purelogstealer | 6a69e0ebb331aa21614ccc0c4028b5cde242f0710300fe7b441b2017c71a8e16

Analysis

max time kernel
284s
max time network
285s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/03/2024, 09:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LoaderVNC.exe
Size 5.2MB
Sample240328-ldevqafa83
SHA256 6a69e0ebb331aa21614ccc0c4028b5cde242f0710300fe7b441b2017c71a8e16
MD5 6108c4dfc40c5059db5851144367ada3
SHA1 adad70901e50be0d5bae17f493bf4b1565cb6113
SHA512 0bc0efa44b86f7db0aa2c074236a30e35241c48bf4e55839322107b1b3dca2867a05a910cf79a5384e7511ef82bb937a0ec291489f0e768e8d111f97ced97671
SSDEEP 98304:YOH2X7UhdU65D7zYQC4nBGddClR5qGyz9kw4lJMyYqw1ce4ARg9XV6ZEwXbTGD:jWoh75D7vHl7qGyz9kw4lCqwWX9l6ZF
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

purelogstealer zgrat persistence rat stealer

Malware Config

Signatures

Detect ZGRat V1 37 IoCs

resource	yara_rule
behavioral3/memory/4372-4-0x0000000006780000-0x0000000006C70000-memory.dmp	family_zgrat_v1
behavioral3/memory/4372-5-0x0000000006780000-0x0000000006C6A000-memory.dmp	family_zgrat_v1
behavioral3/memory/4372-6-0x0000000006780000-0x0000000006C6A000-memory.dmp	family_zgrat_v1
behavioral3/memory/4372-8-0x0000000006780000-0x0000000006C6A000-memory.dmp	family_zgrat_v1
behavioral3/memory/4372-10-0x0000000006780000-0x0000000006C6A000-memory.dmp	family_zgrat_v1
behavioral3/memory/4372-12-0x0000000006780000-0x0000000006C6A000-memory.dmp	family_zgrat_v1
behavioral3/memory/4372-14-0x0000000006780000-0x0000000006C6A000-memory.dmp	family_zgrat_v1
behavioral3/memory/4372-16-0x0000000006780000-0x0000000006C6A000-memory.dmp	family_zgrat_v1
behavioral3/memory/4372-18-0x0000000006780000-0x0000000006C6A000-memory.dmp	family_zgrat_v1
behavioral3/memory/4372-20-0x0000000006780000-0x0000000006C6A000-memory.dmp	family_zgrat_v1
behavioral3/memory/4372-22-0x0000000006780000-0x0000000006C6A000-memory.dmp	family_zgrat_v1
behavioral3/memory/4372-24-0x0000000006780000-0x0000000006C6A000-memory.dmp	family_zgrat_v1
behavioral3/memory/4372-26-0x0000000006780000-0x0000000006C6A000-memory.dmp	family_zgrat_v1
behavioral3/memory/4372-28-0x0000000006780000-0x0000000006C6A000-memory.dmp	family_zgrat_v1
behavioral3/memory/4372-30-0x0000000006780000-0x0000000006C6A000-memory.dmp	family_zgrat_v1
behavioral3/memory/4372-32-0x0000000006780000-0x0000000006C6A000-memory.dmp	family_zgrat_v1
behavioral3/memory/4372-34-0x0000000006780000-0x0000000006C6A000-memory.dmp	family_zgrat_v1
behavioral3/memory/4372-36-0x0000000006780000-0x0000000006C6A000-memory.dmp	family_zgrat_v1
behavioral3/memory/4372-38-0x0000000006780000-0x0000000006C6A000-memory.dmp	family_zgrat_v1
behavioral3/memory/4372-40-0x0000000006780000-0x0000000006C6A000-memory.dmp	family_zgrat_v1
behavioral3/memory/4372-42-0x0000000006780000-0x0000000006C6A000-memory.dmp	family_zgrat_v1
behavioral3/memory/4372-44-0x0000000006780000-0x0000000006C6A000-memory.dmp	family_zgrat_v1
behavioral3/memory/4372-46-0x0000000006780000-0x0000000006C6A000-memory.dmp	family_zgrat_v1
behavioral3/memory/4372-48-0x0000000006780000-0x0000000006C6A000-memory.dmp	family_zgrat_v1
behavioral3/memory/4372-50-0x0000000006780000-0x0000000006C6A000-memory.dmp	family_zgrat_v1
behavioral3/memory/4372-52-0x0000000006780000-0x0000000006C6A000-memory.dmp	family_zgrat_v1
behavioral3/memory/4372-54-0x0000000006780000-0x0000000006C6A000-memory.dmp	family_zgrat_v1
behavioral3/memory/4372-56-0x0000000006780000-0x0000000006C6A000-memory.dmp	family_zgrat_v1
behavioral3/memory/4372-58-0x0000000006780000-0x0000000006C6A000-memory.dmp	family_zgrat_v1
behavioral3/memory/4372-60-0x0000000006780000-0x0000000006C6A000-memory.dmp	family_zgrat_v1
behavioral3/memory/4372-62-0x0000000006780000-0x0000000006C6A000-memory.dmp	family_zgrat_v1
behavioral3/memory/4372-64-0x0000000006780000-0x0000000006C6A000-memory.dmp	family_zgrat_v1
behavioral3/memory/4372-66-0x0000000006780000-0x0000000006C6A000-memory.dmp	family_zgrat_v1
behavioral3/memory/4372-68-0x0000000006780000-0x0000000006C6A000-memory.dmp	family_zgrat_v1
behavioral3/memory/2124-4805-0x00000000059F0000-0x0000000005C44000-memory.dmp	family_zgrat_v1
behavioral3/memory/1052-4811-0x0000000005150000-0x0000000005238000-memory.dmp	family_zgrat_v1
behavioral3/memory/4048-11909-0x0000000005650000-0x000000000572C000-memory.dmp	family_zgrat_v1

PureLog Stealer
PureLog Stealer is an infostealer written in C#.
stealer purelogstealer

PureLog Stealer payload 4 IoCs

resource	yara_rule
behavioral3/files/0x000300000000072f-4790.dat	family_purelog_stealer
behavioral3/files/0x000300000000072f-4795.dat	family_purelog_stealer
behavioral3/memory/2124-4797-0x0000000000B30000-0x0000000000DD0000-memory.dmp	family_purelog_stealer
behavioral3/files/0x000300000000072f-11902.dat	family_purelog_stealer

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation	LoaderVNC.exe

Executes dropped EXE 4 IoCs

pid	Process
2124	vncKript.exe
4264	Current.exe
3096	vncKript.exe
4048	vncKript.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idyahb = "C:\\Users\\Admin\\AppData\\Roaming\\Idyahb.exe"	LoaderVNC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Izfyrgtsv = "C:\\Users\\Admin\\AppData\\Roaming\\Izfyrgtsv.exe"	vncKript.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4372 set thread context of 1052	4372	LoaderVNC.exe	99
PID 2124 set thread context of 4048	2124	vncKript.exe	126

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4372	LoaderVNC.exe
4372	LoaderVNC.exe
2732	msedge.exe
2732	msedge.exe
420	msedge.exe
420	msedge.exe
2124	vncKript.exe
2124	vncKript.exe
4600	powershell.exe
4600	powershell.exe
3396	identity_helper.exe
3396	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	4372	LoaderVNC.exe
Token: SeDebugPrivilege	2124	vncKript.exe
Token: SeDebugPrivilege	1052	LoaderVNC.exe
Token: SeDebugPrivilege	4048	vncKript.exe
Token: SeDebugPrivilege	4600	powershell.exe
Token: SeDebugPrivilege	4264	Current.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4372 wrote to memory of 2124	4372	LoaderVNC.exe	97
PID 4372 wrote to memory of 2124	4372	LoaderVNC.exe	97
PID 4372 wrote to memory of 2124	4372	LoaderVNC.exe	97
PID 4372 wrote to memory of 4300	4372	LoaderVNC.exe	98
PID 4372 wrote to memory of 4300	4372	LoaderVNC.exe	98
PID 4372 wrote to memory of 4300	4372	LoaderVNC.exe	98
PID 4372 wrote to memory of 1052	4372	LoaderVNC.exe	99
PID 4372 wrote to memory of 1052	4372	LoaderVNC.exe	99
PID 4372 wrote to memory of 1052	4372	LoaderVNC.exe	99
PID 4372 wrote to memory of 1052	4372	LoaderVNC.exe	99
PID 4372 wrote to memory of 1052	4372	LoaderVNC.exe	99
PID 4372 wrote to memory of 1052	4372	LoaderVNC.exe	99
PID 4372 wrote to memory of 1052	4372	LoaderVNC.exe	99
PID 4372 wrote to memory of 1052	4372	LoaderVNC.exe	99
PID 420 wrote to memory of 3000	420	msedge.exe	105
PID 420 wrote to memory of 3000	420	msedge.exe	105
PID 420 wrote to memory of 828	420	msedge.exe	106
PID 420 wrote to memory of 828	420	msedge.exe	106
PID 420 wrote to memory of 828	420	msedge.exe	106
PID 420 wrote to memory of 828	420	msedge.exe	106
PID 420 wrote to memory of 828	420	msedge.exe	106
PID 420 wrote to memory of 828	420	msedge.exe	106
PID 420 wrote to memory of 828	420	msedge.exe	106
PID 420 wrote to memory of 828	420	msedge.exe	106
PID 420 wrote to memory of 828	420	msedge.exe	106
PID 420 wrote to memory of 828	420	msedge.exe	106
PID 420 wrote to memory of 828	420	msedge.exe	106
PID 420 wrote to memory of 828	420	msedge.exe	106
PID 420 wrote to memory of 828	420	msedge.exe	106
PID 420 wrote to memory of 828	420	msedge.exe	106
PID 420 wrote to memory of 828	420	msedge.exe	106
PID 420 wrote to memory of 828	420	msedge.exe	106
PID 420 wrote to memory of 828	420	msedge.exe	106
PID 420 wrote to memory of 828	420	msedge.exe	106
PID 420 wrote to memory of 828	420	msedge.exe	106
PID 420 wrote to memory of 828	420	msedge.exe	106
PID 420 wrote to memory of 828	420	msedge.exe	106
PID 420 wrote to memory of 828	420	msedge.exe	106
PID 420 wrote to memory of 828	420	msedge.exe	106
PID 420 wrote to memory of 828	420	msedge.exe	106
PID 420 wrote to memory of 828	420	msedge.exe	106
PID 420 wrote to memory of 828	420	msedge.exe	106
PID 420 wrote to memory of 828	420	msedge.exe	106
PID 420 wrote to memory of 828	420	msedge.exe	106
PID 420 wrote to memory of 828	420	msedge.exe	106
PID 420 wrote to memory of 828	420	msedge.exe	106
PID 420 wrote to memory of 828	420	msedge.exe	106
PID 420 wrote to memory of 828	420	msedge.exe	106
PID 420 wrote to memory of 828	420	msedge.exe	106
PID 420 wrote to memory of 828	420	msedge.exe	106
PID 420 wrote to memory of 828	420	msedge.exe	106
PID 420 wrote to memory of 828	420	msedge.exe	106
PID 420 wrote to memory of 828	420	msedge.exe	106
PID 420 wrote to memory of 828	420	msedge.exe	106
PID 420 wrote to memory of 828	420	msedge.exe	106
PID 420 wrote to memory of 828	420	msedge.exe	106
PID 420 wrote to memory of 2732	420	msedge.exe	107
PID 420 wrote to memory of 2732	420	msedge.exe	107
PID 420 wrote to memory of 3020	420	msedge.exe	108
PID 420 wrote to memory of 3020	420	msedge.exe	108
PID 420 wrote to memory of 3020	420	msedge.exe	108
PID 420 wrote to memory of 3020	420	msedge.exe	108
PID 420 wrote to memory of 3020	420	msedge.exe	108
PID 420 wrote to memory of 3020	420	msedge.exe	108

C:\Users\Admin\AppData\Local\Temp\LoaderVNC.exe
"C:\Users\Admin\AppData\Local\Temp\LoaderVNC.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Users\Admin\AppData\Local\Temp\vncKript.exe
  "C:\Users\Admin\AppData\Local\Temp\vncKript.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2124
- - C:\Users\Admin\AppData\Local\Temp\vncKript.exe
    C:\Users\Admin\AppData\Local\Temp\vncKript.exe
    3⤵
    - Executes dropped EXE
    PID:3096
- - C:\Users\Admin\AppData\Local\Temp\vncKript.exe
    C:\Users\Admin\AppData\Local\Temp\vncKript.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4048
- C:\Users\Admin\AppData\Local\Temp\LoaderVNC.exe
  C:\Users\Admin\AppData\Local\Temp\LoaderVNC.exe
  2⤵
  PID:4300
- C:\Users\Admin\AppData\Local\Temp\LoaderVNC.exe
  C:\Users\Admin\AppData\Local\Temp\LoaderVNC.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1052

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDAHUAcgByAGUAbgB0AC4AZQB4AGUAOwA=
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4600

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0x11c,0x12c,0x7ffb84d146f8,0x7ffb84d14708,0x7ffb84d14718
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,8321528928561649354,1372389342741531024,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2004,8321528928561649354,1372389342741531024,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2508 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2004,8321528928561649354,1372389342741531024,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2620 /prefetch:8
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,8321528928561649354,1372389342741531024,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,8321528928561649354,1372389342741531024,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,8321528928561649354,1372389342741531024,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,8321528928561649354,1372389342741531024,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,8321528928561649354,1372389342741531024,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2328 /prefetch:1
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,8321528928561649354,1372389342741531024,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,8321528928561649354,1372389342741531024,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,8321528928561649354,1372389342741531024,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,8321528928561649354,1372389342741531024,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:1
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,8321528928561649354,1372389342741531024,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6108 /prefetch:1
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,8321528928561649354,1372389342741531024,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  PID:184
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,8321528928561649354,1372389342741531024,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3396

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3848

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4560

C:\Users\Admin\AppData\Local\Keywords\sdvil\Current.exe
C:\Users\Admin\AppData\Local\Keywords\sdvil\Current.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Current.exe

Path C:\Users\Admin\AppData\Local\Keywords\sdvil\Current.exe
Size 2.9MB
SHA256 110446e05d8a5544f036d886da54353ce826849dc955fa0fb1a8253645562aeb
MD5 2c6f34ce0d378604571c10c45491ae47
SHA1 929eb2f06fa73922fd48ce47c5a35ce2028e3752
SHA512 de35fca7bd58cb980d4b0a68630c09b173740c7118792108786ef67c39ec6661fd59db43950ca13fd38379bd2aba4f5176ee49768edfff894900d3d91359a6a5
SSDEEP 49152:V2OXt1mXpJ7H0hdJp0654yWu7c6/Y8T81Pwoyqz9MMwejq19gXgWFw4fXCl1vz6i:YOH2X7UhdU65D7zYQC4nBGddClRX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Current.exe

Path C:\Users\Admin\AppData\Local\Keywords\sdvil\Current.exe
Size 1.2MB
SHA256 e1eab40c314da87fd2d6687eabea682d4ebacd0f11b1e401aea399307b51af99
MD5 6681febaff430b831f41b4cdba14de69
SHA1 bcd205251b58b8b668e11ea557df67edc1d0407e
SHA512 6b6470667b61cba658e5a1a326cc04045398b9055b2f0505c20fbc814f9e36bb73b6623a18ef1078094039e2789b4b5c34e5928be71133620b46fbfd4b87636c
SSDEEP 24576:iCrfiZkDwObR1zKXpp3j9B2STwhdJJXsHAHeiA6Aw3yNbbGvNYFu7cXNwzrY8Td:V2OXt1mXpJ7H0hdJp0654yWu7c6/Y8Td
MD5 SHA1 SHA512 SSDEEP

Submit Download

LoaderVNC.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\LoaderVNC.exe.log
Size 927B
SHA256 264098e15b5b33d425f3b76e45b7976b58f917048125041135f7e60d8151108c
MD5 4a911455784f74e368a4c2c7876d76f4
SHA1 a1700a0849ffb4f26671eb76da2489946b821c34
SHA512 4617591400409e1930195795a55e20d5f063042bb3e9fd1955099066e507b6ac8a1e3ae54cc42418e2639149b31bf7e58cd5743670d9030a15e29f14d813815d
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 01946a2d65e59b66ebc256470ff4861f32edee90a44e31bf67529add95cafef4
MD5 a774512b00820b61a51258335097b2c9
SHA1 38c28d1ea3907a1af6c0443255ab610dd9285095
SHA512 ce109be65060a5e7a872707c6c2ccce3aacd577e59c59d6e23e78d03e3d502f2707713fda40a546ed332e41a56ef90297af99590a5ab02f686a58bcbf3a82da1
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 b54b41e7ce5600bc653aa7c88abb666976872b2d5e2d657bfc1147a0b49e9d74
MD5 fd7944a4ff1be37517983ffaf5700b11
SHA1 c4287796d78e00969af85b7e16a2d04230961240
SHA512 28c58a2ccf39963a8d9f67ea5b93dbccf70b0109b2c8a396a58389cdec9db1205523a95730485bcbc9d533867cbf0e7167ad370fd45740e23656d01d96ee543b
MD5 SHA1 SHA512

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006
Size 198KB
SHA256 f9db7dd5930be2a5c8b4f545a361d51ed9c38e56bd3957650a3f8dbdf9c547fb
MD5 cda68ffa26095220a82ae0a7eaea5f57
SHA1 e892d887688790ddd8f0594607b539fc6baa9e40
SHA512 84c8b0a4f78d8f3797dedf13e833280e6b968b7aeb2c5479211f1ff0b0ba8d3c12e8ab71a89ed128387818e05e335e8b9280a49f1dc775bd090a6114644aaf62
SSDEEP 6144:/91MkLIQ79U1IvNpR0Q01wFrUf99d1GDyc:LMkLIQ79cu01um1c
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 eda1908a4bd0429c09acebb1eb3b61e24c0b74ead103e58dd825f93af9a50877
MD5 bb98dd985e28fe10f0777339f37a12aa
SHA1 e9736b93342b918c861a7a63eedd65d82b948f7a
SHA512 fade61e3b3f3b0568d87794d4b09ed418a9ead61dd62b135e0dde4d3eb6ed7166fef85b8d533d3bdefd24b421f765bf3b33511d106582e146b43323c1a120608
SSDEEP 96:nmkdp81lA5VwpeZAWMoiVmdeYw0Fj1lqI2HEFUWQyV+VD7AiEwb:nmkT8o5VfAWMowwhlqtEFrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 ba9eef2452ffa38119956e0d9085b4a570ef3988e8a91b56ee02686f7979e06b
MD5 0f25332969c42ab0b3507a802b336b66
SHA1 5dc2ef8d42fdcfdf655cc6bb0e63a0a65b9ce6dc
SHA512 e09eeb5069d42e679711a552ba3afca5a94fe50546d95f77bbd3bdbf852f84cd5e8bae50407ffb07c589b9e37fbf4097e9e3dbf8dfb6f9543e48dc8d6d2ca977
SSDEEP 96:nmkdp81lA50wpeZAWMoiVmdejKu0LL11XqIMlHEFUWQyV+VD7AiEwb:nmkT8o50fAWMWuU1ZqLEFrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 9a87229f111a34722d8031bdfc0ed809f10e291d53a228d3bc34874c4054b9eb
MD5 469477ff556220235306a3841d0b7030
SHA1 0310c536d5e0aa55983e578920d2e3f5410fe3f4
SHA512 4a1761bcbb94dc7bf7343de1492665822256541fbea64b568e7bf62ad796f17d7c9dccfd6a10aed8576a1dd7cd4b1cb22b74ac2187098864d0d784fedd2bdeb9
SSDEEP 96:nmk3p81lEp0wpvWMoiVmdeHI/HEFUWQyV+VD7ziEwb:nmkZ88p0GWMXYEFrt
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 370B
SHA256 cb287c59e4f4991156b7d35c44265d85e051f46f1c7e146fef5a6ce25565b257
MD5 2db5f364089ae789d59d2635d67c61f7
SHA1 dc625b2ee88b133ef600c383db5b88619fe0c168
SHA512 d82de189b5e3c154b148ce5acd9b27f833ba691564f280ea766a9206378df98609d986581c29c1839610a496d70b6f3527c492fed631f69ba3f12061a25e23a8
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe5b9ab6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5b9ab6.TMP
Size 370B
SHA256 dc837c41394a3b03b2635a973a907d2c13b7c1661ae51780bb2c8e8238f23537
MD5 fdda2f709f0d09ea261f5b5bdde9671d
SHA1 3e2aa05bbfd43ae8d8cf3a47f5c0d2207827bf09
SHA512 b78468b93ae2fafd754f230dccf6ad2ab40f1c09c5e475de9989b99195ad77ec766723d869998980b3e61ff7bdec57dca3d325cf6eaa18f6a127739bfe7a7993
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 4104c95ae63e020e5d54cae86931a9da0a7369911fc3b5afef47b7880caad3f7
MD5 15a676b805ab2be1b928676401be4d27
SHA1 f420adc2dc2cfaa26c82dd83c5deec13666af9d8
SHA512 01f3dd9223163a4127767a7b562c4946e7272eaa446f6ba479398415b947e71d4517a474d5a1ee4bbb5e1a9fdf9d8884f6db877513f3c3973132d577bbaa498c
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupfhe2RUoZbbljoznIYWLSDh:A9iIxuERzA83h09RZxYtJ0zIDG8YD
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_d2l5lncj.jx5.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_d2l5lncj.jx5.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

vncKript.exe

Path C:\Users\Admin\AppData\Local\Temp\vncKript.exe
Size 2.4MB
SHA256 8a8f24b827be4c370706a3e3d0acd619de9ac9da699bbe584caa1dee1b418ddb
MD5 b22ce857c4f7d0ff1fd1e3eff6b83718
SHA1 bc1dad07c79d58f17c0780001a0a0c5ff861d0ab
SHA512 b9b5b4bd6ee8657b21675337c69e6386a027de69221d84a117d4dc2e29babda1eb3330ae6bf02acbf36b31793dc2d820323831b54aaaa011cae25cbf5694958c
SSDEEP 49152:PCcb3XPMd1Lqaj/pkauqsL2GNX4TeXymmyQTPmsCLzIvkmdZG2iO:qJ1LqaTptuLL2GasmKzY5b
MD5 SHA1 SHA512 SSDEEP

Submit Download

vncKript.exe

Path C:\Users\Admin\AppData\Local\Temp\vncKript.exe
Size 2.1MB
SHA256 505efe759ec21737525a7937f496959ede5d46c6c6b2651463e6f1bb26899013
MD5 c778d1847d7633c75defcbfd5a9737c0
SHA1 16943ba9184c4197a970fa335a7853d438da8583
SHA512 ec8c26bd48548ade337787da44dee8ffbab035bbdc297aee49d0d1fd9137e1c5395c3ccfa9d85cef7d9de6d5d26f6f25b75a748b6c03c64a059bd94e0e59aa29
SSDEEP 49152:PCcb3XPMd1Lqaj/pkauqsL2GNX4TeXymmyQTPmsCLzIvkmdZG:qJ1LqaTptuLL2GasmKzYI
MD5 SHA1 SHA512 SSDEEP

Submit Download

vncKript.exe

Path C:\Users\Admin\AppData\Local\Temp\vncKript.exe
Size 2.6MB
SHA256 e4a91db9e43655931fd3926ec00dbe8a063fbe0d3f0af7d902fd3b9d8281fb3d
MD5 0496ec9393b9228f1cf3439046309cf0
SHA1 c3f51e15b43b521d2e68efd353849ebd03e937ee
SHA512 837b8dbcfa80d43750ffda475afd033349a8c66f588344ceee73f7514645a3f51666a5da67239107b0d6478cad49ddf3064573ff188f419cce7dafc54171a9b2
SSDEEP 49152:PCcb3XPMd1Lqaj/pkauqsL2GNX4TeXymmyQTPmsCLzIvkmdZG2iP:qJ1LqaTptuLL2GasmKzY5
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1052-9286-0x00000000059E0000-0x0000000005A46000-memory.dmp

Download

memory/1052-9274-0x00000000010F0000-0x0000000001146000-memory.dmp

Download

memory/1052-8176-0x0000000002B60000-0x0000000002B70000-memory.dmp

Download

memory/1052-7491-0x0000000074430000-0x0000000074BE0000-memory.dmp

Download

memory/1052-4807-0x0000000000400000-0x000000000049C000-memory.dmp

Download

memory/1052-4811-0x0000000005150000-0x0000000005238000-memory.dmp

Download

memory/1052-4812-0x0000000002B60000-0x0000000002B70000-memory.dmp

Download

memory/1052-4809-0x0000000074430000-0x0000000074BE0000-memory.dmp

Download

memory/1052-9497-0x0000000005B50000-0x0000000005BA4000-memory.dmp

Download

memory/1052-9573-0x0000000074430000-0x0000000074BE0000-memory.dmp

Download

memory/2124-4798-0x0000000074430000-0x0000000074BE0000-memory.dmp

Download

memory/2124-11896-0x0000000001260000-0x0000000001261000-memory.dmp

Download

memory/2124-4800-0x0000000002FA0000-0x0000000002FB0000-memory.dmp

Download

memory/2124-4803-0x0000000005720000-0x000000000597A000-memory.dmp

Download

memory/2124-4805-0x00000000059F0000-0x0000000005C44000-memory.dmp

Download

memory/2124-6842-0x0000000074430000-0x0000000074BE0000-memory.dmp

Download

memory/2124-7494-0x0000000002FA0000-0x0000000002FB0000-memory.dmp

Download

memory/2124-11908-0x0000000074430000-0x0000000074BE0000-memory.dmp

Download

memory/2124-4797-0x0000000000B30000-0x0000000000DD0000-memory.dmp

Download

memory/2124-11898-0x0000000005FF0000-0x000000000608A000-memory.dmp

Download

memory/4048-11906-0x0000000000400000-0x0000000000474000-memory.dmp

Download

memory/4048-11909-0x0000000005650000-0x000000000572C000-memory.dmp

Download

memory/4048-11910-0x0000000074430000-0x0000000074BE0000-memory.dmp

Download

memory/4048-11911-0x0000000005730000-0x0000000005740000-memory.dmp

Download

memory/4264-11942-0x0000000074430000-0x0000000074BE0000-memory.dmp

Download

memory/4264-11946-0x00000000056A0000-0x00000000056B0000-memory.dmp

Download

memory/4372-48-0x0000000006780000-0x0000000006C6A000-memory.dmp

Download

memory/4372-16-0x0000000006780000-0x0000000006C6A000-memory.dmp

Download

memory/4372-0-0x0000000074430000-0x0000000074BE0000-memory.dmp

Download

memory/4372-4799-0x0000000009390000-0x0000000009934000-memory.dmp

Download

memory/4372-50-0x0000000006780000-0x0000000006C6A000-memory.dmp

Download

memory/4372-4785-0x0000000000D00000-0x0000000000D4C000-memory.dmp

Download

memory/4372-4784-0x0000000006E20000-0x0000000007158000-memory.dmp

Download

memory/4372-46-0x0000000006780000-0x0000000006C6A000-memory.dmp

Download

memory/4372-44-0x0000000006780000-0x0000000006C6A000-memory.dmp

Download

memory/4372-4808-0x0000000074430000-0x0000000074BE0000-memory.dmp

Download

memory/4372-42-0x0000000006780000-0x0000000006C6A000-memory.dmp

Download

memory/4372-40-0x0000000006780000-0x0000000006C6A000-memory.dmp

Download

memory/4372-38-0x0000000006780000-0x0000000006C6A000-memory.dmp

Download

memory/4372-4783-0x0000000000AE0000-0x0000000000AE1000-memory.dmp

Download

memory/4372-36-0x0000000006780000-0x0000000006C6A000-memory.dmp

Download

memory/4372-1455-0x00000000050D0000-0x00000000050E0000-memory.dmp

Download

memory/4372-34-0x0000000006780000-0x0000000006C6A000-memory.dmp

Download

memory/4372-32-0x0000000006780000-0x0000000006C6A000-memory.dmp

Download

memory/4372-30-0x0000000006780000-0x0000000006C6A000-memory.dmp

Download

memory/4372-28-0x0000000006780000-0x0000000006C6A000-memory.dmp

Download

memory/4372-26-0x0000000006780000-0x0000000006C6A000-memory.dmp

Download

memory/4372-24-0x0000000006780000-0x0000000006C6A000-memory.dmp

Download

memory/4372-22-0x0000000006780000-0x0000000006C6A000-memory.dmp

Download

memory/4372-20-0x0000000006780000-0x0000000006C6A000-memory.dmp

Download

memory/4372-18-0x0000000006780000-0x0000000006C6A000-memory.dmp

Download

memory/4372-52-0x0000000006780000-0x0000000006C6A000-memory.dmp

Download

memory/4372-14-0x0000000006780000-0x0000000006C6A000-memory.dmp

Download

memory/4372-1310-0x0000000074430000-0x0000000074BE0000-memory.dmp

Download

memory/4372-68-0x0000000006780000-0x0000000006C6A000-memory.dmp

Download

memory/4372-12-0x0000000006780000-0x0000000006C6A000-memory.dmp

Download

memory/4372-10-0x0000000006780000-0x0000000006C6A000-memory.dmp

Download

memory/4372-66-0x0000000006780000-0x0000000006C6A000-memory.dmp

Download

memory/4372-1-0x00000000000E0000-0x000000000061C000-memory.dmp

Download

memory/4372-64-0x0000000006780000-0x0000000006C6A000-memory.dmp

Download

memory/4372-62-0x0000000006780000-0x0000000006C6A000-memory.dmp

Download

memory/4372-60-0x0000000006780000-0x0000000006C6A000-memory.dmp

Download

memory/4372-58-0x0000000006780000-0x0000000006C6A000-memory.dmp

Download

memory/4372-2-0x00000000050D0000-0x00000000050E0000-memory.dmp

Download

memory/4372-8-0x0000000006780000-0x0000000006C6A000-memory.dmp

Download

memory/4372-6-0x0000000006780000-0x0000000006C6A000-memory.dmp

Download

memory/4372-56-0x0000000006780000-0x0000000006C6A000-memory.dmp

Download

memory/4372-3-0x00000000050E0000-0x00000000055D6000-memory.dmp

Download

memory/4372-54-0x0000000006780000-0x0000000006C6A000-memory.dmp

Download

memory/4372-5-0x0000000006780000-0x0000000006C6A000-memory.dmp

Download

memory/4372-4-0x0000000006780000-0x0000000006C70000-memory.dmp

Download

memory/4600-12858-0x0000017A1C590000-0x0000017A1C5B2000-memory.dmp

Download

memory/4600-11944-0x0000017A03DF0000-0x0000017A03E00000-memory.dmp

Download

memory/4600-11912-0x0000017A03DF0000-0x0000017A03E00000-memory.dmp

Download

memory/4600-11907-0x00007FFB81B50000-0x00007FFB82611000-memory.dmp

Download