chaos | f0ebd23eac064a10da288dbf3b9db45bdf5e107c970e57f7974710cad01aed04

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12-03-2024 03:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f0ebd23eac064a10da288dbf3b9db45bdf5e107c970e57f7974710cad01aed04.exe
Size

2.5MB
MD5

411c2e3611e8ee701918cfe17399da79
SHA1

a01d2ceb1b9d0e002eb67a00fbac9238285dce85
SHA256

f0ebd23eac064a10da288dbf3b9db45bdf5e107c970e57f7974710cad01aed04
SHA512

c68a62e0342cdaaa23a8ad385551dff3d7f60e34c28c63797ef8d5969e714df6b0f7fa66a8904aaf65c034c26860f21453434e8678a48d149b2137054ee57b50
SSDEEP

49152:YBO8QRm2I9bC9hY8PU5sevK7F6wd0HL5xRpMrpaKE9eFodKe/HT0:Y88QRmVluhnPyhyx30HlUpaKpodtHT0

Score

10^/10

chaos remcos xworm zgrat remotehost persistence ransomware rat spyware stealer trojan

Malware Config

Extracted

Family

xworm

Version

3.1

gamemodz.duckdns.org:7000

Attributes

Install_directory
%AppData%
install_file
USB.exe

Extracted

Family

remcos

Botnet

RemoteHost

gamemodz.duckdns.org:2404

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
sysupdate.exe
copy_folder
sysupdate
delete_file
true
hide_file
true
hide_keylog_file
false
install_flag
true
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-FEY33U
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Chaos
Ransomware family first seen in June 2021.
ransomware chaos

Chaos Ransomware 2 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023251-4926.dat	family_chaos
behavioral2/memory/5460-4933-0x00000000005A0000-0x00000000005BC000-memory.dmp	family_chaos

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/3008-4800-0x0000000000400000-0x0000000000414000-memory.dmp	family_xworm

Detect ZGRat V1 34 IoCs

resource	yara_rule
behavioral2/memory/3884-2-0x0000000004E10000-0x0000000005040000-memory.dmp	family_zgrat_v1
behavioral2/memory/3884-3-0x0000000004E10000-0x000000000503A000-memory.dmp	family_zgrat_v1
behavioral2/memory/3884-6-0x0000000004E10000-0x000000000503A000-memory.dmp	family_zgrat_v1
behavioral2/memory/3884-4-0x0000000004E10000-0x000000000503A000-memory.dmp	family_zgrat_v1
behavioral2/memory/3884-8-0x0000000004E10000-0x000000000503A000-memory.dmp	family_zgrat_v1
behavioral2/memory/3884-10-0x0000000004E10000-0x000000000503A000-memory.dmp	family_zgrat_v1
behavioral2/memory/3884-12-0x0000000004E10000-0x000000000503A000-memory.dmp	family_zgrat_v1
behavioral2/memory/3884-14-0x0000000004E10000-0x000000000503A000-memory.dmp	family_zgrat_v1
behavioral2/memory/3884-16-0x0000000004E10000-0x000000000503A000-memory.dmp	family_zgrat_v1
behavioral2/memory/3884-18-0x0000000004E10000-0x000000000503A000-memory.dmp	family_zgrat_v1
behavioral2/memory/3884-20-0x0000000004E10000-0x000000000503A000-memory.dmp	family_zgrat_v1
behavioral2/memory/3884-24-0x0000000004E10000-0x000000000503A000-memory.dmp	family_zgrat_v1
behavioral2/memory/3884-22-0x0000000004E10000-0x000000000503A000-memory.dmp	family_zgrat_v1
behavioral2/memory/3884-28-0x0000000004E10000-0x000000000503A000-memory.dmp	family_zgrat_v1
behavioral2/memory/3884-26-0x0000000004E10000-0x000000000503A000-memory.dmp	family_zgrat_v1
behavioral2/memory/3884-30-0x0000000004E10000-0x000000000503A000-memory.dmp	family_zgrat_v1
behavioral2/memory/3884-32-0x0000000004E10000-0x000000000503A000-memory.dmp	family_zgrat_v1
behavioral2/memory/3884-36-0x0000000004E10000-0x000000000503A000-memory.dmp	family_zgrat_v1
behavioral2/memory/3884-40-0x0000000004E10000-0x000000000503A000-memory.dmp	family_zgrat_v1
behavioral2/memory/3884-38-0x0000000004E10000-0x000000000503A000-memory.dmp	family_zgrat_v1
behavioral2/memory/3884-42-0x0000000004E10000-0x000000000503A000-memory.dmp	family_zgrat_v1
behavioral2/memory/3884-34-0x0000000004E10000-0x000000000503A000-memory.dmp	family_zgrat_v1
behavioral2/memory/3884-44-0x0000000004E10000-0x000000000503A000-memory.dmp	family_zgrat_v1
behavioral2/memory/3884-46-0x0000000004E10000-0x000000000503A000-memory.dmp	family_zgrat_v1
behavioral2/memory/3884-48-0x0000000004E10000-0x000000000503A000-memory.dmp	family_zgrat_v1
behavioral2/memory/3884-50-0x0000000004E10000-0x000000000503A000-memory.dmp	family_zgrat_v1
behavioral2/memory/3884-54-0x0000000004E10000-0x000000000503A000-memory.dmp	family_zgrat_v1
behavioral2/memory/3884-56-0x0000000004E10000-0x000000000503A000-memory.dmp	family_zgrat_v1
behavioral2/memory/3884-58-0x0000000004E10000-0x000000000503A000-memory.dmp	family_zgrat_v1
behavioral2/memory/3884-60-0x0000000004E10000-0x000000000503A000-memory.dmp	family_zgrat_v1
behavioral2/memory/3884-62-0x0000000004E10000-0x000000000503A000-memory.dmp	family_zgrat_v1
behavioral2/memory/3884-66-0x0000000004E10000-0x000000000503A000-memory.dmp	family_zgrat_v1
behavioral2/memory/3884-64-0x0000000004E10000-0x000000000503A000-memory.dmp	family_zgrat_v1
behavioral2/memory/3884-52-0x0000000004E10000-0x000000000503A000-memory.dmp	family_zgrat_v1

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 4 IoCs

resource	yara_rule
behavioral2/files/0x000a000000023236-4788.dat	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/1556-4839-0x0000000000F70000-0x0000000000FF2000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/1092-4843-0x00000000012D0000-0x0000000001352000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/1556-4854-0x0000000000F70000-0x0000000000FF2000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
behavioral2/memory/3008-4800-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Detects command variations typically used by ransomware 2 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023251-4926.dat	INDICATOR_SUSPICIOUS_GENRansomware
behavioral2/memory/5460-4933-0x00000000005A0000-0x00000000005BC000-memory.dmp	INDICATOR_SUSPICIOUS_GENRansomware

Renames multiple (202) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation	f0ebd23eac064a10da288dbf3b9db45bdf5e107c970e57f7974710cad01aed04.exe
Key value queried	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation	sysupdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation	shout.exe
Key value queried	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation	svchost.exe

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.url	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	svchost.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\read_it.txt	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
3164	sysupdate.exe
2056	sysupdate.exe
5460	shout.exe
5576	svchost.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-FEY33U = "\"C:\\ProgramData\\sysupdate\\sysupdate.exe\""	sysupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-FEY33U = "\"C:\\ProgramData\\sysupdate\\sysupdate.exe\""	sysupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-FEY33U = "\"C:\\ProgramData\\sysupdate\\sysupdate.exe\""	sysupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-FEY33U = "\"C:\\ProgramData\\sysupdate\\sysupdate.exe\""	sysupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-FEY33U = "\"C:\\ProgramData\\sysupdate\\sysupdate.exe\""	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-FEY33U = "\"C:\\ProgramData\\sysupdate\\sysupdate.exe\""	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\f0ebd23eac064a10da288dbf3b9db45bdf5e107c970e57f7974710cad01aed04 = "C:\\Users\\Admin\\AppData\\Roaming\\f0ebd23eac064a10da288dbf3b9db45bdf5e107c970e57f7974710cad01aed04.exe"	f0ebd23eac064a10da288dbf3b9db45bdf5e107c970e57f7974710cad01aed04.exe

Drops desktop.ini file(s) 34 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	svchost.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-275798769-4264537674-1142822080-1000\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	svchost.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
59	ip-api.com

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\43vsxyqb2.jpg"	svchost.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3884 set thread context of 3008	3884	f0ebd23eac064a10da288dbf3b9db45bdf5e107c970e57f7974710cad01aed04.exe	99
PID 2056 set thread context of 1556	2056	sysupdate.exe	101
PID 1556 set thread context of 1092	1556	iexplore.exe	102

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	sysupdate.exe
Key created	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Local Settings	svchost.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
660	NOTEPAD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5576	svchost.exe

Suspicious behavior: EnumeratesProcesses 51 IoCs

pid	Process
3596	msedge.exe
3596	msedge.exe
4644	msedge.exe
4644	msedge.exe
4780	identity_helper.exe
4780	identity_helper.exe
5460	shout.exe
5460	shout.exe
5460	shout.exe
5460	shout.exe
5460	shout.exe
5460	shout.exe
5460	shout.exe
5460	shout.exe
5460	shout.exe
5460	shout.exe
5460	shout.exe
5460	shout.exe
5460	shout.exe
5460	shout.exe
5460	shout.exe
5460	shout.exe
5460	shout.exe
5460	shout.exe
5460	shout.exe
5460	shout.exe
5460	shout.exe
5460	shout.exe
5576	svchost.exe
5576	svchost.exe
5576	svchost.exe
5576	svchost.exe
5576	svchost.exe
5576	svchost.exe
5576	svchost.exe
5576	svchost.exe
5576	svchost.exe
5576	svchost.exe
5576	svchost.exe
5576	svchost.exe
5576	svchost.exe
5576	svchost.exe
5576	svchost.exe
5576	svchost.exe
5576	svchost.exe
5576	svchost.exe
5576	svchost.exe
5576	svchost.exe
5576	svchost.exe
5576	svchost.exe
5576	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1556	iexplore.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2056	sysupdate.exe
1556	iexplore.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3884	f0ebd23eac064a10da288dbf3b9db45bdf5e107c970e57f7974710cad01aed04.exe
Token: SeDebugPrivilege	3008	f0ebd23eac064a10da288dbf3b9db45bdf5e107c970e57f7974710cad01aed04.exe
Token: SeDebugPrivilege	3008	f0ebd23eac064a10da288dbf3b9db45bdf5e107c970e57f7974710cad01aed04.exe
Token: SeDebugPrivilege	5460	shout.exe
Token: SeDebugPrivilege	5576	svchost.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3884 wrote to memory of 3164	3884	f0ebd23eac064a10da288dbf3b9db45bdf5e107c970e57f7974710cad01aed04.exe	98
PID 3884 wrote to memory of 3164	3884	f0ebd23eac064a10da288dbf3b9db45bdf5e107c970e57f7974710cad01aed04.exe	98
PID 3884 wrote to memory of 3164	3884	f0ebd23eac064a10da288dbf3b9db45bdf5e107c970e57f7974710cad01aed04.exe	98
PID 3884 wrote to memory of 3008	3884	f0ebd23eac064a10da288dbf3b9db45bdf5e107c970e57f7974710cad01aed04.exe	99
PID 3884 wrote to memory of 3008	3884	f0ebd23eac064a10da288dbf3b9db45bdf5e107c970e57f7974710cad01aed04.exe	99
PID 3884 wrote to memory of 3008	3884	f0ebd23eac064a10da288dbf3b9db45bdf5e107c970e57f7974710cad01aed04.exe	99
PID 3884 wrote to memory of 3008	3884	f0ebd23eac064a10da288dbf3b9db45bdf5e107c970e57f7974710cad01aed04.exe	99
PID 3884 wrote to memory of 3008	3884	f0ebd23eac064a10da288dbf3b9db45bdf5e107c970e57f7974710cad01aed04.exe	99
PID 3884 wrote to memory of 3008	3884	f0ebd23eac064a10da288dbf3b9db45bdf5e107c970e57f7974710cad01aed04.exe	99
PID 3884 wrote to memory of 3008	3884	f0ebd23eac064a10da288dbf3b9db45bdf5e107c970e57f7974710cad01aed04.exe	99
PID 3884 wrote to memory of 3008	3884	f0ebd23eac064a10da288dbf3b9db45bdf5e107c970e57f7974710cad01aed04.exe	99
PID 3164 wrote to memory of 2056	3164	sysupdate.exe	100
PID 3164 wrote to memory of 2056	3164	sysupdate.exe	100
PID 3164 wrote to memory of 2056	3164	sysupdate.exe	100
PID 2056 wrote to memory of 1556	2056	sysupdate.exe	101
PID 2056 wrote to memory of 1556	2056	sysupdate.exe	101
PID 2056 wrote to memory of 1556	2056	sysupdate.exe	101
PID 2056 wrote to memory of 1556	2056	sysupdate.exe	101
PID 1556 wrote to memory of 1092	1556	iexplore.exe	102
PID 1556 wrote to memory of 1092	1556	iexplore.exe	102
PID 1556 wrote to memory of 1092	1556	iexplore.exe	102
PID 1556 wrote to memory of 1092	1556	iexplore.exe	102
PID 1556 wrote to memory of 4644	1556	iexplore.exe	107
PID 1556 wrote to memory of 4644	1556	iexplore.exe	107
PID 4644 wrote to memory of 4388	4644	msedge.exe	108
PID 4644 wrote to memory of 4388	4644	msedge.exe	108
PID 4644 wrote to memory of 2456	4644	msedge.exe	109
PID 4644 wrote to memory of 2456	4644	msedge.exe	109
PID 4644 wrote to memory of 2456	4644	msedge.exe	109
PID 4644 wrote to memory of 2456	4644	msedge.exe	109
PID 4644 wrote to memory of 2456	4644	msedge.exe	109
PID 4644 wrote to memory of 2456	4644	msedge.exe	109
PID 4644 wrote to memory of 2456	4644	msedge.exe	109
PID 4644 wrote to memory of 2456	4644	msedge.exe	109
PID 4644 wrote to memory of 2456	4644	msedge.exe	109
PID 4644 wrote to memory of 2456	4644	msedge.exe	109
PID 4644 wrote to memory of 2456	4644	msedge.exe	109
PID 4644 wrote to memory of 2456	4644	msedge.exe	109
PID 4644 wrote to memory of 2456	4644	msedge.exe	109
PID 4644 wrote to memory of 2456	4644	msedge.exe	109
PID 4644 wrote to memory of 2456	4644	msedge.exe	109
PID 4644 wrote to memory of 2456	4644	msedge.exe	109
PID 4644 wrote to memory of 2456	4644	msedge.exe	109
PID 4644 wrote to memory of 2456	4644	msedge.exe	109
PID 4644 wrote to memory of 2456	4644	msedge.exe	109
PID 4644 wrote to memory of 2456	4644	msedge.exe	109
PID 4644 wrote to memory of 2456	4644	msedge.exe	109
PID 4644 wrote to memory of 2456	4644	msedge.exe	109
PID 4644 wrote to memory of 2456	4644	msedge.exe	109
PID 4644 wrote to memory of 2456	4644	msedge.exe	109
PID 4644 wrote to memory of 2456	4644	msedge.exe	109
PID 4644 wrote to memory of 2456	4644	msedge.exe	109
PID 4644 wrote to memory of 2456	4644	msedge.exe	109
PID 4644 wrote to memory of 2456	4644	msedge.exe	109
PID 4644 wrote to memory of 2456	4644	msedge.exe	109
PID 4644 wrote to memory of 2456	4644	msedge.exe	109
PID 4644 wrote to memory of 2456	4644	msedge.exe	109
PID 4644 wrote to memory of 2456	4644	msedge.exe	109
PID 4644 wrote to memory of 2456	4644	msedge.exe	109
PID 4644 wrote to memory of 2456	4644	msedge.exe	109
PID 4644 wrote to memory of 2456	4644	msedge.exe	109
PID 4644 wrote to memory of 2456	4644	msedge.exe	109
PID 4644 wrote to memory of 2456	4644	msedge.exe	109
PID 4644 wrote to memory of 2456	4644	msedge.exe	109

C:\Users\Admin\AppData\Local\Temp\f0ebd23eac064a10da288dbf3b9db45bdf5e107c970e57f7974710cad01aed04.exe
"C:\Users\Admin\AppData\Local\Temp\f0ebd23eac064a10da288dbf3b9db45bdf5e107c970e57f7974710cad01aed04.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3884
- C:\Users\Admin\AppData\Local\Temp\sysupdate.exe
  "C:\Users\Admin\AppData\Local\Temp\sysupdate.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3164
- - C:\ProgramData\sysupdate\sysupdate.exe
    "C:\ProgramData\sysupdate\sysupdate.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:2056
  - - \??\c:\program files (x86)\internet explorer\iexplore.exe
      "c:\program files (x86)\internet explorer\iexplore.exe"
      4⤵
      Adds Run key to start application
      Suspicious use of SetThreadContext
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:1556
    - - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        5⤵
        
        PID:1092
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://i.imgflip.com/1p7cdj.jpg
        5⤵
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:4644
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9287046f8,0x7ff928704708,0x7ff928704718
        6⤵
        
        PID:4388
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,17819959161974484079,8529234428873015741,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
        6⤵
        
        PID:2456
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,17819959161974484079,8529234428873015741,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3596
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,17819959161974484079,8529234428873015741,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
        6⤵
        
        PID:3624
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17819959161974484079,8529234428873015741,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
        6⤵
        
        PID:4396
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17819959161974484079,8529234428873015741,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
        6⤵
        
        PID:4992
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,17819959161974484079,8529234428873015741,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 /prefetch:8
        6⤵
        
        PID:1876
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,17819959161974484079,8529234428873015741,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 /prefetch:8
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4780
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17819959161974484079,8529234428873015741,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
        6⤵
        
        PID:1144
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17819959161974484079,8529234428873015741,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
        6⤵
        
        PID:660
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17819959161974484079,8529234428873015741,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
        6⤵
        
        PID:5160
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17819959161974484079,8529234428873015741,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
        6⤵
        
        PID:5168
    - - C:\Users\Admin\AppData\Local\Temp\shout.exe
        
        "C:\Users\Admin\AppData\Local\Temp\shout.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5460
      - C:\Users\Admin\AppData\Roaming\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost.exe"
        6⤵
        Checks computer location settings
        Drops startup file
        Executes dropped EXE
        Drops desktop.ini file(s)
        Sets desktop wallpaper using registry
        Modifies registry class
        Suspicious behavior: AddClipboardFormatListener
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5576
        
        C:\Windows\system32\NOTEPAD.EXE
        
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\read_it.txt
        7⤵
        Opens file in notepad (likely ransom note)
        
        PID:660
- C:\Users\Admin\AppData\Local\Temp\f0ebd23eac064a10da288dbf3b9db45bdf5e107c970e57f7974710cad01aed04.exe
  C:\Users\Admin\AppData\Local\Temp\f0ebd23eac064a10da288dbf3b9db45bdf5e107c970e57f7974710cad01aed04.exe
  2⤵
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:3008

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1892

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\f0ebd23eac064a10da288dbf3b9db45bdf5e107c970e57f7974710cad01aed04.exe.log

Filesize
927B

MD5
ef1b4e3bfd6facbbb8d6a12f5f5e32de

SHA1
8f3ef66bf86f1697c520303c78b11d58165d146f

SHA256
c652040e1a2f251b1b9e69419d6a53a91e850ea48491b3c54c2ff4a4a2907cd1

SHA512
b6329c2a18217008c5e3544313cd1c7135468c5fb45e5104b9fa2f55a1f14804e66b6b9afcaa8e813cb522f536c06dba32f3afd469c4958a7c57d7df4c0e7315

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1eb86108cb8f5a956fdf48efbd5d06fe

SHA1
7b2b299f753798e4891df2d9cbf30f94b39ef924

SHA256
1b53367e0041d54af89e7dd59733231f5da1393c551ed2b943c89166c0baca40

SHA512
e2a661437688a4a01a6eb3b2bd7979ecf96b806f5a487d39354a7f0d44cb693a3b1c2cf6b1247b04e4106cc816105e982569572042bdddb3cd5bec23b4fce29d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f35bb0615bb9816f562b83304e456294

SHA1
1049e2bd3e1bbb4cea572467d7c4a96648659cb4

SHA256
05e80abd624454e5b860a08f40ddf33d672c3fed319aac180b7de5754bc07b71

SHA512
db9100f3e324e74a9c58c7d9f50c25eaa4c6c4553c93bab9b80c6f7bef777db04111ebcd679f94015203b240fe9f4f371cae0d4290ec891a4173c746ff4b11c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
181B

MD5
b21ae766b110e1629786f5da99de89a2

SHA1
4cb98cf651feff75456ef21ff8e783582ad50e17

SHA256
c8e2d1be2bb7db63fdea39880d0f6f4c170540e270b7adeaaaf38994b93a6683

SHA512
0ad80718132200b865696c208e545ac1b982378424ba9ecd754a5adf87f9e6a0ac3a7f19c516dbe883e7cbd82e0d6c8b0970fd6ad47e0e2a8647e4ef5f96857c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b3b0b9b61a1bb691c806f6bca93c73d8

SHA1
7b22b905ab4b7affa5aaa32956b580b88c5c0526

SHA256
50676629ffbd6ebe20a06bbc18e939d6c0c785dfe192916a653dbac269cebfea

SHA512
e2c591fabc3b12980f907cb01c3cfa237a8611d270ac30a0efc7ace3ad7c815c3940c3fc4cd8655c65ddabd02a5fdf38f4c2bf52047c81124b903943711fbf2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0fd7f7d233f1c953c9d16d12b52f5407

SHA1
761a7f674138fb23b7ac60e1bb489654a49e8e54

SHA256
380a981bd177b00f4c5badd1c59d70d15948e5a337c6191524c5cc37540a1ca6

SHA512
0d686647cdf610b87619f6d86b9f6ddaf49c5204533987edf5ec84c04359e4d4b0886f8b472d000b0993d572ca063a19e6f26c8370556a453d8b0baf4f9d6d7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d77adc90f879235928243a3cb7a14a3b

SHA1
196b4b89bcb3a7cc8d89221c9e38bd20ea114ab6

SHA256
07d732c7bba7df4c5775be3e9e7d9df860a9b50e8d73ee627e8b42126d0ade8a

SHA512
ba5731068cc3f77b0e02cd50f620721f92c83f01eb782cf7129d48d448dc9c4f07085090b56bf1eaa4692303000c64b8bf3e5c387e3f51ef516d940703ac6d84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
12686e6e746662a9d6770912c65184d2

SHA1
44025094f6f34e26099c99ed9b95d8c54ea46bdf

SHA256
5e65218ab2d5d6c8353dd5fa909d7ad1e35a092c06cecdd8d1946e041efb0193

SHA512
3ab992672238da9f762ca249b7286a2806590a004436dd9dfec3968309b3f7d80d9df65b818badc60b37236c26a723a5f328e630e34215c98dd9d9ae36cdbd14

Download Submit
C:\Users\Admin\AppData\Local\Temp\shout.exe

Filesize
84KB

MD5
7051dcbe9a0837a312b09a5ae3b42430

SHA1
3553ff8725a57929e438228bf141b695c13cecb4

SHA256
ce750c7054359e9e88556d48f7eea341374b74f494caed48251185b54c9ed644

SHA512
2e82160bff1fbdd6f6a9f0210dfaf831650fdefdf8e3bb70c3c2717122b107ef3610c5c5f55908843df7ba3bd3bbefc40b9d1dda07877083cbd2ab8b090a276c

Download Submit
C:\Users\Admin\AppData\Local\Temp\sysupdate.exe

Filesize
483KB

MD5
bdfa7710dfc213d8babcd7348440deeb

SHA1
ecd7d6ad5a3e0cc8c24ce1f12a40b0c86a769f98

SHA256
79ec51c588fccbe876f58de8a0256e27de65aa14f245615c42bd92cc640063fe

SHA512
663eb74fba1e38d3f930c0d73787309f86b85852cbccae1b44d3056a6073a95494c1526dc98d132f84a71e379babc5bd6819e76643f82fcd5591e264825fb2ee

Download Submit
C:\Users\Admin\Documents\read_it.txt

Filesize
140B

MD5
ee20a3aaf13c2d8805ede471f1f3ed3c

SHA1
bac14bc149af77885de0f6997fe3f3bf3f9686ad

SHA256
b9afbd14a42e996a8de6eba45b8a6df17a958f1b269913eab89484f62d373919

SHA512
8dea66d1bb1ee359b61fa32e3a45a1d66cf8987fdbec4218ef258b58aaaf9475e77bff2d40f9f28f4a75f321de6f86de6f42ab3cd7afee4e213ffbe3ae03f714

Download Submit
memory/1092-4843-0x00000000012D0000-0x0000000001352000-memory.dmp

Filesize
520KB

Download
memory/1556-4839-0x0000000000F70000-0x0000000000FF2000-memory.dmp

Filesize
520KB

Download
memory/1556-4854-0x0000000000F70000-0x0000000000FF2000-memory.dmp

Filesize
520KB

Download
memory/3008-4864-0x0000000004F40000-0x0000000004F50000-memory.dmp

Filesize
64KB

Download
memory/3008-4851-0x0000000004F40000-0x0000000004F50000-memory.dmp

Filesize
64KB

Download
memory/3008-4850-0x0000000004FC0000-0x0000000005026000-memory.dmp

Filesize
408KB

Download
memory/3008-4853-0x0000000074AC0000-0x0000000075270000-memory.dmp

Filesize
7.7MB

Download
memory/3008-4865-0x0000000006910000-0x00000000069A2000-memory.dmp

Filesize
584KB

Download
memory/3008-4801-0x0000000005070000-0x000000000510C000-memory.dmp

Filesize
624KB

Download
memory/3008-4799-0x0000000074AC0000-0x0000000075270000-memory.dmp

Filesize
7.7MB

Download
memory/3008-4800-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3008-5405-0x0000000006540000-0x000000000654A000-memory.dmp

Filesize
40KB

Download
memory/3884-32-0x0000000004E10000-0x000000000503A000-memory.dmp

Filesize
2.2MB

Download
memory/3884-40-0x0000000004E10000-0x000000000503A000-memory.dmp

Filesize
2.2MB

Download
memory/3884-50-0x0000000004E10000-0x000000000503A000-memory.dmp

Filesize
2.2MB

Download
memory/3884-54-0x0000000004E10000-0x000000000503A000-memory.dmp

Filesize
2.2MB

Download
memory/3884-56-0x0000000004E10000-0x000000000503A000-memory.dmp

Filesize
2.2MB

Download
memory/3884-58-0x0000000004E10000-0x000000000503A000-memory.dmp

Filesize
2.2MB

Download
memory/3884-60-0x0000000004E10000-0x000000000503A000-memory.dmp

Filesize
2.2MB

Download
memory/3884-62-0x0000000004E10000-0x000000000503A000-memory.dmp

Filesize
2.2MB

Download
memory/3884-66-0x0000000004E10000-0x000000000503A000-memory.dmp

Filesize
2.2MB

Download
memory/3884-64-0x0000000004E10000-0x000000000503A000-memory.dmp

Filesize
2.2MB

Download
memory/3884-52-0x0000000004E10000-0x000000000503A000-memory.dmp

Filesize
2.2MB

Download
memory/3884-3426-0x0000000074AC0000-0x0000000075270000-memory.dmp

Filesize
7.7MB

Download
memory/3884-4780-0x0000000004E00000-0x0000000004E10000-memory.dmp

Filesize
64KB

Download
memory/3884-4781-0x0000000004D80000-0x0000000004D81000-memory.dmp

Filesize
4KB

Download
memory/3884-4782-0x00000000054D0000-0x0000000005548000-memory.dmp

Filesize
480KB

Download
memory/3884-4783-0x0000000005550000-0x000000000559C000-memory.dmp

Filesize
304KB

Download
memory/3884-46-0x0000000004E10000-0x000000000503A000-memory.dmp

Filesize
2.2MB

Download
memory/3884-4792-0x0000000006330000-0x00000000068D4000-memory.dmp

Filesize
5.6MB

Download
memory/3884-44-0x0000000004E10000-0x000000000503A000-memory.dmp

Filesize
2.2MB

Download
memory/3884-4798-0x0000000074AC0000-0x0000000075270000-memory.dmp

Filesize
7.7MB

Download
memory/3884-34-0x0000000004E10000-0x000000000503A000-memory.dmp

Filesize
2.2MB

Download
memory/3884-42-0x0000000004E10000-0x000000000503A000-memory.dmp

Filesize
2.2MB

Download
memory/3884-38-0x0000000004E10000-0x000000000503A000-memory.dmp

Filesize
2.2MB

Download
memory/3884-48-0x0000000004E10000-0x000000000503A000-memory.dmp

Filesize
2.2MB

Download
memory/3884-36-0x0000000004E10000-0x000000000503A000-memory.dmp

Filesize
2.2MB

Download
memory/3884-1-0x0000000074AC0000-0x0000000075270000-memory.dmp

Filesize
7.7MB

Download
memory/3884-30-0x0000000004E10000-0x000000000503A000-memory.dmp

Filesize
2.2MB

Download
memory/3884-26-0x0000000004E10000-0x000000000503A000-memory.dmp

Filesize
2.2MB

Download
memory/3884-28-0x0000000004E10000-0x000000000503A000-memory.dmp

Filesize
2.2MB

Download
memory/3884-22-0x0000000004E10000-0x000000000503A000-memory.dmp

Filesize
2.2MB

Download
memory/3884-24-0x0000000004E10000-0x000000000503A000-memory.dmp

Filesize
2.2MB

Download
memory/3884-20-0x0000000004E10000-0x000000000503A000-memory.dmp

Filesize
2.2MB

Download
memory/3884-18-0x0000000004E10000-0x000000000503A000-memory.dmp

Filesize
2.2MB

Download
memory/3884-16-0x0000000004E10000-0x000000000503A000-memory.dmp

Filesize
2.2MB

Download
memory/3884-14-0x0000000004E10000-0x000000000503A000-memory.dmp

Filesize
2.2MB

Download
memory/3884-12-0x0000000004E10000-0x000000000503A000-memory.dmp

Filesize
2.2MB

Download
memory/3884-10-0x0000000004E10000-0x000000000503A000-memory.dmp

Filesize
2.2MB

Download
memory/3884-8-0x0000000004E10000-0x000000000503A000-memory.dmp

Filesize
2.2MB

Download
memory/3884-4-0x0000000004E10000-0x000000000503A000-memory.dmp

Filesize
2.2MB

Download
memory/3884-0-0x00000000000B0000-0x0000000000326000-memory.dmp

Filesize
2.5MB

Download
memory/3884-2-0x0000000004E10000-0x0000000005040000-memory.dmp

Filesize
2.2MB

Download
memory/3884-3-0x0000000004E10000-0x000000000503A000-memory.dmp

Filesize
2.2MB

Download
memory/3884-6-0x0000000004E10000-0x000000000503A000-memory.dmp

Filesize
2.2MB

Download
memory/5460-4947-0x00007FF915320000-0x00007FF915DE1000-memory.dmp

Filesize
10.8MB

Download
memory/5460-4934-0x00007FF915320000-0x00007FF915DE1000-memory.dmp

Filesize
10.8MB

Download
memory/5460-4933-0x00000000005A0000-0x00000000005BC000-memory.dmp

Filesize
112KB

Download
memory/5576-4948-0x00007FF915320000-0x00007FF915DE1000-memory.dmp

Filesize
10.8MB

Download
memory/5576-5426-0x00007FF915320000-0x00007FF915DE1000-memory.dmp

Filesize
10.8MB

Download