stormkitty | f730bbdf76ecc7e6a3cbc22516b2f66e6ce1bc0ff79f86fb651a9caa9020dba2

Analysis

max time kernel
299s
max time network
300s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
15/03/2024, 01:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sus_protected.exe
Size 105KB
Sample240315-bveaeafc32
SHA256 f730bbdf76ecc7e6a3cbc22516b2f66e6ce1bc0ff79f86fb651a9caa9020dba2
MD5 2bdf24dce352606a0f2242f8270bd824
SHA1 15a49cf15a7145452d4f5a5f4ac473e80fe13af8
SHA512 2d4ebaa1259204d7ff8ace8d28173b7df2b81bce81fb9d10d2d911488042499c6549c9895f7ff37c51bbd19b465b719a768706b570d1127d1c1e76a04508c348
SSDEEP 3072:A89pI4WuF+2BCyRf2aQw9X/z4bXCTrdft6ozGiXobQzB:AUWXafcw9/z4bi
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

stormkitty xworm persistence ransomware rat spyware stealer trojan

Malware Config

Extracted

Family

xworm

hai1723rat-60039.portmap.io:60039

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral4/memory/3704-5-0x0000000000400000-0x0000000000418000-memory.dmp	family_xworm
behavioral4/memory/4080-15-0x0000000000D90000-0x0000000000DA0000-memory.dmp	family_xworm

StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 1 IoCs

resource	yara_rule
behavioral4/memory/3704-120-0x0000000007950000-0x0000000007A6E000-memory.dmp	family_stormkitty

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000\Software\Microsoft\Windows\CurrentVersion\Run\113 = "C:\\Users\\Admin\\Desktop\\lmao\\nice.exe"	powershell.exe

Drops desktop.ini file(s) 16 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	sus_protected.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	sus_protected.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	sus_protected.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	sus_protected.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	sus_protected.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	sus_protected.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	sus_protected.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	sus_protected.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	sus_protected.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-3594324687-1993884830-4019639329-1000\desktop.ini	sus_protected.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	sus_protected.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	sus_protected.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	sus_protected.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	sus_protected.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	sus_protected.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	sus_protected.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\XBackground.bmp"	sus_protected.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2336 set thread context of 3704	2336	sus_protected.exe	81

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	Taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	Taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	Taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2336	sus_protected.exe
4080	powershell.exe
4080	powershell.exe
736	powershell.exe
736	powershell.exe
1536	powershell.exe
1536	powershell.exe
3704	sus_protected.exe
3704	sus_protected.exe
3704	sus_protected.exe
3704	sus_protected.exe
3704	sus_protected.exe
3704	sus_protected.exe
3704	sus_protected.exe
3704	sus_protected.exe
3704	sus_protected.exe
3704	sus_protected.exe
3704	sus_protected.exe
3704	sus_protected.exe
3704	sus_protected.exe
3704	sus_protected.exe
3704	sus_protected.exe
3704	sus_protected.exe
3704	sus_protected.exe
3704	sus_protected.exe
3704	sus_protected.exe
3704	sus_protected.exe
3704	sus_protected.exe
3704	sus_protected.exe
3704	sus_protected.exe
3704	sus_protected.exe
3704	sus_protected.exe
3704	sus_protected.exe
3704	sus_protected.exe
3704	sus_protected.exe
3704	sus_protected.exe
3704	sus_protected.exe
3704	sus_protected.exe
3704	sus_protected.exe
3704	sus_protected.exe
3704	sus_protected.exe
3704	sus_protected.exe
3704	sus_protected.exe
3704	sus_protected.exe
3704	sus_protected.exe
3704	sus_protected.exe
3704	sus_protected.exe
3704	sus_protected.exe
3704	sus_protected.exe
3704	sus_protected.exe
3704	sus_protected.exe
3704	sus_protected.exe
3704	sus_protected.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
276	msedge.exe
276	msedge.exe
276	msedge.exe
276	msedge.exe
276	msedge.exe
276	msedge.exe
276	msedge.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	2336	sus_protected.exe
Token: SeDebugPrivilege	4080	powershell.exe
Token: SeDebugPrivilege	3704	sus_protected.exe
Token: SeDebugPrivilege	736	powershell.exe
Token: SeDebugPrivilege	1536	powershell.exe
Token: SeDebugPrivilege	3704	sus_protected.exe
Token: SeDebugPrivilege	4600	Taskmgr.exe
Token: SeSystemProfilePrivilege	4600	Taskmgr.exe
Token: SeCreateGlobalPrivilege	4600	Taskmgr.exe
Token: 33	4600	Taskmgr.exe
Token: SeIncBasePriorityPrivilege	4600	Taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
276	msedge.exe
276	msedge.exe
276	msedge.exe
276	msedge.exe
276	msedge.exe
276	msedge.exe
276	msedge.exe
276	msedge.exe
276	msedge.exe
276	msedge.exe
276	msedge.exe
276	msedge.exe
276	msedge.exe
276	msedge.exe
276	msedge.exe
276	msedge.exe
276	msedge.exe
276	msedge.exe
276	msedge.exe
276	msedge.exe
276	msedge.exe
276	msedge.exe
276	msedge.exe
276	msedge.exe
276	msedge.exe

Suspicious use of SendNotifyMessage 51 IoCs

pid	Process
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
4600	Taskmgr.exe
276	msedge.exe
276	msedge.exe
276	msedge.exe
276	msedge.exe
276	msedge.exe
276	msedge.exe
276	msedge.exe
276	msedge.exe
276	msedge.exe
276	msedge.exe
276	msedge.exe
276	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3704	sus_protected.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 4080	2336	sus_protected.exe	79
PID 2336 wrote to memory of 4080	2336	sus_protected.exe	79
PID 2336 wrote to memory of 4080	2336	sus_protected.exe	79
PID 2336 wrote to memory of 3704	2336	sus_protected.exe	81
PID 2336 wrote to memory of 3704	2336	sus_protected.exe	81
PID 2336 wrote to memory of 3704	2336	sus_protected.exe	81
PID 2336 wrote to memory of 3704	2336	sus_protected.exe	81
PID 2336 wrote to memory of 3704	2336	sus_protected.exe	81
PID 2336 wrote to memory of 3704	2336	sus_protected.exe	81
PID 2336 wrote to memory of 3704	2336	sus_protected.exe	81
PID 2336 wrote to memory of 3704	2336	sus_protected.exe	81
PID 3704 wrote to memory of 736	3704	sus_protected.exe	84
PID 3704 wrote to memory of 736	3704	sus_protected.exe	84
PID 3704 wrote to memory of 736	3704	sus_protected.exe	84
PID 3704 wrote to memory of 1536	3704	sus_protected.exe	86
PID 3704 wrote to memory of 1536	3704	sus_protected.exe	86
PID 3704 wrote to memory of 1536	3704	sus_protected.exe	86
PID 3704 wrote to memory of 276	3704	sus_protected.exe	92
PID 3704 wrote to memory of 276	3704	sus_protected.exe	92
PID 276 wrote to memory of 1120	276	msedge.exe	93
PID 276 wrote to memory of 1120	276	msedge.exe	93
PID 276 wrote to memory of 392	276	msedge.exe	94
PID 276 wrote to memory of 392	276	msedge.exe	94
PID 276 wrote to memory of 392	276	msedge.exe	94
PID 276 wrote to memory of 392	276	msedge.exe	94
PID 276 wrote to memory of 392	276	msedge.exe	94
PID 276 wrote to memory of 392	276	msedge.exe	94
PID 276 wrote to memory of 392	276	msedge.exe	94
PID 276 wrote to memory of 392	276	msedge.exe	94
PID 276 wrote to memory of 392	276	msedge.exe	94
PID 276 wrote to memory of 392	276	msedge.exe	94
PID 276 wrote to memory of 392	276	msedge.exe	94
PID 276 wrote to memory of 392	276	msedge.exe	94
PID 276 wrote to memory of 392	276	msedge.exe	94
PID 276 wrote to memory of 392	276	msedge.exe	94
PID 276 wrote to memory of 392	276	msedge.exe	94
PID 276 wrote to memory of 392	276	msedge.exe	94
PID 276 wrote to memory of 392	276	msedge.exe	94
PID 276 wrote to memory of 392	276	msedge.exe	94
PID 276 wrote to memory of 392	276	msedge.exe	94
PID 276 wrote to memory of 392	276	msedge.exe	94
PID 276 wrote to memory of 392	276	msedge.exe	94
PID 276 wrote to memory of 392	276	msedge.exe	94
PID 276 wrote to memory of 392	276	msedge.exe	94
PID 276 wrote to memory of 392	276	msedge.exe	94
PID 276 wrote to memory of 392	276	msedge.exe	94
PID 276 wrote to memory of 392	276	msedge.exe	94
PID 276 wrote to memory of 392	276	msedge.exe	94
PID 276 wrote to memory of 392	276	msedge.exe	94
PID 276 wrote to memory of 392	276	msedge.exe	94
PID 276 wrote to memory of 392	276	msedge.exe	94
PID 276 wrote to memory of 392	276	msedge.exe	94
PID 276 wrote to memory of 392	276	msedge.exe	94
PID 276 wrote to memory of 392	276	msedge.exe	94
PID 276 wrote to memory of 392	276	msedge.exe	94
PID 276 wrote to memory of 392	276	msedge.exe	94
PID 276 wrote to memory of 392	276	msedge.exe	94
PID 276 wrote to memory of 392	276	msedge.exe	94
PID 276 wrote to memory of 392	276	msedge.exe	94
PID 276 wrote to memory of 392	276	msedge.exe	94
PID 276 wrote to memory of 392	276	msedge.exe	94
PID 276 wrote to memory of 3480	276	msedge.exe	95
PID 276 wrote to memory of 3480	276	msedge.exe	95
PID 276 wrote to memory of 2976	276	msedge.exe	96

C:\Users\Admin\AppData\Local\Temp\sus_protected.exe
"C:\Users\Admin\AppData\Local\Temp\sus_protected.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Remove -ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name '113';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name '113' -Value '"C:\Users\Admin\Desktop\lmao\nice.exe"' -PropertyType 'String'
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4080
- C:\Users\Admin\AppData\Local\Temp\sus_protected.exe
  #cmd
  2⤵
  - Drops desktop.ini file(s)
  - Sets desktop wallpaper using registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3704
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\sus_protected.exe'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:736
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'sus_protected.exe'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\How To Decrypt My Files.html
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff939023cb8,0x7ff939023cc8,0x7ff939023cd8
      4⤵
      PID:1120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,247113431136015918,8450583428260155580,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1920 /prefetch:2
      4⤵
      PID:392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1908,247113431136015918,8450583428260155580,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
      4⤵
      PID:3480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1908,247113431136015918,8450583428260155580,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2628 /prefetch:8
      4⤵
      PID:2976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,247113431136015918,8450583428260155580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
      4⤵
      PID:2636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,247113431136015918,8450583428260155580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
      4⤵
      PID:5088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1908,247113431136015918,8450583428260155580,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5084 /prefetch:8
      4⤵
      PID:4460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1908,247113431136015918,8450583428260155580,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5368 /prefetch:8
      4⤵
      PID:4780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,247113431136015918,8450583428260155580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
      4⤵
      PID:3988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,247113431136015918,8450583428260155580,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
      4⤵
      PID:3536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,247113431136015918,8450583428260155580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:1
      4⤵
      PID:3220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,247113431136015918,8450583428260155580,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
      4⤵
      PID:1724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,247113431136015918,8450583428260155580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4616 /prefetch:1
      4⤵
      PID:3260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,247113431136015918,8450583428260155580,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1964 /prefetch:2
      4⤵
      PID:2424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\How To Decrypt My Files.html
    3⤵
    PID:1492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff939023cb8,0x7ff939023cc8,0x7ff939023cd8
      4⤵
      PID:4572

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1624

C:\Windows\System32\Taskmgr.exe
"C:\Windows\System32\Taskmgr.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4600

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1760

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 9cb8cfca6ac40e91cb8928b58a37868b844c9425644451e5d8a2290b5aa7be8d
MD5 61ecf056210295f7de28e195258731b9
SHA1 53d2b50327ef84e68b914bc937f50b0e3e6b5895
SHA512 ce30fbc0ab11223cc5aad874c848a57c0d84b108914e178e782e45b2aeb1deb40292d9e43c7839c11cbd18264c4f2451de2edbbef5dd6dc4e1b32a7d787dbf61
MD5 SHA1 SHA512

Submit Download

sus_protected.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\sus_protected.exe.log
Size 321B
SHA256 f7ebc9ed3149ecb8a190fbcb1d4e5524e1bdd0e603ab695d8ebff41da59fa2d4
MD5 f67fe6df08d4663b0496e9a0cc94640a
SHA1 d07396cfcf0c6ac3baef97ce55da213a87923095
SHA512 4f92d4a762675eee10856d08921c75cf3f9a6f92e94c21f0ef0aa5147f9a84e168e6cdb001e9a66986b0cff1c454d50a5b44715676875cf5343a3cbc5c0d5e31
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a241c88bb86182b5998d9818e6e054d29b201b53f4f1a6b9b2ee8ba22dd238dc
MD5 5c3ea95e17becd26086dd59ba83b8e84
SHA1 7943b2a84dcf26240afc77459ffaaf269bfef29f
SHA512 64c905e923298528783dc64450c96390dc5edbda51f553c04d88ee944b0c660b05392dc0c823d7fb47f604b04061390b285f982dfcc767c8168ccb00d7e94e21
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 2e5d6a5eeb72575f974d5fa3cdff7ad4d87a361399ffdd4b03f93cdbdec3a110
MD5 c65e704fc47bc3d9d2c45a244bb74d76
SHA1 3e7917feebea866e0909e089e0b976b4a0947a6e
SHA512 36c3be0e5fbc23c5c0ad2e14cfb1cf7913bea9a5aeb83f9f6fcf5dbc52a94d8ccb370cef723b0cda82b5fba1941b6a9ff57f77ff0076a2c5cf4250711e3dd909
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 5a4021d8c9361f1d5563a0a66c7b0c7cf5c3789d929d3cc3511119fa2105d29a
MD5 aa4e66b1015f069c4db85ebd8cf026be
SHA1 88fba5d719a31f228e621217452c754f0dceafdf
SHA512 71003b982e2620fa3154e48aa19b2e178cf0d9a1ca59f78d5cd821fed01585590e2b79af7dd4fbb82fe75eaae16767b7edb19345318329e0e3d61d2bce35a876
SSDEEP 96:nFk3N7tN3kFO0wSv0MoiVmdHIvUJ40WQyV+VpziX3wI3:nFk3NhJkFNv0MAIvy4Lx93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 6a569464cff55dfb60ca6542cd238e91b9bd1c94947354abb146553a4c8317d4
MD5 0fc0c97fe5a22f50e554643c1cf16898
SHA1 0538556f8396f4ef35bd440f655783184ee439b3
SHA512 64d966e3911731154aeae3dc2d545d67f950d6ec9c46e3e35dca7dcd9b7da305cd095f01aeb9685cbdffb871b26d20fa85240f8161ac987911ae0e2b52edce1b
SSDEEP 96:nFk3N8tN3kFO0wSv0MoiVmdHIvUJ40WQyV+VpAiX3wI3:nFk3NuJkFNv0MAIvy4Le93
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 106315cff48601227b2bc8eb304bcdb1a39539dafde2fb5086c5a8e0610bc7a4
MD5 5ce4773934f2d38f9c897f9c2e4a6326
SHA1 5c127130389f75e125d6ccb4411f61dda29ed9b7
SHA512 394c954c295fcbfba6a9956dc6398bd5606dc1a20ecf35f5bbd91743cac00a537a860a3bb7338676f9595ce7fe93129245a05d2996e8f79f752e5637a9529606
SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASGhidoVe2RUdjhRyWPjE7Eu/P4:M9iIxuERzA83h09RZxASGsdaYTjE7ZP4
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 6ebe209017ac3e9d5d644b5bdf4b6f7e39c821a3f63b6c9ef1d16a3a9ea23a5b
MD5 92b76a8318c8c7da4a595fa701458c60
SHA1 378e6eb9fc51a11175d13e24ef2b6044873675f2
SHA512 a00e2f8404594a616bf3c689f8a8f7e48cebb64f042a51687975f8bf831ce600889fee5a1a9c5dce7e028c9fc39bc17e2c6a2edb993a7a9409f0ec39ea5a0e8b
SSDEEP 384:ZL3HhiSSqV1oL1BRHEM6LTHnwjsasVhHZwxzRdAnYEIapDUM:hgSS0cRP6LDwjMVhHZw/d3yUM
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 19KB
SHA256 fa106f9379283c220b9392cb3ee92c9ffb34e33c78ac84a92bd2735b1328bfe8
MD5 b38ca8f1303d397d6d7050eace96b444
SHA1 c8bfa9f2839ea57d2ae4290ee74af9d86281da75
SHA512 2cd6e16d20cae59bf5cec4338957550bfa292ee969f6590a9557695ea94a41063e6e3287e5768b7f9f2b76f113ec0e54260ceb7b3cd40080087d621cbf91db63
SSDEEP 384:4L3HhR6S1/ck/8GIlRCrdxznNHjs2xDghYNhE5XR9wgu0iFML9q:eT6SOk/HGC/xHj7xDgeNhIR9wgu00
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_ohbn4riz.dqe.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ohbn4riz.dqe.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

How To Decrypt My Files.html

Path C:\Users\Admin\Desktop\How To Decrypt My Files.html
Size 639B
SHA256 5ca82cbc4d582a4a425ae328ad12fd198095e2854f4f87b27a4b09e91173a3be
MD5 d2dbbc3383add4cbd9ba8e1e35872552
SHA1 020abbc821b2fe22c4b2a89d413d382e48770b6f
SHA512 bb5e1bbf28c10c077644136b98d8d02bfec3b3e49c0829b4d4570b30e0aea0276eb748f749a491587a5e70141a7653be1d03c463a22e44efecde2e5a6c6e5e66
MD5 SHA1 SHA512

Submit Download

nice.exe

Path C:\Users\Admin\Desktop\lmao\nice.exe
Size 105KB
SHA256 f730bbdf76ecc7e6a3cbc22516b2f66e6ce1bc0ff79f86fb651a9caa9020dba2
MD5 2bdf24dce352606a0f2242f8270bd824
SHA1 15a49cf15a7145452d4f5a5f4ac473e80fe13af8
SHA512 2d4ebaa1259204d7ff8ace8d28173b7df2b81bce81fb9d10d2d911488042499c6549c9895f7ff37c51bbd19b465b719a768706b570d1127d1c1e76a04508c348
SSDEEP 3072:A89pI4WuF+2BCyRf2aQw9X/z4bXCTrdft6ozGiXobQzB:AUWXafcw9/z4bi
MD5 SHA1 SHA512 SSDEEP

Submit Download

NTUSER.DAT{2fa72cf3-34ca-11ed-acae-cbf1edc82a99}.TMContainer00000000000000000001.regtrans-ms.ENC

Path C:\Users\Admin\NTUSER.DAT{2fa72cf3-34ca-11ed-acae-cbf1edc82a99}.TMContainer00000000000000000001.regtrans-ms.ENC
Size 16B
SHA256 0b409ffcd1a7cd93f7f7a3018ac55ac82d36849471813e78521f5a92dad6f30e
MD5 c1de0c79a1db09b76316f71e0111e4f2
SHA1 02d87a121b82e1c5c02f5e9da922e7198737afe7
SHA512 5210a4e6de7fda1a7f206606936a38cc7e099100eec763e277da78766f5f5937724bd16c7640b7254df596273b072f62f94342d7d5758ff6a009924ed2ad55ee
MD5 SHA1 SHA512

Submit Download

memory/736-73-0x000000007F4E0000-0x000000007F4F0000-memory.dmp

Download

memory/736-84-0x00000000075B0000-0x0000000007654000-memory.dmp

Download

memory/736-61-0x0000000004FC0000-0x0000000004FD0000-memory.dmp

Download

memory/736-60-0x0000000004FC0000-0x0000000004FD0000-memory.dmp

Download

memory/736-70-0x0000000005E50000-0x00000000061A7000-memory.dmp

Download

memory/736-72-0x0000000006950000-0x000000000699C000-memory.dmp

Download

memory/736-85-0x0000000004FC0000-0x0000000004FD0000-memory.dmp

Download

memory/736-83-0x0000000004FC0000-0x0000000004FD0000-memory.dmp

Download

memory/736-74-0x0000000070880000-0x00000000708CC000-memory.dmp

Download

memory/736-59-0x00000000751D0000-0x0000000075981000-memory.dmp

Download

memory/736-86-0x0000000007900000-0x0000000007911000-memory.dmp

Download

memory/736-87-0x0000000007940000-0x0000000007955000-memory.dmp

Download

memory/736-89-0x00000000751D0000-0x0000000075981000-memory.dmp

Download

memory/1536-114-0x0000000002E50000-0x0000000002E60000-memory.dmp

Download

memory/1536-91-0x0000000002E50000-0x0000000002E60000-memory.dmp

Download

memory/1536-90-0x00000000751D0000-0x0000000075981000-memory.dmp

Download

memory/1536-116-0x00000000751D0000-0x0000000075981000-memory.dmp

Download

memory/1536-103-0x0000000070880000-0x00000000708CC000-memory.dmp

Download

memory/1536-102-0x000000007EF00000-0x000000007EF10000-memory.dmp

Download

memory/1536-92-0x0000000002E50000-0x0000000002E60000-memory.dmp

Download

memory/1536-113-0x0000000002E50000-0x0000000002E60000-memory.dmp

Download

memory/2336-11-0x00000000751D0000-0x0000000075981000-memory.dmp

Download

memory/2336-0-0x0000000000070000-0x0000000000090000-memory.dmp

Download

memory/2336-2-0x0000000005010000-0x00000000055B6000-memory.dmp

Download

memory/2336-4-0x0000000004BA0000-0x0000000004BB0000-memory.dmp

Download

memory/2336-1-0x00000000751D0000-0x0000000075981000-memory.dmp

Download

memory/3704-119-0x00000000066A0000-0x00000000066AA000-memory.dmp

Download

memory/3704-112-0x00000000751D0000-0x0000000075981000-memory.dmp

Download

memory/3704-5-0x0000000000400000-0x0000000000418000-memory.dmp

Download

memory/3704-14-0x0000000005810000-0x00000000058AC000-memory.dmp

Download

memory/3704-13-0x00000000751D0000-0x0000000075981000-memory.dmp

Download

memory/3704-122-0x0000000007E20000-0x0000000007E6C000-memory.dmp

Download

memory/3704-121-0x0000000007A70000-0x0000000007DC7000-memory.dmp

Download

memory/3704-120-0x0000000007950000-0x0000000007A6E000-memory.dmp

Download

memory/3704-118-0x00000000066D0000-0x0000000006762000-memory.dmp

Download

memory/3704-117-0x0000000005A60000-0x0000000005A70000-memory.dmp

Download

memory/4080-17-0x0000000005440000-0x00000000054A6000-memory.dmp

Download

memory/4080-57-0x00000000751D0000-0x0000000075981000-memory.dmp

Download

memory/4080-32-0x00000000713B0000-0x00000000713FC000-memory.dmp

Download

memory/4080-42-0x0000000000D90000-0x0000000000DA0000-memory.dmp

Download

memory/4080-44-0x0000000000D90000-0x0000000000DA0000-memory.dmp

Download

memory/4080-43-0x0000000006CE0000-0x0000000006D84000-memory.dmp

Download

memory/4080-41-0x00000000060C0000-0x00000000060DE000-memory.dmp

Download

memory/4080-31-0x0000000006A90000-0x0000000006AC4000-memory.dmp

Download

memory/4080-30-0x000000007F620000-0x000000007F630000-memory.dmp

Download

memory/4080-29-0x0000000005B00000-0x0000000005B4C000-memory.dmp

Download

memory/4080-28-0x0000000005AC0000-0x0000000005ADE000-memory.dmp

Download

memory/4080-46-0x0000000006E10000-0x0000000006E2A000-memory.dmp

Download

memory/4080-27-0x0000000005620000-0x0000000005977000-memory.dmp

Download

memory/4080-47-0x0000000006E90000-0x0000000006E9A000-memory.dmp

Download

memory/4080-48-0x00000000070A0000-0x0000000007136000-memory.dmp

Download

memory/4080-18-0x00000000055B0000-0x0000000005616000-memory.dmp

Download

memory/4080-49-0x0000000007020000-0x0000000007031000-memory.dmp

Download

memory/4080-50-0x0000000007050000-0x000000000705E000-memory.dmp

Download

memory/4080-51-0x0000000007060000-0x0000000007075000-memory.dmp

Download

memory/4080-45-0x0000000007460000-0x0000000007ADA000-memory.dmp

Download

memory/4080-54-0x00000000071A0000-0x00000000071C2000-memory.dmp

Download

memory/4080-6-0x00000000022C0000-0x00000000022F6000-memory.dmp

Download

memory/4080-7-0x00000000751D0000-0x0000000075981000-memory.dmp

Download

memory/4080-12-0x0000000000D90000-0x0000000000DA0000-memory.dmp

Download

memory/4080-53-0x0000000007150000-0x0000000007158000-memory.dmp

Download

memory/4080-52-0x0000000007160000-0x000000000717A000-memory.dmp

Download

memory/4080-15-0x0000000000D90000-0x0000000000DA0000-memory.dmp

Download

memory/4080-10-0x0000000004DA0000-0x00000000053CA000-memory.dmp

Download

memory/4080-16-0x0000000004C20000-0x0000000004C42000-memory.dmp

Download

memory/4600-176-0x0000024D86100000-0x0000024D86101000-memory.dmp

Download

memory/4600-182-0x0000024D86100000-0x0000024D86101000-memory.dmp

Download

memory/4600-188-0x0000024D86100000-0x0000024D86101000-memory.dmp

Download

memory/4600-187-0x0000024D86100000-0x0000024D86101000-memory.dmp

Download

memory/4600-186-0x0000024D86100000-0x0000024D86101000-memory.dmp

Download

memory/4600-185-0x0000024D86100000-0x0000024D86101000-memory.dmp

Download

memory/4600-184-0x0000024D86100000-0x0000024D86101000-memory.dmp

Download

memory/4600-183-0x0000024D86100000-0x0000024D86101000-memory.dmp

Download

memory/4600-178-0x0000024D86100000-0x0000024D86101000-memory.dmp

Download

memory/4600-177-0x0000024D86100000-0x0000024D86101000-memory.dmp

Download