Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    1800s
  • max time network
    1802s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/02/2024, 20:33

General

  • Target

    VespyGrabberBuilder.exe

  • Size

    12.6MB

  • MD5

    fab385fb154644665f94aca9424fb0ce

  • SHA1

    8dc525108cebd97b3127129cc1633a7f31010424

  • SHA256

    c08b63c50a78ca119a5ff4fe10592a0f66289708df38349e91e645214aae7576

  • SHA512

    07def38b8590ebaa95d7213e77e3892f60f10a87cef797fa07c6feb033f08d4148024360c7c32b5f92441c41236b8a86e66cee59bb51d6fbde97b86923a640e3

  • SSDEEP

    393216:NayDfg/3Y8G6jgVINcfwt+F2CZZiLe2Wq:wyDfYPwPwtO2Mie2J

Malware Config

Extracted

Family

growtopia

C2

https://discord.com/api/webhooks/1199763266872803338/8vedcXoMcyExhe1xhBm5f8ncmafWmOB3pkulE0l8g9Pel0t3ziyr2V51cLTVEjYsE4Rj

Signatures

  • Detect ZGRat V1 34 IoCs
  • Growtopia

    Growtopa is an opensource modular stealer written in C#.

  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Creates new service(s) 1 TTPs
  • Stops running service(s) 3 TTPs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 4 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 4 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Launches sc.exe 14 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Detects Pyinstaller 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 50 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 22 IoCs
  • Suspicious use of FindShellTrayWindow 33 IoCs
  • Suspicious use of SendNotifyMessage 30 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\VespyGrabberBuilder.exe
    "C:\Users\Admin\AppData\Local\Temp\VespyGrabberBuilder.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2620
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHIAcgB3ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHEAZAB5ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAG4AdABwACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGkAYgBxACMAPgA="
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5088
    • C:\Users\Admin\AppData\Local\Temp\Ilkdt.exe
      "C:\Users\Admin\AppData\Local\Temp\Ilkdt.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1072
    • C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe
      "C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe"
      2⤵
      • Executes dropped EXE
      PID:4800
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:392
      • C:\Windows\system32\sc.exe
        C:\Windows\system32\sc.exe stop UsoSvc
        3⤵
        • Launches sc.exe
        PID:5228
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
        3⤵
          PID:5220
          • C:\Windows\system32\wusa.exe
            wusa /uninstall /kb:890830 /quiet /norestart
            4⤵
              PID:5304
          • C:\Windows\system32\sc.exe
            C:\Windows\system32\sc.exe stop WaaSMedicSvc
            3⤵
            • Launches sc.exe
            PID:5356
          • C:\Windows\system32\sc.exe
            C:\Windows\system32\sc.exe stop wuauserv
            3⤵
            • Launches sc.exe
            PID:5408
          • C:\Windows\system32\sc.exe
            C:\Windows\system32\sc.exe stop bits
            3⤵
            • Launches sc.exe
            PID:5496
          • C:\Windows\system32\sc.exe
            C:\Windows\system32\sc.exe stop dosvc
            3⤵
            • Launches sc.exe
            PID:5592
          • C:\Windows\system32\sc.exe
            C:\Windows\system32\sc.exe delete "GMDTJRUT"
            3⤵
            • Launches sc.exe
            PID:5716
          • C:\Windows\system32\powercfg.exe
            C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:5708
          • C:\Windows\system32\powercfg.exe
            C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:5700
          • C:\Windows\system32\powercfg.exe
            C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:5692
          • C:\Windows\system32\powercfg.exe
            C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:5684
          • C:\Windows\system32\sc.exe
            C:\Windows\system32\sc.exe create "GMDTJRUT" binpath= "C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe" start= "auto"
            3⤵
            • Launches sc.exe
            PID:5940
          • C:\Windows\system32\sc.exe
            C:\Windows\system32\sc.exe start "GMDTJRUT"
            3⤵
            • Launches sc.exe
            PID:6068
          • C:\Windows\system32\sc.exe
            C:\Windows\system32\sc.exe stop eventlog
            3⤵
            • Launches sc.exe
            PID:6060
        • C:\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe
          "C:\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe"
          2⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4656
          • C:\Users\Admin\AppData\Local\Temp\XenoManager\WinErrorMgr.exe
            "C:\Users\Admin\AppData\Local\Temp\XenoManager\WinErrorMgr.exe"
            3⤵
            • Executes dropped EXE
            PID:3516
            • C:\Windows\SysWOW64\schtasks.exe
              "schtasks.exe" /Create /TN "WindowsErrorHandler" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF24F.tmp" /F
              4⤵
              • Creates scheduled task(s)
              PID:1000
        • C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe
          "C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe"
          2⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:3184
        • C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe
          "C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe"
          2⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4888
      • C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe
        "C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe"
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2808
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://onepiecered.co/s?mH4q
          2⤵
          • Enumerates system info in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:2472
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,14767134679723242728,2097016893908463645,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:3400
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,14767134679723242728,2097016893908463645,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2636 /prefetch:8
            3⤵
              PID:3984
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,14767134679723242728,2097016893908463645,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
              3⤵
                PID:4856
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14767134679723242728,2097016893908463645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3112 /prefetch:1
                3⤵
                  PID:3592
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14767134679723242728,2097016893908463645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3104 /prefetch:1
                  3⤵
                    PID:8
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14767134679723242728,2097016893908463645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
                    3⤵
                      PID:4332
                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,14767134679723242728,2097016893908463645,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5324 /prefetch:8
                      3⤵
                        PID:4476
                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,14767134679723242728,2097016893908463645,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5324 /prefetch:8
                        3⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:2764
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14767134679723242728,2097016893908463645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
                        3⤵
                          PID:3136
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14767134679723242728,2097016893908463645,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
                          3⤵
                            PID:4848
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14767134679723242728,2097016893908463645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
                            3⤵
                              PID:4664
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14767134679723242728,2097016893908463645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
                              3⤵
                                PID:3172
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14767134679723242728,2097016893908463645,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1
                                3⤵
                                  PID:2636
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14767134679723242728,2097016893908463645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3656 /prefetch:1
                                  3⤵
                                    PID:2428
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14767134679723242728,2097016893908463645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4540 /prefetch:1
                                    3⤵
                                      PID:2540
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14767134679723242728,2097016893908463645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3780 /prefetch:1
                                      3⤵
                                        PID:4648
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2148,14767134679723242728,2097016893908463645,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6204 /prefetch:8
                                        3⤵
                                        • Modifies registry class
                                        PID:3592
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2148,14767134679723242728,2097016893908463645,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6168 /prefetch:8
                                        3⤵
                                          PID:1000
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14767134679723242728,2097016893908463645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3676 /prefetch:1
                                          3⤵
                                            PID:5700
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14767134679723242728,2097016893908463645,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3508 /prefetch:1
                                            3⤵
                                              PID:6400
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14767134679723242728,2097016893908463645,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
                                              3⤵
                                                PID:6508
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14767134679723242728,2097016893908463645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3740 /prefetch:1
                                                3⤵
                                                  PID:6500
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,14767134679723242728,2097016893908463645,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5364 /prefetch:2
                                                  3⤵
                                                    PID:6956
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffba62746f8,0x7ffba6274708,0x7ffba6274718
                                                1⤵
                                                  PID:704
                                                • C:\Windows\System32\CompPkgSrv.exe
                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                  1⤵
                                                    PID:2168
                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                    1⤵
                                                      PID:1920
                                                    • C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe
                                                      C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe
                                                      1⤵
                                                      • Executes dropped EXE
                                                      • Drops file in System32 directory
                                                      • Suspicious use of SetThreadContext
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:5188
                                                      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                        2⤵
                                                        • Drops file in System32 directory
                                                        • Modifies data under HKEY_USERS
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:2612
                                                      • C:\Windows\system32\sc.exe
                                                        C:\Windows\system32\sc.exe stop UsoSvc
                                                        2⤵
                                                        • Launches sc.exe
                                                        PID:5828
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                                        2⤵
                                                          PID:5936
                                                          • C:\Windows\system32\wusa.exe
                                                            wusa /uninstall /kb:890830 /quiet /norestart
                                                            3⤵
                                                              PID:6032
                                                          • C:\Windows\system32\sc.exe
                                                            C:\Windows\system32\sc.exe stop WaaSMedicSvc
                                                            2⤵
                                                            • Launches sc.exe
                                                            PID:6016
                                                          • C:\Windows\system32\sc.exe
                                                            C:\Windows\system32\sc.exe stop wuauserv
                                                            2⤵
                                                            • Launches sc.exe
                                                            PID:5148
                                                          • C:\Windows\system32\sc.exe
                                                            C:\Windows\system32\sc.exe stop bits
                                                            2⤵
                                                            • Launches sc.exe
                                                            PID:6104
                                                          • C:\Windows\system32\sc.exe
                                                            C:\Windows\system32\sc.exe stop dosvc
                                                            2⤵
                                                            • Launches sc.exe
                                                            PID:5352
                                                          • C:\Windows\system32\conhost.exe
                                                            C:\Windows\system32\conhost.exe
                                                            2⤵
                                                              PID:1820
                                                            • C:\Windows\system32\powercfg.exe
                                                              C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                                              2⤵
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:2728
                                                            • C:\Windows\system32\powercfg.exe
                                                              C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                                              2⤵
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:1240
                                                            • C:\Windows\system32\powercfg.exe
                                                              C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                                              2⤵
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:4884
                                                            • C:\Windows\system32\powercfg.exe
                                                              C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                                              2⤵
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:4628
                                                            • C:\Windows\explorer.exe
                                                              explorer.exe
                                                              2⤵
                                                              • Modifies data under HKEY_USERS
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:5436

                                                          Network

                                                          MITRE ATT&CK Enterprise v15

                                                          Replay Monitor

                                                          Loading Replay Monitor...

                                                          Downloads

                                                          • C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe

                                                            Filesize

                                                            5.0MB

                                                            MD5

                                                            e222309197c5e633aa8e294ba4bdcd29

                                                            SHA1

                                                            52b3f89a3d2262bf603628093f6d1e71d9cc3820

                                                            SHA256

                                                            047a7ca1b8848c1c0e3c0fcc6ece056390760b24580f27f6966b86b0c2a1042b

                                                            SHA512

                                                            9eb37686e0cee9ec18d12a4edd37c8334d26650c74eae5b30231c2b0db1628d52848123c9348c3da306ec950b827ec0a56cdf43ee325a9e280022c68193d8503

                                                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\WinErrorMgr.exe.log

                                                            Filesize

                                                            226B

                                                            MD5

                                                            916851e072fbabc4796d8916c5131092

                                                            SHA1

                                                            d48a602229a690c512d5fdaf4c8d77547a88e7a2

                                                            SHA256

                                                            7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

                                                            SHA512

                                                            07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                            Filesize

                                                            152B

                                                            MD5

                                                            aa6f46176fbc19ccf3e361dc1135ece0

                                                            SHA1

                                                            cb1f8c693b88331e9513b77efe47be9e43c43b12

                                                            SHA256

                                                            2f5ba493c7c4192e9310cea3a96cfec4fd14c6285af6e3659627ab177e560819

                                                            SHA512

                                                            5d26fdffebeb1eb5adde9f7da19fe7069e364d3f68670013cb0cc3e2b40bf1fbcb9bdebbfe999747caf141c88ccd53bd4acf2074283e4bde46b8c28fbae296f5

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                            Filesize

                                                            152B

                                                            MD5

                                                            1af9fbc1d4655baf2df9e8948103d616

                                                            SHA1

                                                            c58d5c208d0d5aab5b6979b64102b0086799b0bf

                                                            SHA256

                                                            e83daa7b2af963dbb884d82919710164e2337f0f9f5e5c56ee4b7129d160c135

                                                            SHA512

                                                            714d0ff527a8a24ec5d32a0a2b74e402ee933ea86e42d3e2fb5615c8345e6c09aa1c2ddf2dea53d71c5a666483a3b494b894326fea0cc1d8a06d3b32ec9397d3

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                            Filesize

                                                            840B

                                                            MD5

                                                            a0c192ff75834d67e73a93ff1f131149

                                                            SHA1

                                                            6b1487ca4a30732152b590d42519593f3f1d11b2

                                                            SHA256

                                                            9314d883d81a49570519a62574ffed0936246f2e7f84ac57cc099fe1e00939d6

                                                            SHA512

                                                            41ebf131ea306d1682bdb12a9c55f61ae9aa103b26d9493459e63de9e9e16fbf022f2a7e0f180747a2ef3f359ac031d05856831bc31f886b564deaa7df1c992c

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                            Filesize

                                                            72B

                                                            MD5

                                                            811d7e0f541599b09c1c351b40f03c2c

                                                            SHA1

                                                            11b73b275d2c7e58a5a5813ae8bc80d2e7d9871f

                                                            SHA256

                                                            b126a6378290793c5e3d5c34ab7e4c0bcfe1f86ff1acedbffa654f3098d64dee

                                                            SHA512

                                                            25be65d2abc46a5e78b80525315724fbb27da90379dd55b6cf99ed3aac442c0763da31d121e30b7290525f156e27c3d71a7f5a919960f4ecd63a0bbd4a283ef3

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                            Filesize

                                                            3KB

                                                            MD5

                                                            edb02ff0f62bae388363a5ad5f4e07db

                                                            SHA1

                                                            acfe477eb57bca7a1a34675db88b6e4da747f660

                                                            SHA256

                                                            c89afee4c675bf977993285d181be44d785f6c069c0d266b38c2ae7dfc3100cb

                                                            SHA512

                                                            20bfe754ab5bd7494f33c19a299b22b8fdfb339c0364c0132e98722f3011b009c9f74c77c89f7928a46849fee3341463c18f75d203ae1fc4f6b57969f8233faf

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                            Filesize

                                                            3KB

                                                            MD5

                                                            6da20c2781313cec6e79c17ce4a7dd5c

                                                            SHA1

                                                            a9c41904d8ec0efb1fa2554be35e6440cda449ff

                                                            SHA256

                                                            48f77ceac2eb9dfeaa3c09b41ecae4afefa6df2a54365ffbe98d0418066bbb29

                                                            SHA512

                                                            5aee8c84ecc9b948e36e5b7af43ba26715a3ae9577f64f5482e858d0f22c87ad8498469465904afe66f668caa3d02aef115b9eec86a9bd814e39eb7d98ed35b4

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                            Filesize

                                                            6KB

                                                            MD5

                                                            c6969bc23dfe0c3b8d1a1a2be0003649

                                                            SHA1

                                                            410e6048e2437ed5fedac349676f790df9a406af

                                                            SHA256

                                                            b4092dd9475583c8e45159d88b2bd1ecc755a40cfacb01e3c60d35de1dd517c3

                                                            SHA512

                                                            0393582f0d55e448072afad86e4384be7170662924e20cef133b1b92ef68a8d30cc6fb80ca0ecc60be0575ea0cc961441c2cdaad0be29aceba27a888087c8321

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                            Filesize

                                                            7KB

                                                            MD5

                                                            884e8dcefe8474bac3c4599f8a4c7074

                                                            SHA1

                                                            aca4a2e9dea8338bf202549d53edd2c79ff4e6e0

                                                            SHA256

                                                            3919741b3ab763fba6b6fecb36ac00f44f9bb9ed940e0af6dc6070bfc78ee87b

                                                            SHA512

                                                            109fb43dfc1d4bc266d6d04ba6105e9ae57b3b04a7cda63d97429c0a6e91652bb64c3806d74bb49e85611556784e1745c9ad4192174959232544f9eebd42e616

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                            Filesize

                                                            8KB

                                                            MD5

                                                            d4b833702d85a23f9dd3162e11b5c6ad

                                                            SHA1

                                                            a9ab3b7cdf73fcca33ada7c7641014386892df26

                                                            SHA256

                                                            d2da51ada0f204903dad386a39849d5ce8f636dd49f5853a918d3c5a11dc7a76

                                                            SHA512

                                                            eb417a91254426f92f0d35f37913f2372a89d1d4081a8052412adb62c353c5b57dc34af52f803001e65818949427de637d0512811827465f93f2f0b9da292ec1

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                            Filesize

                                                            6KB

                                                            MD5

                                                            b39e5dd9aa7bc631e4cc076703f3c6f7

                                                            SHA1

                                                            280de7aee81ef553d717d1d7b49dd3f521cf87bb

                                                            SHA256

                                                            9e226721030c3e2a25dd028a3219f8d03c8630385e5e6fd7bea3e4029632c587

                                                            SHA512

                                                            a50e94be7b0023d5f9aa4c39b0b87048b86936b8039c86a48c128b610304d8cf08651cd2c6f7df8c73e7113a99338d11d71d7d8fafa67d81935e95567a415d52

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                            Filesize

                                                            6KB

                                                            MD5

                                                            e8986f3206d4a5b14f18ea4a59c18c93

                                                            SHA1

                                                            1181ae27e3af044c5d750be4d805dc483ea7658a

                                                            SHA256

                                                            9c0976bc7ef5512244d930d89cceacf10db3fa3d16d42c11cd3fdf3f8e03605d

                                                            SHA512

                                                            5cda61f2b1be6b0f91efee7e5dd1f7095fecdd726aa9588a0a2a6cb37cff84d893ee856d425e78456f8f6f2cd76df0b36bfdc25804b24cd3421282added2c242

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c1eb0cde2406b6af565f825dcd492589d40ab644\e88b8b2b-bf74-4aa9-97ca-c6330bbc86f2\index-dir\the-real-index

                                                            Filesize

                                                            5KB

                                                            MD5

                                                            78bde27c39f79b1170f2d6e92f1b24ac

                                                            SHA1

                                                            8af825068327ac996b34ebad28c45734d1399bc6

                                                            SHA256

                                                            aa1f3ac9fd5bf4ef37f6c77c7d5ab61c8a6943d15587a73a8a5cefeac3b1785d

                                                            SHA512

                                                            e943eaa53d56ed530d0d0d0c854c57077ba5f3dce5cc19b7a5de634777c6b9a4f3360580a5cf6a01d6043fc0b1178ff97850935442294016bc0f4cf00a5d69bf

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c1eb0cde2406b6af565f825dcd492589d40ab644\e88b8b2b-bf74-4aa9-97ca-c6330bbc86f2\index-dir\the-real-index~RFe593fbe.TMP

                                                            Filesize

                                                            48B

                                                            MD5

                                                            f2b440be519ebe7c98f2c00cb63874bb

                                                            SHA1

                                                            80d24390f1d0f12a7a597b68a739d555bafec1c1

                                                            SHA256

                                                            9d012545f451166574a2589573aa8526f990da2f9fb021a2318b47ead711967d

                                                            SHA512

                                                            9fc719d9e9922c1ffa7eb46cd6fb1d0c3a089fd8965ee0e74e898b784eb29721eb69c6c043c45bb1fabe850850425038339181ed6108f635bcd7e03d41aa00be

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c1eb0cde2406b6af565f825dcd492589d40ab644\index.txt

                                                            Filesize

                                                            93B

                                                            MD5

                                                            c9cdc40afd4924f894d8012c83ee14ef

                                                            SHA1

                                                            873e99d1f22878195f8069bb0c3308a7d031d945

                                                            SHA256

                                                            685152e858ca27e46da40e7918e1a02cfed1bb5ddd9bc8913a6a2797f5c2c2ec

                                                            SHA512

                                                            41aa4363794b1bc3312b1afafebeb722c18dc192bfb37c2e883cccc436d721ed06ea3c82643a7e00f461cc8bd37704c4df0f4bba6e503d871ff4c9e7312f53b3

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c1eb0cde2406b6af565f825dcd492589d40ab644\index.txt

                                                            Filesize

                                                            89B

                                                            MD5

                                                            3005959ed7d4405d48cddafc34d510d6

                                                            SHA1

                                                            eb1904dab2ab36647bd809c169b2f5cd5f5e817a

                                                            SHA256

                                                            89765c24b738e23f93bc820da77423d17dedca79d426a41600df4398f19c1398

                                                            SHA512

                                                            81ccffeaa11670220091ab5882c9a852f91148b31d5c028e7a6d8f495fcbefccdab81b265a9f65e9dc27223e2475d281935774999aa94264832a50c7869edac5

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

                                                            Filesize

                                                            16B

                                                            MD5

                                                            46295cac801e5d4857d09837238a6394

                                                            SHA1

                                                            44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                            SHA256

                                                            0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                            SHA512

                                                            8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

                                                            Filesize

                                                            72B

                                                            MD5

                                                            c3a7a49e70bb3e073036e71ef058d672

                                                            SHA1

                                                            ab0945abdf0c7ee562c5058781a765f0c33975d7

                                                            SHA256

                                                            aeede0176dcba0dca9e93886e08df5aa24d11ccbb8a26ebec6722a05b34185ed

                                                            SHA512

                                                            1fb9314d898d19b0333f6a97c1f2e1738ec13964b98c91bc6771eda353aa029868a3292aa2abcb5494de28d0c9ce81fd4052c68bf6b1294de7e541fc2453d05f

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58d4cf.TMP

                                                            Filesize

                                                            48B

                                                            MD5

                                                            8d1f254604d669f68c2b2373ba92da2f

                                                            SHA1

                                                            8e9f1b17d24ffd5f977d303368e896d8d4f45e05

                                                            SHA256

                                                            463eadc8c06425168977757d4997b4d6379a344bc315c82cf12c878eefa01361

                                                            SHA512

                                                            54b1435e5008b4917573f4cb9d3b0c95b98bf9424cee981a08a3f32a6516b7f601240f77f4ca7dd66e6fdab8064856a5aecf270c9b4d9efbc58b0e1ddd40aed7

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                            Filesize

                                                            1KB

                                                            MD5

                                                            19beccb1f5ced65346dcbbecbaa61bbb

                                                            SHA1

                                                            30b7740e0fa87bbdc90ffcb81af52e5c8ccf0518

                                                            SHA256

                                                            54352ef486e42033b5f7a845824b1780b593f4eabf72d6f837ab2387ffe7f93a

                                                            SHA512

                                                            49e95242e8389c660bba2cd6378bffda1d958b79313d9f7509035ff7b8d56a1265fcfc9b7cedbd2ab2e7949b7d969cccc28a8efc441f5883e16bf139a2a4da4d

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                            Filesize

                                                            2KB

                                                            MD5

                                                            019df4cf52f9e01909528cebfe7cec46

                                                            SHA1

                                                            ee5ff4af2be634ff6f0aac3cf045502a91df3ad8

                                                            SHA256

                                                            7fa240a414490dc05182554b80ca7f3ada24696d236e71d1e9b3e1b1ef34f112

                                                            SHA512

                                                            45ea5ecf9f215cff164b92c02af682a8f55d9220e8a5c5b9dc5decf608a626ec6a1d65704c3185c5a2eed17453efebb2ca9da1303e29986846ff44f63994eb50

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5895b3.TMP

                                                            Filesize

                                                            204B

                                                            MD5

                                                            d171f1bbcc554f251ced333c1c35b436

                                                            SHA1

                                                            bf9833ca80f3ec286feeee1f7906fda3f54b67e9

                                                            SHA256

                                                            08c47e9846434cbb0e48e384e46b1265e71f3fc8b4211df94330182856ebef9d

                                                            SHA512

                                                            59b94cd8180637ed7416682046a331dc39c8aec39dcb9d5f6607545bab015f2f6820cf7c47369cb79a327e406d6395de3df47a1a3e47839848fba250a41e9ad4

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                            Filesize

                                                            16B

                                                            MD5

                                                            6752a1d65b201c13b62ea44016eb221f

                                                            SHA1

                                                            58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                            SHA256

                                                            0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                            SHA512

                                                            9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                            Filesize

                                                            11KB

                                                            MD5

                                                            7c02257c97dbdb928caa332418d6e3d8

                                                            SHA1

                                                            552d0de9314e6132bf011dc704d9a401c71eaa05

                                                            SHA256

                                                            b71cc99c14cc92560d0e6d13536ea92a1b02ffe0e777fa06b29c1eaff05488ff

                                                            SHA512

                                                            9ef848735d0fe4416e573dc258289fc97120077b72a855e9c6e50c8ea383601a9a53f220881f3e210e85d7195adb9127f722cd0e97a6eed91c2117fdcec77a5f

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                            Filesize

                                                            18KB

                                                            MD5

                                                            b87880503b929f0492e873b2931ac332

                                                            SHA1

                                                            1b3a0344a44b21b30bdeb7d9054d02c506f2e2b8

                                                            SHA256

                                                            cbc28aa7a096d424807fec4998789e922c68c957c87f65fcfffdd42d905c8a6f

                                                            SHA512

                                                            f385a66072757663d6baac5bfbbf3807d67f962a184e0937b38e2ae4492dca69ea6917c17440b48f931af77e74afa45a409baf9e83446ae995942f567a1976aa

                                                          • C:\Users\Admin\AppData\Local\Temp\Ilkdt.exe

                                                            Filesize

                                                            191KB

                                                            MD5

                                                            e004a568b841c74855f1a8a5d43096c7

                                                            SHA1

                                                            b90fd74593ae9b5a48cb165b6d7602507e1aeca4

                                                            SHA256

                                                            d49013d6be0f0e727c0b53bce1d3fed00656c7a2836ceef0a9d4cb816a5878db

                                                            SHA512

                                                            402dd4d4c57fb6f5c7a531b7210a897dfe41d68df99ae4d605944f6e5b2cecaafa3fe27562fe45e7e216a7c9e29e63139d4382310b41f04a35ad56115fbed2af

                                                          • C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe

                                                            Filesize

                                                            1.4MB

                                                            MD5

                                                            e696469c99af3c613d1b42a6ebbb1463

                                                            SHA1

                                                            efb9aec80ca1069abac4f9dca8f315cf75472d06

                                                            SHA256

                                                            6162721aaf0d9da2f0bc52958862cffe29f8506de8800b2c368e41d20e8b798c

                                                            SHA512

                                                            e643895824e17ad84039d80809435c55ff97beb69d7a48204351c979f0c24823020a9a730bd23a192ac8727f391363aa69de62efaea668ef7cb770d80e934795

                                                          • C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe

                                                            Filesize

                                                            1.8MB

                                                            MD5

                                                            6d22d2ac8d8df0fbcb102c399234931a

                                                            SHA1

                                                            f24f4db7c277db84635c4d4bc76f39967a5739ab

                                                            SHA256

                                                            7998faf031f4a930d91228ce479b87fc0459f69021d495929b8a2bff525355d4

                                                            SHA512

                                                            fc297decd51e57649e5f0c14a6854aba9fa3346a0fadc9c1275ef807676005e185c39177c817a2d8fee58b60b1a568a0934cc6d675ad466c457123486def8ff0

                                                          • C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe

                                                            Filesize

                                                            512KB

                                                            MD5

                                                            ae6bd9089e0ac4272d650941b352e176

                                                            SHA1

                                                            bddd00e08690f1588f57a4c08f68c83643dc2a48

                                                            SHA256

                                                            743151cf89944fbe79eee96abe66c4f214ea954146f7645b4872763d2cfeace7

                                                            SHA512

                                                            e269110a140feffec07ba26c797ffc23f8b3b7332ebe299b64eaf831167d4ca03814560f9a3c8fbcf16a09134f8e1c1d4ace2f03c130e441aac5dcf2e95c9b84

                                                          • C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe

                                                            Filesize

                                                            384KB

                                                            MD5

                                                            8f65f181b0d0ad36244209ba25415712

                                                            SHA1

                                                            a416aff9bb402c07e0550f839826b695a35cdbd1

                                                            SHA256

                                                            9b6857b2f7d6af2a9df50c166a891f861ea091a37a4e23f057a8c695eaa8326b

                                                            SHA512

                                                            182bad151d241d104b81f9d5f265552d062e7dd731f9e47d2756c37d8f145853c86885a5e525fc11b8b23f0cf15dab711b117e32e48085a000d2a1b2a33a0180

                                                          • C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe

                                                            Filesize

                                                            316KB

                                                            MD5

                                                            675d9e9ab252981f2f919cf914d9681d

                                                            SHA1

                                                            7485f5c9da283475136df7fa8b62756efbb5dd17

                                                            SHA256

                                                            0f055835332ef8e368185ae461e7c9eacdeb3d600ea550d605b09a20e0856e2d

                                                            SHA512

                                                            9dd936705fd43ebe8be17fcf77173eaaf16046f5880f8fe48fc68ded91ef6202ba65c605980bd2e330d2c7f463f772750a1bd96246fffdc9cb6bf8e1b00a2ccb

                                                          • C:\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe

                                                            Filesize

                                                            42KB

                                                            MD5

                                                            d499e979a50c958f1a67f0e2a28af43d

                                                            SHA1

                                                            1e5fa0824554c31f19ce01a51edb9bed86f67cf0

                                                            SHA256

                                                            bc3d545c541e42420ce2c2eabc7e5afab32c869a1adb20adb11735957d0d0b0e

                                                            SHA512

                                                            668047f178d82bebefeb8c2e7731d34ff24dc755dacd3362b43d8b44c6b148fc51af0d0ab2d0a67f0344ab6158b883fe568e4eeb0e34152108735574f0e1e763

                                                          • C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe

                                                            Filesize

                                                            2.2MB

                                                            MD5

                                                            6a55c259dd13a058b8b57034a8515803

                                                            SHA1

                                                            34d5628bd3deca9ca0c7a45daf638127f11433f6

                                                            SHA256

                                                            a0c5ff326c74584e6cb2b9fb9fe4f03a1d7255b17653f42444ee3185209c505d

                                                            SHA512

                                                            3cb60047b2f09e589310bfc743b583019667bdea3c5d7667f2af8f3e789c3adf5faa9128d399178cb0060562c27ed278207acd4a40a41425a1d8ec0d9a7f3d1d

                                                          • C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe

                                                            Filesize

                                                            2.2MB

                                                            MD5

                                                            b29ec7c5a1c5d5d4c7907e868ebb18c0

                                                            SHA1

                                                            9012305a6cdaec6a486859238e5f990db540f5ba

                                                            SHA256

                                                            1ad1818ababd28afd6b84c260773387082ca9da5a397f1b3e8b8b8b02b5b7e39

                                                            SHA512

                                                            1b905d5bd8bcf6d49c3ba3617cbe121d0f1957a2a58d0ec83fdd03e83452fa8ef3608d36015206bb8d39711247a6b2f8b9bd16c5a37f73d83a6caa2fa9ba324f

                                                          • C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe

                                                            Filesize

                                                            2.1MB

                                                            MD5

                                                            6682a28ce9f24bf0b0c1c9aecf4a78d9

                                                            SHA1

                                                            bf9d640a8d987a0b98011077aa1e385ebc39c652

                                                            SHA256

                                                            9ac2939f2c8aaf5fcdc9746c1ecc0ad5cb0505c56989c82654a0b2b603c5e2c8

                                                            SHA512

                                                            a93a671e2eb98252f69e695c741ee96c5131270967b45649d2cf184a1fbc5ff51e99543213ff9a7360f957359e91b9a50408fe3e77350faa4c450df344924a9a

                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI31842\VCRUNTIME140.dll

                                                            Filesize

                                                            116KB

                                                            MD5

                                                            be8dbe2dc77ebe7f88f910c61aec691a

                                                            SHA1

                                                            a19f08bb2b1c1de5bb61daf9f2304531321e0e40

                                                            SHA256

                                                            4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

                                                            SHA512

                                                            0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI31842\VCRUNTIME140.dll

                                                            Filesize

                                                            14KB

                                                            MD5

                                                            025997057ab9a7c463fd3e82d15a4d43

                                                            SHA1

                                                            b7eeca10232ac56e438e6c05b9a574f5c28e3db8

                                                            SHA256

                                                            cdbe7488ec1eca0014d37dc5cd8c26b274eb3520c361dc82ad071523dd47e516

                                                            SHA512

                                                            9f71897b23bfa4ab2da70d16b5ada92feb3152d955525789c0625dff46a4b39d049036feb273f94aba9011caa593164351da68449742992a8157f314a77c32f4

                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI31842\_bz2.pyd

                                                            Filesize

                                                            82KB

                                                            MD5

                                                            90f58f625a6655f80c35532a087a0319

                                                            SHA1

                                                            d4a7834201bd796dc786b0eb923f8ec5d60f719b

                                                            SHA256

                                                            bd8621fcc901fa1de3961d93184f61ea71068c436794af2a4449738ccf949946

                                                            SHA512

                                                            b5bb1ecc195700ad7bea5b025503edd3770b1f845f9beee4b067235c4e63496d6e0b19bdd2a42a1b6591d1131a2dc9f627b2ae8036e294300bb6983ecd644dc8

                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI31842\_decimal.pyd

                                                            Filesize

                                                            247KB

                                                            MD5

                                                            f78f9855d2a7ca940b6be51d68b80bf2

                                                            SHA1

                                                            fd8af3dbd7b0ea3de2274517c74186cb7cd81a05

                                                            SHA256

                                                            d4ae192bbd4627fc9487a2c1cd9869d1b461c20cfd338194e87f5cf882bbed12

                                                            SHA512

                                                            6b68c434a6f8c436d890d3c1229d332bd878e5777c421799f84d79679e998b95d2d4a013b09f50c5de4c6a85fcceb796f3c486e36a10cbac509a0da8d8102b18

                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI31842\_hashlib.pyd

                                                            Filesize

                                                            64KB

                                                            MD5

                                                            8baeb2bd6e52ba38f445ef71ef43a6b8

                                                            SHA1

                                                            4132f9cd06343ef8b5b60dc8a62be049aa3270c2

                                                            SHA256

                                                            6c50c9801a5caf0bb52b384f9a0d5a4aa182ca835f293a39e8999cf6edf2f087

                                                            SHA512

                                                            804a4e19ea622646cea9e0f8c1e284b7f2d02f3620199fa6930dbdadc654fa137c1e12757f87c3a1a71ceff9244aa2f598ee70d345469ca32a0400563fe3aa65

                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI31842\_lzma.pyd

                                                            Filesize

                                                            155KB

                                                            MD5

                                                            cf8de1137f36141afd9ff7c52a3264ee

                                                            SHA1

                                                            afde95a1d7a545d913387624ef48c60f23cf4a3f

                                                            SHA256

                                                            22d10e2d6ad3e3ed3c49eb79ab69a81aaa9d16aeca7f948da2fe80877f106c16

                                                            SHA512

                                                            821985ff5bc421bd16b2fa5f77f1f4bf8472d0d1564bc5768e4dbe866ec52865a98356bb3ef23a380058acd0a25cd5a40a1e0dae479f15863e48c4482c89a03f

                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI31842\_socket.pyd

                                                            Filesize

                                                            81KB

                                                            MD5

                                                            439b3ad279befa65bb40ecebddd6228b

                                                            SHA1

                                                            d3ea91ae7cad9e1ebec11c5d0517132bbc14491e

                                                            SHA256

                                                            24017d664af20ee3b89514539345caac83eca34825fcf066a23e8a4c99f73e6d

                                                            SHA512

                                                            a335e1963bb21b34b21aef6b0b14ba8908a5343b88f65294618e029e3d4d0143ea978a5fd76d2df13a918ffab1e2d7143f5a1a91a35e0cc1145809b15af273bd

                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI31842\base_library.zip

                                                            Filesize

                                                            1.3MB

                                                            MD5

                                                            44db87e9a433afe94098d3073d1c86d7

                                                            SHA1

                                                            24cc76d6553563f4d739c9e91a541482f4f83e05

                                                            SHA256

                                                            2b8b36bd4b1b0ee0599e5d519a91d35d70f03cc09270921630168a386b60ac71

                                                            SHA512

                                                            55bc2961c0bca42ef6fb4732ec25ef7d7d2ec47c7fb96d8819dd2daa32d990000b326808ae4a03143d6ff2144416e218395cccf8edaa774783234ec7501db611

                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI31842\libcrypto-3.dll

                                                            Filesize

                                                            1.2MB

                                                            MD5

                                                            70c935d152ab8af9b6a995d360ae89f7

                                                            SHA1

                                                            e708ed82f2ee15034285d126e0c90be5f25a8743

                                                            SHA256

                                                            979b5dcf2b7e473363c5afcd7289b799a2f616ca880b65597174ca3ad022f85c

                                                            SHA512

                                                            117ea7b9710392d4e469df5bdedce9d4a988a6fce4b8301e42436be9032b257f4bb5e43d5f9886022c3945ae26a72f0298697c84d82b1118c1b48eff0f07a513

                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI31842\python312.dll

                                                            Filesize

                                                            128KB

                                                            MD5

                                                            7dd0b85f37b137947a86c06cc0df7911

                                                            SHA1

                                                            112aecad658ab5fec54b6cae2de45b91d921cfeb

                                                            SHA256

                                                            8e4d4e57d43450380830f115875564c042bf862e2265989bfdd63531fbacedd1

                                                            SHA512

                                                            f182f8d7ff2e40cc4acac9dcd6a226117ccf800f0e8bf39a575be5c8d54f98ae1991848f911b2872fc369cc2989299ab5482eb424da74dd7e01b6d8ace20dad7

                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI31842\python312.dll

                                                            Filesize

                                                            3.1MB

                                                            MD5

                                                            d7cfd9cfce47fb307693b5132cb6b802

                                                            SHA1

                                                            0c1ac24943089f39f2225ffccfe8dfbb0d4e3f93

                                                            SHA256

                                                            3d9d862e25fa364b6f003d2ce8cf5d79a12ab7ce4da46b125de19b5e53a3c52d

                                                            SHA512

                                                            d39c1baf22d37c439c81c03704b42c62268628c9420c156ceb3458fd309aaa471cd91f7d660c367607dccb70f8846c4d97088d55e240856c669ae69b94313b0d

                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI31842\select.pyd

                                                            Filesize

                                                            29KB

                                                            MD5

                                                            e1604afe8244e1ce4c316c64ea3aa173

                                                            SHA1

                                                            99704d2c0fa2687997381b65ff3b1b7194220a73

                                                            SHA256

                                                            74cca85600e7c17ea6532b54842e26d3cae9181287cdf5a4a3c50af4dab785e5

                                                            SHA512

                                                            7bf35b1a9da9f1660f238c2959b3693b7d9d2da40cf42c6f9eba2164b73047340d0adff8995049a2fe14e149eba05a5974eee153badd9e8450f961207f0b3d42

                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI31842\unicodedata.pyd

                                                            Filesize

                                                            1.1MB

                                                            MD5

                                                            fc47b9e23ddf2c128e3569a622868dbe

                                                            SHA1

                                                            2814643b70847b496cbda990f6442d8ff4f0cb09

                                                            SHA256

                                                            2a50d629895a05b10a262acf333e7a4a31db5cb035b70d14d1a4be1c3e27d309

                                                            SHA512

                                                            7c08683820498fdff5f1703db4ad94ad15f2aa877d044eddc4b54d90e7dc162f48b22828cd577c9bb1b56f7c11f777f9785a9da1867bf8c0f2b6e75dc57c3f53

                                                          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lhvmx1lh.e4i.ps1

                                                            Filesize

                                                            60B

                                                            MD5

                                                            d17fe0a3f47be24a6453e9ef58c94641

                                                            SHA1

                                                            6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                            SHA256

                                                            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                            SHA512

                                                            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                          • C:\Users\Admin\AppData\Local\Temp\tmpF24F.tmp

                                                            Filesize

                                                            1KB

                                                            MD5

                                                            7f673f709ab0e7278e38f0fd8e745cd4

                                                            SHA1

                                                            ac504108a274b7051e3b477bcd51c9d1a4a01c2c

                                                            SHA256

                                                            da5ab3278aaa04fbd51272a617aef9b903ca53c358fac48fc0f558e257e063a4

                                                            SHA512

                                                            e932ccbd9d3ec6ee129f0dab82710904b84e657532c5b623d3c7b3b4ce45732caf8ff5d7b39095cf99ecf97d4e40dd9d755eb2b89c8ede629b287c29e41d1132

                                                          • memory/392-1417-0x000001D3F9A30000-0x000001D3F9A52000-memory.dmp

                                                            Filesize

                                                            136KB

                                                          • memory/392-1405-0x00007FFBA2380000-0x00007FFBA2E41000-memory.dmp

                                                            Filesize

                                                            10.8MB

                                                          • memory/392-1462-0x00007FFBA2380000-0x00007FFBA2E41000-memory.dmp

                                                            Filesize

                                                            10.8MB

                                                          • memory/392-1409-0x000001D3FA040000-0x000001D3FA050000-memory.dmp

                                                            Filesize

                                                            64KB

                                                          • memory/392-1407-0x000001D3FA040000-0x000001D3FA050000-memory.dmp

                                                            Filesize

                                                            64KB

                                                          • memory/1072-190-0x0000000004F70000-0x0000000004FD5000-memory.dmp

                                                            Filesize

                                                            404KB

                                                          • memory/1072-235-0x0000000004F70000-0x0000000004FD5000-memory.dmp

                                                            Filesize

                                                            404KB

                                                          • memory/1072-118-0x0000000004F70000-0x0000000004FD5000-memory.dmp

                                                            Filesize

                                                            404KB

                                                          • memory/1072-57-0x0000000073390000-0x0000000073B40000-memory.dmp

                                                            Filesize

                                                            7.7MB

                                                          • memory/1072-58-0x0000000004F70000-0x0000000004FD5000-memory.dmp

                                                            Filesize

                                                            404KB

                                                          • memory/1072-61-0x0000000004F70000-0x0000000004FD5000-memory.dmp

                                                            Filesize

                                                            404KB

                                                          • memory/1072-56-0x0000000004F70000-0x0000000004FD5000-memory.dmp

                                                            Filesize

                                                            404KB

                                                          • memory/1072-65-0x0000000004F70000-0x0000000004FD5000-memory.dmp

                                                            Filesize

                                                            404KB

                                                          • memory/1072-92-0x0000000004F70000-0x0000000004FD5000-memory.dmp

                                                            Filesize

                                                            404KB

                                                          • memory/1072-76-0x0000000004F70000-0x0000000004FD5000-memory.dmp

                                                            Filesize

                                                            404KB

                                                          • memory/1072-99-0x0000000004F70000-0x0000000004FD5000-memory.dmp

                                                            Filesize

                                                            404KB

                                                          • memory/1072-75-0x0000000005020000-0x0000000005030000-memory.dmp

                                                            Filesize

                                                            64KB

                                                          • memory/1072-55-0x0000000004F70000-0x0000000004FDC000-memory.dmp

                                                            Filesize

                                                            432KB

                                                          • memory/1072-1648-0x0000000005020000-0x0000000005030000-memory.dmp

                                                            Filesize

                                                            64KB

                                                          • memory/1072-183-0x0000000004F70000-0x0000000004FD5000-memory.dmp

                                                            Filesize

                                                            404KB

                                                          • memory/1072-1646-0x0000000073390000-0x0000000073B40000-memory.dmp

                                                            Filesize

                                                            7.7MB

                                                          • memory/1072-45-0x0000000000770000-0x00000000007A6000-memory.dmp

                                                            Filesize

                                                            216KB

                                                          • memory/1072-105-0x0000000004F70000-0x0000000004FD5000-memory.dmp

                                                            Filesize

                                                            404KB

                                                          • memory/1072-192-0x0000000004F70000-0x0000000004FD5000-memory.dmp

                                                            Filesize

                                                            404KB

                                                          • memory/1072-194-0x0000000004F70000-0x0000000004FD5000-memory.dmp

                                                            Filesize

                                                            404KB

                                                          • memory/1072-196-0x0000000004F70000-0x0000000004FD5000-memory.dmp

                                                            Filesize

                                                            404KB

                                                          • memory/1072-198-0x0000000004F70000-0x0000000004FD5000-memory.dmp

                                                            Filesize

                                                            404KB

                                                          • memory/1072-200-0x0000000004F70000-0x0000000004FD5000-memory.dmp

                                                            Filesize

                                                            404KB

                                                          • memory/1072-202-0x0000000004F70000-0x0000000004FD5000-memory.dmp

                                                            Filesize

                                                            404KB

                                                          • memory/1072-204-0x0000000004F70000-0x0000000004FD5000-memory.dmp

                                                            Filesize

                                                            404KB

                                                          • memory/1072-206-0x0000000004F70000-0x0000000004FD5000-memory.dmp

                                                            Filesize

                                                            404KB

                                                          • memory/1072-208-0x0000000004F70000-0x0000000004FD5000-memory.dmp

                                                            Filesize

                                                            404KB

                                                          • memory/1072-210-0x0000000004F70000-0x0000000004FD5000-memory.dmp

                                                            Filesize

                                                            404KB

                                                          • memory/1072-127-0x0000000004F70000-0x0000000004FD5000-memory.dmp

                                                            Filesize

                                                            404KB

                                                          • memory/1072-212-0x0000000004F70000-0x0000000004FD5000-memory.dmp

                                                            Filesize

                                                            404KB

                                                          • memory/1072-214-0x0000000004F70000-0x0000000004FD5000-memory.dmp

                                                            Filesize

                                                            404KB

                                                          • memory/1072-216-0x0000000004F70000-0x0000000004FD5000-memory.dmp

                                                            Filesize

                                                            404KB

                                                          • memory/1072-218-0x0000000004F70000-0x0000000004FD5000-memory.dmp

                                                            Filesize

                                                            404KB

                                                          • memory/1072-241-0x0000000004F70000-0x0000000004FD5000-memory.dmp

                                                            Filesize

                                                            404KB

                                                          • memory/1072-175-0x0000000004F70000-0x0000000004FD5000-memory.dmp

                                                            Filesize

                                                            404KB

                                                          • memory/1072-142-0x0000000004F70000-0x0000000004FD5000-memory.dmp

                                                            Filesize

                                                            404KB

                                                          • memory/1072-228-0x0000000004F70000-0x0000000004FD5000-memory.dmp

                                                            Filesize

                                                            404KB

                                                          • memory/1072-223-0x0000000004F70000-0x0000000004FD5000-memory.dmp

                                                            Filesize

                                                            404KB

                                                          • memory/1072-230-0x0000000004F70000-0x0000000004FD5000-memory.dmp

                                                            Filesize

                                                            404KB

                                                          • memory/2612-1717-0x000001D62E2C0000-0x000001D62E2CA000-memory.dmp

                                                            Filesize

                                                            40KB

                                                          • memory/2612-1653-0x000001D646850000-0x000001D646860000-memory.dmp

                                                            Filesize

                                                            64KB

                                                          • memory/2612-1651-0x00007FF4A7CF0000-0x00007FF4A7D00000-memory.dmp

                                                            Filesize

                                                            64KB

                                                          • memory/2612-1644-0x000001D62E2A0000-0x000001D62E2BC000-memory.dmp

                                                            Filesize

                                                            112KB

                                                          • memory/2612-1761-0x00007FFBA2380000-0x00007FFBA2E41000-memory.dmp

                                                            Filesize

                                                            10.8MB

                                                          • memory/2612-1743-0x000001D646850000-0x000001D646860000-memory.dmp

                                                            Filesize

                                                            64KB

                                                          • memory/2612-1581-0x000001D646850000-0x000001D646860000-memory.dmp

                                                            Filesize

                                                            64KB

                                                          • memory/2612-1738-0x000001D646820000-0x000001D64682A000-memory.dmp

                                                            Filesize

                                                            40KB

                                                          • memory/2612-1734-0x000001D62E300000-0x000001D62E306000-memory.dmp

                                                            Filesize

                                                            24KB

                                                          • memory/2612-1731-0x000001D62E2D0000-0x000001D62E2D8000-memory.dmp

                                                            Filesize

                                                            32KB

                                                          • memory/2612-1579-0x000001D646850000-0x000001D646860000-memory.dmp

                                                            Filesize

                                                            64KB

                                                          • memory/2612-1727-0x000001D646BA0000-0x000001D646BBA000-memory.dmp

                                                            Filesize

                                                            104KB

                                                          • memory/2612-1576-0x00007FFBA2380000-0x00007FFBA2E41000-memory.dmp

                                                            Filesize

                                                            10.8MB

                                                          • memory/2612-1679-0x000001D62E2E0000-0x000001D62E2FC000-memory.dmp

                                                            Filesize

                                                            112KB

                                                          • memory/2612-1649-0x000001D646760000-0x000001D646815000-memory.dmp

                                                            Filesize

                                                            724KB

                                                          • memory/2612-1659-0x000001D62E110000-0x000001D62E11A000-memory.dmp

                                                            Filesize

                                                            40KB

                                                          • memory/3516-121-0x0000000004AF0000-0x0000000004B00000-memory.dmp

                                                            Filesize

                                                            64KB

                                                          • memory/3516-1742-0x0000000073390000-0x0000000073B40000-memory.dmp

                                                            Filesize

                                                            7.7MB

                                                          • memory/3516-106-0x0000000073390000-0x0000000073B40000-memory.dmp

                                                            Filesize

                                                            7.7MB

                                                          • memory/4656-32-0x0000000000020000-0x0000000000030000-memory.dmp

                                                            Filesize

                                                            64KB

                                                          • memory/4656-104-0x0000000073390000-0x0000000073B40000-memory.dmp

                                                            Filesize

                                                            7.7MB

                                                          • memory/4656-85-0x0000000073390000-0x0000000073B40000-memory.dmp

                                                            Filesize

                                                            7.7MB

                                                          • memory/4888-49-0x0000020E04960000-0x0000020E049B4000-memory.dmp

                                                            Filesize

                                                            336KB

                                                          • memory/4888-62-0x00007FFBA48D0000-0x00007FFBA5391000-memory.dmp

                                                            Filesize

                                                            10.8MB

                                                          • memory/4888-73-0x0000020E04E30000-0x0000020E04E40000-memory.dmp

                                                            Filesize

                                                            64KB

                                                          • memory/4888-128-0x00007FFBA48D0000-0x00007FFBA5391000-memory.dmp

                                                            Filesize

                                                            10.8MB

                                                          • memory/5088-94-0x0000000004B00000-0x0000000004B22000-memory.dmp

                                                            Filesize

                                                            136KB

                                                          • memory/5088-53-0x0000000004B60000-0x0000000005188000-memory.dmp

                                                            Filesize

                                                            6.2MB

                                                          • memory/5088-166-0x0000000007060000-0x00000000070F6000-memory.dmp

                                                            Filesize

                                                            600KB

                                                          • memory/5088-145-0x0000000074750000-0x000000007479C000-memory.dmp

                                                            Filesize

                                                            304KB

                                                          • memory/5088-155-0x0000000006070000-0x000000000608E000-memory.dmp

                                                            Filesize

                                                            120KB

                                                          • memory/5088-139-0x0000000005AB0000-0x0000000005ACE000-memory.dmp

                                                            Filesize

                                                            120KB

                                                          • memory/5088-140-0x0000000005AD0000-0x0000000005B1C000-memory.dmp

                                                            Filesize

                                                            304KB

                                                          • memory/5088-246-0x0000000073390000-0x0000000073B40000-memory.dmp

                                                            Filesize

                                                            7.7MB

                                                          • memory/5088-178-0x000000007F410000-0x000000007F420000-memory.dmp

                                                            Filesize

                                                            64KB

                                                          • memory/5088-240-0x0000000007050000-0x0000000007058000-memory.dmp

                                                            Filesize

                                                            32KB

                                                          • memory/5088-156-0x0000000006AC0000-0x0000000006B63000-memory.dmp

                                                            Filesize

                                                            652KB

                                                          • memory/5088-103-0x0000000005470000-0x00000000054D6000-memory.dmp

                                                            Filesize

                                                            408KB

                                                          • memory/5088-100-0x0000000005400000-0x0000000005466000-memory.dmp

                                                            Filesize

                                                            408KB

                                                          • memory/5088-232-0x0000000007020000-0x0000000007034000-memory.dmp

                                                            Filesize

                                                            80KB

                                                          • memory/5088-179-0x0000000006FD0000-0x0000000006FE1000-memory.dmp

                                                            Filesize

                                                            68KB

                                                          • memory/5088-238-0x0000000007100000-0x000000000711A000-memory.dmp

                                                            Filesize

                                                            104KB

                                                          • memory/5088-222-0x0000000007010000-0x000000000701E000-memory.dmp

                                                            Filesize

                                                            56KB

                                                          • memory/5088-182-0x0000000004520000-0x0000000004530000-memory.dmp

                                                            Filesize

                                                            64KB

                                                          • memory/5088-64-0x0000000004520000-0x0000000004530000-memory.dmp

                                                            Filesize

                                                            64KB

                                                          • memory/5088-158-0x0000000006DD0000-0x0000000006DEA000-memory.dmp

                                                            Filesize

                                                            104KB

                                                          • memory/5088-157-0x0000000007420000-0x0000000007A9A000-memory.dmp

                                                            Filesize

                                                            6.5MB

                                                          • memory/5088-59-0x0000000004520000-0x0000000004530000-memory.dmp

                                                            Filesize

                                                            64KB

                                                          • memory/5088-160-0x0000000006E40000-0x0000000006E4A000-memory.dmp

                                                            Filesize

                                                            40KB

                                                          • memory/5088-119-0x00000000054E0000-0x0000000005834000-memory.dmp

                                                            Filesize

                                                            3.3MB

                                                          • memory/5088-144-0x0000000006A80000-0x0000000006AB2000-memory.dmp

                                                            Filesize

                                                            200KB

                                                          • memory/5088-50-0x0000000073390000-0x0000000073B40000-memory.dmp

                                                            Filesize

                                                            7.7MB

                                                          • memory/5088-40-0x00000000044D0000-0x0000000004506000-memory.dmp

                                                            Filesize

                                                            216KB