crimsonrat | hxxps://github[.]com/Da2dalus/The-MALWARE-Repo

Analysis

max time kernel
1799s
max time network
1804s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
23-03-2024 12:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo

Score

10^/10

crimsonrat warzonerat infostealer persistence rat rezer0

Malware Config

Extracted

Family

crimsonrat

185.136.161.124

Extracted

Family

warzonerat

168.61.222.215:5400

Signatures

CrimsonRAT main payload 3 IoCs

resource	yara_rule
behavioral1/files/0x000100000002a865-333.dat	family_crimsonrat
behavioral1/files/0x000100000002a865-350.dat	family_crimsonrat
behavioral1/files/0x000100000002a865-349.dat	family_crimsonrat

CrimsonRat
Crimson RAT is a malware linked to a Pakistani-linked threat actor.
rat crimsonrat
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

ReZer0 packer 1 IoCs

Detects ReZer0, a packer with multiple versions used in various campaigns.

rezer0

resource	yara_rule
behavioral1/memory/2480-415-0x0000000005DD0000-0x0000000005DF8000-memory.dmp	rezer0

Warzone RAT payload 4 IoCs

rat

resource	yara_rule
behavioral1/memory/252-431-0x0000000000400000-0x0000000000553000-memory.dmp	warzonerat
behavioral1/memory/252-434-0x0000000000400000-0x0000000000553000-memory.dmp	warzonerat
behavioral1/memory/252-436-0x0000000000400000-0x0000000000553000-memory.dmp	warzonerat
behavioral1/memory/252-522-0x0000000000400000-0x0000000000553000-memory.dmp	warzonerat

Downloads MZ/PE file

Modifies Installed Components in the registry 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}	unregmp2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\DontAsk = "2"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\Version = "12,0,22000,282"	unregmp2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\IsInstalled = "0"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\Stubpath = "%SystemRoot%\\system32\\unregmp2.exe /ShowWMP"	unregmp2.exe

Executes dropped EXE 3 IoCs

pid	Process
1912	CrimsonRAT.exe
3992	dlrarhsiva.exe
2480	WarzoneRAT.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	unregmp2.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
29	raw.githubusercontent.com
30	raw.githubusercontent.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2480 set thread context of 252	2480	WarzoneRAT.exe	111

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Media Player\wmplayer.exe	unregmp2.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1916	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133556703809578026"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play\NeverDefault	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play\command	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play\NeverDefault	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play\ = "&Play with Windows Media Player"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play\command	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Video\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\video\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Video\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9800"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue\command	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play\ = "&Play with Windows Media Player"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue\ = "&Add to Windows Media Player list"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue\command	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue\command\DelegateExecute = "{45597c98-80f6-4549-84ff-752cf55e2d29}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Enqueue\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9800"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\video\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue\NeverDefault	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue\command\DelegateExecute = "{45597c98-80f6-4549-84ff-752cf55e2d29}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9800"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue\command\DelegateExecute = "{45597c98-80f6-4549-84ff-752cf55e2d29}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Video\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NetworkExplorerPlugins\urn:schemas-upnp-org:device:MediaRenderer:1\ShellEx\ContextMenuHandlers\{17FC1A80-140E-4290-A64F-4A29A951A867}	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play\command\DelegateExecute = "{ed1d0fdf-4414-470a-a56d-cfb68623fc58}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Play\command	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue\ = "&Add to Windows Media Player list"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Enqueue\NeverDefault	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play\command\DelegateExecute = "{ed1d0fdf-4414-470a-a56d-cfb68623fc58}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue\command\DelegateExecute = "{45597c98-80f6-4549-84ff-752cf55e2d29}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play\command	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue\NeverDefault	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NetworkExplorerPlugins\urn:schemas-upnp-org:device:MediaRenderer:1\ShellEx\ContextMenuHandlers\{A45AEC2B-549E-405F-AF3E-C6B03C4FDFBF}	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue\ = "&Add to Windows Media Player list"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Play\ = "&Play with Windows Media Player"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue\command	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Enqueue\command\DelegateExecute = "{45597c98-80f6-4549-84ff-752cf55e2d29}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue\ = "&Add to Windows Media Player list"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play\command\DelegateExecute = "{ed1d0fdf-4414-470a-a56d-cfb68623fc58}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play\command\DelegateExecute = "{ed1d0fdf-4414-470a-a56d-cfb68623fc58}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9800"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Play\command\DelegateExecute = "{ed1d0fdf-4414-470a-a56d-cfb68623fc58}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Video\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play\NeverDefault	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue\NeverDefault	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Play\NeverDefault	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue\NeverDefault	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NetworkExplorerPlugins\urn:schemas-upnp-org:device:MediaRenderer:1\ShellEx\ContextMenuHandlers\{17FC1A80-140E-4290-A64F-4A29A951A867}\ = "Open Media Sharing Handler"	unregmp2.exe

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\CrimsonRAT.exe:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\WarzoneRAT.exe:Zone.Identifier	chrome.exe
File created	C:\Users\Admin\AppData\Roaming\jFvfxe.exe\:Zone.Identifier:$DATA	WarzoneRAT.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2812	chrome.exe
2812	chrome.exe
2148	chrome.exe
2148	chrome.exe
2480	WarzoneRAT.exe
2480	WarzoneRAT.exe
2480	WarzoneRAT.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2812	chrome.exe
2812	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeCreatePagefilePrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeCreatePagefilePrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeCreatePagefilePrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeCreatePagefilePrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeCreatePagefilePrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeCreatePagefilePrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeCreatePagefilePrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeCreatePagefilePrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeCreatePagefilePrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeCreatePagefilePrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeCreatePagefilePrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeCreatePagefilePrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeCreatePagefilePrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeCreatePagefilePrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeCreatePagefilePrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeCreatePagefilePrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeCreatePagefilePrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeCreatePagefilePrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeCreatePagefilePrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeCreatePagefilePrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeCreatePagefilePrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeCreatePagefilePrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeCreatePagefilePrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeCreatePagefilePrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeCreatePagefilePrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeCreatePagefilePrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeCreatePagefilePrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeCreatePagefilePrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeCreatePagefilePrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeCreatePagefilePrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeCreatePagefilePrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeCreatePagefilePrivilege	2812	chrome.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
3004	wmplayer.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2812 wrote to memory of 4800	2812	chrome.exe	81
PID 2812 wrote to memory of 4800	2812	chrome.exe	81
PID 2812 wrote to memory of 3116	2812	chrome.exe	83
PID 2812 wrote to memory of 3116	2812	chrome.exe	83
PID 2812 wrote to memory of 3116	2812	chrome.exe	83
PID 2812 wrote to memory of 3116	2812	chrome.exe	83
PID 2812 wrote to memory of 3116	2812	chrome.exe	83
PID 2812 wrote to memory of 3116	2812	chrome.exe	83
PID 2812 wrote to memory of 3116	2812	chrome.exe	83
PID 2812 wrote to memory of 3116	2812	chrome.exe	83
PID 2812 wrote to memory of 3116	2812	chrome.exe	83
PID 2812 wrote to memory of 3116	2812	chrome.exe	83
PID 2812 wrote to memory of 3116	2812	chrome.exe	83
PID 2812 wrote to memory of 3116	2812	chrome.exe	83
PID 2812 wrote to memory of 3116	2812	chrome.exe	83
PID 2812 wrote to memory of 3116	2812	chrome.exe	83
PID 2812 wrote to memory of 3116	2812	chrome.exe	83
PID 2812 wrote to memory of 3116	2812	chrome.exe	83
PID 2812 wrote to memory of 3116	2812	chrome.exe	83
PID 2812 wrote to memory of 3116	2812	chrome.exe	83
PID 2812 wrote to memory of 3116	2812	chrome.exe	83
PID 2812 wrote to memory of 3116	2812	chrome.exe	83
PID 2812 wrote to memory of 3116	2812	chrome.exe	83
PID 2812 wrote to memory of 3116	2812	chrome.exe	83
PID 2812 wrote to memory of 3116	2812	chrome.exe	83
PID 2812 wrote to memory of 3116	2812	chrome.exe	83
PID 2812 wrote to memory of 3116	2812	chrome.exe	83
PID 2812 wrote to memory of 3116	2812	chrome.exe	83
PID 2812 wrote to memory of 3116	2812	chrome.exe	83
PID 2812 wrote to memory of 3116	2812	chrome.exe	83
PID 2812 wrote to memory of 3116	2812	chrome.exe	83
PID 2812 wrote to memory of 3116	2812	chrome.exe	83
PID 2812 wrote to memory of 3116	2812	chrome.exe	83
PID 2812 wrote to memory of 3116	2812	chrome.exe	83
PID 2812 wrote to memory of 3116	2812	chrome.exe	83
PID 2812 wrote to memory of 3116	2812	chrome.exe	83
PID 2812 wrote to memory of 3116	2812	chrome.exe	83
PID 2812 wrote to memory of 3116	2812	chrome.exe	83
PID 2812 wrote to memory of 3116	2812	chrome.exe	83
PID 2812 wrote to memory of 3116	2812	chrome.exe	83
PID 2812 wrote to memory of 1932	2812	chrome.exe	84
PID 2812 wrote to memory of 1932	2812	chrome.exe	84
PID 2812 wrote to memory of 1628	2812	chrome.exe	85
PID 2812 wrote to memory of 1628	2812	chrome.exe	85
PID 2812 wrote to memory of 1628	2812	chrome.exe	85
PID 2812 wrote to memory of 1628	2812	chrome.exe	85
PID 2812 wrote to memory of 1628	2812	chrome.exe	85
PID 2812 wrote to memory of 1628	2812	chrome.exe	85
PID 2812 wrote to memory of 1628	2812	chrome.exe	85
PID 2812 wrote to memory of 1628	2812	chrome.exe	85
PID 2812 wrote to memory of 1628	2812	chrome.exe	85
PID 2812 wrote to memory of 1628	2812	chrome.exe	85
PID 2812 wrote to memory of 1628	2812	chrome.exe	85
PID 2812 wrote to memory of 1628	2812	chrome.exe	85
PID 2812 wrote to memory of 1628	2812	chrome.exe	85
PID 2812 wrote to memory of 1628	2812	chrome.exe	85
PID 2812 wrote to memory of 1628	2812	chrome.exe	85
PID 2812 wrote to memory of 1628	2812	chrome.exe	85
PID 2812 wrote to memory of 1628	2812	chrome.exe	85
PID 2812 wrote to memory of 1628	2812	chrome.exe	85
PID 2812 wrote to memory of 1628	2812	chrome.exe	85
PID 2812 wrote to memory of 1628	2812	chrome.exe	85
PID 2812 wrote to memory of 1628	2812	chrome.exe	85
PID 2812 wrote to memory of 1628	2812	chrome.exe	85

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/Da2dalus/The-MALWARE-Repo
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8688d9758,0x7ff8688d9768,0x7ff8688d9778
  2⤵
  PID:4800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1644 --field-trial-handle=1820,i,16684467057746217011,10810976902505796397,131072 /prefetch:2
  2⤵
  PID:3116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=1820,i,16684467057746217011,10810976902505796397,131072 /prefetch:8
  2⤵
  PID:1932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2148 --field-trial-handle=1820,i,16684467057746217011,10810976902505796397,131072 /prefetch:8
  2⤵
  PID:1628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2144 --field-trial-handle=1820,i,16684467057746217011,10810976902505796397,131072 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2988 --field-trial-handle=1820,i,16684467057746217011,10810976902505796397,131072 /prefetch:1
  2⤵
  PID:2024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 --field-trial-handle=1820,i,16684467057746217011,10810976902505796397,131072 /prefetch:8
  2⤵
  PID:4452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4848 --field-trial-handle=1820,i,16684467057746217011,10810976902505796397,131072 /prefetch:8
  2⤵
  PID:232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 --field-trial-handle=1820,i,16684467057746217011,10810976902505796397,131072 /prefetch:8
  2⤵
  PID:4344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3772 --field-trial-handle=1820,i,16684467057746217011,10810976902505796397,131072 /prefetch:8
  2⤵
  PID:2480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5012 --field-trial-handle=1820,i,16684467057746217011,10810976902505796397,131072 /prefetch:8
  2⤵
  PID:4316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5476 --field-trial-handle=1820,i,16684467057746217011,10810976902505796397,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5460 --field-trial-handle=1820,i,16684467057746217011,10810976902505796397,131072 /prefetch:8
  2⤵
  - NTFS ADS
  PID:1192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5464 --field-trial-handle=1820,i,16684467057746217011,10810976902505796397,131072 /prefetch:8
  2⤵
  PID:2008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4692 --field-trial-handle=1820,i,16684467057746217011,10810976902505796397,131072 /prefetch:8
  2⤵
  PID:1364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5312 --field-trial-handle=1820,i,16684467057746217011,10810976902505796397,131072 /prefetch:8
  2⤵
  PID:4364
- C:\Users\Admin\Downloads\CrimsonRAT.exe
  "C:\Users\Admin\Downloads\CrimsonRAT.exe"
  2⤵
  - Executes dropped EXE
  PID:1912
- - C:\ProgramData\Hdlharas\dlrarhsiva.exe
    "C:\ProgramData\Hdlharas\dlrarhsiva.exe"
    3⤵
    - Executes dropped EXE
    PID:3992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5584 --field-trial-handle=1820,i,16684467057746217011,10810976902505796397,131072 /prefetch:8
  2⤵
  PID:3412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3708 --field-trial-handle=1820,i,16684467057746217011,10810976902505796397,131072 /prefetch:8
  2⤵
  PID:4676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1516 --field-trial-handle=1820,i,16684467057746217011,10810976902505796397,131072 /prefetch:8
  2⤵
  - NTFS ADS
  PID:668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5028 --field-trial-handle=1820,i,16684467057746217011,10810976902505796397,131072 /prefetch:8
  2⤵
  PID:1016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5208 --field-trial-handle=1820,i,16684467057746217011,10810976902505796397,131072 /prefetch:8
  2⤵
  PID:4916
- C:\Users\Admin\Downloads\WarzoneRAT.exe
  "C:\Users\Admin\Downloads\WarzoneRAT.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2480
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jFvfxe" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1D7C.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:1916
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:252

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2968

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
1⤵
PID:2444
- C:\Program Files (x86)\Windows Media Player\setup_wm.exe
  "C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
  2⤵
  PID:2968
- - C:\Windows\SysWOW64\unregmp2.exe
    C:\Windows\system32\unregmp2.exe /ShowWMP /SetShowState /CreateMediaLibrary
    3⤵
    PID:2156
  - - C:\Windows\system32\unregmp2.exe
      "C:\Windows\SysNative\unregmp2.exe" /ShowWMP /SetShowState /CreateMediaLibrary /REENTRANT
      4⤵
      Modifies Installed Components in the registry
      Drops desktop.ini file(s)
      Drops file in Program Files directory
      Modifies registry class
      PID:764
- - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Relaunch /Play C:\Users\Admin\Desktop\CompressComplete.wm
    3⤵
    - Enumerates connected drives
    - Suspicious use of FindShellTrayWindow
    PID:3004
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  PID:3360
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    PID:4344

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:1360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Hdlharas\dlrarhsiva.exe

Filesize
9.1MB

MD5
64261d5f3b07671f15b7f10f2f78da3f

SHA1
d4f978177394024bb4d0e5b6b972a5f72f830181

SHA256
87f51b4632c5fbc351a59a234dfefef506d807f2c173aac23162b85d0d73c2ad

SHA512
3a9ff39e6bc7585b0b03f7327652e4c3b766563e8b183c25b6497e30956945add5684f1579862117e44c6bac2802601fc7c4d2a0daa1824f16c4da1fd6c9c91a

Download Submit
C:\ProgramData\Hdlharas\dlrarhsiva.exe

Filesize
7.7MB

MD5
edfca46dfa3e3d82977fa6e9af042622

SHA1
0128e85d6b36b46d246649a6cc2bf9587414e6df

SHA256
6acc489132be0e932e33f148886378eaee3fd753f35655eae3dcfe2aeeb4c63a

SHA512
2a884b1785add76165757fcf7c5129ac861d507694846d35680ad15134edf2ed948cfd5ee3c380402d65fd0967670cdaa32a86740a8fded9ad8f314bb3ed3024

Download Submit
C:\ProgramData\Hdlharas\dlrarhsiva.exe

Filesize
6.6MB

MD5
44dfc66467d452f097b8fb1e7ce0c2bd

SHA1
43bdad1a6cd960446015bb6dc879f17dc1b32bb1

SHA256
919a4f64610717fbe2e9c1b2b76528bf47b713b234636bf17a90a2653d6aafc4

SHA512
269660785cdd7a8da513786161d5d16323fa869671131b469a09843039095718a044cbdf71b7f3b1e78feba32dd4d36c34bb385d0be60a38854f62df036afbad

Download Submit
C:\ProgramData\Hdlharas\mdkhm.zip

Filesize
56KB

MD5
b635f6f767e485c7e17833411d567712

SHA1
5a9cbdca7794aae308c44edfa7a1ff5b155e4aa8

SHA256
6838286fb88e9e4e68882601a13fa770f1b510a0a86389b6a29070a129bf2e5e

SHA512
551ba05bd44e66685f359802b35a8c9775792a12844906b4b53e1a000d56624c6db323754331c9f399072790991c1b256d9114a50fb78111652a1c973d2880af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\1cf3d50b-de49-4dca-9e2b-717d92ce40e0.tmp

Filesize
6KB

MD5
35ec991345db40f37c624bc98d246605

SHA1
34f16451d56e7875972c5ddff5ef44588ffa0ecb

SHA256
e8b1e051c2010c365cde59ccc5f2e36841bd11924bce0e3fc746a58fbb92f208

SHA512
5d2ed43b31ff503b71ebae9c1fd580137b38cb6734f130329b9b567556fb8eecd66aaa758503670fcffb5b89eb459a78ceb72e0dd888c5a4241f55f1a153ba1d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
7aad3c569feba213531abc5c9e58a76d

SHA1
dda46d6ff4498e8c28f41ab93d99420164467899

SHA256
776ad46f73726f89b75d3bc2288ea2a40720cba5a5382ccfa7ca206a10131edc

SHA512
c1f2c10f0fc3008f775a30cf83293f569d15c05f252eab6f491750d2e8e975a83b87bdcb594cb2b7ba41d0e52ecfe127a1eea5705551b2498a3a61f796d89828

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
315ba60ce6c569626600968ddb011962

SHA1
04efcf851752c22551c7a6ff28668940ef44b660

SHA256
7169e20a47d77bd8744616b5b490e93581a9dcd2de2b5217da39e62c6fe9854c

SHA512
6d98279a115c01bb2803e65292f8ed6b646095b029d529b488b28073a920de26592511f95dd507f5d12eff7fa1b8c27b2a6e9bbd96f4508b15749c1650a6d241

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
770088041c191431b610b0ef6d1454f4

SHA1
849ba7d864adc5bcefb81c40fc88d79ac25e331e

SHA256
7f704ac1514b7b348a5287a0ecd70e8aca9d8767d68c647435f049e72c28a272

SHA512
6f4b030d59de1045afeb030e96eb6dd9e1dbde9fcf23b5cc7fa4bb76649aee590f317d66d1cdb40968963ccbf7dbaf9ae10630e75670a1d1a9c327af2ed7b092

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
6646e4a5cf04d810f6261c94079a20e2

SHA1
1ab96741deac59cce3ad044738165103d3f4a417

SHA256
fd4db7cc9dc0d29a52f675d986c9f24ea9339473cf847430de3c1ed8c5a94fd3

SHA512
69089915a11d3f5ece764c384c6e447cd681322bfae37981c63097785dbd51002df31e94b21deac1a45ffc4d3e55f48bbf660113cd442a6502c56523b2608eb2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
f220e04b29570c903bd24cdd84966d1e

SHA1
24835d789b4e8ce4ad8d41705ac8e67edeb7ddfe

SHA256
a7f275738e25db1c840287766787ab1d7c3a80fb369f8e09f21bd4430bbaec95

SHA512
51c845659ef88c3f7af6fd8cf5c598adc9b59763a21633048d8b3b1b1e24095c8fef8980e3a50012e401fd83ee13ef3d2e64ec7ffebb08c71f285790cd32814b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
6ce6f3d18cd6a04d139d0aba5328058b

SHA1
33ee63bd78cd2f9e9e6d254fca0befc8e9508d7e

SHA256
bf659375c2632b51ca67b273d9ae9e61399d00256f46606988ccde3169f94144

SHA512
908d490b55c53d86f8505420d6f8da91133e59d9711b8633dbc800254c26c702084e4440dae9df4edb79388bf5c0872ed063c678336fa4624e9b5ba8d36fa45c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
72d07a0d27176d61d23347961efb5b9a

SHA1
a0d8f135333a05403659405cddfedff32ab80b2e

SHA256
a4dae1d524c20a10c833cf4ebdb585d8bacbd9fe212ec5eca843097d7a06fab6

SHA512
c6539cd766d2aad5ca36042d7be8a37e958c1fd00f2851a1fd3d0099035577e09cc8b5a99c00e173552114737a4dfbc053d079eb8d52cd79ad6863eaa56ce723

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
c024f0b2b23443d6a73f9d0ff10c01aa

SHA1
d38c4e86e3f0fb253d9ea4b06e93c02199e92f5f

SHA256
86c22676733bc37d863e5508ddddf984f3ffddfd9ec6210f2910f3e1cbf0c53b

SHA512
78222ef159dbad86b9fca644969eb441bee1e7191f3940cd1fdfcc56a8ee76270f08ab9f6b1d9c19dacdc17188f2cdee684c6e40f55324bed1cc4e93bed71e8f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
bb520d128f0e17342a9689aad65b3d85

SHA1
ea5da66f119e61d8acd3c1f0ca8707b7e268d8c4

SHA256
474faebde419dbb0fe1f25f986414ef5f8c7fa6f59f21428bda4b5e2bb62e4d7

SHA512
8ea300bd793ebb0ed17a6798a6603ea213fa2d42f79cd012745b8426d92a8dd35483ad989bdab689ff8e3da03bf4d7639ab671721a233932a0d03978279e0739

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
f3c4985c795ab2ed3aa2253da17dce76

SHA1
f7c5f373bd7296d304f2bec7d769a224bec58932

SHA256
5c526e3039d7da2ec37305af68c1422232c2a09467a03a896a60c8f9dd925782

SHA512
7729b169dddeb79b4681393518f82c732aae25d0d3e73fafdf38d853bad683ac2d0db2a2e909ed8458e82b79f86555bebcd21683e8f2571239eca1869eda4ae3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
1aa53f085f50dd3608f273fea3aa5fe4

SHA1
2afa6228f65bf03c18dd3d53703ce562d1387291

SHA256
e125b4cf28e9ed15767a42702f74a6ed71b0c99e3ab72e64d38af1c479ef10c9

SHA512
dbae613fda3a30becd6075e41fb916c4fbdbcac408475bf744135cee3b5562411dbaf15b997f53d52abbaa9fa9d9f004d1411081ecfdc4e3a76158a286357f03

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
d373818c78f1eabb252983f22e3e1d59

SHA1
53213fd1c05f0ad2b28be95169248e31c4e6874e

SHA256
66bd46c4163ba8ec5f9b13466c44027bfa881510d20b1e5f9ddb916a29d4721d

SHA512
a62a78dbb18816025c33ee4e286556f4f71c8f5fad0f895c581387d9f1ff9c4fe4ba36cbb560bfc2335df68c5157b55e78204c89ecfdd33dc1177ef71835a22e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
40a481b02d9c6f0baf507edcb9aa4e87

SHA1
67a0bd157b9adad97a7afc2b184fbba9386fdd95

SHA256
f836d8bd129d1bac6cc07b5b7caf17f2fc25da1991ec536e8f4725d991c5539c

SHA512
c7eac9bd95707698a683a8a2ba4625245f15575f24154036b523021e74bf2efd902f8f63853294f8a45b52203a0b872bc286a7b72c4ce108bbee7f559f37a687

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
c91640a6681dc852e340d85a49b15b20

SHA1
b2c8af4a1118f4630734a444c9b75be85c287b04

SHA256
cb6bc179ebc3b2f38df7e70ea408ce13aec9da13bea8715c67bf5d398d349b17

SHA512
acf7320053ef46db931c2719a9134a16e3db6a1ee9a7a9fee091b173033cafd92ece17215fa1559677273324873fc22995e177cf395de066aaa05e33b664cf99

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
6305042952f8097dc79ababf8b5ce15d

SHA1
f765d088aea428d4d5a7dcf0131433c6532be5c2

SHA256
8ade49681fc6d0617e243ddc8a1ce88f5b6f88d21327f5046f85e618ba4d6c27

SHA512
bdbbe4ec31d765f11f7aa3065ee0db3fb3a94bb8fd249ae1668548a0cabd8706da462fffb3e14b5d3844bd9312473675b565012882adfaefc291bdd469e2d039

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
c406a45eed402eafd407abbc14bfd30e

SHA1
16d937c1d5bde05293546bf8b31dfac26e1ecdb3

SHA256
5b0694041178fb456e89f8fa8079a88eccb30b59bf418ba6d5788bca35a50646

SHA512
1df0b1a9809cb3cbd16529aebdeaa45f3d2526ca4fa7cce6d915e6fd6e49ffe67a2b11f5497b9eae5986bf1e349780e3ff850e5d421a71fce0448d6833237faf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
ef4d1181bcef4acd9f449b68a6af4690

SHA1
93cbc9c25083045e1fc1643309cf337815b480be

SHA256
5d6176553d63e75fb1ba46ad29bb5e74225ab9f88762bf234fdfa555794828c2

SHA512
c6a72014a73046859dc951bf172a8b583218b2f08a653a509264041811c75f97dca990f149564a0c91b3f0aba30f92f96c16099e5d904f3d108c0f9d3aa1ec75

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
29a9e892262916fbf76b5e1ac732c4ac

SHA1
9b62413516c167143d234c813ba4d0ebce5117fd

SHA256
517fa10f0d96a655222de99e684197c69797eaaef247af03bde00b6cd0286b29

SHA512
cf13a4d8f0568adac94aed77f37c8596658891ea24035232f5001ce2cb377753795881be9fdbe52e906cf5202de05f1bf86b04d94f9043f96fc34633b2a71a81

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
130KB

MD5
54ec311c62a678f17c136120e74a9699

SHA1
2d2f9630107eb48111f8830e0451f570af9fe0df

SHA256
7bb0d57a0cf6921b262bee668f6abe4201fd81e58fb5b810572b324a9297b92a

SHA512
897ef9d9dfa0807fe963e235e8a49647145fe638bc2b207affb81dcd3ac0d65a3a2f8e6bd4729ed459f6c96c414516d0c80150836ecfa4c7634783d62e6cfaf6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
109KB

MD5
6832da6bec5a597f2c64d0a61dc10052

SHA1
dd66f54a7f24f050c052f1b1b5890a43123d0f7f

SHA256
a9f031bd7fb324b967ac8d1a231ca01fae42d2e9b28f9ff3d50c2bc5f6cabbdc

SHA512
9e5aac9b98fb52ba75104c560c61c159053101e635539b66f02f2d65cf505e4ab2857e1350732702d124416e0de21893aa89d7cff6bb385e498e4f625d025389

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe59c0c6.TMP

Filesize
93KB

MD5
b7f0c83aaddd4edcabbafa625402d8e0

SHA1
9a60d512760067085e402fa685a667a369e0da3c

SHA256
4034fb0b1c8cfd43a64d730df5d70f5c5beb6fc18f929d675bf28befcf0c6b2c

SHA512
889bd039f388b7cd362f9b4a1624fb43bfa70502f691d5d88c60bca7dd28a9e15f8df213cd5f24365f9525bf271cab64ca4fa0434fec077df53d4f2c6aa8db24

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
256KB

MD5
8b8e6caf112c983a5d5aa8ad19056699

SHA1
c34a912b901bd2f8dda2a1a615f5fd1cd0109bc7

SHA256
0578f8301af27323dc4903d93f1446c2f5c4f841381fd3e4080fee79c75ad9ca

SHA512
bede4e23a608dac903d5fc96d9079dd5fe45a57bbde1c2064a57a7db1582d52ebc9c90d9f24904110140d6e9ef3cd0728d699c3e120be1d0fb2cee4c96d27f4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
1024KB

MD5
000c2f26d7f0cd177f4786d28ff5903f

SHA1
09025f78266d4f347c795f411ac59bf326331386

SHA256
90fa046c84defa6cda38295aab2199f85a6e248e05ea8e83d13c875b34f2849d

SHA512
599a5e6354c59a740e83937ee2fff48e10fc3af57dfa7056b93d45a8555839641a72237fca33d8778cfcf28637d2dceb0e175a1ba2f4d9537c8a72941de06b7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1D7C.tmp

Filesize
1KB

MD5
2cb33380cac4bb33aaddaa4678becf89

SHA1
382567efa17c44f5e06cc68c781f7fb1bf5da98e

SHA256
37bc9887538a5240d3a15a0d1e8d38298536e55ef1a22df14b28b2beff25895f

SHA512
92b8cdd94d56f94fc417de05f3eb71ec147e74015fb88b8e29064e8ce533cf275b14f9822552d69de59998f83463c4b0aff197a9977fb4e47705e28f4f084082

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmsetup.log

Filesize
1KB

MD5
359105a8ad07b8b0ddac7f644db5f0c2

SHA1
d29c192194cd3333afce428e3f0603528fc7c006

SHA256
586e876ee9825ef2b69f90ab7926ad0191181484a502f6329058a13e656286a1

SHA512
ae29568fc04f00895731ad4c19ff7c81e65fb67fe94d797c07bc1df3f4099938625b1ab540be028c55ed53939c487cec014aad600cca28a54fe11e7d5a5d7fbd

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmsetup.log

Filesize
2KB

MD5
864c422fc89417d18e7d220113fd9ff8

SHA1
6b9cb16085ac72513f14c5b31144e9ca6f0a87d8

SHA256
bf879f80783dc7fe6808401c36862a5e40794c1348e5eec1942dd13bbe55eee4

SHA512
3ff237c5ae2951fef85e8c22a9b6875cabbc03140b89cca305c156c441074d8827ec4ff1d978956d49db802a2e2e9a01f9cc7653f472284ab1d83f1e221d3d50

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms

Filesize
8KB

MD5
dc60d49f3d5d9b2203664b042903e2b0

SHA1
4248d4343f9acb465ea24e44255daa15f1a18a9f

SHA256
55d1cd23703748dc6f063f30d7e7a99b189ead30bd9c2245a1ee9cb4774bf30e

SHA512
2a321e1426ab6c8ba3b7e1383296bd894051694936aaca6e013ba01fd0e66b6fca82a5d1aee4ea003efdbb6cf2ecab772bd79a88f6de06b2e7cd601d263f54ee

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms

Filesize
1KB

MD5
393108b34989e01fff01fd729f355ff4

SHA1
c52f9990648abc4626f28cff4b329e2a63415b26

SHA256
fab3c0d9521798cdfeb2daba39be7e20642b3e0a3be8f71d1a8a5fc13f74c11d

SHA512
97de739d362c15139caed48402c6b1d87205cba1a657ee6d3c9b7fa884926dfd6bf785d4ffb52b5967db6cbe9bc7435412df3edf2dbc7ecbe36bdc36c0704fa6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms

Filesize
3KB

MD5
ddb39bc6a6bd4149251159256cbc3f4c

SHA1
85621d1fa59b54d912078512be8e4a72ac19aace

SHA256
8d735fbffd7107118e338e81d50ddc52b66aace58c8ff8e99f4712d1fd883e32

SHA512
2d16e910adeb845fbf6fb5b43800266ac10421e5b1b09d98f67aa04c888e317eee6f0b5a9a6e37c3539dc92d86a8e356eecbb18425e1978c5cdab1e8bec8ffb2

Download Submit
C:\Users\Admin\Downloads\CrimsonRAT.exe

Filesize
84KB

MD5
b6e148ee1a2a3b460dd2a0adbf1dd39c

SHA1
ec0efbe8fd2fa5300164e9e4eded0d40da549c60

SHA256
dc31e710277eac1b125de6f4626765a2684d992147691a33964e368e5f269cba

SHA512
4b8c62ddfc7cd3e5ce1f8b5a1ba4a611ab1bfccf81d80cf2cfc831cffa1d7a4b6da0494616a53b419168bc3a324b57382d4a6186af083de6fc93d144c4503741

Download Submit
C:\Users\Admin\Downloads\CrimsonRAT.exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\WarzoneRAT.exe

Filesize
321KB

MD5
600e0dbaefc03f7bf50abb0def3fb465

SHA1
1b5f0ac48e06edc4ed8243be61d71077f770f2b4

SHA256
61e6a93f43049712b5f2d949fd233fa8015fe4bef01b9e1285d3d87b12f894f2

SHA512
151eebac8f8f6e72d130114f030f048dff5bce0f99ff8d3a22e8fed7616155b3e87d29acf79f488d6b53ed2c5c9b05b57f76f1f91a568c21fe9bca228efb23d9

Download Submit
memory/252-522-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/252-436-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/252-434-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/252-431-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/1912-309-0x00007FF865960000-0x00007FF866422000-memory.dmp

Filesize
10.8MB

Download
memory/1912-354-0x00007FF865960000-0x00007FF866422000-memory.dmp

Filesize
10.8MB

Download
memory/1912-308-0x0000022C5E300000-0x0000022C5E31E000-memory.dmp

Filesize
120KB

Download
memory/1912-310-0x0000022C5E820000-0x0000022C5E830000-memory.dmp

Filesize
64KB

Download
memory/2480-414-0x0000000006490000-0x000000000652C000-memory.dmp

Filesize
624KB

Download
memory/2480-413-0x0000000005A20000-0x0000000005A28000-memory.dmp

Filesize
32KB

Download
memory/2480-412-0x0000000005A40000-0x0000000005AD2000-memory.dmp

Filesize
584KB

Download
memory/2480-411-0x0000000005EE0000-0x0000000006486000-memory.dmp

Filesize
5.6MB

Download
memory/2480-435-0x0000000074980000-0x0000000075131000-memory.dmp

Filesize
7.7MB

Download
memory/2480-410-0x00000000056A0000-0x00000000056B0000-memory.dmp

Filesize
64KB

Download
memory/2480-408-0x0000000000B90000-0x0000000000BE6000-memory.dmp

Filesize
344KB

Download
memory/2480-409-0x0000000074980000-0x0000000075131000-memory.dmp

Filesize
7.7MB

Download
memory/2480-415-0x0000000005DD0000-0x0000000005DF8000-memory.dmp

Filesize
160KB

Download
memory/3004-512-0x0000000008040000-0x0000000008050000-memory.dmp

Filesize
64KB

Download
memory/3004-516-0x0000000008040000-0x0000000008050000-memory.dmp

Filesize
64KB

Download
memory/3004-510-0x00000000058E0000-0x00000000058F0000-memory.dmp

Filesize
64KB

Download
memory/3004-511-0x0000000008040000-0x0000000008050000-memory.dmp

Filesize
64KB

Download
memory/3004-537-0x0000000008050000-0x0000000008060000-memory.dmp

Filesize
64KB

Download
memory/3004-513-0x0000000008050000-0x0000000008060000-memory.dmp

Filesize
64KB

Download
memory/3004-518-0x0000000008040000-0x0000000008050000-memory.dmp

Filesize
64KB

Download
memory/3004-517-0x0000000008040000-0x0000000008050000-memory.dmp

Filesize
64KB

Download
memory/3004-519-0x0000000008040000-0x0000000008050000-memory.dmp

Filesize
64KB

Download
memory/3004-509-0x00000000058E0000-0x00000000058F0000-memory.dmp

Filesize
64KB

Download
memory/3004-515-0x0000000008040000-0x0000000008050000-memory.dmp

Filesize
64KB

Download
memory/3004-514-0x0000000008040000-0x0000000008050000-memory.dmp

Filesize
64KB

Download
memory/3004-520-0x0000000008040000-0x0000000008050000-memory.dmp

Filesize
64KB

Download
memory/3004-521-0x0000000008040000-0x0000000008050000-memory.dmp

Filesize
64KB

Download
memory/3004-523-0x0000000008040000-0x0000000008050000-memory.dmp

Filesize
64KB

Download
memory/3992-353-0x000001B5E4EB0000-0x000001B5E57C4000-memory.dmp

Filesize
9.1MB

Download
memory/3992-352-0x00007FF865960000-0x00007FF866422000-memory.dmp

Filesize
10.8MB

Download
memory/3992-405-0x00007FF865960000-0x00007FF866422000-memory.dmp

Filesize
10.8MB

Download
memory/3992-407-0x000001B5E7590000-0x000001B5E75A0000-memory.dmp

Filesize
64KB

Download
memory/3992-357-0x000001B5E7590000-0x000001B5E75A0000-memory.dmp

Filesize
64KB

Download