xmrig | 36977b28c9fed001eac6ee6618edb0b5a8d1f47e7bc43c43124a9633dcf6b7bc

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-12-2024 17:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

coldrain.exe
Size

5.0MB
MD5

d3750f6797201c09918071e5cfbc5b31
SHA1

bacd5effd168ff9a16c59d93b499713858ed93fc
SHA256

36977b28c9fed001eac6ee6618edb0b5a8d1f47e7bc43c43124a9633dcf6b7bc
SHA512

cdab6afd2fa7720dbbc71069b1afb154f695232ee8f4cae3c49b2bba04edcc6e5cb48019556816988bc352682c4293662e6dd3ac8b23bc50e34c4c1a0a79b5d6
SSDEEP

98304:DcuBfco43+mCaazAoQqk3EdjiYQA7uHrrQN457K+8aatJgv/BxHR0wjvakHMXP:dBftXX1Qv3EBiu7eRfvJxxvPs/

Score

10^/10

xmrig discovery evasion execution miner persistence upx

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 11 IoCs

miner

resource	yara_rule
behavioral2/memory/988-89-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/988-90-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/988-91-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/988-88-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/988-85-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/988-86-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/988-92-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/988-160-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/988-171-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/988-170-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/988-172-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3376	powershell.exe
1192	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 1 IoCs

pid	Process
4496	gmstcccpdzbb.exe

Power Settings 1 TTPs 8 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
4248	powercfg.exe
4224	powercfg.exe
4992	powercfg.exe
5004	powercfg.exe
3196	powercfg.exe
3820	powercfg.exe
2196	powercfg.exe
4892	powercfg.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MRT.exe	coldrain.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	gmstcccpdzbb.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4496 set thread context of 1220	4496	gmstcccpdzbb.exe	150
PID 4496 set thread context of 988	4496	gmstcccpdzbb.exe	155

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/988-81-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/988-80-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/988-89-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/988-90-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/988-91-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/988-88-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/988-85-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/988-84-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/988-83-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/988-86-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/988-82-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/988-92-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/988-160-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/988-171-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/988-170-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/988-172-0x0000000140000000-0x0000000140848000-memory.dmp	upx

Launches sc.exe 14 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3804	sc.exe
2504	sc.exe
732	sc.exe
1276	sc.exe
1176	sc.exe
2512	sc.exe
4468	sc.exe
436	sc.exe
2376	sc.exe
2156	sc.exe
644	sc.exe
2756	sc.exe
1056	sc.exe
512	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 46 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2872	coldrain.exe
3376	powershell.exe
3376	powershell.exe
2872	coldrain.exe
2872	coldrain.exe
2872	coldrain.exe
2872	coldrain.exe
2872	coldrain.exe
2872	coldrain.exe
2872	coldrain.exe
2872	coldrain.exe
2872	coldrain.exe
2872	coldrain.exe
2872	coldrain.exe
2872	coldrain.exe
2872	coldrain.exe
2872	coldrain.exe
4496	gmstcccpdzbb.exe
1192	powershell.exe
1192	powershell.exe
4556	msedge.exe
4556	msedge.exe
4836	msedge.exe
4836	msedge.exe
4496	gmstcccpdzbb.exe
4496	gmstcccpdzbb.exe
4496	gmstcccpdzbb.exe
4496	gmstcccpdzbb.exe
4496	gmstcccpdzbb.exe
4496	gmstcccpdzbb.exe
4496	gmstcccpdzbb.exe
4496	gmstcccpdzbb.exe
4496	gmstcccpdzbb.exe
4496	gmstcccpdzbb.exe
4496	gmstcccpdzbb.exe
4496	gmstcccpdzbb.exe
988	conhost.exe
988	conhost.exe
988	conhost.exe
988	conhost.exe
988	conhost.exe
988	conhost.exe
988	conhost.exe
988	conhost.exe
988	conhost.exe
988	conhost.exe
988	conhost.exe
988	conhost.exe
4328	taskmgr.exe
4328	taskmgr.exe
3092	identity_helper.exe
3092	identity_helper.exe
988	conhost.exe
988	conhost.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeDebugPrivilege	3376	powershell.exe
Token: SeShutdownPrivilege	5004	powercfg.exe
Token: SeCreatePagefilePrivilege	5004	powercfg.exe
Token: SeShutdownPrivilege	4992	powercfg.exe
Token: SeCreatePagefilePrivilege	4992	powercfg.exe
Token: SeShutdownPrivilege	3820	powercfg.exe
Token: SeCreatePagefilePrivilege	3820	powercfg.exe
Token: SeShutdownPrivilege	3196	powercfg.exe
Token: SeCreatePagefilePrivilege	3196	powercfg.exe
Token: SeDebugPrivilege	1192	powershell.exe
Token: SeLockMemoryPrivilege	988	conhost.exe
Token: SeShutdownPrivilege	4248	powercfg.exe
Token: SeCreatePagefilePrivilege	4248	powercfg.exe
Token: SeShutdownPrivilege	4224	powercfg.exe
Token: SeCreatePagefilePrivilege	4224	powercfg.exe
Token: SeShutdownPrivilege	2196	powercfg.exe
Token: SeCreatePagefilePrivilege	2196	powercfg.exe
Token: SeShutdownPrivilege	4892	powercfg.exe
Token: SeCreatePagefilePrivilege	4892	powercfg.exe
Token: SeDebugPrivilege	4328	taskmgr.exe
Token: SeSystemProfilePrivilege	4328	taskmgr.exe
Token: SeCreateGlobalPrivilege	4328	taskmgr.exe
Token: 33	4328	taskmgr.exe
Token: SeIncBasePriorityPrivilege	4328	taskmgr.exe
Token: 33	4820	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4820	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe
4328	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3836 wrote to memory of 784	3836	cmd.exe	95
PID 3836 wrote to memory of 784	3836	cmd.exe	95
PID 4836 wrote to memory of 396	4836	msedge.exe	120
PID 4836 wrote to memory of 396	4836	msedge.exe	120
PID 4836 wrote to memory of 1204	4836	msedge.exe	124
PID 4836 wrote to memory of 1204	4836	msedge.exe	124
PID 4836 wrote to memory of 1204	4836	msedge.exe	124
PID 4836 wrote to memory of 1204	4836	msedge.exe	124
PID 4836 wrote to memory of 1204	4836	msedge.exe	124
PID 4836 wrote to memory of 1204	4836	msedge.exe	124
PID 4836 wrote to memory of 1204	4836	msedge.exe	124
PID 4836 wrote to memory of 1204	4836	msedge.exe	124
PID 4836 wrote to memory of 1204	4836	msedge.exe	124
PID 4836 wrote to memory of 1204	4836	msedge.exe	124
PID 4836 wrote to memory of 1204	4836	msedge.exe	124
PID 4836 wrote to memory of 1204	4836	msedge.exe	124
PID 4836 wrote to memory of 1204	4836	msedge.exe	124
PID 4836 wrote to memory of 1204	4836	msedge.exe	124
PID 4836 wrote to memory of 1204	4836	msedge.exe	124
PID 4836 wrote to memory of 1204	4836	msedge.exe	124
PID 4836 wrote to memory of 1204	4836	msedge.exe	124
PID 4836 wrote to memory of 1204	4836	msedge.exe	124
PID 4836 wrote to memory of 1204	4836	msedge.exe	124
PID 4836 wrote to memory of 1204	4836	msedge.exe	124
PID 4836 wrote to memory of 1204	4836	msedge.exe	124
PID 4836 wrote to memory of 1204	4836	msedge.exe	124
PID 4836 wrote to memory of 1204	4836	msedge.exe	124
PID 4836 wrote to memory of 1204	4836	msedge.exe	124
PID 4836 wrote to memory of 1204	4836	msedge.exe	124
PID 4836 wrote to memory of 1204	4836	msedge.exe	124
PID 4836 wrote to memory of 1204	4836	msedge.exe	124
PID 4836 wrote to memory of 1204	4836	msedge.exe	124
PID 4836 wrote to memory of 1204	4836	msedge.exe	124
PID 4836 wrote to memory of 1204	4836	msedge.exe	124
PID 4836 wrote to memory of 1204	4836	msedge.exe	124
PID 4836 wrote to memory of 1204	4836	msedge.exe	124
PID 4836 wrote to memory of 1204	4836	msedge.exe	124
PID 4836 wrote to memory of 1204	4836	msedge.exe	124
PID 4836 wrote to memory of 1204	4836	msedge.exe	124
PID 4836 wrote to memory of 1204	4836	msedge.exe	124
PID 4836 wrote to memory of 1204	4836	msedge.exe	124
PID 4836 wrote to memory of 1204	4836	msedge.exe	124
PID 4836 wrote to memory of 1204	4836	msedge.exe	124
PID 4836 wrote to memory of 1204	4836	msedge.exe	124
PID 4836 wrote to memory of 4556	4836	msedge.exe	125
PID 4836 wrote to memory of 4556	4836	msedge.exe	125
PID 4836 wrote to memory of 3596	4836	msedge.exe	126
PID 4836 wrote to memory of 3596	4836	msedge.exe	126
PID 4836 wrote to memory of 3596	4836	msedge.exe	126
PID 4836 wrote to memory of 3596	4836	msedge.exe	126
PID 4836 wrote to memory of 3596	4836	msedge.exe	126
PID 4836 wrote to memory of 3596	4836	msedge.exe	126
PID 4836 wrote to memory of 3596	4836	msedge.exe	126
PID 4836 wrote to memory of 3596	4836	msedge.exe	126
PID 4836 wrote to memory of 3596	4836	msedge.exe	126
PID 4836 wrote to memory of 3596	4836	msedge.exe	126
PID 4836 wrote to memory of 3596	4836	msedge.exe	126
PID 4836 wrote to memory of 3596	4836	msedge.exe	126
PID 4836 wrote to memory of 3596	4836	msedge.exe	126
PID 4836 wrote to memory of 3596	4836	msedge.exe	126
PID 4836 wrote to memory of 3596	4836	msedge.exe	126
PID 4836 wrote to memory of 3596	4836	msedge.exe	126
PID 4836 wrote to memory of 3596	4836	msedge.exe	126
PID 4836 wrote to memory of 3596	4836	msedge.exe	126

C:\Users\Admin\AppData\Local\Temp\coldrain.exe
"C:\Users\Admin\AppData\Local\Temp\coldrain.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2872
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3376
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3836
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:784
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:3804
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:1176
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:2512
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:2156
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:512
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:4992
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:3820
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:5004
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:3196
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe delete "XLZQHCLS"
  2⤵
  - Launches sc.exe
  PID:644
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe create "XLZQHCLS" binpath= "C:\ProgramData\oaocofwmfjha\gmstcccpdzbb.exe" start= "auto"
  2⤵
  - Launches sc.exe
  PID:2504
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop eventlog
  2⤵
  - Launches sc.exe
  PID:4468
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe start "XLZQHCLS"
  2⤵
  - Launches sc.exe
  PID:436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd64e246f8,0x7ffd64e24708,0x7ffd64e24718
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,8996398461920996511,17375614008234128142,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1976 /prefetch:2
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1996,8996398461920996511,17375614008234128142,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1996,8996398461920996511,17375614008234128142,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:8
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,8996398461920996511,17375614008234128142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,8996398461920996511,17375614008234128142,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,8996398461920996511,17375614008234128142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4172 /prefetch:1
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,8996398461920996511,17375614008234128142,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1996,8996398461920996511,17375614008234128142,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5416 /prefetch:8
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1996,8996398461920996511,17375614008234128142,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5416 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,8996398461920996511,17375614008234128142,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3604 /prefetch:1
  2⤵
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,8996398461920996511,17375614008234128142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2256 /prefetch:1
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,8996398461920996511,17375614008234128142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2824 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,8996398461920996511,17375614008234128142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,8996398461920996511,17375614008234128142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3620 /prefetch:1
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,8996398461920996511,17375614008234128142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3680 /prefetch:1
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,8996398461920996511,17375614008234128142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,8996398461920996511,17375614008234128142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,8996398461920996511,17375614008234128142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1996,8996398461920996511,17375614008234128142,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5740 /prefetch:8
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1996,8996398461920996511,17375614008234128142,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4812 /prefetch:8
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,8996398461920996511,17375614008234128142,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4956 /prefetch:2
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,8996398461920996511,17375614008234128142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3640 /prefetch:1
  2⤵
  PID:1132

C:\ProgramData\oaocofwmfjha\gmstcccpdzbb.exe
C:\ProgramData\oaocofwmfjha\gmstcccpdzbb.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:4496
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1192
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  PID:3396
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:3588
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:2756
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:732
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:1276
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:2376
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:1056
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:2196
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:4892
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:4248
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:4224
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:1220
- C:\Windows\system32\conhost.exe
  conhost.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:988

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4148

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4964

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4328

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2c8 0x408
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4820

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Power Settings

T1653

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\oaocofwmfjha\gmstcccpdzbb.exe

Filesize
5.0MB

MD5
d3750f6797201c09918071e5cfbc5b31

SHA1
bacd5effd168ff9a16c59d93b499713858ed93fc

SHA256
36977b28c9fed001eac6ee6618edb0b5a8d1f47e7bc43c43124a9633dcf6b7bc

SHA512
cdab6afd2fa7720dbbc71069b1afb154f695232ee8f4cae3c49b2bba04edcc6e5cb48019556816988bc352682c4293662e6dd3ac8b23bc50e34c4c1a0a79b5d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e443ee4336fcf13c698b8ab5f3c173d0

SHA1
9bf70b16f03820cbe3158e1f1396b07b8ac9d75a

SHA256
79e277da2074f9467e0518f0f26ca2ba74914bee82553f935a0ccf64a0119e8b

SHA512
cbf6f6aa0ea69b47f51592296da2b7be1180e7b483c61b4d17ba9ee1a2d3345cbe0987b96f4e25de1438b553db358f330aad8a26e8522601f055c3d5a8313cdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56a4f78e21616a6e19da57228569489b

SHA1
21bfabbfc294d5f2aa1da825c5590d760483bc76

SHA256
d036661e765ee8fd18978a2b5501e8df6b220e4bca531d9860407555294c96fb

SHA512
c2c3cd1152bb486028fe75ab3ce0d0bc9d64c4ca7eb8860ddd934b2f6e0140d2c913af4fa082b88e92a6a6d20fd483a1cb9813209f371a0f56374bc97d7f863b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
239KB

MD5
5b1a50d32003745b1a936967b98f11e6

SHA1
fbe602b3997dd91a54a9a6578b2f5dac7cf50280

SHA256
177717c6a2bfd0ed22a2d249ad621321f2b901f0fce4dc118ef8e020d80d8d95

SHA512
6c49d6db209bb14e1462e655bb7d90b02750eb2ef6241110a97365799b8af2ada372b3455396ced05ecd9ca49baf007171d4a72a7b219fdea4afc16c43b7dac2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
49KB

MD5
7ca090d5f0c1a9e7d42edb60ad4ec5e8

SHA1
7278dcacb472ec8a27af7fbc6f8212b21e191042

SHA256
4039fef5575ba88350a109b2c8d9aa107f583acb6cbe2ac8e609071567c4cc76

SHA512
c4f2d23eacf74f87de8dea6e4532b120253bb9ad356341532f5e1aaf2ce90d137f46b50df7de5250bce4eca1fbfb74da088accd7c626fa853dc524abad7bfe8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
635KB

MD5
b537ca5fec304dcf3ce3171edf1e8fa4

SHA1
52665eefc08697d21f82719269fbfef687a643d7

SHA256
50b93c8ccbf1304dde0b424bafadf2fb654597bf4a35def9f29356988dfeb2ca

SHA512
81ae8df536c60aa8eb9a687625a72de559d15018c5248e0bc12ce7ed45aa7b960e999b79a8e197c38ddde219aa942ba4534f154aa99386e5e242d18a7d76c805

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
34KB

MD5
e85ac71b59dadc1488a1c888db91c5ea

SHA1
a4aa7fc9226bd867a978945a27fd78a0a82cc994

SHA256
7441da6812af01a6eb9afa5d602986b233a57700cb721343b0aa9830a15def0d

SHA512
2b4d952a258f9001c2d8a42402c98788759138669750667524df2031d3926e21836b037974ded859bebf88fd9296791a6a2de65561b8098f066f9cbb8ae719ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
34KB

MD5
6242c13ec6b35fed918ab71eb096d097

SHA1
691e6865e78afb11d9070056ba6cd99bdad7b04e

SHA256
b1c7566622f40bad557a6c5b7bc5b8ae25b4da191ac716cc7923282eef96034c

SHA512
52914b4ca7362e9ebe326ea89006f5cc096fd4d1c360cae33ca768af92fe6fdb5078d0848fb6dc092848ba0e3d3f51bfb20a292250c35e8bd2e79fd5a19dd7b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ca6e8cc0e48cd7c1d1092c350adcbb93

SHA1
611c1f6edadeab1f5842641d972ff59a67b60489

SHA256
e38cfc457ead8df071ef6f2d8802d1f53bf53c1393814024c0053eab09a604de

SHA512
c917b7639e5051516a0559728971cc61f34d65c718cc0c9eb9fe74878e9396bd9db12087d9537d1b1c458d9b79a7006e60df4da265b9a9c04074202c3f243b0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f1d4dc611d6013a38fa02502019333b7

SHA1
d9558882ddde15a74ff1517158600fe315d1c404

SHA256
c15a875d2d5aa511b81ee83196ed5627970c4dd434408d1bfb798f7994c6ee3d

SHA512
299d20dc36966402aad5d89522c16c1042e810d9269750cc1caa71efcfc80e7e048faf753bfadf6123f6e460d0fd53ee62bd46e4af3442aab985f2571bef2a56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d8f0bb9552c8f0f05647d733f2b6e31c

SHA1
ed16170e4097d1a8f2ec5e3bf9d76a534c51a1c1

SHA256
a5542cb778a186330787d290dc6b68e1ac23fc5f10b69273c3f03c9dba38c446

SHA512
c7cfa75dd09399dff91f630ec1a529c33025f6ce8ce5933c1c0d6be024ac240d80064b1298c203a021506655528edcd330d451f2d2326b7c986dddd1ceafa25a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
38e9479c211529891df9118bb2a4bd3a

SHA1
2636f959b4170176cff8f853d34453c9c33fcb35

SHA256
bd39f5cfb4fafac89ddbc4786e03c75403d5ccdc82ff3ea99b081795db948175

SHA512
887427566d1fb284886004c5ad37af20e76d61ab3ce6d8d14fe8b34d8b009e9f3063a14849019f4a404b5de894ca9be6a6007c515d7d3cda05cbb36bda821794

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
6ae507b44ad0532005b27b27d3666068

SHA1
70ccf677ac9fb760daf66fa5206a605875944389

SHA256
089de5396881817d7d5a0d3490b7ea0a9389c117586b34df0c4b5086cab08b78

SHA512
2fab794c1b5c3f0bb38043ca20a8698247b2ea5e017138f008840e8356742f9ff211a597ab1214c12f2a5ce2ccf1e2eae6cabfad4fa27a18351a83551f7c1ebe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c6ca350079c45ec129d012984d69cf3a

SHA1
666613d532a662530280d9e5866c7ec032917004

SHA256
51fff91590a4da4c04fe5cd2c7df2a11a8afed1ff63a35e24e20ef742393ffff

SHA512
5179f9a6a7d7860d854159e4ff7d28d7d960fdd30a8f1221c8d1564de1591c9e1d5b4ee0387806d87c17737ca6dab6bca3cf6a6754924c783fae5d946c0d9d1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\2c90b645-6dac-420a-9b2d-85611ff3c23e\index-dir\the-real-index

Filesize
2KB

MD5
e8854d6b1219890274117662bfafac60

SHA1
455c6e86d7352e29ff71007ce8066c3c585e888d

SHA256
dfbc777e63bec7a90af9c3fb0cefa6a4de34b3a747c1856cc72e5c16f4f12ea6

SHA512
e5e670371ebfbbf6d5922ac64397b4915bb843684139b0aebe158ca04abe30004e1b7639d9c744766a973ae27d9ce7c8eddf85ce910eb56023dcc063aebdbcf6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\2c90b645-6dac-420a-9b2d-85611ff3c23e\index-dir\the-real-index~RFe597d93.TMP

Filesize
48B

MD5
e6444b7b4b44c4718348edeebe050c1c

SHA1
1b1cbb1ca2a9aa5cc5667a6550554044a9ab17fa

SHA256
d57de7a7caaedd7b5dab97775b95ba74a7d665c804cbd0a0e6a3221915d7f4a1

SHA512
6e6561df45adfdadbc2c69be50e91cca85db4cdda1ac0a7779a85c1a52311c4286c989ae3835f8b57e532afe1dced3a3b775459cce93e457245dec1c6ac15886

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\47f8421c-b063-4c30-95db-615a070e8870\index

Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
89B

MD5
61c385ddbd8e5655d88baa8a1457bcf3

SHA1
e8987060aae4a05bcd4aee75fbc1909938493688

SHA256
8777aa8592c4907c431ac210fb6a4077fed6509a5f938a627fe198c0763329da

SHA512
1e3334ad0038cc971f53517f28c7e3d14ce52fc2762b2a2bfdf0973898742f5cb4393d3e6c865bc21cbaf9c10dd15d05ecd0716fe1c7e948907e867dd59abd86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
395fbf431dc6fa6c0aab25e71dfc1fb6

SHA1
6701131d42874ace19fdf0ad5530e102d9cca98f

SHA256
6f79ab0901886e0cca6bba00c09083946e0571b56861922ac09cf2516464a284

SHA512
1267b89198560db6ee49a2593a3cf5f19887dae792037ae15eac8d2923a3949f2a787ad45d5fa07ba69ba3d4c9a7048c305e62571636bee9db8c16cc4ba71459

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
82B

MD5
892f4df5c41566f2a9d91cfb1bc50310

SHA1
d35d72f760622734e5b3658dd98b2d5e1513e657

SHA256
410322f5e23727b9d469b4b155dd759a2bf714789f3565d095f7a7eec68a2b9f

SHA512
91fcdb6f16454d0b64cb02e687cd4bb8a4d94e84b75985777aee0c04cfe2b613bced2647a1217e39431900aa97674be0376aa506f398a5323de8a4a733273c83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
148B

MD5
9d46be3bf30bd5cf827d9d1a24973da6

SHA1
124e115d14ef9e9195202909f5e7a5cb8d34de77

SHA256
818532491874119e02d09ae46b78e4f2617b59cd9ecb780d5fbc2aff7a20bae7

SHA512
9fdae4572c21a883136ea8eaffa36b921f63a49359170156345596a25d47cdde739dac769f80f631d5b325a156f08db6b4c58b02510259bd5fbf61fcc13ec0fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
157B

MD5
bd221d57fb8dccda2f1fc38a0d3d9be0

SHA1
0849b523c1642a7d0951c11a162f7ae9d0590f00

SHA256
14bb03cce0494b5acebe199f57901c7989c99fdd78594213d6eae4edef2637c0

SHA512
c50a1ad1d6c10b9e19df2205541a7c940a2c40f59d15b9b923977dd044491772949804f4be04bc1c49e051455cbc96291affcb0df4e76410c85a2b92dbf9115d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
84B

MD5
d9f886ef1b38db687616f098a12332ee

SHA1
52a086ae747cc5e7a7660efa7a59dcd1895fb275

SHA256
07abc99ab91b6d05dc2ee3f61c159a8ba7495878351a7fd1bbaa6c45cb22a808

SHA512
ee6d2df04fd7ceb295b3db73c8743fe8c8c1d68fffc4013411c8ec0d777f2b3190514604550ee34f5d7ed71dce2a874c81537413e22cf1f0e83b1d2c1d648b0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a4a4298cad337c9a151c81e29e814fa0

SHA1
312f940ee20ecbce8d2fce5ff00a7b5c97341260

SHA256
f5c8e42af0f87a26e96825194f694c0f621eb72aaea492fe7d644e477bf6dff1

SHA512
83eaf5e11b95b68f5219e47e4c84c3fbea320cb9781ae2543201286ec748bf22df34b03bb41b0853c031c663aa266be1b666e95f7dcb9a64178ad1f0de935c11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d30f698bd29bf215068b1aab3359ceb0

SHA1
39e71f784a354c38da81b94d838076e90cfcf174

SHA256
ad999ec14ab219884f4660d7fe0a6cce8fdfefd2a98f7f9ae8b1fe9e8f9069ec

SHA512
dc4b4a1e320ba6ef64fae4befde82f32611827d4b4f066f179d45d29ea4f7044cc1fc4cee428cb9aa46827458648e689035e03edf29a93be48920a550ad476f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe596d37.TMP

Filesize
536B

MD5
c65c6ff4edb099f03d474e4d02205775

SHA1
fe40fb38badc7a3ea39b68f619c44205fe57ff06

SHA256
bfb5ce078fa4c27ef993a2d7e2ac20ad9582a9d3d8890a2f0b0aa0e70cbc670d

SHA512
4d516e51b3ff1a28ee7cdd7aa03abfa8022149d47195cfc3752f0c529962d21a7569f898c813e2b98f9c5e437b7c3f89f25a9a9ec8713cf76b9a5041b69582ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
eeac75936bfe96606da9fa540b9040f6

SHA1
7934e64f9729eb43b579f93c6707dcad4570ea27

SHA256
905416de542f5fe4caf36bf98a468d47027edd988478fe708c41ae6a76b45302

SHA512
afb58bf7ff263c333a0c9e00e53f2ab3d746f81ba895dd2d48ed9a70ee6be2c776e32ef3ec173c53a14a29e28de76c70809b53d24bd87cc1fddffa7b5ccadbc4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2c006da10d5c51c47bf1cba050230736

SHA1
290a8be763fc2c5f42c094051f2028834577c20d

SHA256
11ca9b130dba5f9b6ef06fd03062995f526c2d2fb38d39e1dfe997d8d07e2658

SHA512
46b0b666fd9934fbed106faeadbb775dcde7593ec304b3f1900459e356a555e7d6953c866c40bf266b4a4f72551cb5c6e2e1c2f06c07fe4476d722fcba33cc6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pyxlkjks.s4p.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
memory/988-171-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/988-170-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/988-81-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/988-90-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/988-87-0x00000249DB3B0000-0x00000249DB3D0000-memory.dmp

Filesize
128KB

Download
memory/988-92-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/988-85-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/988-82-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/988-91-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/988-86-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/988-84-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/988-172-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/988-83-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/988-89-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/988-80-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/988-88-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/988-160-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1192-61-0x0000020DE78E0000-0x0000020DE78EA000-memory.dmp

Filesize
40KB

Download
memory/1192-60-0x0000020D82670000-0x0000020D82725000-memory.dmp

Filesize
724KB

Download
memory/1192-65-0x0000020DE78F0000-0x0000020DE78FA000-memory.dmp

Filesize
40KB

Download
memory/1192-64-0x0000020DE7980000-0x0000020DE799C000-memory.dmp

Filesize
112KB

Download
memory/1192-68-0x0000020D82880000-0x0000020D82886000-memory.dmp

Filesize
24KB

Download
memory/1192-67-0x0000020D82870000-0x0000020D82878000-memory.dmp

Filesize
32KB

Download
memory/1192-69-0x0000020DE7940000-0x0000020DE794A000-memory.dmp

Filesize
40KB

Download
memory/1192-66-0x0000020DE79A0000-0x0000020DE79BA000-memory.dmp

Filesize
104KB

Download
memory/1192-59-0x0000020D801D0000-0x0000020D801EC000-memory.dmp

Filesize
112KB

Download
memory/1220-72-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/1220-79-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/1220-73-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/1220-75-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/1220-76-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/1220-74-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/3376-15-0x00007FFD55750000-0x00007FFD56211000-memory.dmp

Filesize
10.8MB

Download
memory/3376-12-0x00007FFD55750000-0x00007FFD56211000-memory.dmp

Filesize
10.8MB

Download
memory/3376-0-0x00007FFD55753000-0x00007FFD55755000-memory.dmp

Filesize
8KB

Download
memory/3376-11-0x00007FFD55750000-0x00007FFD56211000-memory.dmp

Filesize
10.8MB

Download
memory/3376-1-0x0000012C77520000-0x0000012C77542000-memory.dmp

Filesize
136KB

Download
memory/4328-129-0x00000263B28E0000-0x00000263B28E1000-memory.dmp

Filesize
4KB

Download
memory/4328-132-0x00000263B28E0000-0x00000263B28E1000-memory.dmp

Filesize
4KB

Download
memory/4328-133-0x00000263B28E0000-0x00000263B28E1000-memory.dmp

Filesize
4KB

Download
memory/4328-134-0x00000263B28E0000-0x00000263B28E1000-memory.dmp

Filesize
4KB

Download
memory/4328-122-0x00000263B28E0000-0x00000263B28E1000-memory.dmp

Filesize
4KB

Download
memory/4328-130-0x00000263B28E0000-0x00000263B28E1000-memory.dmp

Filesize
4KB

Download
memory/4328-128-0x00000263B28E0000-0x00000263B28E1000-memory.dmp

Filesize
4KB

Download
memory/4328-124-0x00000263B28E0000-0x00000263B28E1000-memory.dmp

Filesize
4KB

Download
memory/4328-123-0x00000263B28E0000-0x00000263B28E1000-memory.dmp

Filesize
4KB

Download
memory/4328-131-0x00000263B28E0000-0x00000263B28E1000-memory.dmp

Filesize
4KB

Download