growtopia | 571a330dfb82f72878d9ede8bdfc332544446a0160117bf37399c3b9ca0775e2

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
22/02/2024, 10:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RadiumExecutor.exe
Size 12.6MB
Sample240222-l9ff5agb74
SHA256 571a330dfb82f72878d9ede8bdfc332544446a0160117bf37399c3b9ca0775e2
MD5 7a17d34bac23e365863ea1da1e42e968
SHA1 b5ccab413899349d2821cc2798bce29f0118121f
SHA512 c021f26320c49c64831c676820d1bc7cb84ba3f49b798d4f858461eebc398a37d937de1d4cf214b973b8ac1cb693830894c4ae9b1bc7d62f2fd5d56b7d5ba4ac
SSDEEP 196608:MRvSjNRyzz9V4EAWzcNtYuZuT0ItZ/jBpOtwDc3rSlou2it3NaB+He+8:MRqjj+xV8acwWuNtZ/jetwc3SYihNqc
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

growtopia zgrat evasion persistence pyinstaller rat stealer

Malware Config

Extracted

Family

growtopia

https://discord.com/api/webhooks/1199763266872803338/8vedcXoMcyExhe1xhBm5f8ncmafWmOB3pkulE0l8g9Pel0t3ziyr2V51cLTVEjYsE4Rj

Signatures

Detect ZGRat V1 34 IoCs

resource	yara_rule
behavioral2/memory/4232-53-0x0000000002C60000-0x0000000002CCC000-memory.dmp	family_zgrat_v1
behavioral2/memory/4232-59-0x0000000002C60000-0x0000000002CC5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4232-58-0x0000000002C60000-0x0000000002CC5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4232-62-0x0000000002C60000-0x0000000002CC5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4232-85-0x0000000002C60000-0x0000000002CC5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4232-65-0x0000000002C60000-0x0000000002CC5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4232-95-0x0000000002C60000-0x0000000002CC5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4232-102-0x0000000002C60000-0x0000000002CC5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4232-108-0x0000000002C60000-0x0000000002CC5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4232-120-0x0000000002C60000-0x0000000002CC5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4232-123-0x0000000002C60000-0x0000000002CC5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4232-126-0x0000000002C60000-0x0000000002CC5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4232-145-0x0000000002C60000-0x0000000002CC5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4232-147-0x0000000002C60000-0x0000000002CC5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4232-140-0x0000000002C60000-0x0000000002CC5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4232-149-0x0000000002C60000-0x0000000002CC5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4232-151-0x0000000002C60000-0x0000000002CC5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4232-155-0x0000000002C60000-0x0000000002CC5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4232-153-0x0000000002C60000-0x0000000002CC5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4232-157-0x0000000002C60000-0x0000000002CC5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4232-159-0x0000000002C60000-0x0000000002CC5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4232-162-0x0000000002C60000-0x0000000002CC5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4232-164-0x0000000002C60000-0x0000000002CC5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4232-166-0x0000000002C60000-0x0000000002CC5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4232-168-0x0000000002C60000-0x0000000002CC5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4232-175-0x0000000002C60000-0x0000000002CC5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4232-177-0x0000000002C60000-0x0000000002CC5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4232-179-0x0000000002C60000-0x0000000002CC5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4232-181-0x0000000002C60000-0x0000000002CC5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4232-183-0x0000000002C60000-0x0000000002CC5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4232-191-0x0000000002C60000-0x0000000002CC5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4232-219-0x0000000002C60000-0x0000000002CC5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4232-201-0x0000000002C60000-0x0000000002CC5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4232-224-0x0000000002C60000-0x0000000002CC5000-memory.dmp	family_zgrat_v1

Growtopia
Growtopa is an opensource modular stealer written in C#.
stealer growtopia
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\Control Panel\International\Geo\Nation	RadiumExecutor.exe
Key value queried	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\Control Panel\International\Geo\Nation	WinErrorMgr.exe

Executes dropped EXE 8 IoCs

pid	Process
4232	Ilkdt.exe
2412	WinHostMgr.exe
2964	WinErrorMgr.exe
1816	KeyGeneratorI.exe
4772	Sahyui1337.exe
4788	WinErrorMgr.exe
2240	KeyGeneratorI.exe
1608	bauwrdgwodhv.exe

Loads dropped DLL 4 IoCs

pid	Process
2240	KeyGeneratorI.exe
2240	KeyGeneratorI.exe
2240	KeyGeneratorI.exe
2240	KeyGeneratorI.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
185	pastebin.com
21	discord.com
22	discord.com
183	pastebin.com

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
274	api.ipify.org
278	api.ipify.org
334	api.ipify.org

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MRT.exe	WinHostMgr.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	bauwrdgwodhv.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1608 set thread context of 5056	1608	bauwrdgwodhv.exe	173
PID 1608 set thread context of 3540	1608	bauwrdgwodhv.exe	178

Launches sc.exe 14 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4492	sc.exe
3448	sc.exe
4768	sc.exe
3748	sc.exe
4428	sc.exe
3780	sc.exe
2400	sc.exe
5056	sc.exe
4808	sc.exe
1680	sc.exe
852	sc.exe
3696	sc.exe
2596	sc.exe
2448	sc.exe

Detects Pyinstaller 4 IoCs

pyinstaller

resource	yara_rule
behavioral2/files/0x0006000000023255-38.dat	pyinstaller
behavioral2/files/0x0006000000023255-75.dat	pyinstaller
behavioral2/files/0x0006000000023255-98.dat	pyinstaller
behavioral2/files/0x0006000000023255-48.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
912	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 50 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-910440534-423636034-2318342392-1000\{B7354F7E-5C6D-405E-A4EE-285C6C7B623D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4772	Sahyui1337.exe
4772	Sahyui1337.exe
4012	powershell.exe
4012	powershell.exe
2664	msedge.exe
2664	msedge.exe
3324	msedge.exe
3324	msedge.exe
3048	identity_helper.exe
3048	identity_helper.exe
2412	WinHostMgr.exe
4416	powershell.exe
4416	powershell.exe
4416	powershell.exe
2412	WinHostMgr.exe
2412	WinHostMgr.exe
2412	WinHostMgr.exe
2412	WinHostMgr.exe
2412	WinHostMgr.exe
2412	WinHostMgr.exe
2412	WinHostMgr.exe
2412	WinHostMgr.exe
2412	WinHostMgr.exe
2412	WinHostMgr.exe
2412	WinHostMgr.exe
2412	WinHostMgr.exe
2412	WinHostMgr.exe
2412	WinHostMgr.exe
1608	bauwrdgwodhv.exe
2148	powershell.exe
2148	powershell.exe
2148	powershell.exe
1608	bauwrdgwodhv.exe
1608	bauwrdgwodhv.exe
1608	bauwrdgwodhv.exe
1608	bauwrdgwodhv.exe
1608	bauwrdgwodhv.exe
1608	bauwrdgwodhv.exe
1608	bauwrdgwodhv.exe
1608	bauwrdgwodhv.exe
1608	bauwrdgwodhv.exe
1608	bauwrdgwodhv.exe
1608	bauwrdgwodhv.exe
1608	bauwrdgwodhv.exe
3540	explorer.exe
3540	explorer.exe
3540	explorer.exe
3540	explorer.exe
3540	explorer.exe
3540	explorer.exe
3540	explorer.exe
3540	explorer.exe
3540	explorer.exe
3540	explorer.exe
3540	explorer.exe
3540	explorer.exe
3540	explorer.exe
3540	explorer.exe
3540	explorer.exe
3540	explorer.exe
3540	explorer.exe
3540	explorer.exe
3540	explorer.exe
3540	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	4772	Sahyui1337.exe
Token: SeDebugPrivilege	4232	Ilkdt.exe
Token: SeDebugPrivilege	4012	powershell.exe
Token: SeDebugPrivilege	4416	powershell.exe
Token: SeShutdownPrivilege	2248	powercfg.exe
Token: SeCreatePagefilePrivilege	2248	powercfg.exe
Token: SeShutdownPrivilege	3940	powercfg.exe
Token: SeCreatePagefilePrivilege	3940	powercfg.exe
Token: SeShutdownPrivilege	828	powercfg.exe
Token: SeCreatePagefilePrivilege	828	powercfg.exe
Token: SeShutdownPrivilege	944	powercfg.exe
Token: SeCreatePagefilePrivilege	944	powercfg.exe
Token: SeDebugPrivilege	2148	powershell.exe
Token: SeShutdownPrivilege	4424	powercfg.exe
Token: SeCreatePagefilePrivilege	4424	powercfg.exe
Token: SeShutdownPrivilege	2932	powercfg.exe
Token: SeCreatePagefilePrivilege	2932	powercfg.exe
Token: SeShutdownPrivilege	4376	powercfg.exe
Token: SeCreatePagefilePrivilege	4376	powercfg.exe
Token: SeShutdownPrivilege	3964	powercfg.exe
Token: SeCreatePagefilePrivilege	3964	powercfg.exe
Token: SeLockMemoryPrivilege	3540	explorer.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1616 wrote to memory of 4012	1616	RadiumExecutor.exe	89
PID 1616 wrote to memory of 4012	1616	RadiumExecutor.exe	89
PID 1616 wrote to memory of 4012	1616	RadiumExecutor.exe	89
PID 1616 wrote to memory of 4232	1616	RadiumExecutor.exe	91
PID 1616 wrote to memory of 4232	1616	RadiumExecutor.exe	91
PID 1616 wrote to memory of 4232	1616	RadiumExecutor.exe	91
PID 1616 wrote to memory of 2412	1616	RadiumExecutor.exe	92
PID 1616 wrote to memory of 2412	1616	RadiumExecutor.exe	92
PID 1616 wrote to memory of 2964	1616	RadiumExecutor.exe	93
PID 1616 wrote to memory of 2964	1616	RadiumExecutor.exe	93
PID 1616 wrote to memory of 2964	1616	RadiumExecutor.exe	93
PID 1616 wrote to memory of 1816	1616	RadiumExecutor.exe	94
PID 1616 wrote to memory of 1816	1616	RadiumExecutor.exe	94
PID 1616 wrote to memory of 4772	1616	RadiumExecutor.exe	96
PID 1616 wrote to memory of 4772	1616	RadiumExecutor.exe	96
PID 2964 wrote to memory of 4788	2964	WinErrorMgr.exe	97
PID 2964 wrote to memory of 4788	2964	WinErrorMgr.exe	97
PID 2964 wrote to memory of 4788	2964	WinErrorMgr.exe	97
PID 1816 wrote to memory of 2240	1816	KeyGeneratorI.exe	98
PID 1816 wrote to memory of 2240	1816	KeyGeneratorI.exe	98
PID 2240 wrote to memory of 3324	2240	KeyGeneratorI.exe	100
PID 2240 wrote to memory of 3324	2240	KeyGeneratorI.exe	100
PID 3324 wrote to memory of 1084	3324	msedge.exe	101
PID 3324 wrote to memory of 1084	3324	msedge.exe	101
PID 3324 wrote to memory of 1212	3324	msedge.exe	103
PID 3324 wrote to memory of 1212	3324	msedge.exe	103
PID 3324 wrote to memory of 1212	3324	msedge.exe	103
PID 3324 wrote to memory of 1212	3324	msedge.exe	103
PID 3324 wrote to memory of 1212	3324	msedge.exe	103
PID 3324 wrote to memory of 1212	3324	msedge.exe	103
PID 3324 wrote to memory of 1212	3324	msedge.exe	103
PID 3324 wrote to memory of 1212	3324	msedge.exe	103
PID 3324 wrote to memory of 1212	3324	msedge.exe	103
PID 3324 wrote to memory of 1212	3324	msedge.exe	103
PID 3324 wrote to memory of 1212	3324	msedge.exe	103
PID 3324 wrote to memory of 1212	3324	msedge.exe	103
PID 3324 wrote to memory of 1212	3324	msedge.exe	103
PID 3324 wrote to memory of 1212	3324	msedge.exe	103
PID 3324 wrote to memory of 1212	3324	msedge.exe	103
PID 3324 wrote to memory of 1212	3324	msedge.exe	103
PID 3324 wrote to memory of 1212	3324	msedge.exe	103
PID 3324 wrote to memory of 1212	3324	msedge.exe	103
PID 3324 wrote to memory of 1212	3324	msedge.exe	103
PID 3324 wrote to memory of 1212	3324	msedge.exe	103
PID 3324 wrote to memory of 1212	3324	msedge.exe	103
PID 3324 wrote to memory of 1212	3324	msedge.exe	103
PID 3324 wrote to memory of 1212	3324	msedge.exe	103
PID 3324 wrote to memory of 1212	3324	msedge.exe	103
PID 3324 wrote to memory of 1212	3324	msedge.exe	103
PID 3324 wrote to memory of 1212	3324	msedge.exe	103
PID 3324 wrote to memory of 1212	3324	msedge.exe	103
PID 3324 wrote to memory of 1212	3324	msedge.exe	103
PID 3324 wrote to memory of 1212	3324	msedge.exe	103
PID 3324 wrote to memory of 1212	3324	msedge.exe	103
PID 3324 wrote to memory of 1212	3324	msedge.exe	103
PID 3324 wrote to memory of 1212	3324	msedge.exe	103
PID 3324 wrote to memory of 1212	3324	msedge.exe	103
PID 3324 wrote to memory of 1212	3324	msedge.exe	103
PID 3324 wrote to memory of 1212	3324	msedge.exe	103
PID 3324 wrote to memory of 1212	3324	msedge.exe	103
PID 3324 wrote to memory of 1212	3324	msedge.exe	103
PID 3324 wrote to memory of 1212	3324	msedge.exe	103
PID 3324 wrote to memory of 1212	3324	msedge.exe	103
PID 3324 wrote to memory of 1212	3324	msedge.exe	103

C:\Users\Admin\AppData\Local\Temp\RadiumExecutor.exe
"C:\Users\Admin\AppData\Local\Temp\RadiumExecutor.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1616
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGcAawB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHQAdwBpACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHoAbQBnACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGEAagB0ACMAPgA="
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4012
- C:\Users\Admin\AppData\Local\Temp\Ilkdt.exe
  "C:\Users\Admin\AppData\Local\Temp\Ilkdt.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4232
- C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe
  "C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:2412
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4416
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:3780
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:4996
  - - C:\Windows\system32\wusa.exe
      wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      PID:3496
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:3696
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop wuauserv
    3⤵
    - Launches sc.exe
    PID:4492
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop bits
    3⤵
    - Launches sc.exe
    PID:2596
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop dosvc
    3⤵
    - Launches sc.exe
    PID:2400
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2248
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "GMDTJRUT"
    3⤵
    - Launches sc.exe
    PID:2448
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:944
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3940
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:828
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "GMDTJRUT" binpath= "C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:5056
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:3448
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "GMDTJRUT"
    3⤵
    - Launches sc.exe
    PID:4768
- C:\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe
  "C:\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2964
- - C:\Users\Admin\AppData\Local\Temp\XenoManager\WinErrorMgr.exe
    "C:\Users\Admin\AppData\Local\Temp\XenoManager\WinErrorMgr.exe"
    3⤵
    - Executes dropped EXE
    PID:4788
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /Create /TN "WindowsErrorHandler" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCB6E.tmp" /F
      4⤵
      Creates scheduled task(s)
      PID:912
- C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe
  "C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1816
- - C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe
    "C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://onepiecered.co/s?mH4q
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:3324
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc6da046f8,0x7ffc6da04708,0x7ffc6da04718
        5⤵
        
        PID:1084
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,12670109925277269492,10113469539476412616,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2664
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,12670109925277269492,10113469539476412616,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
        5⤵
        
        PID:1212
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12670109925277269492,10113469539476412616,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
        5⤵
        
        PID:1988
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12670109925277269492,10113469539476412616,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
        5⤵
        
        PID:4820
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,12670109925277269492,10113469539476412616,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2620 /prefetch:8
        5⤵
        
        PID:1384
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12670109925277269492,10113469539476412616,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4380 /prefetch:1
        5⤵
        
        PID:2204
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12670109925277269492,10113469539476412616,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:1
        5⤵
        
        PID:3424
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12670109925277269492,10113469539476412616,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
        5⤵
        
        PID:4932
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12670109925277269492,10113469539476412616,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
        5⤵
        
        PID:1464
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12670109925277269492,10113469539476412616,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4260 /prefetch:1
        5⤵
        
        PID:4884
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12670109925277269492,10113469539476412616,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
        5⤵
        
        PID:1976
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,12670109925277269492,10113469539476412616,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6020 /prefetch:8
        5⤵
        
        PID:2588
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,12670109925277269492,10113469539476412616,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6020 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3048
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12670109925277269492,10113469539476412616,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
        5⤵
        
        PID:1632
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12670109925277269492,10113469539476412616,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
        5⤵
        
        PID:4016
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12670109925277269492,10113469539476412616,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
        5⤵
        
        PID:1992
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12670109925277269492,10113469539476412616,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1
        5⤵
        
        PID:4016
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12670109925277269492,10113469539476412616,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
        5⤵
        
        PID:372
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12670109925277269492,10113469539476412616,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3540 /prefetch:1
        5⤵
        
        PID:3696
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2160,12670109925277269492,10113469539476412616,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5728 /prefetch:8
        5⤵
        Modifies registry class
        
        PID:2304
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2160,12670109925277269492,10113469539476412616,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3840 /prefetch:8
        5⤵
        
        PID:2100
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12670109925277269492,10113469539476412616,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
        5⤵
        
        PID:4432
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12670109925277269492,10113469539476412616,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3552 /prefetch:1
        5⤵
        
        PID:2304
- C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe
  "C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4772

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4016

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3272

C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe
C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:1608
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2148
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:4808
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  PID:4920
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:4492
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:3748
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:4428
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:1680
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:852
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:5056
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4424
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3964
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4376
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2932
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

bauwrdgwodhv.exe

Path C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe
Size 5.0MB
SHA256 047a7ca1b8848c1c0e3c0fcc6ece056390760b24580f27f6966b86b0c2a1042b
MD5 e222309197c5e633aa8e294ba4bdcd29
SHA1 52b3f89a3d2262bf603628093f6d1e71d9cc3820
SHA512 9eb37686e0cee9ec18d12a4edd37c8334d26650c74eae5b30231c2b0db1628d52848123c9348c3da306ec950b827ec0a56cdf43ee325a9e280022c68193d8503
SSDEEP 98304:vNsoCN7HENkGG3JqXwpKRyygqqFgcgSIqLaY6pCFyV:vNUN7pJHMR+Fgcg096pWm
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 54c176976e1c56f13af90be9b8b678f17f36a943210a30274be6a777cf9a8dc4
MD5 854f73d7b3f85bf181d2f2002afd17db
SHA1 53e5e04c78d1b81b5e6c400ce226e6be25e0dea8
SHA512 de14899cfaad4c312804a7fe4dcb3e9221f430088cb8bf5a9b941ac392a0bbad4e6ca974e258e34617bbffff3bf6490fa90d8c6921616f44186e267ddaa02971
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 3964e81a3b4b582e570836837b90a0539e820886a35281b416e428e9bf25fd76
MD5 a65ab4f620efd5ba6c5e3cba8713e711
SHA1 f79ff4397a980106300bb447ab9cd764af47db08
SHA512 90330661b0f38ca44d6bd13a7ea2ab08a4065ec4801695e5e7e0dea154b13ac8d9b2737e36ebe9a314d2501b5ef498d03c5617c87e36986e294c701182db41b9
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 40a5391282ea575bf6588d9890cd2b600c2ab403722bbe773357fccb1ce69299
MD5 a5be58ca6722aed6434be071a52deff6
SHA1 31637fa359ebdfa47aac37711fe072b500b0126e
SHA512 e0ecf47f7d4ceaf3b46c482fde11ae580558c8d68f8a022a3ad70a2363e5776d63d84e240cc06f941425d950b58c884e210dae180fd74f5bfc3976dc6726daaf
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 5KB
SHA256 5374b632b37e7241448ec53e8147b78f8022a4621731e530651d65944ff8dc07
MD5 6bd955f1c891ed400b5498242f68e117
SHA1 c766cae476f31bc9113d375d7190916383372ac6
SHA512 8a40db94976d109728b8a0dec5c5973cd09a69a8509f46529807bcf849b63ca8ec2f876cf335680a3466b01158badc79929f096b665afe5df4b8e2ef078eab2b
SSDEEP 96:+NPE64YZ5vM9+uR6fFxaZCOi+D6GSVRjcG1spjOGwfofXyCib666zKeBCgNXxN3b:+NPE64YZ5vM9+uR6fFxaZRTD6GcRjcYK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 e77eae944f7f2bb02fa4f569850b71d667559f654d1b7e8e43f51d25bc13a91d
MD5 486d32068fdf4e0f88844097277a8f9e
SHA1 5231fe19928c3d1b11500cab5bfdafb4fee3d510
SHA512 3f7bc267b8d1d796fc838a59d5006d7501c8ef8c0cc9ca9bb51bad2de823d38dbb4ae3d4a6cbb5d78cee618d5ed23c197e12586ecbf9fd472fc37d89753e3d7a
SSDEEP 96:n+jkPSxm/FQYmqm1dm2ywpvWMoiVmdeHlQ16bDUqUWQyV+VD7ziEwb:n+jkPPO5Tm2yGWMXl9bDUqrt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 9e1eb44904c63006bf1b626d545f29774a438cce36eedc4fab9c62a759e87587
MD5 40c8e4e1979a2e657f0d70949ef682db
SHA1 94cc183e8d11b803b345ec280e8b737e4c0e48b7
SHA512 cd6ea751864e2fd5a979c81cf6d31487ec4b84f62c9d5d5333b9b4fc3ff9c4f62efc4ede2d2acb83eb17283da9fe21ded1e71c3f914c2f757d3f9b4fdf1dbca9
SSDEEP 192:n+jkWUPA5T+2yKPWMzwgBdGfM2lSbDUqrg:n+jbUiS23WiXGSbDUj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 91c356c2e18fcd029d87ccd82e1d236b081fb5a15e6048c50ab9adcd10ef0aba
MD5 94d7225c24d6b2d13a911a35d822d4b1
SHA1 ad3350e3608d4c90d6e555b74451130b33af209f
SHA512 8b2943758fcf01e84f234964ea47981ad03e6a2db3d4be4a0241688d3ae49cc1232bad59fdbda826466456fd268a0c10f0353b0ae864e45e91866e5be5b67ced
SSDEEP 192:n+jkRPF5T+2yKPWMIdbpjdGfF73MRLZqlVbDUqrg:n+j0LS23WpZUVbDUj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 e9d6362b2f1a5c27eec8bc464503eb4ccf49096de4ca7996d09303fb0483152c
MD5 d6bf0dc733b5d87b0b1902fac091c365
SHA1 256740666611116673b809df2f2cbf0ea1cb4437
SHA512 a64252b17354f150a67d9ac7fd5bb2e4585c616a7b8e461b8002381b0f459bd94a0ccafd2d71dcde470f818d857f59679daebd7064663d2b2467d13afba84188
SSDEEP 192:n+jkePK5T+2yKPWMIdbpAcczpdGfF73MxLrxlfbDUqrg:n+jFAS23WpAHPLfbDUj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 b957b145434a13075183f5573ef649d0370c546458e93c6b3cf88a3a09a5f8d8
MD5 53adbd040458cbf8ee0e7e4e648f9c16
SHA1 60fe8164bf90ce49c4693b675362adf70e148f25
SHA512 1b4c2efeaca2066c8bd6339b03b9ba70ca74e2c5cab35a25745278e54350081a7b14f602ff73940c1e7b88a8ccd302d0bcdd87cc5c7030b3d032a00766b12f05
SSDEEP 192:n+jkRPK5T+2yKPWMIdbpA1yHpdGfF73MxLrxl7bDUqrg:n+j0AS23WpA4PL7bDUj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 8c7637df0907272fc0267021f6af189609ec7ec1d0f674bff2d3d04bb2104241
MD5 a6ed0e458207e4bc5d932d60678a8150
SHA1 739a070961a12666cf3d708d44bfea9d3eb86bfd
SHA512 ea13de8fa3d0e4563992a162ca9fb7dfea2d307470b1b93ddcc746433ce266379fe15ec8a7ae7db2688b2aeb5f4dc230f6484eaf25e6be20162d0ce59b1ba089
SSDEEP 96:n+jkPSxm/Famqm1d+2ywpvWMoiVmde2YuK1jlQt36bDUqUWQyV+VD7AiEwb:n+jkPPD5T+2yGWMtuKhlDbDUqrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c1eb0cde2406b6af565f825dcd492589d40ab644\739c36b0-015a-4a2c-ae8f-0c8619246b0f\index-dir\the-real-index
Size 5KB
SHA256 69f6f701ca4d7ea14401d36006a3f536655ec5829e61ba1d152b3771a37ce0c0
MD5 167775a48c9bc5d920493977eb20f2fe
SHA1 1865a54afe7102ad19034f14ae2164dab53662a4
SHA512 3181e17c0bc868a084e80dbcae0e37972a84195bfa926ce2e8959bbcdb4ae9763be383f7b005905120d729fc360b0116aa27be57cfe2afad489d7042d2cfb810
SSDEEP 96:l97EgfOPnJi1LgubTcbA0qrGS7K1fW3tdoWQpKoVIk:l977GBi1tIbLqrGGg8tdof5
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index~RFe58d8d7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c1eb0cde2406b6af565f825dcd492589d40ab644\739c36b0-015a-4a2c-ae8f-0c8619246b0f\index-dir\the-real-index~RFe58d8d7.TMP
Size 48B
SHA256 132842430896883c9f74a01d23ba36d88b44d1acdaf86b5ca7777ee991fc07db
MD5 d2851c857dc11798350767fbee09dd00
SHA1 249033abf6050a8628c47393c7778392496f14fc
SHA512 df2f9b0ada259f1c96b30d4fe0fe5b6ef7412466c7dd076a8a5ff65da96ee4b51730b5e6aa23d6cbf79c663471d707fb7cddc8c50f5dd27cda01d7f286de760b
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c1eb0cde2406b6af565f825dcd492589d40ab644\index.txt
Size 93B
SHA256 47f7609802071238f00a869a57a072c7c053b209491ec7b2db3b59f8a796e782
MD5 239bac81421f1fc47946dbaa6bf107f1
SHA1 d02479707deefd0e95a250fcdb44fb9d64649fc4
SHA512 3b2df1e963711d4aff146a71840e4fcdf90d76e42a010eb3b95b16823d4a46f1c3028b548fda173663e1d12cb91ed4cb1faf0e53128d2947686364900349cf64
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c1eb0cde2406b6af565f825dcd492589d40ab644\index.txt
Size 89B
SHA256 7ac70e7add0e401bd7f6e6f76a5c6109edeee4e488117b6152572ab718e1a6b9
MD5 b0316df3465fee30a70601797786743d
SHA1 22964a368988c55f5f9ae4e57fa9170deadbd9eb
SHA512 37ec53f2375e4e4764857a77f8cf9090c820747285fff096ce174ebcf45d6494d48b2efefd6241b099e2b991c3e6c25717e31ac5305632ae192bec7ba55101f8
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 fea88633e2999362274bdbd6d0ef8f2cbd43015436ddbc335c89f167b51ae553
MD5 5295e47fe151e0fd8f9a8ce3059a3486
SHA1 67ec22dad2489ca1ac6f7fb30661ae4565e4660e
SHA512 f555d3b5a45fd6b376052a0908f3af3e0f953d1b44ae2bc85ad915a02b271be48d2785672b23d56f5156189bbe97b9da29802d34b95ac5fa5966931fba603408
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe585530.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe585530.TMP
Size 48B
SHA256 b7dcefc917a555b5500684ec6a1d59e15bef976a4ec8046bdc4d674c776ef29c
MD5 389a0e1766a1226bd1cd5e249274aeab
SHA1 a4e2e0a41aca2467aa0115540a0849c6b5efeb88
SHA512 ba53aca5104e4262a6d42a7b2790730b47b8e6a42685d9b77225f4e51903fab9179d3d1383b877a66918ecba1f3bff38ebb585c3c1937467b602000ea84c074d
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 a1a135e9d1b827d943d073f729484ca2ed6ee49c10727af3ceb7892313db8242
MD5 2b71102122a8c71b64ea54890bcb792a
SHA1 57a180826542adf12912ba17e99eac07f07c2b25
SHA512 ab4e9d2da97b1fd44b305dc9ad6268c004ef1d6e27e8b6abb379ba00c459d91ae786034d1dfd9e4de9f9e467d2a05f4fc036722a0e449691cecf58261ac1c01a
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 2KB
SHA256 857542b3bbea3cadf8a71ab9a049c6f63f9d128251e50b79c3a0f4833e33a4f4
MD5 d68f5bdb560df4f10870743cf204060a
SHA1 fb3a0b8db157ce4e889ef1f71819a38fa7ea3489
SHA512 6528e9f14c1a5ea13e778578fc9dac6c1397c3eef4cfa26d5cc71b7a1625407972fdcc8848262c4d74a6a38657212ec7ca557a88951edbfb50a6419c5f5ce106
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 3KB
SHA256 7eb86760d17e27f6de51c5a1a2da499f2c8fce1c42229e2b535ed06c6aa43636
MD5 e50ef61f47167822938004ad4b218202
SHA1 9ae4244f05a5a1d3e76bdcfe8ba015ea725629c7
SHA512 541fda88120e307cba773e0141ee8027191c479f778a508938f1b79dbeac5327a0e5679cabe23ea00fd8449d344b9076cab32a3cb514ef54fadb2add8c7ae5d5
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 3KB
SHA256 975b18a65d1d97fb33d849a21e483b312aa6b17aadfee59dee1d5cc8b0442d7d
MD5 6e166682fec24ee28622d949f46056f7
SHA1 6429ae1369fa940cb956a262b6388b2f05cd6c14
SHA512 ca73f642b30ba18aeba80241b130762671561761a190b6d7077e02a442aad33568c636dfb61833667590126691ce65c419d3b90b367081fda803e108954ee15a
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 3KB
SHA256 90161c063cbfabd659cfb336c11e203eb545518e5b09ea7ca3f9963cd9368023
MD5 8d43f5f5d8b293c3c83796cea99f0f09
SHA1 2252e9785685c88702dc278954742a3e4d0f6868
SHA512 54fcec503afcfb6fec1c247090e82fcc831c04b6bd337053bc16afa01f2907a0bdd0f49dfd2561204f6670530fe0fce0ed443d0ea7bbda099ae5960d28707a5e
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 3KB
SHA256 09b34c85e5d9275fbb0efe358665b42c1c3508200fcb71a7b9a6fb8140e3c36d
MD5 c52a12bfc5bc28e1f610e4b2c0dd5f58
SHA1 688f1712bd0ba59b2d398bf50164e68810212477
SHA512 3b1f0764eebdcb6d4cd600145e64469610e5fc7540d86bb5310d55694a626df3664d04ea62406c8a5b8fea62b3452628fd97d06644d560c7478c1f55223aa25a
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 3KB
SHA256 c1101d89920eaad02037031192cc987619e42afe3caca5ce02f4f4203a2bac9a
MD5 ab0d15db34e51d6bfa9e9e89b5df98a7
SHA1 16c9e3042ecb61ce2e42e192a7cb7e32abf187d8
SHA512 0fa36b8055ace4d381440c4ff5ef53aa2ee5e45478ec9e15db02cb34969a80e4241944fd42d4d258d17a720f7e3f1544137be8ffec5c75eadea36e7a9a2e3341
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 3KB
SHA256 e560960a6b3b9e5aefbc8058deb310b61854be0e628d51ba90d16b3cffd19a3b
MD5 363aa1e00bc63e4df11399727eb07511
SHA1 d3927a844dcd30da84c2c64e848d081d503b1b00
SHA512 6996be43368f9614a340d41bdd6921947a43988f0e00ecbc4066c4c6ef578cb078d07aed1dae308acb3c1d1cac7de696e5d612e87cb4dae8ad77bb8eda577374
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 3KB
SHA256 ff63b2b21683d4ca23eab5e4e33a6af7030a060ac5ad45d6234938cbd65436c5
MD5 f333b868e0e5dacd65e8bea536bca960
SHA1 3fee972c6875004115788a27926c1c51c6e12fd6
SHA512 6ab3d9fa1d22a8abfdf3ea68f94065b7efb7c92c9986dc2f3af1d86e61c95c9d29335828ad6f96cdcfb00d27158d1be8c92b74fb5298d1317e0f7cae06f1a64f
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe581cba.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581cba.TMP
Size 204B
SHA256 e909ea6f18311fdea5be06c83ebe86cb5dc10e532ed37ef7a8c2dc5b66ee648f
MD5 fdd6935e2110b5586d59b1b82e350639
SHA1 d404b5f547587313735200531b1ca6ba9924b5e8
SHA512 94b51955dd115bf56a3fc0dcbf5addbb3b95f795b707bd4007829847e6152a48a70af7b72d5f22d781ab692f4a8d126136062baa92a81ef2a86b7f2b189146e6
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 957ec54454c5431d6c605b33ffe1897b95b85abda257c1efeae133c596248d73
MD5 b0b48b65762e8aec2d8381965bc606aa
SHA1 4e67f0cdbc545e8494d82317119ab8eefddacd78
SHA512 8d1c7084aca51b61e589cbd618e354201874b444d8fd0758737b5fc0434580b69e04b7184ba058230942d161404acef68f1c1a5a50317e8c7258081f7e90b083
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupH5F9Ue2RUoTinDbVF9xUXb:A9iIxuERzA83h09RZxYHb9aTTiNF9E15
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 d2c85c79b0e3ae8df22f06ed68c7144cacfedefa839db9318f7a6fd401a5fd26
MD5 031ff661730f8f064d7220d4ab624a3c
SHA1 d60d98c1f4d30d9ebcf1735894312efcc066c1f4
SHA512 9553e6ed319e547680394afe52a6340a2735151ff4d549be18ff5bf9e2bf680ae736316eced11a2a1b6ab99ebd0bd9e98fdeb5cadcc9b9a47f9f48ec281d604b
SSDEEP 384:46+BO9i+MsROBBiDpUJk+o9ogTpK6seYWjm/a/H3SofqVrf+0Oz/Ypd0gDR+kKhD:5U+SotVjogTpNK0XSxb+rz/1Is3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ilkdt.exe

Path C:\Users\Admin\AppData\Local\Temp\Ilkdt.exe
Size 191KB
SHA256 d49013d6be0f0e727c0b53bce1d3fed00656c7a2836ceef0a9d4cb816a5878db
MD5 e004a568b841c74855f1a8a5d43096c7
SHA1 b90fd74593ae9b5a48cb165b6d7602507e1aeca4
SHA512 402dd4d4c57fb6f5c7a531b7210a897dfe41d68df99ae4d605944f6e5b2cecaafa3fe27562fe45e7e216a7c9e29e63139d4382310b41f04a35ad56115fbed2af
SSDEEP 3072:tqlD4M+72hZJN9PxrPgxy5d96YrfFW8Wj2VpWKmTsfkdgPeZ1w9JwveK5YlFEc:4Z0oZJbPxr4s5dvrdLVpBfkd6Jwv+lW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Sahyui1337.exe

Path C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe
Size 316KB
SHA256 0f055835332ef8e368185ae461e7c9eacdeb3d600ea550d605b09a20e0856e2d
MD5 675d9e9ab252981f2f919cf914d9681d
SHA1 7485f5c9da283475136df7fa8b62756efbb5dd17
SHA512 9dd936705fd43ebe8be17fcf77173eaaf16046f5880f8fe48fc68ded91ef6202ba65c605980bd2e330d2c7f463f772750a1bd96246fffdc9cb6bf8e1b00a2ccb
SSDEEP 6144:C2aU6MDdbBCydeWE1sMLwPM8WVXTTayGdTpSVZyXbd:C2xqsMLwPLqT8SVAbd
MD5 SHA1 SHA512 SSDEEP

Submit Download

WinErrorMgr.exe

Path C:\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe
Size 42KB
SHA256 bc3d545c541e42420ce2c2eabc7e5afab32c869a1adb20adb11735957d0d0b0e
MD5 d499e979a50c958f1a67f0e2a28af43d
SHA1 1e5fa0824554c31f19ce01a51edb9bed86f67cf0
SHA512 668047f178d82bebefeb8c2e7731d34ff24dc755dacd3362b43d8b44c6b148fc51af0d0ab2d0a67f0344ab6158b883fe568e4eeb0e34152108735574f0e1e763
SSDEEP 768:Ba7HmiY7iDr6pKvhSirGDo1aRqcVrwjhORaNIVIbEVHq3YH5E:XiY0ryqhrGkkRq0wj4RcIVIbEQ3Y2
MD5 SHA1 SHA512 SSDEEP

Submit Download

WinHostMgr.exe

Path C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe
Size 2.7MB
SHA256 7ae2b6e6b062a4728068c97a0246f7772734e0d095aeada55bbce812bf3df796
MD5 868454a627021586c4327ef3a8afb2ee
SHA1 4e265903660706c1d244937ec89f955968e415fb
SHA512 ba8da083f24cd49e4e487564d1a0f9a361b550f791388fba6823d246d59747fae53ff4abece66709b1a2dd1159770225d0cb0dd3be49958fc811713654b2286e
SSDEEP 49152:jzZXu8ooiXNzXa4l2+xiNkG+Qk36gqD1pwpKRV8yd+meQqFgc3:vNsoCN7HENkGG3JqXwpKRyygqqFgc3
MD5 SHA1 SHA512 SSDEEP

Submit Download

WinHostMgr.exe

Path C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe
Size 2.4MB
SHA256 0d08508384c34a375fb6d20b608764c5e3810f390130bb4c188634d4d8bab7e8
MD5 4124c8e0b6cef8bb1a478b8229a90fc4
SHA1 c68ea118ee49b3ba91f94c9eb8b636b603808736
SHA512 726802b4f1cf3962c2b6390162d6afdb9c7789859033d4d92bac57fef7cdccf7482e7426372cfacce086a93d0de6ac837ea16cc685a388f3be6c12e5b79126bd
SSDEEP 49152:jzZXu8ooiXNzXa4l2+xiNkG+Qk36gqD1pwpKRV8yd+5:vNsoCN7HENkGG3JqXwpKRyyg5
MD5 SHA1 SHA512 SSDEEP

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI18162\VCRUNTIME140.dll
Size 116KB
SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
MD5 be8dbe2dc77ebe7f88f910c61aec691a
SHA1 a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA512 0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655
SSDEEP 1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho
MD5 SHA1 SHA512 SSDEEP

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18162\_bz2.pyd
Size 82KB
SHA256 bd8621fcc901fa1de3961d93184f61ea71068c436794af2a4449738ccf949946
MD5 90f58f625a6655f80c35532a087a0319
SHA1 d4a7834201bd796dc786b0eb923f8ec5d60f719b
SHA512 b5bb1ecc195700ad7bea5b025503edd3770b1f845f9beee4b067235c4e63496d6e0b19bdd2a42a1b6591d1131a2dc9f627b2ae8036e294300bb6983ecd644dc8
SSDEEP 1536:ES7z7Sj2u5ia5ifC83zYLzbCK8CkotIpCVF7SyTUxIS:/7z+jw3MzCNCkotIpCVF+
MD5 SHA1 SHA512 SSDEEP

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18162\_decimal.pyd
Size 247KB
SHA256 d4ae192bbd4627fc9487a2c1cd9869d1b461c20cfd338194e87f5cf882bbed12
MD5 f78f9855d2a7ca940b6be51d68b80bf2
SHA1 fd8af3dbd7b0ea3de2274517c74186cb7cd81a05
SHA512 6b68c434a6f8c436d890d3c1229d332bd878e5777c421799f84d79679e998b95d2d4a013b09f50c5de4c6a85fcceb796f3c486e36a10cbac509a0da8d8102b18
SSDEEP 6144:kgd/2mZLgPFIY9qWM53pLW1AepppzoeteKU:JZLgPykeKU
MD5 SHA1 SHA512 SSDEEP

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18162\_hashlib.pyd
Size 64KB
SHA256 6c50c9801a5caf0bb52b384f9a0d5a4aa182ca835f293a39e8999cf6edf2f087
MD5 8baeb2bd6e52ba38f445ef71ef43a6b8
SHA1 4132f9cd06343ef8b5b60dc8a62be049aa3270c2
SHA512 804a4e19ea622646cea9e0f8c1e284b7f2d02f3620199fa6930dbdadc654fa137c1e12757f87c3a1a71ceff9244aa2f598ee70d345469ca32a0400563fe3aa65
SSDEEP 1536:uElYij3wzR1lBafLEmIRhFIpOIi7SyHqxn:zYdBaTEmghFIpOIiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18162\_lzma.pyd
Size 155KB
SHA256 22d10e2d6ad3e3ed3c49eb79ab69a81aaa9d16aeca7f948da2fe80877f106c16
MD5 cf8de1137f36141afd9ff7c52a3264ee
SHA1 afde95a1d7a545d913387624ef48c60f23cf4a3f
SHA512 821985ff5bc421bd16b2fa5f77f1f4bf8472d0d1564bc5768e4dbe866ec52865a98356bb3ef23a380058acd0a25cd5a40a1e0dae479f15863e48c4482c89a03f
SSDEEP 3072:kEVLLSVeexIDteznfV9mNoNMuX4mZp7zuNtIpZ1uV:kEVHbeye9YON1buNN
MD5 SHA1 SHA512 SSDEEP

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18162\_socket.pyd
Size 81KB
SHA256 24017d664af20ee3b89514539345caac83eca34825fcf066a23e8a4c99f73e6d
MD5 439b3ad279befa65bb40ecebddd6228b
SHA1 d3ea91ae7cad9e1ebec11c5d0517132bbc14491e
SHA512 a335e1963bb21b34b21aef6b0b14ba8908a5343b88f65294618e029e3d4d0143ea978a5fd76d2df13a918ffab1e2d7143f5a1a91a35e0cc1145809b15af273bd
SSDEEP 1536:MUuhDLiJvz76Hl+ZWly+uC69/s+S+pzcHst8/n1IsJHO7sBIpLwfB7SysaZx7:MU6DL4vHAy+uC69/sT+pzus81IwHO7sl
MD5 SHA1 SHA512 SSDEEP

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI18162\base_library.zip
Size 1.3MB
SHA256 2b8b36bd4b1b0ee0599e5d519a91d35d70f03cc09270921630168a386b60ac71
MD5 44db87e9a433afe94098d3073d1c86d7
SHA1 24cc76d6553563f4d739c9e91a541482f4f83e05
SHA512 55bc2961c0bca42ef6fb4732ec25ef7d7d2ec47c7fb96d8819dd2daa32d990000b326808ae4a03143d6ff2144416e218395cccf8edaa774783234ec7501db611
SSDEEP 12288:uttcY+bStOmgRF1+fYNXPh26UZWAzau7joqYnhjHgkVHdmmPcHz1d1YgCCaYceE:uttcY+UHCiaAd+cqHdmmPmzqEaYceE
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI18162\libcrypto-3.dll
Size 1.1MB
SHA256 4215286d6471cd5ee61dc161f5f6547d31eb778f2bb497436a2c0aa1d00fabc5
MD5 fcce7072c6071e1ba4f07242aa92a6e9
SHA1 e2714eeb183e425e7026daebef8d97de5296a44a
SHA512 d227967d74fc5071980fa6201f8c1337dd73655690e2a2ddb8c882634859851defb4bfa8cfb5298a81c7d7f78264db43f3b1784ae24026e72e6a12e5b6c133a0
SSDEEP 24576:JTKuk2IPAVIH06iyN3OjPW84DYYgLEX3+u:JTKuk2IIIU6iw3OjPWRr9
MD5 SHA1 SHA512 SSDEEP

Submit Download

python312.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI18162\python312.dll
Size 2.4MB
SHA256 4009841e586ebcaff807b9b5de41c15aaacf0852836aaf9ac48b7295bb2b2b9a
MD5 a0aa01d93053d105c4b47d0432d6c27f
SHA1 0d044036481fe65ddbfba4cc18cbf5c3c048529d
SHA512 756df1d42c92da4ff72e88bfc5a6c54ee4bcd83b8c2e80acfc9da1efb03b467c3376b605a0cdd9f79bda7d62f273e5dba832cf60eff16da0ce3da699a41a4d96
SSDEEP 49152:2O/cau0lnlpqB6O/uZ1fHMY9Anftu11aOvi+iVi9yye1veKSvEYqgZQziXSk4Fgy:2OUmnjqB6bHMYM3RNgqX
MD5 SHA1 SHA512 SSDEEP

Submit Download

python312.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI18162\python312.dll
Size 2.0MB
SHA256 211a32ee3f9f4a8178eb0e029a390a47190e6dae6d85e6c605186a55d3d69e66
MD5 94e0165656b8a06a54251a1b13bdb7e3
SHA1 c019814e30138139f0846089ac3fca4b9cfafa54
SHA512 16194acdaf8b23f94ead42caad442a8ca902f7811b2b55386dcdb263061885e7a514bdbe86cc0faec791a936bc7ec7bc6872b9c37648f3764af5b24c3d00db6c
SSDEEP 49152:2O/cau0lnlpqB6O/uZ1fHMY9Anftu11aOvi+iVi9yye1veKSvEYqgH:2OUmnjqB6bHMYM3RNC
MD5 SHA1 SHA512 SSDEEP

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18162\select.pyd
Size 29KB
SHA256 74cca85600e7c17ea6532b54842e26d3cae9181287cdf5a4a3c50af4dab785e5
MD5 e1604afe8244e1ce4c316c64ea3aa173
SHA1 99704d2c0fa2687997381b65ff3b1b7194220a73
SHA512 7bf35b1a9da9f1660f238c2959b3693b7d9d2da40cf42c6f9eba2164b73047340d0adff8995049a2fe14e149eba05a5974eee153badd9e8450f961207f0b3d42
SSDEEP 384:OyLTFInPLnIloHqP3DT90IBIpQG28HQIYiSy1pCQ5mrUAM+o/8E9VF0NyOYl:hinzfHqv1rBIpQG/5YiSyvkrUAMxkErl
MD5 SHA1 SHA512 SSDEEP

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18162\unicodedata.pyd
Size 1.1MB
SHA256 2a50d629895a05b10a262acf333e7a4a31db5cb035b70d14d1a4be1c3e27d309
MD5 fc47b9e23ddf2c128e3569a622868dbe
SHA1 2814643b70847b496cbda990f6442d8ff4f0cb09
SHA512 7c08683820498fdff5f1703db4ad94ad15f2aa877d044eddc4b54d90e7dc162f48b22828cd577c9bb1b56f7c11f777f9785a9da1867bf8c0f2b6e75dc57c3f53
SSDEEP 12288:PrEHdcM6hb1CjJ43w9hIpCQvb0QN8MdIEQ+U2BNNmD+99FfciA0:PrEXQCjfk7bPNfv42BN6yzUiA0
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_dohwduxs.014.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dohwduxs.014.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

tmpCB6E.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpCB6E.tmp
Size 1KB
SHA256 da5ab3278aaa04fbd51272a617aef9b903ca53c358fac48fc0f558e257e063a4
MD5 7f673f709ab0e7278e38f0fd8e745cd4
SHA1 ac504108a274b7051e3b477bcd51c9d1a4a01c2c
SHA512 e932ccbd9d3ec6ee129f0dab82710904b84e657532c5b623d3c7b3b4ce45732caf8ff5d7b39095cf99ecf97d4e40dd9d755eb2b89c8ede629b287c29e41d1132
MD5 SHA1 SHA512

Submit Download

KeyGeneratorI.exe

Path C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe
Size 2.2MB
SHA256 8b643648bb644e96ce6aa64f13866ec5bd7ceacea823e4846fe2e2cb2d4d3a40
MD5 260665eac56899955967b64960f2c89f
SHA1 2fa1bf2cdba575b0b93b17ca0aaab06bd9b29514
SHA512 17df97102047a45861787aa06ee1d84beda0b00755bb8ed948210667e43c65c299265aed43cce91ec77c536f5e6388d664285725ac335b4782784b329dc850bc
SSDEEP 49152:zQDTl8ylGbIzfd1I1FhqCiACyAaQO6g90n3ADgxG:wZ8pUcU1W903AEM
MD5 SHA1 SHA512 SSDEEP

Submit Download

KeyGeneratorI.exe

Path C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe
Size 6.0MB
SHA256 8752718c7699e18dce3ebcb021c97d346632ca605f5cb1d9b76446738937f0b4
MD5 cd92a6b2c6926ed10d52ec965493874f
SHA1 e136e6f27f72180c364bcaf7c3a65eafec57e386
SHA512 67ed16d6638a1108620b205b9c475f5a367ac02fb0796d4f530eed6e97524fa980b85c5ba72d331dae1d7c4d6a2456e704940c0e4872150eae590bbaa9a6aa77
SSDEEP 98304:wZ8pUcU1W903AE4V4QKUjAXoSQyTosxuG9Pt/Rky3Yl852WCFs49X0ibfUxgABHR:wZIU1W903eV4QFMToEuGxgh858F0ibfK
MD5 SHA1 SHA512 SSDEEP

Submit Download

KeyGeneratorI.exe

Path C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe
Size 3.3MB
SHA256 8d455b65ca0f896927d3bcffc2e58399695d166877e77be89cb88cd90bdf2f04
MD5 8d2e5e63d9b951d572b43e127bde0cbc
SHA1 681ec4de267b7c1c6528dd5247418fa4a40d6221
SHA512 12251d247452c81534f0934c082907ff02bdec9d8e701bf62874b94031bcdadaa94ddfc3a7af72218f73799082cf6aa3b52e7bff97c26a279fb6e7aa1427ab3e
SSDEEP 49152:zQDTl8ylGbIzfd1I1FhqCiACyAaQO6g90n3ADgxtRqLHT5yC4KfnKUjADzoxoQz6:wZ8pUcU1W903AE4V4QKUjAXoSQyTt
MD5 SHA1 SHA512 SSDEEP

Submit Download

KeyGeneratorI.exe

Path C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe
Size 2.3MB
SHA256 031d6426cfaba010637ab88243be965af33d3baafc90fc37333ef30f4fe3d0b3
MD5 97e6429427c46c8d68a2ad55737105da
SHA1 4fbe01360cbf6d798fda69ab9d20a57132b27bfd
SHA512 fb67fdaa4947b1985766351ef3e5fc9795b1d67f815857917f153dc0750626205429339e5ea3c1089d9059a4c2f26f8e3a919ba71b66a15d46e4e8610b074435
SSDEEP 49152:zQDTl8ylGbIzfd1I1FhqCiACyAaQO6g90n3ADgxtRP:wZ8pUcU1W903AEV
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2148-1894-0x0000027ECB780000-0x0000027ECB78A000-memory.dmp

Download

memory/2148-1864-0x0000027ECB5E0000-0x0000027ECB5EA000-memory.dmp

Download

memory/2148-1857-0x0000027ECB500000-0x0000027ECB51C000-memory.dmp

Download

memory/2148-1897-0x0000027ECB1D0000-0x0000027ECB1E0000-memory.dmp

Download

memory/2148-1903-0x00007FFC5BDE0000-0x00007FFC5C8A1000-memory.dmp

Download

memory/2148-1859-0x00007FF468C70000-0x00007FF468C80000-memory.dmp

Download

memory/2148-1844-0x0000027ECB1D0000-0x0000027ECB1E0000-memory.dmp

Download

memory/2148-1890-0x0000027ECB770000-0x0000027ECB776000-memory.dmp

Download

memory/2148-1889-0x0000027ECB740000-0x0000027ECB748000-memory.dmp

Download

memory/2148-1888-0x0000027ECB790000-0x0000027ECB7AA000-memory.dmp

Download

memory/2148-1880-0x0000027ECB730000-0x0000027ECB73A000-memory.dmp

Download

memory/2148-1839-0x00007FFC5BDE0000-0x00007FFC5C8A1000-memory.dmp

Download

memory/2148-1865-0x0000027ECB750000-0x0000027ECB76C000-memory.dmp

Download

memory/2148-1845-0x0000027ECB1D0000-0x0000027ECB1E0000-memory.dmp

Download

memory/2148-1861-0x0000027ECB520000-0x0000027ECB5D5000-memory.dmp

Download

memory/2148-1860-0x0000027ECB1D0000-0x0000027ECB1E0000-memory.dmp

Download

memory/2964-36-0x0000000000EE0000-0x0000000000EF0000-memory.dmp

Download

memory/2964-97-0x0000000073CF0000-0x00000000744A0000-memory.dmp

Download

memory/2964-57-0x0000000073CF0000-0x00000000744A0000-memory.dmp

Download

memory/4012-198-0x0000000070D40000-0x0000000070D8C000-memory.dmp

Download

memory/4012-56-0x0000000005580000-0x0000000005BA8000-memory.dmp

Download

memory/4012-190-0x0000000007210000-0x0000000007242000-memory.dmp

Download

memory/4012-35-0x0000000002970000-0x00000000029A6000-memory.dmp

Download

memory/4012-124-0x0000000005DD0000-0x0000000005E36000-memory.dmp

Download

memory/4012-143-0x0000000006340000-0x000000000638C000-memory.dmp

Download

memory/4012-212-0x0000000002E80000-0x0000000002E90000-memory.dmp

Download

memory/4012-220-0x0000000007260000-0x0000000007303000-memory.dmp

Download

memory/4012-139-0x0000000006290000-0x00000000062AE000-memory.dmp

Download

memory/4012-122-0x0000000005D30000-0x0000000005D96000-memory.dmp

Download

memory/4012-221-0x0000000007C00000-0x000000000827A000-memory.dmp

Download

memory/4012-222-0x00000000075C0000-0x00000000075DA000-memory.dmp

Download

memory/4012-211-0x00000000071F0000-0x000000000720E000-memory.dmp

Download

memory/4012-50-0x0000000073CF0000-0x00000000744A0000-memory.dmp

Download

memory/4012-192-0x000000007FD50000-0x000000007FD60000-memory.dmp

Download

memory/4012-109-0x00000000052D0000-0x00000000052F2000-memory.dmp

Download

memory/4012-60-0x0000000002E80000-0x0000000002E90000-memory.dmp

Download

memory/4012-227-0x0000000007630000-0x000000000763A000-memory.dmp

Download

memory/4012-233-0x0000000007860000-0x00000000078F6000-memory.dmp

Download

memory/4012-236-0x00000000077E0000-0x00000000077F1000-memory.dmp

Download

memory/4012-268-0x0000000007820000-0x000000000782E000-memory.dmp

Download

memory/4012-274-0x0000000007830000-0x0000000007844000-memory.dmp

Download

memory/4012-286-0x0000000007920000-0x000000000793A000-memory.dmp

Download

memory/4012-291-0x0000000007900000-0x0000000007908000-memory.dmp

Download

memory/4012-127-0x0000000005E40000-0x0000000006194000-memory.dmp

Download

memory/4012-332-0x0000000073CF0000-0x00000000744A0000-memory.dmp

Download

memory/4012-73-0x0000000002E80000-0x0000000002E90000-memory.dmp

Download

memory/4232-123-0x0000000002C60000-0x0000000002CC5000-memory.dmp

Download

memory/4232-153-0x0000000002C60000-0x0000000002CC5000-memory.dmp

Download

memory/4232-224-0x0000000002C60000-0x0000000002CC5000-memory.dmp

Download

memory/4232-201-0x0000000002C60000-0x0000000002CC5000-memory.dmp

Download

memory/4232-219-0x0000000002C60000-0x0000000002CC5000-memory.dmp

Download

memory/4232-191-0x0000000002C60000-0x0000000002CC5000-memory.dmp

Download

memory/4232-183-0x0000000002C60000-0x0000000002CC5000-memory.dmp

Download

memory/4232-181-0x0000000002C60000-0x0000000002CC5000-memory.dmp

Download

memory/4232-28-0x0000000000840000-0x0000000000876000-memory.dmp

Download

memory/4232-179-0x0000000002C60000-0x0000000002CC5000-memory.dmp

Download

memory/4232-177-0x0000000002C60000-0x0000000002CC5000-memory.dmp

Download

memory/4232-33-0x0000000073CF0000-0x00000000744A0000-memory.dmp

Download

memory/4232-53-0x0000000002C60000-0x0000000002CCC000-memory.dmp

Download

memory/4232-59-0x0000000002C60000-0x0000000002CC5000-memory.dmp

Download

memory/4232-58-0x0000000002C60000-0x0000000002CC5000-memory.dmp

Download

memory/4232-62-0x0000000002C60000-0x0000000002CC5000-memory.dmp

Download

memory/4232-175-0x0000000002C60000-0x0000000002CC5000-memory.dmp

Download

memory/4232-168-0x0000000002C60000-0x0000000002CC5000-memory.dmp

Download

memory/4232-166-0x0000000002C60000-0x0000000002CC5000-memory.dmp

Download

memory/4232-164-0x0000000002C60000-0x0000000002CC5000-memory.dmp

Download

memory/4232-84-0x0000000002CD0000-0x0000000002CE0000-memory.dmp

Download

memory/4232-162-0x0000000002C60000-0x0000000002CC5000-memory.dmp

Download

memory/4232-85-0x0000000002C60000-0x0000000002CC5000-memory.dmp

Download

memory/4232-159-0x0000000002C60000-0x0000000002CC5000-memory.dmp

Download

memory/4232-157-0x0000000002C60000-0x0000000002CC5000-memory.dmp

Download

memory/4232-1786-0x0000000073CF0000-0x00000000744A0000-memory.dmp

Download

memory/4232-155-0x0000000002C60000-0x0000000002CC5000-memory.dmp

Download

memory/4232-151-0x0000000002C60000-0x0000000002CC5000-memory.dmp

Download

memory/4232-65-0x0000000002C60000-0x0000000002CC5000-memory.dmp

Download

memory/4232-149-0x0000000002C60000-0x0000000002CC5000-memory.dmp

Download

memory/4232-140-0x0000000002C60000-0x0000000002CC5000-memory.dmp

Download

memory/4232-147-0x0000000002C60000-0x0000000002CC5000-memory.dmp

Download

memory/4232-95-0x0000000002C60000-0x0000000002CC5000-memory.dmp

Download

memory/4232-145-0x0000000002C60000-0x0000000002CC5000-memory.dmp

Download

memory/4232-126-0x0000000002C60000-0x0000000002CC5000-memory.dmp

Download

memory/4232-102-0x0000000002C60000-0x0000000002CC5000-memory.dmp

Download

memory/4232-120-0x0000000002C60000-0x0000000002CC5000-memory.dmp

Download

memory/4232-108-0x0000000002C60000-0x0000000002CC5000-memory.dmp

Download

memory/4416-1830-0x00007FFC5BDE0000-0x00007FFC5C8A1000-memory.dmp

Download

memory/4416-1824-0x000002A6B09D0000-0x000002A6B09F2000-memory.dmp

Download

memory/4416-1825-0x00007FFC5BDE0000-0x00007FFC5C8A1000-memory.dmp

Download

memory/4416-1826-0x000002A6C8F80000-0x000002A6C8F90000-memory.dmp

Download

memory/4416-1827-0x000002A6C8F80000-0x000002A6C8F90000-memory.dmp

Download

memory/4772-55-0x00000238BA750000-0x00000238BA7A4000-memory.dmp

Download

memory/4772-89-0x00000238D4DC0000-0x00000238D4DD0000-memory.dmp

Download

memory/4772-64-0x00007FFC5E000000-0x00007FFC5EAC1000-memory.dmp

Download

memory/4772-144-0x00007FFC5E000000-0x00007FFC5EAC1000-memory.dmp

Download

memory/4788-101-0x00000000016E0000-0x00000000016F0000-memory.dmp

Download

memory/4788-1858-0x0000000073CF0000-0x00000000744A0000-memory.dmp

Download

memory/4788-96-0x0000000073CF0000-0x00000000744A0000-memory.dmp

Download

memory/4788-2127-0x00000000016E0000-0x00000000016F0000-memory.dmp

Download