zgrat | e387c084d5c3b62413743e912ee10776564e7c55ba1dc801990b312b88b61efe

Resubmissions

12-05-2024 18:26

240512-w3ftesdb55 10

12-05-2024 01:57

240512-cc9t2aea99 10

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12-05-2024 01:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Nvidia.exe
Size

2.6MB
MD5

87610f8f3d48edf25d48c4c0ba2b3486
SHA1

ab7498abd8626c968c84167ef1c1c503faace1fe
SHA256

e387c084d5c3b62413743e912ee10776564e7c55ba1dc801990b312b88b61efe
SHA512

73840a477b360fb1ab2061087838618a748f8b24560d289d563b4ba4b1b905f62686f4bca2c2e236007be1bc5931711c0d162b1c0f3ade009861e004116ddfe1
SSDEEP

49152:O+8l/s9Yf5u4uT/s9YEQtQRTMYIMi7ztf33cSywWyFoEgn9u65:OtVsGobzsG1tQRjdih8rwcV5

Score

10^/10

zgrat ransomware rat spyware stealer

Malware Config

Signatures

Detect ZGRat V1 1 IoCs

resource	yara_rule
behavioral2/memory/4356-1-0x000002632A100000-0x000002632A3A4000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

.NET Reactor proctector 1 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral2/memory/4356-1-0x000002632A100000-0x000002632A3A4000-memory.dmp	net_reactor

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\T4bzBg0leXAM700i.exe	Nvidia.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\T4bzBg0leXAM700i.exe	Nvidia.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.CashRansomware	Nvidia.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
14	api.ipify.org
15	api.ipify.org
16	icanhazip.com
18	ip-api.com

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Cash.img"	Nvidia.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClient.man.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.cs-cz.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\System\ado\adovbs.inc.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipstr.xml.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\de-DE\msdaremr.dll.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\System\wab32.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\nb-NO\tipresx.dll.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\msinfo32.exe.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\msdaosp.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipshi.xml.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig-office.xrm-ms.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipTsf.dll.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fi-FI\tipresx.dll.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\es-ES\TabTip.exe.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\System\ado\msado60.tlb.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsjpn.xml.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipscsy.xml.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ea-sym.xml.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InkDiv.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InkObj.dll.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipTsf.dll.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\System\ado\ja-JP\msader15.dll.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOLoaderUI.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\es-ES\tabskb.dll.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\msinfo32.exe.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\oledb32.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.da-dk.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TabTip.exe.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\fr-FR\sqlxmlx.rll.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\bg-BG\tipresx.dll.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sl-si.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\it-IT\mshwLatin.dll.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\msaddsr.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\de-DE\sqloledb.rll.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mshwLatin.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\System\ado\msadox28.tlb.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\it-IT\msaddsr.dll.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\en-US\InkObj.dll.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\hu-HU\tipresx.dll.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\ShapeCollector.exe.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOMessageProvider.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\rtscom.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\zh-CN\tipresx.dll.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.CashRansomware	Nvidia.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3632	msedge.exe
3632	msedge.exe
856	msedge.exe
856	msedge.exe
292	identity_helper.exe
292	identity_helper.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4356	Nvidia.exe
Token: SeBackupPrivilege	4408	vssvc.exe
Token: SeRestorePrivilege	4408	vssvc.exe
Token: SeAuditPrivilege	4408	vssvc.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4356 wrote to memory of 856	4356	Nvidia.exe	92
PID 4356 wrote to memory of 856	4356	Nvidia.exe	92
PID 856 wrote to memory of 4992	856	msedge.exe	93
PID 856 wrote to memory of 4992	856	msedge.exe	93
PID 856 wrote to memory of 4460	856	msedge.exe	94
PID 856 wrote to memory of 4460	856	msedge.exe	94
PID 856 wrote to memory of 4460	856	msedge.exe	94
PID 856 wrote to memory of 4460	856	msedge.exe	94
PID 856 wrote to memory of 4460	856	msedge.exe	94
PID 856 wrote to memory of 4460	856	msedge.exe	94
PID 856 wrote to memory of 4460	856	msedge.exe	94
PID 856 wrote to memory of 4460	856	msedge.exe	94
PID 856 wrote to memory of 4460	856	msedge.exe	94
PID 856 wrote to memory of 4460	856	msedge.exe	94
PID 856 wrote to memory of 4460	856	msedge.exe	94
PID 856 wrote to memory of 4460	856	msedge.exe	94
PID 856 wrote to memory of 4460	856	msedge.exe	94
PID 856 wrote to memory of 4460	856	msedge.exe	94
PID 856 wrote to memory of 4460	856	msedge.exe	94
PID 856 wrote to memory of 4460	856	msedge.exe	94
PID 856 wrote to memory of 4460	856	msedge.exe	94
PID 856 wrote to memory of 4460	856	msedge.exe	94
PID 856 wrote to memory of 4460	856	msedge.exe	94
PID 856 wrote to memory of 4460	856	msedge.exe	94
PID 856 wrote to memory of 4460	856	msedge.exe	94
PID 856 wrote to memory of 4460	856	msedge.exe	94
PID 856 wrote to memory of 4460	856	msedge.exe	94
PID 856 wrote to memory of 4460	856	msedge.exe	94
PID 856 wrote to memory of 4460	856	msedge.exe	94
PID 856 wrote to memory of 4460	856	msedge.exe	94
PID 856 wrote to memory of 4460	856	msedge.exe	94
PID 856 wrote to memory of 4460	856	msedge.exe	94
PID 856 wrote to memory of 4460	856	msedge.exe	94
PID 856 wrote to memory of 4460	856	msedge.exe	94
PID 856 wrote to memory of 4460	856	msedge.exe	94
PID 856 wrote to memory of 4460	856	msedge.exe	94
PID 856 wrote to memory of 4460	856	msedge.exe	94
PID 856 wrote to memory of 4460	856	msedge.exe	94
PID 856 wrote to memory of 4460	856	msedge.exe	94
PID 856 wrote to memory of 4460	856	msedge.exe	94
PID 856 wrote to memory of 4460	856	msedge.exe	94
PID 856 wrote to memory of 4460	856	msedge.exe	94
PID 856 wrote to memory of 4460	856	msedge.exe	94
PID 856 wrote to memory of 4460	856	msedge.exe	94
PID 856 wrote to memory of 3632	856	msedge.exe	95
PID 856 wrote to memory of 3632	856	msedge.exe	95
PID 856 wrote to memory of 2608	856	msedge.exe	96
PID 856 wrote to memory of 2608	856	msedge.exe	96
PID 856 wrote to memory of 2608	856	msedge.exe	96
PID 856 wrote to memory of 2608	856	msedge.exe	96
PID 856 wrote to memory of 2608	856	msedge.exe	96
PID 856 wrote to memory of 2608	856	msedge.exe	96
PID 856 wrote to memory of 2608	856	msedge.exe	96
PID 856 wrote to memory of 2608	856	msedge.exe	96
PID 856 wrote to memory of 2608	856	msedge.exe	96
PID 856 wrote to memory of 2608	856	msedge.exe	96
PID 856 wrote to memory of 2608	856	msedge.exe	96
PID 856 wrote to memory of 2608	856	msedge.exe	96
PID 856 wrote to memory of 2608	856	msedge.exe	96
PID 856 wrote to memory of 2608	856	msedge.exe	96
PID 856 wrote to memory of 2608	856	msedge.exe	96
PID 856 wrote to memory of 2608	856	msedge.exe	96
PID 856 wrote to memory of 2608	856	msedge.exe	96
PID 856 wrote to memory of 2608	856	msedge.exe	96

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Nvidia.exe
"C:\Users\Admin\AppData\Local\Temp\Nvidia.exe"
1⤵
- Drops startup file
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\Cash Ransomware.html
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa3f9246f8,0x7ffa3f924708,0x7ffa3f924718
    3⤵
    PID:4992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,1552817368075087095,13209286370776118205,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
    3⤵
    PID:4460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,1552817368075087095,13209286370776118205,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,1552817368075087095,13209286370776118205,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8
    3⤵
    PID:2608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1552817368075087095,13209286370776118205,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
    3⤵
    PID:4376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1552817368075087095,13209286370776118205,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
    3⤵
    PID:2580
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,1552817368075087095,13209286370776118205,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5056 /prefetch:8
    3⤵
    PID:3360
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,1552817368075087095,13209286370776118205,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5056 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1552817368075087095,13209286370776118205,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:1
    3⤵
    PID:776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1552817368075087095,13209286370776118205,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
    3⤵
    PID:1252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1552817368075087095,13209286370776118205,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
    3⤵
    PID:2856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1552817368075087095,13209286370776118205,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
    3⤵
    PID:1284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,1552817368075087095,13209286370776118205,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2248 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3376

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4408

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4608

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\metadata.CashRansomware

Filesize
16B

MD5
967331f544e093c7130095a7489cb751

SHA1
78569d73f562436ccce2550f3518fff76172689b

SHA256
e8d247056fcafe2e3324882d0523e8f077d966662f27f9d013857bd56e52ab73

SHA512
a9c38fc7fb7c5393ca92a54e6f2631ddb9fefb99fd2f5c7210d5cbb69486a992543141927505ae530eac7b8c0be1bfdc276a738ad0a55890077888bafb74c5be

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT.CashRansomware

Filesize
32B

MD5
66477764fac5c6c5c8a0c3b3eac8c288

SHA1
f452c8025393bda430bf96a837ecd042c3814d9d

SHA256
834587e824cf15c0336d0d035a6c5e34e61cb40462abef08cef3e5c9b8052302

SHA512
04caff0493639377d70111afbad59baa6a4a8d0c28692c4c378864da9f0a27946966a94d7fab774e28a5b206f5c865b45fde8086c36aed20c3e208732edfa8a3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001.CashRansomware

Filesize
48B

MD5
f60a6997b4d935c856f1a6caf1e70b27

SHA1
6599a66b3304a0907beb8d7ee43a88ec66bc9612

SHA256
ff7a92af62b67c8b0571c6f8c8d2e836bd4c5053528c75d50fa210d61918a678

SHA512
8afb757dab86e5f3b198b6f3e7821efce0441053f20d616acf2c4c05fdb4577ac26373d160f6e4935892184f449127f008bf4deb2435d260d4f7f4c1b40bb964

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2.CashRansomware

Filesize
8KB

MD5
ea121778f055ef15ebd97bc049431fe0

SHA1
44916b906eb09c6e0228d2310c57d2abaa8e3e30

SHA256
b4bec0ed802f27d8859ea4a048903c156f0054caf25b5bead7772b089fe38cb4

SHA512
7ceab485a35ea433310e8ca808534659c16204b4828846f17fb42795047615c0d30395292a9cd8a2ff3a45b98ac83402e8f16dc4028e0abb95e7d4665feeacb8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_0.CashRansomware

Filesize
8KB

MD5
d2cd65bebc573fa5c4a5c2e320ae988e

SHA1
0e969ad8748644591f47c9518ca38ade5f65faba

SHA256
c783768b9083c0d115fab63521e2034039cadc37f53f3d7de5c1b2f03514e195

SHA512
d2fbd96e4349e2467f154b0d5fe64989838ce1657f3f943fe539223dee652e3d1a7d1dcfda5340313b6078268a5e6683b3b4dd82c7cea73692741b9fd7c0bd89

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_1.CashRansomware

Filesize
264KB

MD5
9652a0b68cd615a3984ea21c876f3977

SHA1
19b10c7f651476b2ce287680b273e1787aed0d95

SHA256
edfed186cd7207e56cf192955bc99f0df9ae4efd43122c04027da110329df69c

SHA512
c346af96a42996c10d32df4e1d336f68a37be58b374797279e92f8c34ccc0a34b2f2fdaae312d5e425e804c8007aaccf644ef1b02c9ac12c987f6bcae5c415ea

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_3.CashRansomware

Filesize
8KB

MD5
c536a6304806e14b92fbbfc589357d8b

SHA1
c4953c3ae7fc2de5b766b9a67516844166d81b9e

SHA256
dc5a1fc13b905eda9efbd900cecaa10826c4eb50fbbdb3eb26eea3a2ee5f984f

SHA512
c24e32d1c8ed92168122e11114b78f2949dc62fa04b72e10a90ea8ad6adb91d19a9367690ad0fb0b9e680cae31fae03af9927b5b6729ee6a5f1bb0d9a0f2fad7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
176B

MD5
4b0fdb42df7710656db54c391246153d

SHA1
76448462cca39b432c314f680ebb330258a28749

SHA256
72b128de5bd06d50af02c4113956687082280bd564ff6b5517e4bc466ae5d526

SHA512
f5681e8c75062df44e985069f51ebaf7f0cf0e10427b5dc4800e1c8af1d401816cc9bafad6157afcea9c85bf347540211332c273573c706632c290cbf90de067

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
36f1ca8e5285b3e3e83fe984c753a126

SHA1
7f5ad6885e0d804f830eab9b1252634348ed649a

SHA256
c06bb59c5ebb6a62c11277ce06c4433ac1e3ee96aa0dda45b9c7ec74f9da0a46

SHA512
dba22f24032f5f6366f4dddf8c1a5803d3ab0f8c4bc4788e193de84b029f5d2e6c7a786a83805e44e03decd78e2d1e74d199a18d323c6031fb718a3d21615b66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
19713cfb746571d6e1fe8b7fc057c149

SHA1
6ad0bc75d7d3c4e79d7eaf3ec2da270f042bc4c1

SHA256
f5b2f6adeeea6a72f0fa8076b920e0f9a6bc8eb5317c30fbfa407498fa7f5831

SHA512
9b7633d9d6b4c9dd6b24c6073dc11dbc9d9de7b4c7a0c645ea10f73b84f505e2271380c8adfec64b3cca8d467598fbd04f4d2d4634a0001b81dd0b5086829957

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
253977156451ea64b107da9cbaf8e81f

SHA1
84667b12dc53052e87ab4246fb2b7c419c18fb9d

SHA256
3e434fb28314274813e0b3296463f6b9e337a47d396e432f5454058e831b9abe

SHA512
d8e38febabfd94b378989924d3acc381bae4a8faf292e0eaa91f8b946b439f5e9f9665744bae9aa4c7df49b6f15d10e5af0d22706ed08cc77511845f84c1c990

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\Settings\settings.dat.CashRansomware

Filesize
8KB

MD5
73919f5b1ac86bf254238c2270e99ff4

SHA1
5f9c22e4731cc093e80a8f8e102dae6c81a4d460

SHA256
60fcb9e835ec84f435e62b2272ad53f74ec9a24621f3775b56e97ec127408070

SHA512
15d9042bcef067c4c379ec64cb4cbaf8db77d180a0c6ff359c4a86131bd96f5d966a692f5532ee914688172e55e23a42d2ea45c65a0932f06b08fb053d162d21

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{A5E73466-E220-8EF4-B956-A582187356D9}.CashRansomware

Filesize
36KB

MD5
38d4015fb4499a3a0b233e42b226049c

SHA1
ec1f2909989b49b3a27b76c6fcba43b2b0d83e2c

SHA256
021efd338f81e2279e080b13645995ac73d2fbd8a396e8e0674f9081a7b303c9

SHA512
2139e6141b9b4516614bde1e099dd604c98a8c93a3352e43ebc16ff1672b924eb8ac14d45b5835d5ef1c86b161ef542c51be942593b6439d861fc76322f8d40b

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_comexp_msc.CashRansomware

Filesize
36KB

MD5
1bf9893233b033e27bb1f19c6f7aef7c

SHA1
df06079fc81f3caebde616b5fb3f810c97d8c69b

SHA256
f6b5722385140fff1f180f89ec8d202a2ec1b29683a39b5479b94f79887f2ae9

SHA512
253fe7b7b382df51f1d0f9c28cc37ea6dee53a4299a5c33363dabd08c19ede610efc72fcf8b40946f5e6e7a3f75757f227f4cb04b58c57020ba5b9387fdff0d6

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{5ad19b1b-600e-4a94-9f1d-df48f742e3e2}\0.1.filtertrie.intermediate.txt.CashRansomware

Filesize
16B

MD5
b52b04d9c9e6cc4b3d75bd91414f47da

SHA1
f8342c6269222378b0fed1dbee63fb2d64fb19a4

SHA256
80301316cd39e79910f16926ad1162e5f5f50eb51188bfa92e30184be6d17714

SHA512
030d769b7424920d6f0273733b6c3d9bbea8fd895022a35e9ba2be65c165dd5591e9abeec68695f44b49c464aebfb0c7b43cf73a419a0a0f31943e947564c469

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{5ad19b1b-600e-4a94-9f1d-df48f742e3e2}\0.2.filtertrie.intermediate.txt.CashRansomware

Filesize
16B

MD5
369a969b4941d5bb99707c99cb2edd38

SHA1
ecda018f88fab086cd2a5517eac81dab259f6950

SHA256
ec197433f77a28049248aa786114d7e82234fa3e51a4933c56650aa58fa13b83

SHA512
962c86a163f3517ccb584be2422c5051c891359fc304928c315a54f97dc931f8824b99bff26e345e7d22cbd6fdb0f7c6f3b9a6d2efe5eb13968dda90ecd8feb5

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133596439083295209.txt.CashRansomware

Filesize
77KB

MD5
8a455ede2c0f5fe81c53f5b9a439a64b

SHA1
e533489814d0664564694b0b812f91650485214a

SHA256
59bdd87059f9eedd06d69fc81121b9330e12accdd6a9b3d1e93ad19eadbd6fac

SHA512
d2e5d42a0ba5fd9320db0b3c1a2aa2c3e72c4a1c811c77e925b8868a95b12cea275196472ade45f7d8f4211c6dcf3905aa052318d38b365c98b896d92556b5ed

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133596440479376967.txt.CashRansomware

Filesize
47KB

MD5
47fa3e46335a6216dd1a7458d91e017c

SHA1
ea88535254b9e83c856598201c51007fb5c410f7

SHA256
5cf24d06be7f0e32602fbf3d9afd0339ce12c1c1c95d820a39ee1e3bedc48695

SHA512
9a30631749cbe0e9eee1453c86a31b749695529ccfb1437bc986b9d1ba60b89dfe413100935fbeae7d8d4dd91073763e2fc72f2bcc48fd31404443725bf7e695

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133596447864304096.txt.CashRansomware

Filesize
66KB

MD5
5b4c77d47677e04ced5a600383d5f978

SHA1
f5461dd0ecdd1ca4c79c5b5741eb0488c52dbc91

SHA256
92d5d2bbab49058dd9dcc4f38d006288459be2107b0f96adf1e36bc25329e1ca

SHA512
d9c1235f7f0c92dfb450bad9adf0447214194f6ed986f845d4a381460b9ce4a68c919e2491b2f910099dc1b2246d8dae44bce745d5bfffe6d73bc180f7f9e039

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133596477452623360.txt.CashRansomware

Filesize
75KB

MD5
fde14e072993e79e3d05d44b97f7a9b2

SHA1
ecddefe55db95f6d756d023e59e366f6611d98bb

SHA256
6122786e974cbfe66e734d4b5780ce69528f5f19de660ed597c9ee5f4796936e

SHA512
89c66dbc3bd71e1b1c8a4578f72d253d5f20e4041989f10100b09575f5b6b4a910be46d19e5a84be597665ea1142d1157b1c87c79ee2f5d5cad6097a77ddbfca

Download Submit
C:\Users\Admin\AppData\Local\Temp\wctEED4.tmp.CashRansomware

Filesize
63KB

MD5
d713c4adeba2f2809b80170eb23d122c

SHA1
4b7a6987a25a4c3073a418ee917597773142b7e3

SHA256
38461519415b4f35e7813a1b7f56bab3f923e470be58d8dd4e71bca0c28a26d8

SHA512
c62126c632efaf6192692084f82dd8aa6ae2962dfec64f5f0c2f12e186f95fd9e7be5f4460f987ca09e81960b68949cce89b8b7468e1aedb03190ce3f4e991d8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afevplna.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.CashRansomware

Filesize
48KB

MD5
6274dd195272c5cec88ed06249a6148c

SHA1
c8d42ecb3c527b6f78493b1f6e35d04920c21ce1

SHA256
75dbdf0a4056e5d47d0bbf8723a676dc6ef15ec57b7e70538c345f9616f55089

SHA512
a28bff4e030f74dcd6f79729d9537b71a793b7bab86a01c7bfbd5d0c9b273d340958bf48eb60135f3bd197f9ae0d5f80e70bdb072f986f7968cb6a5689b5e5e0

Download Submit
C:\Users\Admin\Desktop\Cash Ransomware.html

Filesize
9KB

MD5
b38d3abcc3a30f095eaecfdd9f62e033

SHA1
f9960cb04896c229fdf6438efa51b4afd98f526f

SHA256
579374af17d7b9f972e9efcb761e0a8f88ef6d44dce53d56d0512d16c4728b9d

SHA512
46968c3951daa569dfecf75ba95a6694d525cbbd1883070189896ab270bb561cb2d00d7d38168405da1f78695f95cc481d28bcbff74be53d9a89822a09595768

Download Submit
memory/4356-1753-0x00007FFA45920000-0x00007FFA463E1000-memory.dmp

Filesize
10.8MB

Download
memory/4356-1716-0x00007FFA45920000-0x00007FFA463E1000-memory.dmp

Filesize
10.8MB

Download
memory/4356-1717-0x00007FFA45920000-0x00007FFA463E1000-memory.dmp

Filesize
10.8MB

Download
memory/4356-1715-0x00007FFA45920000-0x00007FFA463E1000-memory.dmp

Filesize
10.8MB

Download
memory/4356-1752-0x00007FFA45923000-0x00007FFA45925000-memory.dmp

Filesize
8KB

Download
memory/4356-1718-0x000002634B610000-0x000002634B7D2000-memory.dmp

Filesize
1.8MB

Download
memory/4356-1234-0x0000026344B10000-0x0000026344C12000-memory.dmp

Filesize
1.0MB

Download
memory/4356-0-0x00007FFA45923000-0x00007FFA45925000-memory.dmp

Filesize
8KB

Download
memory/4356-1719-0x000002634BD10000-0x000002634C238000-memory.dmp

Filesize
5.2MB

Download
memory/4356-2-0x00007FFA45920000-0x00007FFA463E1000-memory.dmp

Filesize
10.8MB

Download
memory/4356-1793-0x00007FFA45920000-0x00007FFA463E1000-memory.dmp

Filesize
10.8MB

Download
memory/4356-1795-0x00007FFA45920000-0x00007FFA463E1000-memory.dmp

Filesize
10.8MB

Download
memory/4356-1-0x000002632A100000-0x000002632A3A4000-memory.dmp

Filesize
2.6MB

Download