XenoManager\WinErrorMgr.exe
    "C:\Users\Admin\AppData\Local\Temp\XenoManager\WinErrorMgr.exe"
    3⤵
    - Executes dropped EXE
    PID:4788
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /Create /TN "WindowsErrorHandler" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCB6E.tmp" /F
      4⤵
      Creates scheduled task(s)
      PID:912
- C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe
  "C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1816
- - C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe
    "C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://onepiecered.co/s?mH4q
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:3324
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc6da046f8,0x7ffc6da04708,0x7ffc6da04718
        5⤵
        
        PID:1084
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,12670109925277269492,10113469539476412616,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2664
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,12670109925277269492,10113469539476412616,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
        5⤵
        
        PID:1212
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12670109925277269492,10113469539476412616,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
        5⤵
        
        PID:1988
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12670109925277269492,10113469539476412616,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
        5⤵
        
        PID:4820
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,12670109925277269492,10113469539476412616,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2620 /prefetch:8
        5⤵
        
        PID:1384
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12670109925277269492,10113469539476412616,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4380 /prefetch:1
        5⤵
        
        PID:2204
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12670109925277269492,10113469539476412616,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:1
        5⤵
        
        PID:3424
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12670109925277269492,10113469539476412616,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
        5⤵
        
        PID:4932
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12670109925277269492,10113469539476412616,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
        5⤵
        
        PID:1464
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12670109925277269492,10113469539476412616,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4260 /prefetch:1
        5⤵
        
        PID:4884
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12670109925277269492,10113469539476412616,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
        5⤵
        
        PID:1976
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,12670109925277269492,10113469539476412616,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6020 /prefetch:8
        5⤵
        
        PID:2588
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,12670109925277269492,10113469539476412616,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6020 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3048
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12670109925277269492,10113469539476412616,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
        5⤵
        
        PID:1632
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12670109925277269492,10113469539476412616,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
        5⤵
        
        PID:4016
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12670109925277269492,10113469539476412616,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
        5⤵
        
        PID:1992
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12670109925277269492,10113469539476412616,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1
        5⤵
        
        PID:4016
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12670109925277269492,10113469539476412616,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
        5⤵
        
        PID:372
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12670109925277269492,10113469539476412616,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3540 /prefetch:1
        5⤵
        
        PID:3696
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2160,12670109925277269492,10113469539476412616,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5728 /prefetch:8
        5⤵
        Modifies registry class
        
        PID:2304
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2160,12670109925277269492,10113469539476412616,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3840 /prefetch:8
        5⤵
        
        PID:2100
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12670109925277269492,10113469539476412616,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
        5⤵
        
        PID:4432
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12670109925277269492,10113469539476412616,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3552 /prefetch:1
        5⤵
        
        PID:2304
- C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe
  "C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4772

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4016

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3272

C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe
C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:1608
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2148
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:4808
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  PID:4920
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:4492
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:3748
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:4428
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:1680
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:852
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:5056
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4424
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3964
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4376
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2932
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe

Filesize
5.0MB

MD5
e222309197c5e633aa8e294ba4bdcd29

SHA1
52b3f89a3d2262bf603628093f6d1e71d9cc3820

SHA256
047a7ca1b8848c1c0e3c0fcc6ece056390760b24580f27f6966b86b0c2a1042b

SHA512
9eb37686e0cee9ec18d12a4edd37c8334d26650c74eae5b30231c2b0db1628d52848123c9348c3da306ec950b827ec0a56cdf43ee325a9e280022c68193d8503

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
854f73d7b3f85bf181d2f2002afd17db

SHA1
53e5e04c78d1b81b5e6c400ce226e6be25e0dea8

SHA256
54c176976e1c56f13af90be9b8b678f17f36a943210a30274be6a777cf9a8dc4

SHA512
de14899cfaad4c312804a7fe4dcb3e9221f430088cb8bf5a9b941ac392a0bbad4e6ca974e258e34617bbffff3bf6490fa90d8c6921616f44186e267ddaa02971

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a65ab4f620efd5ba6c5e3cba8713e711

SHA1
f79ff4397a980106300bb447ab9cd764af47db08

SHA256
3964e81a3b4b582e570836837b90a0539e820886a35281b416e428e9bf25fd76

SHA512
90330661b0f38ca44d6bd13a7ea2ab08a4065ec4801695e5e7e0dea154b13ac8d9b2737e36ebe9a314d2501b5ef498d03c5617c87e36986e294c701182db41b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
a5be58ca6722aed6434be071a52deff6

SHA1
31637fa359ebdfa47aac37711fe072b500b0126e

SHA256
40a5391282ea575bf6588d9890cd2b600c2ab403722bbe773357fccb1ce69299

SHA512
e0ecf47f7d4ceaf3b46c482fde11ae580558c8d68f8a022a3ad70a2363e5776d63d84e240cc06f941425d950b58c884e210dae180fd74f5bfc3976dc6726daaf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
6bd955f1c891ed400b5498242f68e117

SHA1
c766cae476f31bc9113d375d7190916383372ac6

SHA256
5374b632b37e7241448ec53e8147b78f8022a4621731e530651d65944ff8dc07

SHA512
8a40db94976d109728b8a0dec5c5973cd09a69a8509f46529807bcf849b63ca8ec2f876cf335680a3466b01158badc79929f096b665afe5df4b8e2ef078eab2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
486d32068fdf4e0f88844097277a8f9e

SHA1
5231fe19928c3d1b11500cab5bfdafb4fee3d510

SHA256
e77eae944f7f2bb02fa4f569850b71d667559f654d1b7e8e43f51d25bc13a91d

SHA512
3f7bc267b8d1d796fc838a59d5006d7501c8ef8c0cc9ca9bb51bad2de823d38dbb4ae3d4a6cbb5d78cee618d5ed23c197e12586ecbf9fd472fc37d89753e3d7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
40c8e4e1979a2e657f0d70949ef682db

SHA1
94cc183e8d11b803b345ec280e8b737e4c0e48b7

SHA256
9e1eb44904c63006bf1b626d545f29774a438cce36eedc4fab9c62a759e87587

SHA512
cd6ea751864e2fd5a979c81cf6d31487ec4b84f62c9d5d5333b9b4fc3ff9c4f62efc4ede2d2acb83eb17283da9fe21ded1e71c3f914c2f757d3f9b4fdf1dbca9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
94d7225c24d6b2d13a911a35d822d4b1

SHA1
ad3350e3608d4c90d6e555b74451130b33af209f

SHA256
91c356c2e18fcd029d87ccd82e1d236b081fb5a15e6048c50ab9adcd10ef0aba

SHA512
8b2943758fcf01e84f234964ea47981ad03e6a2db3d4be4a0241688d3ae49cc1232bad59fdbda826466456fd268a0c10f0353b0ae864e45e91866e5be5b67ced

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
d6bf0dc733b5d87b0b1902fac091c365

SHA1
256740666611116673b809df2f2cbf0ea1cb4437

SHA256
e9d6362b2f1a5c27eec8bc464503eb4ccf49096de4ca7996d09303fb0483152c

SHA512
a64252b17354f150a67d9ac7fd5bb2e4585c616a7b8e461b8002381b0f459bd94a0ccafd2d71dcde470f818d857f59679daebd7064663d2b2467d13afba84188

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
53adbd040458cbf8ee0e7e4e648f9c16

SHA1
60fe8164bf90ce49c4693b675362adf70e148f25

SHA256
b957b145434a13075183f5573ef649d0370c546458e93c6b3cf88a3a09a5f8d8

SHA512
1b4c2efeaca2066c8bd6339b03b9ba70ca74e2c5cab35a25745278e54350081a7b14f602ff73940c1e7b88a8ccd302d0bcdd87cc5c7030b3d032a00766b12f05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a6ed0e458207e4bc5d932d60678a8150

SHA1
739a070961a12666cf3d708d44bfea9d3eb86bfd

SHA256
8c7637df0907272fc0267021f6af189609ec7ec1d0f674bff2d3d04bb2104241

SHA512
ea13de8fa3d0e4563992a162ca9fb7dfea2d307470b1b93ddcc746433ce266379fe15ec8a7ae7db2688b2aeb5f4dc230f6484eaf25e6be20162d0ce59b1ba089

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c1eb0cde2406b6af565f825dcd492589d40ab644\739c36b0-015a-4a2c-ae8f-0c8619246b0f\index-dir\the-real-index

Filesize
5KB

MD5
167775a48c9bc5d920493977eb20f2fe

SHA1
1865a54afe7102ad19034f14ae2164dab53662a4

SHA256
69f6f701ca4d7ea14401d36006a3f536655ec5829e61ba1d152b3771a37ce0c0

SHA512
3181e17c0bc868a084e80dbcae0e37972a84195bfa926ce2e8959bbcdb4ae9763be383f7b005905120d729fc360b0116aa27be57cfe2afad489d7042d2cfb810

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c1eb0cde2406b6af565f825dcd492589d40ab644\739c36b0-015a-4a2c-ae8f-0c8619246b0f\index-dir\the-real-index~RFe58d8d7.TMP

Filesize
48B

MD5
d2851c857dc11798350767fbee09dd00

SHA1
249033abf6050a8628c47393c7778392496f14fc

SHA256
132842430896883c9f74a01d23ba36d88b44d1acdaf86b5ca7777ee991fc07db

SHA512
df2f9b0ada259f1c96b30d4fe0fe5b6ef7412466c7dd076a8a5ff65da96ee4b51730b5e6aa23d6cbf79c663471d707fb7cddc8c50f5dd27cda01d7f286de760b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c1eb0cde2406b6af565f825dcd492589d40ab644\index.txt

Filesize
93B

MD5
239bac81421f1fc47946dbaa6bf107f1

SHA1
d02479707deefd0e95a250fcdb44fb9d64649fc4

SHA256
47f7609802071238f00a869a57a072c7c053b209491ec7b2db3b59f8a796e782

SHA512
3b2df1e963711d4aff146a71840e4fcdf90d76e42a010eb3b95b16823d4a46f1c3028b548fda173663e1d12cb91ed4cb1faf0e53128d2947686364900349cf64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c1eb0cde2406b6af565f825dcd492589d40ab644\index.txt

Filesize
89B

MD5
b0316df3465fee30a70601797786743d

SHA1
22964a368988c55f5f9ae4e57fa9170deadbd9eb

SHA256
7ac70e7add0e401bd7f6e6f76a5c6109edeee4e488117b6152572ab718e1a6b9

SHA512
37ec53f2375e4e4764857a77f8cf9090c820747285fff096ce174ebcf45d6494d48b2efefd6241b099e2b991c3e6c25717e31ac5305632ae192bec7ba55101f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
5295e47fe151e0fd8f9a8ce3059a3486

SHA1
67ec22dad2489ca1ac6f7fb30661ae4565e4660e

SHA256
fea88633e2999362274bdbd6d0ef8f2cbd43015436ddbc335c89f167b51ae553

SHA512
f555d3b5a45fd6b376052a0908f3af3e0f953d1b44ae2bc85ad915a02b271be48d2785672b23d56f5156189bbe97b9da29802d34b95ac5fa5966931fba603408

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe585530.TMP

Filesize
48B

MD5
389a0e1766a1226bd1cd5e249274aeab

SHA1
a4e2e0a41aca2467aa0115540a0849c6b5efeb88

SHA256
b7dcefc917a555b5500684ec6a1d59e15bef976a4ec8046bdc4d674c776ef29c

SHA512
ba53aca5104e4262a6d42a7b2790730b47b8e6a42685d9b77225f4e51903fab9179d3d1383b877a66918ecba1f3bff38ebb585c3c1937467b602000ea84c074d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2b71102122a8c71b64ea54890bcb792a

SHA1
57a180826542adf12912ba17e99eac07f07c2b25

SHA256
a1a135e9d1b827d943d073f729484ca2ed6ee49c10727af3ceb7892313db8242

SHA512
ab4e9d2da97b1fd44b305dc9ad6268c004ef1d6e27e8b6abb379ba00c459d91ae786034d1dfd9e4de9f9e467d2a05f4fc036722a0e449691cecf58261ac1c01a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
d68f5bdb560df4f10870743cf204060a

SHA1
fb3a0b8db157ce4e889ef1f71819a38fa7ea3489

SHA256
857542b3bbea3cadf8a71ab9a049c6f63f9d128251e50b79c3a0f4833e33a4f4

SHA512
6528e9f14c1a5ea13e778578fc9dac6c1397c3eef4cfa26d5cc71b7a1625407972fdcc8848262c4d74a6a38657212ec7ca557a88951edbfb50a6419c5f5ce106

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
e50ef61f47167822938004ad4b218202

SHA1
9ae4244f05a5a1d3e76bdcfe8ba015ea725629c7

SHA256
7eb86760d17e27f6de51c5a1a2da499f2c8fce1c42229e2b535ed06c6aa43636

SHA512
541fda88120e307cba773e0141ee8027191c479f778a508938f1b79dbeac5327a0e5679cabe23ea00fd8449d344b9076cab32a3cb514ef54fadb2add8c7ae5d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
6e166682fec24ee28622d949f46056f7

SHA1
6429ae1369fa940cb956a262b6388b2f05cd6c14

SHA256
975b18a65d1d97fb33d849a21e483b312aa6b17aadfee59dee1d5cc8b0442d7d

SHA512
ca73f642b30ba18aeba80241b130762671561761a190b6d7077e02a442aad33568c636dfb61833667590126691ce65c419d3b90b367081fda803e108954ee15a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
8d43f5f5d8b293c3c83796cea99f0f09

SHA1
2252e9785685c88702dc278954742a3e4d0f6868

SHA256
90161c063cbfabd659cfb336c11e203eb545518e5b09ea7ca3f9963cd9368023

SHA512
54fcec503afcfb6fec1c247090e82fcc831c04b6bd337053bc16afa01f2907a0bdd0f49dfd2561204f6670530fe0fce0ed443d0ea7bbda099ae5960d28707a5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
c52a12bfc5bc28e1f610e4b2c0dd5f58

SHA1
688f1712bd0ba59b2d398bf50164e68810212477

SHA256
09b34c85e5d9275fbb0efe358665b42c1c3508200fcb71a7b9a6fb8140e3c36d

SHA512
3b1f0764eebdcb6d4cd600145e64469610e5fc7540d86bb5310d55694a626df3664d04ea62406c8a5b8fea62b3452628fd97d06644d560c7478c1f55223aa25a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
ab0d15db34e51d6bfa9e9e89b5df98a7

SHA1
16c9e3042ecb61ce2e42e192a7cb7e32abf187d8

SHA256
c1101d89920eaad02037031192cc987619e42afe3caca5ce02f4f4203a2bac9a

SHA512
0fa36b8055ace4d381440c4ff5ef53aa2ee5e45478ec9e15db02cb34969a80e4241944fd42d4d258d17a720f7e3f1544137be8ffec5c75eadea36e7a9a2e3341

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
363aa1e00bc63e4df11399727eb07511

SHA1
d3927a844dcd30da84c2c64e848d081d503b1b00

SHA256
e560960a6b3b9e5aefbc8058deb310b61854be0e628d51ba90d16b3cffd19a3b

SHA512
6996be43368f9614a340d41bdd6921947a43988f0e00ecbc4066c4c6ef578cb078d07aed1dae308acb3c1d1cac7de696e5d612e87cb4dae8ad77bb8eda577374

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
f333b868e0e5dacd65e8bea536bca960

SHA1
3fee972c6875004115788a27926c1c51c6e12fd6

SHA256
ff63b2b21683d4ca23eab5e4e33a6af7030a060ac5ad45d6234938cbd65436c5

SHA512
6ab3d9fa1d22a8abfdf3ea68f94065b7efb7c92c9986dc2f3af1d86e61c95c9d29335828ad6f96cdcfb00d27158d1be8c92b74fb5298d1317e0f7cae06f1a64f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581cba.TMP

Filesize
204B

MD5
fdd6935e2110b5586d59b1b82e350639

SHA1
d404b5f547587313735200531b1ca6ba9924b5e8

SHA256
e909ea6f18311fdea5be06c83ebe86cb5dc10e532ed37ef7a8c2dc5b66ee648f

SHA512
94b51955dd115bf56a3fc0dcbf5addbb3b95f795b707bd4007829847e6152a48a70af7b72d5f22d781ab692f4a8d126136062baa92a81ef2a86b7f2b189146e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b0b48b65762e8aec2d8381965bc606aa

SHA1
4e67f0cdbc545e8494d82317119ab8eefddacd78

SHA256
957ec54454c5431d6c605b33ffe1897b95b85abda257c1efeae133c596248d73

SHA512
8d1c7084aca51b61e589cbd618e354201874b444d8fd0758737b5fc0434580b69e04b7184ba058230942d161404acef68f1c1a5a50317e8c7258081f7e90b083

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
031ff661730f8f064d7220d4ab624a3c

SHA1
d60d98c1f4d30d9ebcf1735894312efcc066c1f4

SHA256
d2c85c79b0e3ae8df22f06ed68c7144cacfedefa839db9318f7a6fd401a5fd26

SHA512
9553e6ed319e547680394afe52a6340a2735151ff4d549be18ff5bf9e2bf680ae736316eced11a2a1b6ab99ebd0bd9e98fdeb5cadcc9b9a47f9f48ec281d604b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ilkdt.exe

Filesize
191KB

MD5
e004a568b841c74855f1a8a5d43096c7

SHA1
b90fd74593ae9b5a48cb165b6d7602507e1aeca4

SHA256
d49013d6be0f0e727c0b53bce1d3fed00656c7a2836ceef0a9d4cb816a5878db

SHA512
402dd4d4c57fb6f5c7a531b7210a897dfe41d68df99ae4d605944f6e5b2cecaafa3fe27562fe45e7e216a7c9e29e63139d4382310b41f04a35ad56115fbed2af

Download Submit
C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe

Filesize
316KB

MD5
675d9e9ab252981f2f919cf914d9681d

SHA1
7485f5c9da283475136df7fa8b62756efbb5dd17

SHA256
0f055835332ef8e368185ae461e7c9eacdeb3d600ea550d605b09a20e0856e2d

SHA512
9dd936705fd43ebe8be17fcf77173eaaf16046f5880f8fe48fc68ded91ef6202ba65c605980bd2e330d2c7f463f772750a1bd96246fffdc9cb6bf8e1b00a2ccb

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe

Filesize
42KB

MD5
d499e979a50c958f1a67f0e2a28af43d

SHA1
1e5fa0824554c31f19ce01a51edb9bed86f67cf0

SHA256
bc3d545c541e42420ce2c2eabc7e5afab32c869a1adb20adb11735957d0d0b0e

SHA512
668047f178d82bebefeb8c2e7731d34ff24dc755dacd3362b43d8b44c6b148fc51af0d0ab2d0a67f0344ab6158b883fe568e4eeb0e34152108735574f0e1e763

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe

Filesize
2.7MB

MD5
868454a627021586c4327ef3a8afb2ee

SHA1
4e265903660706c1d244937ec89f955968e415fb

SHA256
7ae2b6e6b062a4728068c97a0246f7772734e0d095aeada55bbce812bf3df796

SHA512
ba8da083f24cd49e4e487564d1a0f9a361b550f791388fba6823d246d59747fae53ff4abece66709b1a2dd1159770225d0cb0dd3be49958fc811713654b2286e

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe

Filesize
2.4MB

MD5
4124c8e0b6cef8bb1a478b8229a90fc4

SHA1
c68ea118ee49b3ba91f94c9eb8b636b603808736

SHA256
0d08508384c34a375fb6d20b608764c5e3810f390130bb4c188634d4d8bab7e8

SHA512
726802b4f1cf3962c2b6390162d6afdb9c7789859033d4d92bac57fef7cdccf7482e7426372cfacce086a93d0de6ac837ea16cc685a388f3be6c12e5b79126bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI18162\VCRUNTIME140.dll

Filesize
116KB

MD5
be8dbe2dc77ebe7f88f910c61aec691a

SHA1
a19f08bb2b1c1de5bb61daf9f2304531321e0e40

SHA256
4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

SHA512
0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI18162\_bz2.pyd

Filesize
82KB

MD5
90f58f625a6655f80c35532a087a0319

SHA1
d4a7834201bd796dc786b0eb923f8ec5d60f719b

SHA256
bd8621fcc901fa1de3961d93184f61ea71068c436794af2a4449738ccf949946

SHA512
b5bb1ecc195700ad7bea5b025503edd3770b1f845f9beee4b067235c4e63496d6e0b19bdd2a42a1b6591d1131a2dc9f627b2ae8036e294300bb6983ecd644dc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI18162\_decimal.pyd

Filesize
247KB

MD5
f78f9855d2a7ca940b6be51d68b80bf2

SHA1
fd8af3dbd7b0ea3de2274517c74186cb7cd81a05

SHA256
d4ae192bbd4627fc9487a2c1cd9869d1b461c20cfd338194e87f5cf882bbed12

SHA512
6b68c434a6f8c436d890d3c1229d332bd878e5777c421799f84d79679e998b95d2d4a013b09f50c5de4c6a85fcceb796f3c486e36a10cbac509a0da8d8102b18

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI18162\_hashlib.pyd

Filesize
64KB

MD5
8baeb2bd6e52ba38f445ef71ef43a6b8

SHA1
4132f9cd06343ef8b5b60dc8a62be049aa3270c2

SHA256
6c50c9801a5caf0bb52b384f9a0d5a4aa182ca835f293a39e8999cf6edf2f087

SHA512
804a4e19ea622646cea9e0f8c1e284b7f2d02f3620199fa6930dbdadc654fa137c1e12757f87c3a1a71ceff9244aa2f598ee70d345469ca32a0400563fe3aa65

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI18162\_lzma.pyd

Filesize
155KB

MD5
cf8de1137f36141afd9ff7c52a3264ee

SHA1
afde95a1d7a545d913387624ef48c60f23cf4a3f

SHA256
22d10e2d6ad3e3ed3c49eb79ab69a81aaa9d16aeca7f948da2fe80877f106c16

SHA512
821985ff5bc421bd16b2fa5f77f1f4bf8472d0d1564bc5768e4dbe866ec52865a98356bb3ef23a380058acd0a25cd5a40a1e0dae479f15863e48c4482c89a03f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI18162\_socket.pyd

Filesize
81KB

MD5
439b3ad279befa65bb40ecebddd6228b

SHA1
d3ea91ae7cad9e1ebec11c5d0517132bbc14491e

SHA256
24017d664af20ee3b89514539345caac83eca34825fcf066a23e8a4c99f73e6d

SHA512
a335e1963bb21b34b21aef6b0b14ba8908a5343b88f65294618e029e3d4d0143ea978a5fd76d2df13a918ffab1e2d7143f5a1a91a35e0cc1145809b15af273bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI18162\base_library.zip

Filesize
1.3MB

MD5
44db87e9a433afe94098d3073d1c86d7

SHA1
24cc76d6553563f4d739c9e91a541482f4f83e05

SHA256
2b8b36bd4b1b0ee0599e5d519a91d35d70f03cc09270921630168a386b60ac71

SHA512
55bc2961c0bca42ef6fb4732ec25ef7d7d2ec47c7fb96d8819dd2daa32d990000b326808ae4a03143d6ff2144416e218395cccf8edaa774783234ec7501db611

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI18162\libcrypto-3.dll

Filesize
1.1MB

MD5
fcce7072c6071e1ba4f07242aa92a6e9

SHA1
e2714eeb183e425e7026daebef8d97de5296a44a

SHA256
4215286d6471cd5ee61dc161f5f6547d31eb778f2bb497436a2c0aa1d00fabc5

SHA512
d227967d74fc5071980fa6201f8c1337dd73655690e2a2ddb8c882634859851defb4bfa8cfb5298a81c7d7f78264db43f3b1784ae24026e72e6a12e5b6c133a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI18162\python312.dll

Filesize
2.4MB

MD5
a0aa01d93053d105c4b47d0432d6c27f

SHA1
0d044036481fe65ddbfba4cc18cbf5c3c048529d

SHA256
4009841e586ebcaff807b9b5de41c15aaacf0852836aaf9ac48b7295bb2b2b9a

SHA512
756df1d42c92da4ff72e88bfc5a6c54ee4bcd83b8c2e80acfc9da1efb03b467c3376b605a0cdd9f79bda7d62f273e5dba832cf60eff16da0ce3da699a41a4d96

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI18162\python312.dll

Filesize
2.0MB

MD5
94e0165656b8a06a54251a1b13bdb7e3

SHA1
c019814e30138139f0846089ac3fca4b9cfafa54

SHA256
211a32ee3f9f4a8178eb0e029a390a47190e6dae6d85e6c605186a55d3d69e66

SHA512
16194acdaf8b23f94ead42caad442a8ca902f7811b2b55386dcdb263061885e7a514bdbe86cc0faec791a936bc7ec7bc6872b9c37648f3764af5b24c3d00db6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI18162\select.pyd

Filesize
29KB

MD5
e1604afe8244e1ce4c316c64ea3aa173

SHA1
99704d2c0fa2687997381b65ff3b1b7194220a73

SHA256
74cca85600e7c17ea6532b54842e26d3cae9181287cdf5a4a3c50af4dab785e5

SHA512
7bf35b1a9da9f1660f238c2959b3693b7d9d2da40cf42c6f9eba2164b73047340d0adff8995049a2fe14e149eba05a5974eee153badd9e8450f961207f0b3d42

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI18162\unicodedata.pyd

Filesize
1.1MB

MD5
fc47b9e23ddf2c128e3569a622868dbe

SHA1
2814643b70847b496cbda990f6442d8ff4f0cb09

SHA256
2a50d629895a05b10a262acf333e7a4a31db5cb035b70d14d1a4be1c3e27d309

SHA512
7c08683820498fdff5f1703db4ad94ad15f2aa877d044eddc4b54d90e7dc162f48b22828cd577c9bb1b56f7c11f777f9785a9da1867bf8c0f2b6e75dc57c3f53

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dohwduxs.014.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpCB6E.tmp

Filesize
1KB

MD5
7f673f709ab0e7278e38f0fd8e745cd4

SHA1
ac504108a274b7051e3b477bcd51c9d1a4a01c2c

SHA256
da5ab3278aaa04fbd51272a617aef9b903ca53c358fac48fc0f558e257e063a4

SHA512
e932ccbd9d3ec6ee129f0dab82710904b84e657532c5b623d3c7b3b4ce45732caf8ff5d7b39095cf99ecf97d4e40dd9d755eb2b89c8ede629b287c29e41d1132

Download Submit
C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe

Filesize
2.2MB

MD5
260665eac56899955967b64960f2c89f

SHA1
2fa1bf2cdba575b0b93b17ca0aaab06bd9b29514

SHA256
8b643648bb644e96ce6aa64f13866ec5bd7ceacea823e4846fe2e2cb2d4d3a40

SHA512
17df97102047a45861787aa06ee1d84beda0b00755bb8ed948210667e43c65c299265aed43cce91ec77c536f5e6388d664285725ac335b4782784b329dc850bc

Download Submit
C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe

Filesize
6.0MB

MD5
cd92a6b2c6926ed10d52ec965493874f

SHA1
e136e6f27f72180c364bcaf7c3a65eafec57e386

SHA256
8752718c7699e18dce3ebcb021c97d346632ca605f5cb1d9b76446738937f0b4

SHA512
67ed16d6638a1108620b205b9c475f5a367ac02fb0796d4f530eed6e97524fa980b85c5ba72d331dae1d7c4d6a2456e704940c0e4872150eae590bbaa9a6aa77

Download Submit
C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe

Filesize
3.3MB

MD5
8d2e5e63d9b951d572b43e127bde0cbc

SHA1
681ec4de267b7c1c6528dd5247418fa4a40d6221

SHA256
8d455b65ca0f896927d3bcffc2e58399695d166877e77be89cb88cd90bdf2f04

SHA512
12251d247452c81534f0934c082907ff02bdec9d8e701bf62874b94031bcdadaa94ddfc3a7af72218f73799082cf6aa3b52e7bff97c26a279fb6e7aa1427ab3e

Download Submit
C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe

Filesize
2.3MB

MD5
97e6429427c46c8d68a2ad55737105da

SHA1
4fbe01360cbf6d798fda69ab9d20a57132b27bfd

SHA256
031d6426cfaba010637ab88243be965af33d3baafc90fc37333ef30f4fe3d0b3

SHA512
fb67fdaa4947b1985766351ef3e5fc9795b1d67f815857917f153dc0750626205429339e5ea3c1089d9059a4c2f26f8e3a919ba71b66a15d46e4e8610b074435

Download Submit
\??\pipe\LOCAL\crashpad_3324_KGCODFASNBBKGBCU

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2148-1894-0x0000027ECB780000-0x0000027ECB78A000-memory.dmp

Filesize
40KB

Download
memory/2148-1864-0x0000027ECB5E0000-0x0000027ECB5EA000-memory.dmp

Filesize
40KB

Download
memory/2148-1857-0x0000027ECB500000-0x0000027ECB51C000-memory.dmp

Filesize
112KB

Download
memory/2148-1897-0x0000027ECB1D0000-0x0000027ECB1E0000-memory.dmp

Filesize
64KB

Download
memory/2148-1903-0x00007FFC5BDE0000-0x00007FFC5C8A1000-memory.dmp

Filesize
10.8MB

Download
memory/2148-1859-0x00007FF468C70000-0x00007FF468C80000-memory.dmp

Filesize
64KB

Download
memory/2148-1844-0x0000027ECB1D0000-0x0000027ECB1E0000-memory.dmp

Filesize
64KB

Download
memory/2148-1890-0x0000027ECB770000-0x0000027ECB776000-memory.dmp

Filesize
24KB

Download
memory/2148-1889-0x0000027ECB740000-0x0000027ECB748000-memory.dmp

Filesize
32KB

Download
memory/2148-1888-0x0000027ECB790000-0x0000027ECB7AA000-memory.dmp

Filesize
104KB

Download
memory/2148-1880-0x0000027ECB730000-0x0000027ECB73A000-memory.dmp

Filesize
40KB

Download
memory/2148-1839-0x00007FFC5BDE0000-0x00007FFC5C8A1000-memory.dmp

Filesize
10.8MB

Download
memory/2148-1865-0x0000027ECB750000-0x0000027ECB76C000-memory.dmp

Filesize
112KB

Download
memory/2148-1845-0x0000027ECB1D0000-0x0000027ECB1E0000-memory.dmp

Filesize
64KB

Download
memory/2148-1861-0x0000027ECB520000-0x0000027ECB5D5000-memory.dmp

Filesize
724KB

Download
memory/2148-1860-0x0000027ECB1D0000-0x0000027ECB1E0000-memory.dmp

Filesize
64KB

Download
memory/2964-36-0x0000000000EE0000-0x0000000000EF0000-memory.dmp

Filesize
64KB

Download
memory/2964-97-0x0000000073CF0000-0x00000000744A0000-memory.dmp

Filesize
7.7MB

Download
memory/2964-57-0x0000000073CF0000-0x00000000744A0000-memory.dmp

Filesize
7.7MB

Download
memory/4012-198-0x0000000070D40000-0x0000000070D8C000-memory.dmp

Filesize
304KB

Download
memory/4012-56-0x0000000005580000-0x0000000005BA8000-memory.dmp

Filesize
6.2MB

Download
memory/4012-190-0x0000000007210000-0x0000000007242000-memory.dmp

Filesize
200KB

Download
memory/4012-35-0x0000000002970000-0x00000000029A6000-memory.dmp

Filesize
216KB

Download
memory/4012-124-0x0000000005DD0000-0x0000000005E36000-memory.dmp

Filesize
408KB

Download
memory/4012-143-0x0000000006340000-0x000000000638C000-memory.dmp

Filesize
304KB

Download
memory/4012-212-0x0000000002E80000-0x0000000002E90000-memory.dmp

Filesize
64KB

Download
memory/4012-220-0x0000000007260000-0x0000000007303000-memory.dmp

Filesize
652KB

Download
memory/4012-139-0x0000000006290000-0x00000000062AE000-memory.dmp

Filesize
120KB

Download
memory/4012-122-0x0000000005D30000-0x0000000005D96000-memory.dmp

Filesize
408KB

Download
memory/4012-221-0x0000000007C00000-0x000000000827A000-memory.dmp

Filesize
6.5MB

Download
memory/4012-222-0x00000000075C0000-0x00000000075DA000-memory.dmp

Filesize
104KB

Download
memory/4012-211-0x00000000071F0000-0x000000000720E000-memory.dmp

Filesize
120KB

Download
memory/4012-50-0x0000000073CF0000-0x00000000744A0000-memory.dmp

Filesize
7.7MB

Download
memory/4012-192-0x000000007FD50000-0x000000007FD60000-memory.dmp

Filesize
64KB

Download
memory/4012-109-0x00000000052D0000-0x00000000052F2000-memory.dmp

Filesize
136KB

Download
memory/4012-60-0x0000000002E80000-0x0000000002E90000-memory.dmp

Filesize
64KB

Download
memory/4012-227-0x0000000007630000-0x000000000763A000-memory.dmp

Filesize
40KB

Download
memory/4012-233-0x0000000007860000-0x00000000078F6000-memory.dmp

Filesize
600KB

Download
memory/4012-236-0x00000000077E0000-0x00000000077F1000-memory.dmp

Filesize
68KB

Download
memory/4012-268-0x0000000007820000-0x000000000782E000-memory.dmp

Filesize
56KB

Download
memory/4012-274-0x0000000007830000-0x0000000007844000-memory.dmp

Filesize
80KB

Download
memory/4012-286-0x0000000007920000-0x000000000793A000-memory.dmp

Filesize
104KB

Download
memory/4012-291-0x0000000007900000-0x0000000007908000-memory.dmp

Filesize
32KB

Download
memory/4012-127-0x0000000005E40000-0x0000000006194000-memory.dmp

Filesize
3.3MB

Download
memory/4012-332-0x0000000073CF0000-0x00000000744A0000-memory.dmp

Filesize
7.7MB

Download
memory/4012-73-0x0000000002E80000-0x0000000002E90000-memory.dmp

Filesize
64KB

Download
memory/4232-123-0x0000000002C60000-0x0000000002CC5000-memory.dmp

Filesize
404KB

Download
memory/4232-153-0x0000000002C60000-0x0000000002CC5000-memory.dmp

Filesize
404KB

Download
memory/4232-224-0x0000000002C60000-0x0000000002CC5000-memory.dmp

Filesize
404KB

Download
memory/4232-201-0x0000000002C60000-0x0000000002CC5000-memory.dmp

Filesize
404KB

Download
memory/4232-219-0x0000000002C60000-0x0000000002CC5000-memory.dmp

Filesize
404KB

Download
memory/4232-191-0x0000000002C60000-0x0000000002CC5000-memory.dmp

Filesize
404KB

Download
memory/4232-183-0x0000000002C60000-0x0000000002CC5000-memory.dmp

Filesize
404KB

Download
memory/4232-181-0x0000000002C60000-0x0000000002CC5000-memory.dmp

Filesize
404KB

Download
memory/4232-28-0x0000000000840000-0x0000000000876000-memory.dmp

Filesize
216KB

Download
memory/4232-179-0x0000000002C60000-0x0000000002CC5000-memory.dmp

Filesize
404KB

Download
memory/4232-177-0x0000000002C60000-0x0000000002CC5000-memory.dmp

Filesize
404KB

Download
memory/4232-33-0x0000000073CF0000-0x00000000744A0000-memory.dmp

Filesize
7.7MB

Download
memory/4232-53-0x0000000002C60000-0x0000000002CCC000-memory.dmp

Filesize
432KB

Download
memory/4232-59-0x0000000002C60000-0x0000000002CC5000-memory.dmp

Filesize
404KB

Download
memory/4232-58-0x0000000002C60000-0x0000000002CC5000-memory.dmp

Filesize
404KB

Download
memory/4232-62-0x0000000002C60000-0x0000000002CC5000-memory.dmp

Filesize
404KB

Download
memory/4232-175-0x0000000002C60000-0x0000000002CC5000-memory.dmp

Filesize
404KB

Download
memory/4232-168-0x0000000002C60000-0x0000000002CC5000-memory.dmp

Filesize
404KB

Download
memory/4232-166-0x0000000002C60000-0x0000000002CC5000-memory.dmp

Filesize
404KB

Download
memory/4232-164-0x0000000002C60000-0x0000000002CC5000-memory.dmp

Filesize
404KB

Download
memory/4232-84-0x0000000002CD0000-0x0000000002CE0000-memory.dmp

Filesize
64KB

Download
memory/4232-162-0x0000000002C60000-0x0000000002CC5000-memory.dmp

Filesize
404KB

Download
memory/4232-85-0x0000000002C60000-0x0000000002CC5000-memory.dmp

Filesize
404KB

Download
memory/4232-159-0x0000000002C60000-0x0000000002CC5000-memory.dmp

Filesize
404KB

Download
memory/4232-157-0x0000000002C60000-0x0000000002CC5000-memory.dmp

Filesize
404KB

Download
memory/4232-1786-0x0000000073CF0000-0x00000000744A0000-memory.dmp

Filesize
7.7MB

Download
memory/4232-155-0x0000000002C60000-0x0000000002CC5000-memory.dmp

Filesize
404KB

Download
memory/4232-151-0x0000000002C60000-0x0000000002CC5000-memory.dmp

Filesize
404KB

Download
memory/4232-65-0x0000000002C60000-0x0000000002CC5000-memory.dmp

Filesize
404KB

Download
memory/4232-149-0x0000000002C60000-0x0000000002CC5000-memory.dmp

Filesize
404KB

Download
memory/4232-140-0x0000000002C60000-0x0000000002CC5000-memory.dmp

Filesize
404KB

Download
memory/4232-147-0x0000000002C60000-0x0000000002CC5000-memory.dmp

Filesize
404KB

Download
memory/4232-95-0x0000000002C60000-0x0000000002CC5000-memory.dmp

Filesize
404KB

Download
memory/4232-145-0x0000000002C60000-0x0000000002CC5000-memory.dmp

Filesize
404KB

Download
memory/4232-126-0x0000000002C60000-0x0000000002CC5000-memory.dmp

Filesize
404KB

Download
memory/4232-102-0x0000000002C60000-0x0000000002CC5000-memory.dmp

Filesize
404KB

Download
memory/4232-120-0x0000000002C60000-0x0000000002CC5000-memory.dmp

Filesize
404KB

Download
memory/4232-108-0x0000000002C60000-0x0000000002CC5000-memory.dmp

Filesize
404KB

Download
memory/4416-1830-0x00007FFC5BDE0000-0x00007FFC5C8A1000-memory.dmp

Filesize
10.8MB

Download
memory/4416-1824-0x000002A6B09D0000-0x000002A6B09F2000-memory.dmp

Filesize
136KB

Download
memory/4416-1825-0x00007FFC5BDE0000-0x00007FFC5C8A1000-memory.dmp

Filesize
10.8MB

Download
memory/4416-1826-0x000002A6C8F80000-0x000002A6C8F90000-memory.dmp

Filesize
64KB

Download
memory/4416-1827-0x000002A6C8F80000-0x000002A6C8F90000-memory.dmp

Filesize
64KB

Download
memory/4772-55-0x00000238BA750000-0x00000238BA7A4000-memory.dmp

Filesize
336KB

Download
memory/4772-89-0x00000238D4DC0000-0x00000238D4DD0000-memory.dmp

Filesize
64KB

Download
memory/4772-64-0x00007FFC5E000000-0x00007FFC5EAC1000-memory.dmp

Filesize
10.8MB

Download
memory/4772-144-0x00007FFC5E000000-0x00007FFC5EAC1000-memory.dmp

Filesize
10.8MB

Download
memory/4788-101-0x00000000016E0000-0x00000000016F0000-memory.dmp

Filesize
64KB

Download
memory/4788-1858-0x0000000073CF0000-0x00000000744A0000-memory.dmp

Filesize
7.7MB

Download
memory/4788-96-0x0000000073CF0000-0x00000000744A0000-memory.dmp

Filesize
7.7MB

Download
memory/4788-2127-0x00000000016E0000-0x00000000016F0000-memory.dmp

Filesize
64KB

Download