growtopia | 965e26ab119bb1fe78e0f2e9f3a4b85de6b308100faa6c12dd6aa60ee52f42ef

Analysis

max time kernel
114s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
22-02-2024 18:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

GX_Builder.exe
Size

12.9MB
MD5

de6416915830c63685b6771684689d36
SHA1

f3516b1816295056c870e3c15a52aafbf4e9aab3
SHA256

965e26ab119bb1fe78e0f2e9f3a4b85de6b308100faa6c12dd6aa60ee52f42ef
SHA512

7efb6ba401dad084f2e7aa0af834171724168f2bd28da2d28fd3c1083b6286b262f352fe6dac703eacb5624f8b810918293d563353dafd85ac96532da61f25a7
SSDEEP

393216:oNOnxeqv5yEgPDflLNVga2D3o5Doo7Mm:0OnxD56DtLzGD3ohoo7Mm

Score

10^/10

growtopia zgrat evasion persistence pyinstaller rat stealer

Malware Config

Extracted

Family

growtopia

https://discord.com/api/webhooks/1199763266872803338/8vedcXoMcyExhe1xhBm5f8ncmafWmOB3pkulE0l8g9Pel0t3ziyr2V51cLTVEjYsE4Rj

Signatures

Detect ZGRat V1 34 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4244-58-0x0000000005880000-0x00000000058E5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4244-57-0x0000000005880000-0x00000000058E5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4244-60-0x0000000005880000-0x00000000058E5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4244-55-0x0000000005880000-0x00000000058EC000-memory.dmp	family_zgrat_v1
behavioral2/memory/4244-88-0x0000000005880000-0x00000000058E5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4244-96-0x0000000005880000-0x00000000058E5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4244-63-0x0000000005880000-0x00000000058E5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4244-107-0x0000000005880000-0x00000000058E5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4244-138-0x0000000005880000-0x00000000058E5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4244-140-0x0000000005880000-0x00000000058E5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4244-142-0x0000000005880000-0x00000000058E5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4244-144-0x0000000005880000-0x00000000058E5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4244-146-0x0000000005880000-0x00000000058E5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4244-148-0x0000000005880000-0x00000000058E5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4244-150-0x0000000005880000-0x00000000058E5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4244-152-0x0000000005880000-0x00000000058E5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4244-154-0x0000000005880000-0x00000000058E5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4244-120-0x0000000005880000-0x00000000058E5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4244-103-0x0000000005880000-0x00000000058E5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4244-174-0x0000000005880000-0x00000000058E5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4244-176-0x0000000005880000-0x00000000058E5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4244-180-0x0000000005880000-0x00000000058E5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4244-169-0x0000000005880000-0x00000000058E5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4244-189-0x0000000005880000-0x00000000058E5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4244-191-0x0000000005880000-0x00000000058E5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4244-193-0x0000000005880000-0x00000000058E5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4244-196-0x0000000005880000-0x00000000058E5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4244-198-0x0000000005880000-0x00000000058E5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4244-200-0x0000000005880000-0x00000000058E5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4244-202-0x0000000005880000-0x00000000058E5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4244-206-0x0000000005880000-0x00000000058E5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4244-208-0x0000000005880000-0x00000000058E5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4244-210-0x0000000005880000-0x00000000058E5000-memory.dmp	family_zgrat_v1
behavioral2/memory/4244-212-0x0000000005880000-0x00000000058E5000-memory.dmp	family_zgrat_v1

Growtopia
Growtopa is an opensource modular stealer written in C#.
stealer growtopia
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

GX_Builder.exeWinErrorMgr.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000\Control Panel\International\Geo\Nation	GX_Builder.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000\Control Panel\International\Geo\Nation	WinErrorMgr.exe

Executes dropped EXE 8 IoCs

Processes:

Ilkdt.exeWinHostMgr.exeWinErrorMgr.exeSahyui1337.exeKeyGeneratorTOP.exeWinErrorMgr.exeKeyGeneratorTOP.exebauwrdgwodhv.exe

pid	process
4244	Ilkdt.exe
2148	WinHostMgr.exe
4428	WinErrorMgr.exe
2916	Sahyui1337.exe
792	KeyGeneratorTOP.exe
2820	WinErrorMgr.exe
3108	KeyGeneratorTOP.exe
5384	bauwrdgwodhv.exe

Loads dropped DLL 4 IoCs

Processes:

KeyGeneratorTOP.exe

pid process

3108 KeyGeneratorTOP.exe
3108 KeyGeneratorTOP.exe
3108 KeyGeneratorTOP.exe
3108 KeyGeneratorTOP.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service
T1102

Processes:

flow ioc

41 discord.com
42 discord.com
280 pastebin.com
281 pastebin.com
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

242 api.ipify.org
244 api.ipify.org

pid	process
3108	KeyGeneratorTOP.exe
3108	KeyGeneratorTOP.exe
3108	KeyGeneratorTOP.exe
3108	KeyGeneratorTOP.exe

flow	ioc
41	discord.com
42	discord.com
280	pastebin.com
281	pastebin.com

flow	ioc
242	api.ipify.org
244	api.ipify.org

Drops file in System32 directory 4 IoCs

Processes:

WinHostMgr.exepowershell.exebauwrdgwodhv.exe

description	ioc	process
File opened for modification	C:\Windows\system32\MRT.exe	WinHostMgr.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	bauwrdgwodhv.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

bauwrdgwodhv.exe

description	pid	process	target process
PID 5384 set thread context of 1444	5384	bauwrdgwodhv.exe	conhost.exe
PID 5384 set thread context of 5892	5384	bauwrdgwodhv.exe	explorer.exe

Launches sc.exe 14 IoCs

Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid	process
5656	sc.exe
3080	sc.exe
5760	sc.exe
5812	sc.exe
3092	sc.exe
5192	sc.exe
5996	sc.exe
5504	sc.exe
5692	sc.exe
5916	sc.exe
5180	sc.exe
1440	sc.exe
5592	sc.exe
5828	sc.exe

Detects Pyinstaller 4 IoCs

pyinstaller

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe	pyinstaller
C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe	pyinstaller
C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe	pyinstaller
C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

5024 schtasks.exe

pid	process
5024	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 50 IoCs

Processes:

powershell.exeexplorer.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3316742141-2240921845-2885234760-1000\{5BED1455-6C3E-4371-A510-A8776A961B2A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Sahyui1337.exepowershell.exetaskmgr.exemsedge.exemsedge.exeWinHostMgr.exeidentity_helper.exebauwrdgwodhv.exepowershell.exemsedge.exe

pid	process
2916	Sahyui1337.exe
2916	Sahyui1337.exe
4944	powershell.exe
4944	powershell.exe
4944	powershell.exe
4148	taskmgr.exe
4148	taskmgr.exe
3640	msedge.exe
3640	msedge.exe
1760	msedge.exe
1760	msedge.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
2148	WinHostMgr.exe
4944	powershell.exe
4944	powershell.exe
4148	taskmgr.exe
4148	taskmgr.exe
4944	powershell.exe
5264	identity_helper.exe
5264	identity_helper.exe
2148	WinHostMgr.exe
2148	WinHostMgr.exe
2148	WinHostMgr.exe
2148	WinHostMgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
2148	WinHostMgr.exe
2148	WinHostMgr.exe
2148	WinHostMgr.exe
2148	WinHostMgr.exe
2148	WinHostMgr.exe
2148	WinHostMgr.exe
2148	WinHostMgr.exe
2148	WinHostMgr.exe
2148	WinHostMgr.exe
2148	WinHostMgr.exe
5384	bauwrdgwodhv.exe
5416	powershell.exe
5416	powershell.exe
4148	taskmgr.exe
4148	taskmgr.exe
5416	powershell.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
5536	msedge.exe
5536	msedge.exe
4148	taskmgr.exe
4148	taskmgr.exe
5384	bauwrdgwodhv.exe
5384	bauwrdgwodhv.exe
4148	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

Processes:

msedge.exe

pid	process
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

Processes:

Sahyui1337.exeIlkdt.exepowershell.exetaskmgr.exepowershell.exepowercfg.exepowercfg.exeexplorer.exepowercfg.exepowershell.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exe

description	pid	process
Token: SeDebugPrivilege	2916	Sahyui1337.exe
Token: SeDebugPrivilege	4244	Ilkdt.exe
Token: SeDebugPrivilege	4944	powershell.exe
Token: SeDebugPrivilege	4148	taskmgr.exe
Token: SeSystemProfilePrivilege	4148	taskmgr.exe
Token: SeCreateGlobalPrivilege	4148	taskmgr.exe
Token: SeDebugPrivilege	4944	powershell.exe
Token: SeShutdownPrivilege	5900	powercfg.exe
Token: SeCreatePagefilePrivilege	5900	powercfg.exe
Token: SeShutdownPrivilege	5908	powercfg.exe
Token: SeCreatePagefilePrivilege	5908	powercfg.exe
Token: SeShutdownPrivilege	5892	explorer.exe
Token: SeCreatePagefilePrivilege	5892	explorer.exe
Token: SeShutdownPrivilege	5884	powercfg.exe
Token: SeCreatePagefilePrivilege	5884	powercfg.exe
Token: SeDebugPrivilege	5416	powershell.exe
Token: SeShutdownPrivilege	2612	powercfg.exe
Token: SeCreatePagefilePrivilege	2612	powercfg.exe
Token: SeShutdownPrivilege	2056	powercfg.exe
Token: SeCreatePagefilePrivilege	2056	powercfg.exe
Token: SeShutdownPrivilege	5532	powercfg.exe
Token: SeCreatePagefilePrivilege	5532	powercfg.exe
Token: SeShutdownPrivilege	212	powercfg.exe
Token: SeCreatePagefilePrivilege	212	powercfg.exe
Token: SeLockMemoryPrivilege	5892	explorer.exe

Suspicious use of FindShellTrayWindow 53 IoCs

Processes:

taskmgr.exemsedge.exe

pid	process
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
1760	msedge.exe

Suspicious use of SendNotifyMessage 51 IoCs

Processes:

taskmgr.exemsedge.exe

pid	process
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

GX_Builder.exeWinErrorMgr.exeKeyGeneratorTOP.exeKeyGeneratorTOP.exemsedge.exeWinErrorMgr.exe

description	pid	process	target process
PID 3764 wrote to memory of 4944	3764	GX_Builder.exe	powershell.exe
PID 3764 wrote to memory of 4944	3764	GX_Builder.exe	powershell.exe
PID 3764 wrote to memory of 4944	3764	GX_Builder.exe	powershell.exe
PID 3764 wrote to memory of 4244	3764	GX_Builder.exe	Ilkdt.exe
PID 3764 wrote to memory of 4244	3764	GX_Builder.exe	Ilkdt.exe
PID 3764 wrote to memory of 4244	3764	GX_Builder.exe	Ilkdt.exe
PID 3764 wrote to memory of 2148	3764	GX_Builder.exe	WinHostMgr.exe
PID 3764 wrote to memory of 2148	3764	GX_Builder.exe	WinHostMgr.exe
PID 3764 wrote to memory of 4428	3764	GX_Builder.exe	WinErrorMgr.exe
PID 3764 wrote to memory of 4428	3764	GX_Builder.exe	WinErrorMgr.exe
PID 3764 wrote to memory of 4428	3764	GX_Builder.exe	WinErrorMgr.exe
PID 3764 wrote to memory of 2916	3764	GX_Builder.exe	Sahyui1337.exe
PID 3764 wrote to memory of 2916	3764	GX_Builder.exe	Sahyui1337.exe
PID 3764 wrote to memory of 792	3764	GX_Builder.exe	KeyGeneratorTOP.exe
PID 3764 wrote to memory of 792	3764	GX_Builder.exe	KeyGeneratorTOP.exe
PID 4428 wrote to memory of 2820	4428	WinErrorMgr.exe	WinErrorMgr.exe
PID 4428 wrote to memory of 2820	4428	WinErrorMgr.exe	WinErrorMgr.exe
PID 4428 wrote to memory of 2820	4428	WinErrorMgr.exe	WinErrorMgr.exe
PID 792 wrote to memory of 3108	792	KeyGeneratorTOP.exe	KeyGeneratorTOP.exe
PID 792 wrote to memory of 3108	792	KeyGeneratorTOP.exe	KeyGeneratorTOP.exe
PID 3108 wrote to memory of 1760	3108	KeyGeneratorTOP.exe	msedge.exe
PID 3108 wrote to memory of 1760	3108	KeyGeneratorTOP.exe	msedge.exe
PID 1760 wrote to memory of 3032	1760	msedge.exe	msedge.exe
PID 1760 wrote to memory of 3032	1760	msedge.exe	msedge.exe
PID 2820 wrote to memory of 5024	2820	WinErrorMgr.exe	schtasks.exe
PID 2820 wrote to memory of 5024	2820	WinErrorMgr.exe	schtasks.exe
PID 2820 wrote to memory of 5024	2820	WinErrorMgr.exe	schtasks.exe
PID 1760 wrote to memory of 3484	1760	msedge.exe	msedge.exe
PID 1760 wrote to memory of 3484	1760	msedge.exe	msedge.exe
PID 1760 wrote to memory of 3484	1760	msedge.exe	msedge.exe
PID 1760 wrote to memory of 3484	1760	msedge.exe	msedge.exe
PID 1760 wrote to memory of 3484	1760	msedge.exe	msedge.exe
PID 1760 wrote to memory of 3484	1760	msedge.exe	msedge.exe
PID 1760 wrote to memory of 3484	1760	msedge.exe	msedge.exe
PID 1760 wrote to memory of 3484	1760	msedge.exe	msedge.exe
PID 1760 wrote to memory of 3484	1760	msedge.exe	msedge.exe
PID 1760 wrote to memory of 3484	1760	msedge.exe	msedge.exe
PID 1760 wrote to memory of 3484	1760	msedge.exe	msedge.exe
PID 1760 wrote to memory of 3484	1760	msedge.exe	msedge.exe
PID 1760 wrote to memory of 3484	1760	msedge.exe	msedge.exe
PID 1760 wrote to memory of 3484	1760	msedge.exe	msedge.exe
PID 1760 wrote to memory of 3484	1760	msedge.exe	msedge.exe
PID 1760 wrote to memory of 3484	1760	msedge.exe	msedge.exe
PID 1760 wrote to memory of 3484	1760	msedge.exe	msedge.exe
PID 1760 wrote to memory of 3484	1760	msedge.exe	msedge.exe
PID 1760 wrote to memory of 3484	1760	msedge.exe	msedge.exe
PID 1760 wrote to memory of 3484	1760	msedge.exe	msedge.exe
PID 1760 wrote to memory of 3484	1760	msedge.exe	msedge.exe
PID 1760 wrote to memory of 3484	1760	msedge.exe	msedge.exe
PID 1760 wrote to memory of 3484	1760	msedge.exe	msedge.exe
PID 1760 wrote to memory of 3484	1760	msedge.exe	msedge.exe
PID 1760 wrote to memory of 3484	1760	msedge.exe	msedge.exe
PID 1760 wrote to memory of 3484	1760	msedge.exe	msedge.exe
PID 1760 wrote to memory of 3484	1760	msedge.exe	msedge.exe
PID 1760 wrote to memory of 3484	1760	msedge.exe	msedge.exe
PID 1760 wrote to memory of 3484	1760	msedge.exe	msedge.exe
PID 1760 wrote to memory of 3484	1760	msedge.exe	msedge.exe
PID 1760 wrote to memory of 3484	1760	msedge.exe	msedge.exe
PID 1760 wrote to memory of 3484	1760	msedge.exe	msedge.exe
PID 1760 wrote to memory of 3484	1760	msedge.exe	msedge.exe
PID 1760 wrote to memory of 3484	1760	msedge.exe	msedge.exe
PID 1760 wrote to memory of 3484	1760	msedge.exe	msedge.exe
PID 1760 wrote to memory of 3484	1760	msedge.exe	msedge.exe
PID 1760 wrote to memory of 3484	1760	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\GX_Builder.exe
"C:\Users\Admin\AppData\Local\Temp\GX_Builder.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3764
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHkAeAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGcAeQB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHYAeAB3ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHkAcQBsACMAPgA="
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4944
- C:\Users\Admin\AppData\Local\Temp\Ilkdt.exe
  "C:\Users\Admin\AppData\Local\Temp\Ilkdt.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4244
- C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe
  "C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:2148
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4944
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:5504
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:5496
  - - C:\Windows\system32\wusa.exe
      wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      PID:5628
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:5592
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop wuauserv
    3⤵
    - Launches sc.exe
    PID:5692
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop bits
    3⤵
    - Launches sc.exe
    PID:5760
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop dosvc
    3⤵
    - Launches sc.exe
    PID:5812
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "GMDTJRUT"
    3⤵
    - Launches sc.exe
    PID:5916
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5908
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5900
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
    3⤵
    PID:5892
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5884
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "GMDTJRUT" binpath= "C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:3092
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "GMDTJRUT"
    3⤵
    - Launches sc.exe
    PID:5192
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:5180
- C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe
  "C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:792
- C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe
  "C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2916
- C:\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe
  "C:\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4428

C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe
"C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://onepiecered.co/s?mH4q
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,14973788773495357066,16304850242959727996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3100 /prefetch:1
    3⤵
    PID:3092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,14973788773495357066,16304850242959727996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3092 /prefetch:1
    3⤵
    PID:3140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,14973788773495357066,16304850242959727996,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,14973788773495357066,16304850242959727996,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
    3⤵
    PID:3484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,14973788773495357066,16304850242959727996,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3368 /prefetch:8
    3⤵
    PID:3496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,14973788773495357066,16304850242959727996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3964 /prefetch:1
    3⤵
    PID:2368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,14973788773495357066,16304850242959727996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4896 /prefetch:1
    3⤵
    PID:2552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,14973788773495357066,16304850242959727996,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
    3⤵
    PID:4920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,14973788773495357066,16304850242959727996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:1
    3⤵
    PID:728
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,14973788773495357066,16304850242959727996,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5924 /prefetch:8
    3⤵
    PID:5248
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,14973788773495357066,16304850242959727996,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5924 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,14973788773495357066,16304850242959727996,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4088 /prefetch:1
    3⤵
    PID:4456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,14973788773495357066,16304850242959727996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
    3⤵
    PID:5468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,14973788773495357066,16304850242959727996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
    3⤵
    PID:5964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,14973788773495357066,16304850242959727996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
    3⤵
    PID:3060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,14973788773495357066,16304850242959727996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6204 /prefetch:1
    3⤵
    PID:5136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,14973788773495357066,16304850242959727996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6508 /prefetch:1
    3⤵
    PID:2552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,14973788773495357066,16304850242959727996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6852 /prefetch:1
    3⤵
    PID:5376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2140,14973788773495357066,16304850242959727996,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6064 /prefetch:8
    3⤵
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:5536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2140,14973788773495357066,16304850242959727996,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6572 /prefetch:8
    3⤵
    PID:5848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,14973788773495357066,16304850242959727996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:1
    3⤵
    PID:6024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,14973788773495357066,16304850242959727996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6620 /prefetch:1
    3⤵
    PID:5844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,14973788773495357066,16304850242959727996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7152 /prefetch:1
    3⤵
    PID:5224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,14973788773495357066,16304850242959727996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6900 /prefetch:1
    3⤵
    PID:4924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,14973788773495357066,16304850242959727996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6588 /prefetch:1
    3⤵
    PID:3696

C:\Users\Admin\AppData\Local\Temp\XenoManager\WinErrorMgr.exe
"C:\Users\Admin\AppData\Local\Temp\XenoManager\WinErrorMgr.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /Create /TN "WindowsErrorHandler" /XML "C:\Users\Admin\AppData\Local\Temp\tmp409E.tmp" /F
  2⤵
  - Creates scheduled task(s)
  PID:5024

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff8318e46f8,0x7ff8318e4708,0x7ff8318e4718
1⤵
PID:3032

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4148

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2380

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3136

C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe
C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:5384
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5416
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:5828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  PID:5736
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:3228
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:1440
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:5996
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:5656
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:3080
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2612
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:1444
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5532
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:212
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2056
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:5892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe

Filesize
2.3MB

MD5
463295cf71442527887e9829cf7a8fe2

SHA1
1e52ca2af70ff8bfb59002061c8c79fa59860b1f

SHA256
e5e092715dd418f5d05631aefd04012a9840d7d448bec445fdfa9be6fd5afb1d

SHA512
bd73b3251865da1dcaad357dfd4e0faa526cce6466f0bc2a9991c9f4890fa9c2a8e3af9346a737f5ca7b784aedd5e07ef09f69819de1093035f60c013de71c1f

Download Submit
C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe

Filesize
1.6MB

MD5
1f2a8bda5d3c8c29b3c2a933c1061d01

SHA1
45681af3d6c5d7475cbc722124ad0393ebc3b21c

SHA256
a8e3acb0a09ce4c2d69040f2dcebc01fbfac09cb906d921091da2547d58688e9

SHA512
00362d49968356210c873adecc3061996b5351f3881738430738cf9445f6d8e44b6894df13e0cef60fa2820d7dd2f97cf23859785c9c93654b1863068962f4cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\WinErrorMgr.exe.log

Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
aa6f46176fbc19ccf3e361dc1135ece0

SHA1
cb1f8c693b88331e9513b77efe47be9e43c43b12

SHA256
2f5ba493c7c4192e9310cea3a96cfec4fd14c6285af6e3659627ab177e560819

SHA512
5d26fdffebeb1eb5adde9f7da19fe7069e364d3f68670013cb0cc3e2b40bf1fbcb9bdebbfe999747caf141c88ccd53bd4acf2074283e4bde46b8c28fbae296f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1af9fbc1d4655baf2df9e8948103d616

SHA1
c58d5c208d0d5aab5b6979b64102b0086799b0bf

SHA256
e83daa7b2af963dbb884d82919710164e2337f0f9f5e5c56ee4b7129d160c135

SHA512
714d0ff527a8a24ec5d32a0a2b74e402ee933ea86e42d3e2fb5615c8345e6c09aa1c2ddf2dea53d71c5a666483a3b494b894326fea0cc1d8a06d3b32ec9397d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000037

Filesize
106KB

MD5
4eea01e22f421ce082cb210d0f806eef

SHA1
3ff509ccd8ce5db1877227e800053b8cf94a7c24

SHA256
8c735544e463345ad56a4666c9b68d1390b9eb889828282ef9be52c93c35aa80

SHA512
96ec7c9ccc9968c09fb4ec2b02f85dd9731749a500caf4b2fafbf3b81af70487934d0808d71d92c1f7fec7005a81cde9555e528683ac75248cf20506181d2005

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
2c6afc7818c5b42383df7fa7c12047f5

SHA1
37bf71ccf2767ca60f9728fb8a18fb368123592f

SHA256
8480e9564aeb4d6a156f7f9900f9aed3f7c42a2897eec759f16ff907722cf28c

SHA512
b2fda8a7a7adf1cc4b8c80156739cc2e70d4374a91c9d7af35ddc0491d412e44e0d5cda032c8c5d21b7abf3f383abed709b8f5d4eaa974fe75765238d0e88f70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
08076d847fd9bdaf3436520bbc83a72a

SHA1
17c25929b8ff2b2854e3b284cbe1c403ee55468c

SHA256
e99eebf60ea44c6ec0d5222cb9abc602519a4b6c76f8b5a5bd12039bd9a60787

SHA512
f8f18da1bd3834bf3772db4ab2ecb11aee1eb139ceebac6cfb763fcf41d5c3e71636cf276698ce1247411ef71d0fe67567c6b6e460219190740ebc0b69ec69bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d054791bd212829e04f2782b1082ba1b

SHA1
6ec7f6dfff3cf3236e685c962545db52f0e21a0a

SHA256
1ac6898ff06f1c8d4c3538938a8ce424fecca16186064a7c3ba620dd232fec22

SHA512
dc9afc0f93ad8aca7c3e6baaae62d46215deb9a421a426d2a5564b436d78384139cd2053649b53523b764b1073a5e29de2976076710fca1e49b43289fce90a94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
36792a950906e3e346150669935d8249

SHA1
b7c388f80c5745a6aa5ddbf461d30d880226acde

SHA256
aa4b54a70a6ed90d1531cd4d4c655c72268bfe55a4527340aad316e4bec148f5

SHA512
2f714ee472aa1dc3daee4d3240ec213e1a5358c50516c2a03b3a70eaade5b3030e2d55376dc818e4463aa9149a518337423705506cfc69f508862d60f3e2a4c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
d5fb450d3dbfea956108a2cfd2025178

SHA1
45208aed934fb60894fec456f1e820b2b9a0a7cb

SHA256
a6b4236d5a54f1095fb7209812c33be14801a2134b3d3a1e862338bea81aa7d3

SHA512
e007abb72c93c53f3253b0e6702585cb9d457d62e20d21053c5b7c17093aee8e8f649ff3dc3afd3c7929232fd67c9edf0926de2b81b48363eabb55551eafcec3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
4769799adaf0b2b240c1fd568553cb50

SHA1
270253dbc4413c64b4e2b35e93435761a47a8492

SHA256
c2af55822929057b31fdadbc91954fdc331801f0b1eb2944fe1773a733671253

SHA512
eb31e95d5489eaa0aa438c4b18c847c639116cef649afbb6203a2ba23fc3d2d8a6a0c91d683e51fc46608984d70cd604bd73f5c9eaecd7d2c7bd7dd2d472346f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7ba1efd418b6580e0a1367fc4e2d4720

SHA1
062a9b49e2774c00d738f605862048d17f1a5531

SHA256
810b36fe3e3273a74a25ae259b5834fc7223ca0a35087d221892e52384507f71

SHA512
318efc3f09a46d2f7a931a8428123c67f34c9bc246dfe6cfb70dda97dca893d486652a8e1617517fee8e057e717e5ae8dcdacafcfe471b0eee0fefb2a89550ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c1eb0cde2406b6af565f825dcd492589d40ab644\index.txt

Filesize
93B

MD5
d578de8c76fd8ea6c34d8ea9504fdac9

SHA1
afef202ff0f9b235f86ae84e5cb441740c14fa37

SHA256
b127a5cf9a9fb90e079484249087879bde0c421fb6d8a08d966a52a3fb0b648b

SHA512
ea07f933645f80bf5e77195d6bb0ad0c8dfc8db493447a4995e940db16a1bfbb11c6a122af44d8f7c198c9cf033a6338da99f637480c326938e62f2a3aafc0d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
3b3822e6eb7522c62ebdf512b4b2c491

SHA1
42d43078aa93b47f604fda86901ea87cecdae65a

SHA256
b41a6a551c56ef4c7b8c1466c14b85ff2a93aa3f51e98b1300fbd9a90a298352

SHA512
30b071735635a351dd2558cf52c8bdf51929d332ddc850c7a7c24feca153cce5062b10b1c6acdaf03305aba0a92d4412d4ddb18dc4e274f32a387330f37e7640

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58d174.TMP

Filesize
48B

MD5
3ed732d8dfd685f82f7808ffe4ee51a5

SHA1
3594991bb6fcacb3a5d13fdeac000b9feae8203e

SHA256
2321b3682cccb08348a21b523dd890d2e9b97c09df81247b58c43b4d32fd5194

SHA512
08fce99159c01a7402e56f508415014607de7c6195f77362bd470290711b7a12c7cc06d3dfb840caba23c1eb2381a840719b72fbb2a68048ae3f9a95699e10e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
a7351c5c6a1baa3ff4804ddc2c903cb5

SHA1
94c282e2d0b63bee51d3ea7cc778fd8f04cc2893

SHA256
cef5439a50f279152bfa7b9b5cb7ef9db44a3443b0b02255cc2af544783a48f3

SHA512
932939cb717f3ffcb7489e006d0bd32a7d06fa78b3f6106ed279c12657f3e1d5dbf4335e01fc3bc7d20b12672593accf7ca095f3a87416199e7907f6ed574202

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
34af8a5ab8c12227b80cc2d28d988f7a

SHA1
dff9aa5227fd25162c9456a1dc58f35176f8c1b4

SHA256
3fae8f1ed538576b98022af5db7ba083be7498bd3e0f98ccf4cb3d9220f58a96

SHA512
7e5a66a44781150fd5bb0bf83a5a1bd38f54c101aeabe750791caaf906414c6c938ab1465f084f09268adf661a1efd4cc393efa6a5c79e97a30f4a29d4f39329

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
d7f6700d1ac238a75d84f8feb10671d3

SHA1
a961c17d3d4c90caffe22b06cd103f0233993801

SHA256
405af9a37ec41cc9b1a2677c7ffd3c691e45f33ae8407aad6eac122adb9d2f2e

SHA512
7305ffa9a1688f2fbe94251ee31069a205b3597082d3b0b6cf5e9760af75e9849c96af7b66f2db08c5be21a97a54241d8d46d1373f64fb35db6ba6e708bfe3aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
9700e9976384cd567b8061b16ac1ce50

SHA1
b5e2e6e452c05ce31523778ad0993eb346821266

SHA256
a16aeede7876b0d9877dac089213d33c4f59cd8f6b310aa3f0ef17e23a65670e

SHA512
faecbbd5859d0887b781958046ee33ab3fa5694aac4868c1191043166f22ea274deb358e93dbef7b30bf21a29eed60144f3c52bc467bb5a75706dbbf09f11d82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58a9c8.TMP

Filesize
371B

MD5
c91bc9ccd0f1f5af7f62a041bacabb7e

SHA1
b71840d7c2fa394a3b6590e36e689aa9cef2419b

SHA256
82241ac7ca9da94f438e57aa73377f330e7ea5c7d3a216f8892859fc3229a21d

SHA512
b91408bb77ca052c8646d07452a1e6b56acd63d621f01803d5f2e81522927ba1ffa2c92d226dc8f902cd068cc434712225f51d772cdea7c56b40a9592fb46a17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
72b2c00b85825e688144b1fc5f9fa984

SHA1
02d3ca9ae1292138aea31286595f1fa2b3700791

SHA256
e0b019265d072bbff431a4ad02220fa77582de12dbee4541517ddafdece77f69

SHA512
d44608fcd50dc759d2f1d365e745ec47e6a10d001e9bdeeb3cae09c2b462d18dc716c8a565e7c0b9eee73461b1a5df0be208dd1000d60d45b326decec9794dbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5d09acc2e152345c2afd8f3e0a4b8431

SHA1
6be78e8c093ea658365db05f80ae7910d2bbce98

SHA256
ee8735b85bd70c3df44d96a00537816debf27d93a8d4bdd16c7ed00cef14e2bb

SHA512
30af099122c1494cc02589828ad8e8db3963853d893e4a043a431b693cfd110ed7867e085329972ae990e5084824138d4526c2cc62a8905c385af2cf664c6e19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
f66b88db88d51dc928edebb0415192b5

SHA1
2c517372baedc29719f5547ae7c472bed8f13d3e

SHA256
4889910385bb5c108353bda05a3c943a70be4cb2463cab47501d35d3162cd90d

SHA512
50b3667146b4a0ea4a2acb92f530b807009ea70220ae0d965a43dc8470bf9fe0017ef8971eacc5e65e4eb9bf5d0956fd684f6088e330f9c45b5fb44bc3c6658c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ilkdt.exe

Filesize
191KB

MD5
e004a568b841c74855f1a8a5d43096c7

SHA1
b90fd74593ae9b5a48cb165b6d7602507e1aeca4

SHA256
d49013d6be0f0e727c0b53bce1d3fed00656c7a2836ceef0a9d4cb816a5878db

SHA512
402dd4d4c57fb6f5c7a531b7210a897dfe41d68df99ae4d605944f6e5b2cecaafa3fe27562fe45e7e216a7c9e29e63139d4382310b41f04a35ad56115fbed2af

Download Submit
C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe

Filesize
3.6MB

MD5
22bf2c033ecca133ce95d36b4ee58762

SHA1
5db7259c6754b05b57140b681adc2902c48d2953

SHA256
b2213b53bad972c612612a443f8fc5241ea2261e174b6528102e8e0433c4c2e2

SHA512
37c1d72ccf4f8054bbcb07caa5fcbcae5f7b5cc558902337383a389e3d4f0b949414d526d3eb32ba1cb84ab9a1749233256487e210ca8eec23713f92d8bb9261

Download Submit
C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe

Filesize
1.6MB

MD5
a54d708270eebee29e5673a6b4e1399a

SHA1
a64955bb206bd8422c12bdf3b35cc0cc624743ae

SHA256
64065fe6e9dc1afd340f16166c1fc62043bff036603172e3102d29838f40706c

SHA512
a6c347c407a59c1f58a135145a8938bf372a2fac4dae31ee5750849b1f6937bb3945bf7f1e3bec4f53b0a0526dd22ffd68c1168ab035aa4d28fbb5a4838c9261

Download Submit
C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe

Filesize
1.3MB

MD5
eec5bcfd6b46536342e9147a3d105fb0

SHA1
856d175b2403b86233a86ea491252c6363832cdd

SHA256
bdeea390cf16dc4ccc675faa173e7bfe5801ae671c4b487d49a423711e7cfb85

SHA512
15a6ac17787f0e132e57c36dfa1f6d8dbaa18e22f6c6b37d837f16984e1f05e9e798b5cff0e7332a1c607225b2a6bef3adb36531b0a6591226d85f3cc7c3ef46

Download Submit
C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe

Filesize
512KB

MD5
ae6bd9089e0ac4272d650941b352e176

SHA1
bddd00e08690f1588f57a4c08f68c83643dc2a48

SHA256
743151cf89944fbe79eee96abe66c4f214ea954146f7645b4872763d2cfeace7

SHA512
e269110a140feffec07ba26c797ffc23f8b3b7332ebe299b64eaf831167d4ca03814560f9a3c8fbcf16a09134f8e1c1d4ace2f03c130e441aac5dcf2e95c9b84

Download Submit
C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe

Filesize
316KB

MD5
675d9e9ab252981f2f919cf914d9681d

SHA1
7485f5c9da283475136df7fa8b62756efbb5dd17

SHA256
0f055835332ef8e368185ae461e7c9eacdeb3d600ea550d605b09a20e0856e2d

SHA512
9dd936705fd43ebe8be17fcf77173eaaf16046f5880f8fe48fc68ded91ef6202ba65c605980bd2e330d2c7f463f772750a1bd96246fffdc9cb6bf8e1b00a2ccb

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe

Filesize
42KB

MD5
d499e979a50c958f1a67f0e2a28af43d

SHA1
1e5fa0824554c31f19ce01a51edb9bed86f67cf0

SHA256
bc3d545c541e42420ce2c2eabc7e5afab32c869a1adb20adb11735957d0d0b0e

SHA512
668047f178d82bebefeb8c2e7731d34ff24dc755dacd3362b43d8b44c6b148fc51af0d0ab2d0a67f0344ab6158b883fe568e4eeb0e34152108735574f0e1e763

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe

Filesize
4.1MB

MD5
d4590c58d28d7fba8a923192711feda5

SHA1
980cb52068d314d08636d1fce02de60c70f8a518

SHA256
47a02a0934e6af733319a571a9b7d0953aba93986021cd01db0057c7c498332d

SHA512
6dabdf20bf0a45a7b4620ba526c82022ed518a72c682a860e335b33ee691c939ac304c7c78e7be26df57b436276d631d44e321791cc2d8515408308d37d8697d

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe

Filesize
1.8MB

MD5
9c84341b4b74067c2192ccc640e684b6

SHA1
98d49b38de83f9c3b888a3aff48bd781c4cc849e

SHA256
b51f3ed25d80bef20b492e122d75ef8fa2ee177fca92dc6117ec023d58e2f48b

SHA512
ded1eeba8ebde27c9fc2511246f13e16e3ba3b82fa0f84a6260eaab911ca5f163ac7d64646c71cdb1a4c58d15cb9ea2e66ae8dbe1a2a66c967f8b9d8cc3f90d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe

Filesize
2.2MB

MD5
b29ec7c5a1c5d5d4c7907e868ebb18c0

SHA1
9012305a6cdaec6a486859238e5f990db540f5ba

SHA256
1ad1818ababd28afd6b84c260773387082ca9da5a397f1b3e8b8b8b02b5b7e39

SHA512
1b905d5bd8bcf6d49c3ba3617cbe121d0f1957a2a58d0ec83fdd03e83452fa8ef3608d36015206bb8d39711247a6b2f8b9bd16c5a37f73d83a6caa2fa9ba324f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7922\VCRUNTIME140.dll

Filesize
116KB

MD5
be8dbe2dc77ebe7f88f910c61aec691a

SHA1
a19f08bb2b1c1de5bb61daf9f2304531321e0e40

SHA256
4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

SHA512
0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7922\_bz2.pyd

Filesize
82KB

MD5
90f58f625a6655f80c35532a087a0319

SHA1
d4a7834201bd796dc786b0eb923f8ec5d60f719b

SHA256
bd8621fcc901fa1de3961d93184f61ea71068c436794af2a4449738ccf949946

SHA512
b5bb1ecc195700ad7bea5b025503edd3770b1f845f9beee4b067235c4e63496d6e0b19bdd2a42a1b6591d1131a2dc9f627b2ae8036e294300bb6983ecd644dc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7922\_decimal.pyd

Filesize
247KB

MD5
f78f9855d2a7ca940b6be51d68b80bf2

SHA1
fd8af3dbd7b0ea3de2274517c74186cb7cd81a05

SHA256
d4ae192bbd4627fc9487a2c1cd9869d1b461c20cfd338194e87f5cf882bbed12

SHA512
6b68c434a6f8c436d890d3c1229d332bd878e5777c421799f84d79679e998b95d2d4a013b09f50c5de4c6a85fcceb796f3c486e36a10cbac509a0da8d8102b18

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7922\_hashlib.pyd

Filesize
64KB

MD5
8baeb2bd6e52ba38f445ef71ef43a6b8

SHA1
4132f9cd06343ef8b5b60dc8a62be049aa3270c2

SHA256
6c50c9801a5caf0bb52b384f9a0d5a4aa182ca835f293a39e8999cf6edf2f087

SHA512
804a4e19ea622646cea9e0f8c1e284b7f2d02f3620199fa6930dbdadc654fa137c1e12757f87c3a1a71ceff9244aa2f598ee70d345469ca32a0400563fe3aa65

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7922\_lzma.pyd

Filesize
155KB

MD5
cf8de1137f36141afd9ff7c52a3264ee

SHA1
afde95a1d7a545d913387624ef48c60f23cf4a3f

SHA256
22d10e2d6ad3e3ed3c49eb79ab69a81aaa9d16aeca7f948da2fe80877f106c16

SHA512
821985ff5bc421bd16b2fa5f77f1f4bf8472d0d1564bc5768e4dbe866ec52865a98356bb3ef23a380058acd0a25cd5a40a1e0dae479f15863e48c4482c89a03f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7922\_socket.pyd

Filesize
81KB

MD5
439b3ad279befa65bb40ecebddd6228b

SHA1
d3ea91ae7cad9e1ebec11c5d0517132bbc14491e

SHA256
24017d664af20ee3b89514539345caac83eca34825fcf066a23e8a4c99f73e6d

SHA512
a335e1963bb21b34b21aef6b0b14ba8908a5343b88f65294618e029e3d4d0143ea978a5fd76d2df13a918ffab1e2d7143f5a1a91a35e0cc1145809b15af273bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7922\base_library.zip

Filesize
1.1MB

MD5
440a985edd19118efb6024239abc687b

SHA1
f9d2040369133e2f3dca3b09aafc5d27d7b21cb3

SHA256
78e9e50701af6cd0e3f4ff1f206ec5985d66fbc918a44768b1091db86376c30a

SHA512
1e21e1e1931d7835272bad87197aa921d620ecfc0729dbe5c7db6143a0f06a40e307cc93e9719005473535469c4e18bedd813b68711150e31b6a04b4439043f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7922\libcrypto-3.dll

Filesize
3.6MB

MD5
4e5122f3f6ea2647060331ed85e56176

SHA1
bff7680603fd2f5041b30fb12e71c3bd92540a9d

SHA256
7a848336407b86f951703d428396a4ed0be9068d8bc7e528b4a57b3d396da3b3

SHA512
59b8e0d47321b3000b666a0e064d6408d9b7c7e5c91363fb1007080371a75a73d6fd43ed148d78cf4ce59a4510bae6ea70025e3254f6891aa6b4503e576742d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7922\python312.dll

Filesize
3.2MB

MD5
14f0b3b491e5c8a51002579f3b9dc997

SHA1
c1bc0fed162a63051be9dac51cd4ade01530039e

SHA256
06e86d99df7f1f5b3ea675b0d091c28297b222abcd99ba761c4fa06f12a97bc7

SHA512
fb2229506324ddfd9b015d92806fe01577f7821c66b2ce2baae2f1aa8fe6128f48e5e8c6512a6dc45c119fc32e604824e1c5e6a68cabe08973cd28c31f32d659

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7922\python312.dll

Filesize
3.0MB

MD5
e9900be3a532f7c510d311d394412b60

SHA1
5503e3ebd021395f1628651978fc997b6f98a36b

SHA256
e446304a653077e8b97398ecaec384b0294d3a8d2b49313c58c6a403c8d65934

SHA512
3345a1d7df111122875901b8ed0696d45ad3b096bca9d4687775878390e8d44aa4b103d49de58c36bcb96081881ed7c60f44ff230f223bb7d3348f213c6a5187

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7922\select.pyd

Filesize
29KB

MD5
e1604afe8244e1ce4c316c64ea3aa173

SHA1
99704d2c0fa2687997381b65ff3b1b7194220a73

SHA256
74cca85600e7c17ea6532b54842e26d3cae9181287cdf5a4a3c50af4dab785e5

SHA512
7bf35b1a9da9f1660f238c2959b3693b7d9d2da40cf42c6f9eba2164b73047340d0adff8995049a2fe14e149eba05a5974eee153badd9e8450f961207f0b3d42

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7922\unicodedata.pyd

Filesize
1.1MB

MD5
fc47b9e23ddf2c128e3569a622868dbe

SHA1
2814643b70847b496cbda990f6442d8ff4f0cb09

SHA256
2a50d629895a05b10a262acf333e7a4a31db5cb035b70d14d1a4be1c3e27d309

SHA512
7c08683820498fdff5f1703db4ad94ad15f2aa877d044eddc4b54d90e7dc162f48b22828cd577c9bb1b56f7c11f777f9785a9da1867bf8c0f2b6e75dc57c3f53

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_khaphl43.kj0.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp409E.tmp

Filesize
1KB

MD5
7f673f709ab0e7278e38f0fd8e745cd4

SHA1
ac504108a274b7051e3b477bcd51c9d1a4a01c2c

SHA256
da5ab3278aaa04fbd51272a617aef9b903ca53c358fac48fc0f558e257e063a4

SHA512
e932ccbd9d3ec6ee129f0dab82710904b84e657532c5b623d3c7b3b4ce45732caf8ff5d7b39095cf99ecf97d4e40dd9d755eb2b89c8ede629b287c29e41d1132

Download Submit
\??\pipe\LOCAL\crashpad_1760_CHODJYXXPYXYRFVW

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2820-2168-0x00000000025F0000-0x0000000002600000-memory.dmp

Filesize
64KB

Download
memory/2820-2167-0x00000000739F0000-0x00000000741A0000-memory.dmp

Filesize
7.7MB

Download
memory/2820-98-0x00000000739F0000-0x00000000741A0000-memory.dmp

Filesize
7.7MB

Download
memory/2916-62-0x00007FF821940000-0x00007FF822401000-memory.dmp

Filesize
10.8MB

Download
memory/2916-105-0x00007FF821940000-0x00007FF822401000-memory.dmp

Filesize
10.8MB

Download
memory/2916-41-0x000001428EB40000-0x000001428EB94000-memory.dmp

Filesize
336KB

Download
memory/2916-87-0x00000142A91E0000-0x00000142A91F0000-memory.dmp

Filesize
64KB

Download
memory/4244-144-0x0000000005880000-0x00000000058E5000-memory.dmp

Filesize
404KB

Download
memory/4244-96-0x0000000005880000-0x00000000058E5000-memory.dmp

Filesize
404KB

Download
memory/4244-154-0x0000000005880000-0x00000000058E5000-memory.dmp

Filesize
404KB

Download
memory/4244-152-0x0000000005880000-0x00000000058E5000-memory.dmp

Filesize
404KB

Download
memory/4244-150-0x0000000005880000-0x00000000058E5000-memory.dmp

Filesize
404KB

Download
memory/4244-148-0x0000000005880000-0x00000000058E5000-memory.dmp

Filesize
404KB

Download
memory/4244-146-0x0000000005880000-0x00000000058E5000-memory.dmp

Filesize
404KB

Download
memory/4244-103-0x0000000005880000-0x00000000058E5000-memory.dmp

Filesize
404KB

Download
memory/4244-142-0x0000000005880000-0x00000000058E5000-memory.dmp

Filesize
404KB

Download
memory/4244-140-0x0000000005880000-0x00000000058E5000-memory.dmp

Filesize
404KB

Download
memory/4244-138-0x0000000005880000-0x00000000058E5000-memory.dmp

Filesize
404KB

Download
memory/4244-174-0x0000000005880000-0x00000000058E5000-memory.dmp

Filesize
404KB

Download
memory/4244-176-0x0000000005880000-0x00000000058E5000-memory.dmp

Filesize
404KB

Download
memory/4244-107-0x0000000005880000-0x00000000058E5000-memory.dmp

Filesize
404KB

Download
memory/4244-2084-0x00000000739F0000-0x00000000741A0000-memory.dmp

Filesize
7.7MB

Download
memory/4244-180-0x0000000005880000-0x00000000058E5000-memory.dmp

Filesize
404KB

Download
memory/4244-169-0x0000000005880000-0x00000000058E5000-memory.dmp

Filesize
404KB

Download
memory/4244-50-0x00000000739F0000-0x00000000741A0000-memory.dmp

Filesize
7.7MB

Download
memory/4244-63-0x0000000005880000-0x00000000058E5000-memory.dmp

Filesize
404KB

Download
memory/4244-120-0x0000000005880000-0x00000000058E5000-memory.dmp

Filesize
404KB

Download
memory/4244-189-0x0000000005880000-0x00000000058E5000-memory.dmp

Filesize
404KB

Download
memory/4244-191-0x0000000005880000-0x00000000058E5000-memory.dmp

Filesize
404KB

Download
memory/4244-193-0x0000000005880000-0x00000000058E5000-memory.dmp

Filesize
404KB

Download
memory/4244-88-0x0000000005880000-0x00000000058E5000-memory.dmp

Filesize
404KB

Download
memory/4244-196-0x0000000005880000-0x00000000058E5000-memory.dmp

Filesize
404KB

Download
memory/4244-198-0x0000000005880000-0x00000000058E5000-memory.dmp

Filesize
404KB

Download
memory/4244-200-0x0000000005880000-0x00000000058E5000-memory.dmp

Filesize
404KB

Download
memory/4244-202-0x0000000005880000-0x00000000058E5000-memory.dmp

Filesize
404KB

Download
memory/4244-206-0x0000000005880000-0x00000000058E5000-memory.dmp

Filesize
404KB

Download
memory/4244-208-0x0000000005880000-0x00000000058E5000-memory.dmp

Filesize
404KB

Download
memory/4244-94-0x00000000059A0000-0x00000000059B0000-memory.dmp

Filesize
64KB

Download
memory/4244-210-0x0000000005880000-0x00000000058E5000-memory.dmp

Filesize
404KB

Download
memory/4244-212-0x0000000005880000-0x00000000058E5000-memory.dmp

Filesize
404KB

Download
memory/4244-47-0x0000000000F70000-0x0000000000FA6000-memory.dmp

Filesize
216KB

Download
memory/4244-55-0x0000000005880000-0x00000000058EC000-memory.dmp

Filesize
432KB

Download
memory/4244-60-0x0000000005880000-0x00000000058E5000-memory.dmp

Filesize
404KB

Download
memory/4244-57-0x0000000005880000-0x00000000058E5000-memory.dmp

Filesize
404KB

Download
memory/4244-58-0x0000000005880000-0x00000000058E5000-memory.dmp

Filesize
404KB

Download
memory/4428-91-0x00000000739F0000-0x00000000741A0000-memory.dmp

Filesize
7.7MB

Download
memory/4428-46-0x0000000000EE0000-0x0000000000EF0000-memory.dmp

Filesize
64KB

Download
memory/4944-177-0x0000000007FA0000-0x000000000861A000-memory.dmp

Filesize
6.5MB

Download
memory/4944-157-0x0000000074320000-0x000000007436C000-memory.dmp

Filesize
304KB

Download
memory/4944-1026-0x00007FF81E9C0000-0x00007FF81F481000-memory.dmp

Filesize
10.8MB

Download
memory/4944-1028-0x0000015EFBC20000-0x0000015EFBC30000-memory.dmp

Filesize
64KB

Download
memory/4944-1034-0x0000015EFBBA0000-0x0000015EFBBC2000-memory.dmp

Filesize
136KB

Download
memory/4944-367-0x0000000007C90000-0x0000000007C98000-memory.dmp

Filesize
32KB

Download
memory/4944-1095-0x00007FF81E9C0000-0x00007FF81F481000-memory.dmp

Filesize
10.8MB

Download
memory/4944-361-0x0000000007CA0000-0x0000000007CBA000-memory.dmp

Filesize
104KB

Download
memory/4944-352-0x0000000007BC0000-0x0000000007BD4000-memory.dmp

Filesize
80KB

Download
memory/4944-54-0x00000000056F0000-0x0000000005D18000-memory.dmp

Filesize
6.2MB

Download
memory/4944-56-0x00000000739F0000-0x00000000741A0000-memory.dmp

Filesize
7.7MB

Download
memory/4944-340-0x0000000007BB0000-0x0000000007BBE000-memory.dmp

Filesize
56KB

Download
memory/4944-203-0x0000000007B50000-0x0000000007B61000-memory.dmp

Filesize
68KB

Download
memory/4944-90-0x0000000003000000-0x0000000003010000-memory.dmp

Filesize
64KB

Download
memory/4944-101-0x0000000005F50000-0x0000000005FB6000-memory.dmp

Filesize
408KB

Download
memory/4944-97-0x0000000005660000-0x0000000005682000-memory.dmp

Filesize
136KB

Download
memory/4944-76-0x0000000003000000-0x0000000003010000-memory.dmp

Filesize
64KB

Download
memory/4944-42-0x0000000003050000-0x0000000003086000-memory.dmp

Filesize
216KB

Download
memory/4944-104-0x0000000006030000-0x0000000006096000-memory.dmp

Filesize
408KB

Download
memory/4944-114-0x00000000060A0000-0x00000000063F4000-memory.dmp

Filesize
3.3MB

Download
memory/4944-135-0x0000000006620000-0x000000000663E000-memory.dmp

Filesize
120KB

Download
memory/4944-136-0x00000000066D0000-0x000000000671C000-memory.dmp

Filesize
304KB

Download
memory/4944-156-0x00000000075B0000-0x00000000075E2000-memory.dmp

Filesize
200KB

Download
memory/4944-595-0x00000000739F0000-0x00000000741A0000-memory.dmp

Filesize
7.7MB

Download
memory/4944-195-0x0000000007BE0000-0x0000000007C76000-memory.dmp

Filesize
600KB

Download
memory/4944-182-0x00000000079C0000-0x00000000079CA000-memory.dmp

Filesize
40KB

Download
memory/4944-168-0x0000000007820000-0x00000000078C3000-memory.dmp

Filesize
652KB

Download
memory/4944-179-0x0000000007950000-0x000000000796A000-memory.dmp

Filesize
104KB

Download
memory/4944-173-0x0000000003000000-0x0000000003010000-memory.dmp

Filesize
64KB

Download
memory/4944-171-0x0000000003000000-0x0000000003010000-memory.dmp

Filesize
64KB

Download
memory/4944-170-0x000000007F810000-0x000000007F820000-memory.dmp

Filesize
64KB

Download
memory/4944-167-0x00000000077F0000-0x000000000780E000-memory.dmp

Filesize
120KB

Download
memory/5416-1350-0x0000017A4AB00000-0x0000017A4AB0A000-memory.dmp

Filesize
40KB

Download
memory/5416-1264-0x0000017A4A8D0000-0x0000017A4A8DA000-memory.dmp

Filesize
40KB

Download
memory/5416-1373-0x0000017A4AB50000-0x0000017A4AB5A000-memory.dmp

Filesize
40KB

Download
memory/5416-1368-0x0000017A4AB40000-0x0000017A4AB46000-memory.dmp

Filesize
24KB

Download
memory/5416-1365-0x0000017A4AB10000-0x0000017A4AB18000-memory.dmp

Filesize
32KB

Download
memory/5416-1361-0x0000017A4AB60000-0x0000017A4AB7A000-memory.dmp

Filesize
104KB

Download
memory/5416-2023-0x00007FF81E9C0000-0x00007FF81F481000-memory.dmp

Filesize
10.8MB

Download
memory/5416-1292-0x0000017A4AB20000-0x0000017A4AB3C000-memory.dmp

Filesize
112KB

Download
memory/5416-1179-0x00007FF81E9C0000-0x00007FF81F481000-memory.dmp

Filesize
10.8MB

Download
memory/5416-1243-0x00007FF47FA20000-0x00007FF47FA30000-memory.dmp

Filesize
64KB

Download
memory/5416-1256-0x0000017A4A900000-0x0000017A4A9B5000-memory.dmp

Filesize
724KB

Download
memory/5416-1257-0x0000017A4A410000-0x0000017A4A420000-memory.dmp

Filesize
64KB

Download
memory/5416-1253-0x0000017A4A8E0000-0x0000017A4A8FC000-memory.dmp

Filesize
112KB

Download
memory/5416-1181-0x0000017A4A410000-0x0000017A4A420000-memory.dmp

Filesize
64KB

Download
memory/5892-2143-0x0000000002160000-0x0000000002180000-memory.dmp

Filesize
128KB

Download