zgrat | e1696968ad55e7e03a8334711d90350c4145fb4f60de5fb4a2f5f19187183c05

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12-05-2024 01:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

zune.exe
Size

2.7MB
MD5

d395e798b9884b6c1837fe4fe147a3fa
SHA1

530ffbe23bbb3f88fb97ff95ef5486d3628776a3
SHA256

e1696968ad55e7e03a8334711d90350c4145fb4f60de5fb4a2f5f19187183c05
SHA512

30cc4aa9b0e7e6ff85d56a11b2f81e079687d4c2ac87ac72835c15253787fe9b15bd4308ffdb689301b5816f0f3c7fd8f6700b71aa991bf8c066a5f6ba36eb27
SSDEEP

49152:Bik3l/s9YcuT/s9YEQtQRTMYIMi7ztf33cSywWyFoEgn9u4:BvVsGfzsG1tQRjdih8rwc

Score

10^/10

zgrat ransomware rat spyware stealer

Malware Config

Signatures

Detect ZGRat V1 1 IoCs

resource	yara_rule
behavioral2/memory/4500-1-0x00000141BC910000-0x00000141BCBC8000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

.NET Reactor proctector 1 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral2/memory/4500-1-0x00000141BC910000-0x00000141BCBC8000-memory.dmp	net_reactor

Drops startup file 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.CashRansomware	zune.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BuQM7hgYn1Geukes.exe	zune.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BuQM7hgYn1Geukes.exe	zune.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
16	api.ipify.org
17	icanhazip.com
20	ip-api.com
15	api.ipify.org

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Cash.img"	zune.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\msinfo32.exe.mui.CashRansomware	zune.exe
File opened for modification	C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui.CashRansomware	zune.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe.CashRansomware	zune.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\de-DE\TabTip.exe.mui.CashRansomware	zune.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\sqlxmlx.dll.CashRansomware	zune.exe
File opened for modification	C:\Program Files\Common Files\System\ado\msador15.dll.CashRansomware	zune.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\fr-FR\msadcer.dll.mui.CashRansomware	zune.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\en-US\InkObj.dll.mui.CashRansomware	zune.exe
File opened for modification	C:\Program Files\Common Files\System\ado\msado60.tlb.CashRansomware	zune.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\SharedPerformance.man.CashRansomware	zune.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\hwrusash.dat.CashRansomware	zune.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll.CashRansomware	zune.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll.CashRansomware	zune.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\IpsPlugin.dll.CashRansomware	zune.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\msaddsr.dll.CashRansomware	zune.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll.CashRansomware	zune.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sl-si.dll.CashRansomware	zune.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.CashRansomware	zune.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml.CashRansomware	zune.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mraut.dll.CashRansomware	zune.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\ja-JP\msaddsr.dll.mui.CashRansomware	zune.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\it-IT\oledb32r.dll.mui.CashRansomware	zune.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp140.dll.CashRansomware	zune.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee100.tlb.CashRansomware	zune.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.el-gr.dll.CashRansomware	zune.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.en-us.dll.CashRansomware	zune.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipRes.dll.mui.CashRansomware	zune.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fi-FI\tipresx.dll.mui.CashRansomware	zune.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\it-IT\InputPersonalization.exe.mui.CashRansomware	zune.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\msdasql.dll.CashRansomware	zune.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll.CashRansomware	zune.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe.CashRansomware	zune.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml.CashRansomware	zune.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsjpn.xml.CashRansomware	zune.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsita.xml.CashRansomware	zune.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InputPersonalization.exe.mui.CashRansomware	zune.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsptb.xml.CashRansomware	zune.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\msinfo32.exe.mui.CashRansomware	zune.exe
File opened for modification	C:\Program Files\Common Files\System\de-DE\wab32res.dll.mui.CashRansomware	zune.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.uk-ua.dll.CashRansomware	zune.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml.CashRansomware	zune.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\msdatl3.dll.CashRansomware	zune.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\fr-FR\sqloledb.rll.mui.CashRansomware	zune.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\en-US\TipRes.dll.mui.CashRansomware	zune.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipRes.dll.mui.CashRansomware	zune.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\rtscom.dll.mui.CashRansomware	zune.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipRes.dll.mui.CashRansomware	zune.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll.CashRansomware	zune.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe.CashRansomware	zune.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsid.xml.CashRansomware	zune.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\de-DE\InkObj.dll.mui.CashRansomware	zune.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll.CashRansomware	zune.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nl-nl.dll.CashRansomware	zune.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\de-DE\tabskb.dll.mui.CashRansomware	zune.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml.CashRansomware	zune.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee90.tlb.CashRansomware	zune.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\de-DE\msdaprsr.dll.mui.CashRansomware	zune.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\sqloledb.dll.CashRansomware	zune.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\ja-JP\sqlxmlx.rll.mui.CashRansomware	zune.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\ja-JP\msdasqlr.dll.mui.CashRansomware	zune.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll.CashRansomware	zune.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\he-IL\tipresx.dll.mui.CashRansomware	zune.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\es-ES\msdaremr.dll.mui.CashRansomware	zune.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\ja-JP\msdaremr.dll.mui.CashRansomware	zune.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3988	msedge.exe
3988	msedge.exe
908	msedge.exe
908	msedge.exe
3644	identity_helper.exe
3644	identity_helper.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4500	zune.exe
Token: SeBackupPrivilege	1428	vssvc.exe
Token: SeRestorePrivilege	1428	vssvc.exe
Token: SeAuditPrivilege	1428	vssvc.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4500 wrote to memory of 908	4500	zune.exe	93
PID 4500 wrote to memory of 908	4500	zune.exe	93
PID 908 wrote to memory of 220	908	msedge.exe	94
PID 908 wrote to memory of 220	908	msedge.exe	94
PID 908 wrote to memory of 1760	908	msedge.exe	95
PID 908 wrote to memory of 1760	908	msedge.exe	95
PID 908 wrote to memory of 1760	908	msedge.exe	95
PID 908 wrote to memory of 1760	908	msedge.exe	95
PID 908 wrote to memory of 1760	908	msedge.exe	95
PID 908 wrote to memory of 1760	908	msedge.exe	95
PID 908 wrote to memory of 1760	908	msedge.exe	95
PID 908 wrote to memory of 1760	908	msedge.exe	95
PID 908 wrote to memory of 1760	908	msedge.exe	95
PID 908 wrote to memory of 1760	908	msedge.exe	95
PID 908 wrote to memory of 1760	908	msedge.exe	95
PID 908 wrote to memory of 1760	908	msedge.exe	95
PID 908 wrote to memory of 1760	908	msedge.exe	95
PID 908 wrote to memory of 1760	908	msedge.exe	95
PID 908 wrote to memory of 1760	908	msedge.exe	95
PID 908 wrote to memory of 1760	908	msedge.exe	95
PID 908 wrote to memory of 1760	908	msedge.exe	95
PID 908 wrote to memory of 1760	908	msedge.exe	95
PID 908 wrote to memory of 1760	908	msedge.exe	95
PID 908 wrote to memory of 1760	908	msedge.exe	95
PID 908 wrote to memory of 1760	908	msedge.exe	95
PID 908 wrote to memory of 1760	908	msedge.exe	95
PID 908 wrote to memory of 1760	908	msedge.exe	95
PID 908 wrote to memory of 1760	908	msedge.exe	95
PID 908 wrote to memory of 1760	908	msedge.exe	95
PID 908 wrote to memory of 1760	908	msedge.exe	95
PID 908 wrote to memory of 1760	908	msedge.exe	95
PID 908 wrote to memory of 1760	908	msedge.exe	95
PID 908 wrote to memory of 1760	908	msedge.exe	95
PID 908 wrote to memory of 1760	908	msedge.exe	95
PID 908 wrote to memory of 1760	908	msedge.exe	95
PID 908 wrote to memory of 1760	908	msedge.exe	95
PID 908 wrote to memory of 1760	908	msedge.exe	95
PID 908 wrote to memory of 1760	908	msedge.exe	95
PID 908 wrote to memory of 1760	908	msedge.exe	95
PID 908 wrote to memory of 1760	908	msedge.exe	95
PID 908 wrote to memory of 1760	908	msedge.exe	95
PID 908 wrote to memory of 1760	908	msedge.exe	95
PID 908 wrote to memory of 1760	908	msedge.exe	95
PID 908 wrote to memory of 1760	908	msedge.exe	95
PID 908 wrote to memory of 3988	908	msedge.exe	96
PID 908 wrote to memory of 3988	908	msedge.exe	96
PID 908 wrote to memory of 1956	908	msedge.exe	97
PID 908 wrote to memory of 1956	908	msedge.exe	97
PID 908 wrote to memory of 1956	908	msedge.exe	97
PID 908 wrote to memory of 1956	908	msedge.exe	97
PID 908 wrote to memory of 1956	908	msedge.exe	97
PID 908 wrote to memory of 1956	908	msedge.exe	97
PID 908 wrote to memory of 1956	908	msedge.exe	97
PID 908 wrote to memory of 1956	908	msedge.exe	97
PID 908 wrote to memory of 1956	908	msedge.exe	97
PID 908 wrote to memory of 1956	908	msedge.exe	97
PID 908 wrote to memory of 1956	908	msedge.exe	97
PID 908 wrote to memory of 1956	908	msedge.exe	97
PID 908 wrote to memory of 1956	908	msedge.exe	97
PID 908 wrote to memory of 1956	908	msedge.exe	97
PID 908 wrote to memory of 1956	908	msedge.exe	97
PID 908 wrote to memory of 1956	908	msedge.exe	97
PID 908 wrote to memory of 1956	908	msedge.exe	97
PID 908 wrote to memory of 1956	908	msedge.exe	97

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\zune.exe
"C:\Users\Admin\AppData\Local\Temp\zune.exe"
1⤵
- Drops startup file
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\Cash Ransomware.html
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xdc,0xe0,0xe4,0xd8,0x108,0x7ff8ab5a46f8,0x7ff8ab5a4708,0x7ff8ab5a4718
    3⤵
    PID:220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,12925047114554621925,5238240058702724205,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
    3⤵
    PID:1760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,12925047114554621925,5238240058702724205,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,12925047114554621925,5238240058702724205,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:8
    3⤵
    PID:1956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12925047114554621925,5238240058702724205,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
    3⤵
    PID:2424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12925047114554621925,5238240058702724205,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
    3⤵
    PID:940
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,12925047114554621925,5238240058702724205,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5088 /prefetch:8
    3⤵
    PID:4708
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,12925047114554621925,5238240058702724205,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5088 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12925047114554621925,5238240058702724205,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
    3⤵
    PID:2348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12925047114554621925,5238240058702724205,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
    3⤵
    PID:460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12925047114554621925,5238240058702724205,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
    3⤵
    PID:4652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12925047114554621925,5238240058702724205,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
    3⤵
    PID:2932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,12925047114554621925,5238240058702724205,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1300 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1720

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1428

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2216

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\metadata.CashRansomware

Filesize
16B

MD5
e72abc2258d42999694b2f5c20bc1f95

SHA1
324df1ac7da46ff7c41024b9cecf44d0d9ee9768

SHA256
0a275cacc09713f7211d3d57b7cfe6c3bd2c6584dbfb6ea0a410edf76ed66179

SHA512
bd2050258081656936378a13ef9ef492ff20a92879f60874680968d3184ff93f09590d9e819da5b2010a051146f0e41c576daf0001f5f613fd0b6a30146657af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT.CashRansomware

Filesize
32B

MD5
207ede89f2f38408a388cf00499304ac

SHA1
a837b16a4d08b599b399af6954f65e8b2b5edf1a

SHA256
ae7b9f4ce84f911ef85f06b84a6b0ff9faccaed9801e4b5d070ac444b3ba9109

SHA512
56d6560bfd3aee928fbe81e283a7ba22f0caa08dce642f962ca88b407f98e73ec13dc7e3b2d6c69e355bfe980e35e8e445c689d5b1e025e391dca45091954be6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001.CashRansomware

Filesize
48B

MD5
43e8d6deb6941ba6519fb6c87daec6df

SHA1
ca915b2f1398d7f2ebc63cc38e55f92cb42a2a85

SHA256
1cff465ff57b2c19ba5c8139b75a0cd58a297d7f6306f68b5905f4194c4c5aec

SHA512
1bbf32a267a20006511915b37118d932dcd041fc6212745a645eff7d58d240874d4b6d1c112b54703825cdd4f619b18c22feeb4cc852d1329442f09f31a1e335

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2.CashRansomware

Filesize
8KB

MD5
5821a1ba48141a91279939c8b6157533

SHA1
147bee84b27ca020379475550271671494b5cd0e

SHA256
257e47de50639f52832734b6043c2ae8dd58f28247e32ac0e506656a524ad1ea

SHA512
ba83c94e26e214299fc540ae2bab847000ac057a43d3d8c62343e444160caff81e738db18bd068f884e8da3f2db0d3612c4728ca825da030c5c9e7f96a8b8d10

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_0.CashRansomware

Filesize
8KB

MD5
d337f6a24ccb0fcabf3bfdc32b94c572

SHA1
7d0dda115190688164384bb9708dd3ab9f377735

SHA256
277c4037c0a9c609f05d15bc66f916d137473683f0819bf864004cb25d755cdb

SHA512
c036511a4e4b49f1d6c5deff81a3fb094967c5d36f8370a910de27b3b2b4942cbdf6695d5aa4196d4c0819ea6cbadedc5fcb821ed90d9156efdc78fd31c70d27

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_1.CashRansomware

Filesize
264KB

MD5
95204c7af0a094acb8ecd690215aef8b

SHA1
8911fc05d15e5574d0dce4b762c2ba927472a786

SHA256
1cd43733340d1c930d54572c0a2f5156c21208c634db7da2628dd25ac93e1abe

SHA512
344124256962175ae688b4bcc9f45799e043f36b1c364b44ecf79b0fb495c68ae281ab000df952131ae5f79fff5dfbe44386b5e5683ae9c05a99ff0e4ab111b5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_3.CashRansomware

Filesize
8KB

MD5
b7c2afe50358f733d6f574dc365feeae

SHA1
5aab355ba8448056d13f073318233e94d5eee89f

SHA256
8f75fabdfb066f9dbc9de613ce29b1c2c72e29f22095a49f7720dad46b0d257d

SHA512
a537a356b06b3b2b96b40b97765ccf426241f9cebb86b02803433e95358d1170926039bcc51c2be577cbc93f2abd3f314ab37c24c9207c44483b26aed5d9075d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
176B

MD5
4b0fdb42df7710656db54c391246153d

SHA1
76448462cca39b432c314f680ebb330258a28749

SHA256
72b128de5bd06d50af02c4113956687082280bd564ff6b5517e4bc466ae5d526

SHA512
f5681e8c75062df44e985069f51ebaf7f0cf0e10427b5dc4800e1c8af1d401816cc9bafad6157afcea9c85bf347540211332c273573c706632c290cbf90de067

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c907bfeacd151b3e174427e21e103928

SHA1
91fb783770cd81e7d26545be8ad0244b53ac92c5

SHA256
c0a392398d149449b2eb62f1f577a2e1950ac22559212184f81d50aea6f39079

SHA512
063d1b9bc5cecf5433cd5fb6fdd718a224d736c256147d6e1f01a4732e35b7cb084e53088371e352a347ba78ae5a4ba0aabf2995f7333136bdebfc7943a55988

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
63aaccddd77665a91cfae6621443d967

SHA1
dc099f5c4ba5e26ae9c0818eed6957d8df14d259

SHA256
613f9d6e53ef972457d74aa936750c11ed0381a738c8826442fc15ca810fd38c

SHA512
862cb886c6e166535bb332f192e0b6a8d9c71b59de5fb8d6421aec06282cd6da1d224d292e27db9808cdccd042a53bbd63199ae219bfc6b1bd165ce09a160c94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6f2432fda425e4a4e868d58c0462cd8b

SHA1
3499e2e445bdc3cfcb6be8c6bfe59fa6a5f0e656

SHA256
a2409e4117953e73443996ffcb4daddc9b4ffd941218c7e439a8ea580e374c70

SHA512
ff37b02053b58023852cf147cd96e3a024caa06b964865871dd35793fdb0393a797fc66b7d18c04783a2682b90acb86d9b617e10302fd8c4398b26335c607c58

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\Settings\settings.dat.CashRansomware

Filesize
8KB

MD5
fc5bcaceb6fb50682aa7875d18df779d

SHA1
d08cdae107a4ddbec6f436b5328b774a2a783b7a

SHA256
e931f52b33642974e0104262539c87452e484b4faa11447c12af1edfd635070b

SHA512
da3c3b6355568ccdc961cc76849bb59c82e7121b6e1b4161284e3b1c0eb050f76303d8222f93effcab37caf0f9549e3ff6239449714931c168c549cf581ea653

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{A5E73466-E220-8EF4-B956-A582187356D9}.CashRansomware

Filesize
36KB

MD5
46c6e99830c38d0eda189f73d3fb6bcc

SHA1
9276f0abd9b9e8054d831aa39375cdc4ce5d331c

SHA256
fc295fb3e16e4f82d02e268bc2540fbe32d3b4d3dc83c0053699fa0b13ab6dad

SHA512
a2d4c02a0d47dcb6bd5ea012957da274f6020df21cb71e32cf15539cbf59aa88efd1bc8a9ae3566ad6a59d7d67919d00088d1089d1a775b5bc42c1d82e36db31

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_comexp_msc.CashRansomware

Filesize
36KB

MD5
35a4308e12feaf912375af4369d693ff

SHA1
1b1b6343feab20a3f417fa7398ead53b87e876f7

SHA256
b031e20587ff0fe28a9885d4ea1ec83806e7c4b7da4c5fd7c103a6218656ee55

SHA512
a8b982d27b5731e529f5524f171163560b6d2bb28147813553073a837d62e5295068ca19ef389f87c6aa57f546dfcdbcb91302c8523d7b757b59ae32ea6f8490

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{c3f14530-5781-4d4c-b996-e492b5452164}\0.1.filtertrie.intermediate.txt.CashRansomware

Filesize
16B

MD5
1476757b46a6e9b280f1b54dba596824

SHA1
efd403883da78aacb2e060d4c32cf861e938bca8

SHA256
c48b91fa4257c873aac956d6f440474a7dc83314b2ee23c56b72fcad33534404

SHA512
980f8f7a6d3e3714bc08065ed8370144ce756c89b844bd63d75ab13cb82a038a11f00ac83a56288d0c0fb7ddd5e7cb85e335ff277aeda780cf9911d08d2cd6db

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{c3f14530-5781-4d4c-b996-e492b5452164}\0.2.filtertrie.intermediate.txt.CashRansomware

Filesize
16B

MD5
0674faedfc07eb5a664ea36501839e30

SHA1
e25ad710c17ca2169c897315835b7249499bb537

SHA256
49f685a11045ae3d1b17fe003875444090791ffea2029300afa265f1c9eb37ab

SHA512
b63ae9bee73ae8321078da3356e2bb8201d2b1c87659c15ec5053fa2ec9eec62309a7d04e8e82288ab6ef0f3700a2b514942479ce5fcbc034fddcfe3e253ec3c

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133596439061629985.txt.CashRansomware

Filesize
77KB

MD5
9a51d9ba232eafec39a7fb03de556a78

SHA1
db504061c330cf444d7deeb80bfed0ed5d9e56b6

SHA256
f53356bd88e005328494fa44ddb7a1c523255cf081f6b4121d549db2b082d387

SHA512
ad6970c079647d9a85f53529c1f0074310e41649c6df885423c3b191a4e9746d1705839eec976ebbf9e7a705b9bf1964f8a30859c95cc18e7cb16f2b7682387f

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133596440659070499.txt.CashRansomware

Filesize
47KB

MD5
23baf0d6daaaa47a3bf3308aad4c8ddb

SHA1
7776714d81c191d83f96fbf87212dcbf6425ffee

SHA256
0a59dd0fd04e831c437acdeda2df7cdb0abd0d1bab441229a613e2ecd8c5f605

SHA512
b5f096bb232dfa3029b3506031d6920ab84f04c61c21465d36a799dbc3092a60e4237deb4954ae7d4f023401d00cb6574bb9387e200f1cacc91ee5d29316185d

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133596447917177929.txt.CashRansomware

Filesize
66KB

MD5
433fa5cd935f3fb66e61f64884a60fea

SHA1
e0ceb9f16e22fa74cc7a45053f47c54c7c2d7bb2

SHA256
c9323f8db6eb2e78366f306d6a9022b1e0efe1801dc4db1fc427391d2d06e2f1

SHA512
fba4733df4a50ddc96e027d21444b594dab8c31d8323858526220306cb3877bdd5ae5d0851a277761e898be78016d45da34acb77c47e2e9c22a42d82c4c02ec3

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133596482452017585.txt.CashRansomware

Filesize
75KB

MD5
387d854345859ea487324a7f67d926e1

SHA1
3530fbb09de58396bce8dd89e2e2d4b01c345cfd

SHA256
0cf4dcf4916ae4820ec372f6801a287b6e966a7aa728b3b620b26538cef9c41e

SHA512
b918ba9e41212713babec3e9d814a21936beb55407770090d292e6fa5719730b98f173623a17c038f8d185bf179d027b2c8d048e9b43020f7d4cf59146402f07

Download Submit
C:\Users\Admin\AppData\Local\Temp\wctC39E.tmp.CashRansomware

Filesize
63KB

MD5
86ea436f94b8ac019a434826f5ce09f9

SHA1
16027b06c13a4d274e8cfd99d2041e0742462c70

SHA256
981c7caaac9be2cde971b9e8e62248f44b4a03819305a75ff6b93972cf88054c

SHA512
9aadd2349cc74f206499436ccdeaf8e404f395f365966eae82cd698bf5984f796ae8406bc5e08b648e10b880efebc2ec98f1804e5ab7363ab50a7c8f52014f62

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ue3bcu6m.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.CashRansomware

Filesize
48KB

MD5
dca8af04b47f3dbb4d4d4a8d60f60fc7

SHA1
433657b879120c1dbcbc3fc92118331ef5067e95

SHA256
cc20e1bc392c67140b6a79ac8783ba2c3133ddfca6b3c15c207ccc509d1d8402

SHA512
f53e6e1cac5fc8ea9faa0291070b51b6720d1e84220b6eebf7b695c3c9739951015b0957483115ce6bbce97a295fe8503ab12fcad61a307fddc0c568063b559b

Download Submit
C:\Users\Admin\Desktop\Cash Ransomware.html

Filesize
9KB

MD5
b38d3abcc3a30f095eaecfdd9f62e033

SHA1
f9960cb04896c229fdf6438efa51b4afd98f526f

SHA256
579374af17d7b9f972e9efcb761e0a8f88ef6d44dce53d56d0512d16c4728b9d

SHA512
46968c3951daa569dfecf75ba95a6694d525cbbd1883070189896ab270bb561cb2d00d7d38168405da1f78695f95cc481d28bcbff74be53d9a89822a09595768

Download Submit
memory/4500-1708-0x00007FF8B1450000-0x00007FF8B1F11000-memory.dmp

Filesize
10.8MB

Download
memory/4500-1713-0x00000141DCE60000-0x00000141DD06C000-memory.dmp

Filesize
2.0MB

Download
memory/4500-1714-0x00007FF8B1453000-0x00007FF8B1455000-memory.dmp

Filesize
8KB

Download
memory/4500-1711-0x00000141DE680000-0x00000141DEBA8000-memory.dmp

Filesize
5.2MB

Download
memory/4500-1710-0x00000141DDF80000-0x00000141DE142000-memory.dmp

Filesize
1.8MB

Download
memory/4500-1744-0x00007FF8B1450000-0x00007FF8B1F11000-memory.dmp

Filesize
10.8MB

Download
memory/4500-1709-0x00007FF8B1450000-0x00007FF8B1F11000-memory.dmp

Filesize
10.8MB

Download
memory/4500-0-0x00007FF8B1453000-0x00007FF8B1455000-memory.dmp

Filesize
8KB

Download
memory/4500-1707-0x00007FF8B1450000-0x00007FF8B1F11000-memory.dmp

Filesize
10.8MB

Download
memory/4500-2-0x00007FF8B1450000-0x00007FF8B1F11000-memory.dmp

Filesize
10.8MB

Download
memory/4500-1784-0x00007FF8B1450000-0x00007FF8B1F11000-memory.dmp

Filesize
10.8MB

Download
memory/4500-1785-0x00000141DCE60000-0x00000141DD06C000-memory.dmp

Filesize
2.0MB

Download
memory/4500-1786-0x00007FF8B1450000-0x00007FF8B1F11000-memory.dmp

Filesize
10.8MB

Download
memory/4500-1787-0x00007FF8B1450000-0x00007FF8B1F11000-memory.dmp

Filesize
10.8MB

Download
memory/4500-1797-0x00000141DCE60000-0x00000141DD06C000-memory.dmp

Filesize
2.0MB

Download
memory/4500-1800-0x00000141DCE60000-0x00000141DD06C000-memory.dmp

Filesize
2.0MB

Download
memory/4500-1810-0x00000141DCE60000-0x00000141DD06C000-memory.dmp

Filesize
2.0MB

Download
memory/4500-1-0x00000141BC910000-0x00000141BCBC8000-memory.dmp

Filesize
2.7MB

Download
memory/4500-1849-0x00000141DCE60000-0x00000141DD06C000-memory.dmp

Filesize
2.0MB

Download