xmrig | hxxps://gofile[.]io/d/FI8E7i

Analysis

max time kernel
299s
max time network
295s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27/12/2024, 21:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://gofile.io/d/FI8E7i

Score

10^/10

xmrig discovery evasion execution miner persistence upx

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 7 IoCs

miner

resource	yara_rule
behavioral1/memory/4828-266-0x0000000140000000-0x0000000140835000-memory.dmp	xmrig
behavioral1/memory/4828-267-0x0000000140000000-0x0000000140835000-memory.dmp	xmrig
behavioral1/memory/4828-270-0x0000000140000000-0x0000000140835000-memory.dmp	xmrig
behavioral1/memory/4828-273-0x0000000140000000-0x0000000140835000-memory.dmp	xmrig
behavioral1/memory/4828-274-0x0000000140000000-0x0000000140835000-memory.dmp	xmrig
behavioral1/memory/4828-272-0x0000000140000000-0x0000000140835000-memory.dmp	xmrig
behavioral1/memory/4828-271-0x0000000140000000-0x0000000140835000-memory.dmp	xmrig

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Downloads MZ/PE file
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 7 IoCs

pid	Process
5572	Anon Drainer.exe
3184	vpsvpbtuonsc.exe
4596	Anon Drainer.exe
5996	Anon Drainer.exe
1564	Anon Drainer.exe
5700	vpsvpbtuonsc.exe
516	Anon Drainer.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\ET68GOXG	njCryper.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3184 set thread context of 4376	3184	vpsvpbtuonsc.exe	160
PID 3184 set thread context of 4828	3184	vpsvpbtuonsc.exe	161

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4828-261-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral1/memory/4828-266-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral1/memory/4828-267-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral1/memory/4828-270-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral1/memory/4828-273-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral1/memory/4828-274-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral1/memory/4828-272-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral1/memory/4828-271-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral1/memory/4828-265-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral1/memory/4828-264-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral1/memory/4828-262-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral1/memory/4828-263-0x0000000140000000-0x0000000140835000-memory.dmp	upx

Launches sc.exe 6 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1244	sc.exe
2324	sc.exe
1748	sc.exe
3388	sc.exe
4568	sc.exe
1580	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	njCryper.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	njCryper.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	njCryper.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0 = 5a003100000000009b59cba8100053797374656d33320000420009000400efbe874f77489b59cba82e000000b90c00000000010000000000000000000000000000009a9e7800530079007300740065006d0033003200000018000000	njCryper.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	njCryper.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	njCryper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Pictures"	njCryper.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	njCryper.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	njCryper.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	njCryper.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202	njCryper.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	njCryper.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	njCryper.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	njCryper.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	njCryper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic"	njCryper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Downloads"	njCryper.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	njCryper.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	njCryper.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	njCryper.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	njCryper.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Version = "1"	njCryper.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	njCryper.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\MRUListEx = 00000000ffffffff	njCryper.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	njCryper.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	njCryper.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	njCryper.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	njCryper.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	njCryper.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	njCryper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	njCryper.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\MRUListEx = ffffffff	njCryper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	njCryper.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	njCryper.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	njCryper.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	njCryper.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\MRUListEx = 00000000ffffffff	njCryper.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	njCryper.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	njCryper.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	njCryper.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	njCryper.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	njCryper.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	njCryper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	njCryper.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	njCryper.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	njCryper.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1 = 19002f433a5c000000000000000000000000000000000000000000	njCryper.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0	njCryper.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0	njCryper.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	njCryper.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	njCryper.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	njCryper.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	njCryper.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	njCryper.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	njCryper.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	njCryper.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	njCryper.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\NodeSlot = "3"	njCryper.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	njCryper.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	njCryper.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	njCryper.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	njCryper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Pictures"	njCryper.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 462124.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4268	msedge.exe
4268	msedge.exe
2056	msedge.exe
2056	msedge.exe
4052	identity_helper.exe
4052	identity_helper.exe
4588	msedge.exe
4588	msedge.exe
4132	msedge.exe
4132	msedge.exe
1152	msedge.exe
1152	msedge.exe
5596	msedge.exe
5596	msedge.exe
5596	msedge.exe
5596	msedge.exe
3012	msedge.exe
3012	msedge.exe
5572	Anon Drainer.exe
5572	Anon Drainer.exe
5572	Anon Drainer.exe
5572	Anon Drainer.exe
3184	vpsvpbtuonsc.exe
3184	vpsvpbtuonsc.exe
4828	explorer.exe
4828	explorer.exe
4828	explorer.exe
4828	explorer.exe
4828	explorer.exe
4828	explorer.exe
4828	explorer.exe
4828	explorer.exe
4828	explorer.exe
4828	explorer.exe
4828	explorer.exe
4828	explorer.exe
4828	explorer.exe
4828	explorer.exe
4828	explorer.exe
4828	explorer.exe
4828	explorer.exe
4828	explorer.exe
4828	explorer.exe
4828	explorer.exe
4828	explorer.exe
4828	explorer.exe
4596	Anon Drainer.exe
4596	Anon Drainer.exe
4828	explorer.exe
4828	explorer.exe
4828	explorer.exe
4828	explorer.exe
4828	explorer.exe
4828	explorer.exe
4828	explorer.exe
4828	explorer.exe
4828	explorer.exe
4828	explorer.exe
4828	explorer.exe
4828	explorer.exe
4828	explorer.exe
4828	explorer.exe
4828	explorer.exe
4828	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5240	njCryper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4828	explorer.exe

Suspicious use of FindShellTrayWindow 55 IoCs

pid	Process
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
6124	njCryper.exe
6124	njCryper.exe
6124	njCryper.exe
2056	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
5240	njCryper.exe
5240	njCryper.exe
5240	njCryper.exe
5240	njCryper.exe
6124	njCryper.exe
6124	njCryper.exe
6124	njCryper.exe
6124	njCryper.exe
6124	njCryper.exe
6124	njCryper.exe
6124	njCryper.exe
6124	njCryper.exe
6000	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 2428	2056	msedge.exe	82
PID 2056 wrote to memory of 2428	2056	msedge.exe	82
PID 2056 wrote to memory of 3628	2056	msedge.exe	83
PID 2056 wrote to memory of 3628	2056	msedge.exe	83
PID 2056 wrote to memory of 3628	2056	msedge.exe	83
PID 2056 wrote to memory of 3628	2056	msedge.exe	83
PID 2056 wrote to memory of 3628	2056	msedge.exe	83
PID 2056 wrote to memory of 3628	2056	msedge.exe	83
PID 2056 wrote to memory of 3628	2056	msedge.exe	83
PID 2056 wrote to memory of 3628	2056	msedge.exe	83
PID 2056 wrote to memory of 3628	2056	msedge.exe	83
PID 2056 wrote to memory of 3628	2056	msedge.exe	83
PID 2056 wrote to memory of 3628	2056	msedge.exe	83
PID 2056 wrote to memory of 3628	2056	msedge.exe	83
PID 2056 wrote to memory of 3628	2056	msedge.exe	83
PID 2056 wrote to memory of 3628	2056	msedge.exe	83
PID 2056 wrote to memory of 3628	2056	msedge.exe	83
PID 2056 wrote to memory of 3628	2056	msedge.exe	83
PID 2056 wrote to memory of 3628	2056	msedge.exe	83
PID 2056 wrote to memory of 3628	2056	msedge.exe	83
PID 2056 wrote to memory of 3628	2056	msedge.exe	83
PID 2056 wrote to memory of 3628	2056	msedge.exe	83
PID 2056 wrote to memory of 3628	2056	msedge.exe	83
PID 2056 wrote to memory of 3628	2056	msedge.exe	83
PID 2056 wrote to memory of 3628	2056	msedge.exe	83
PID 2056 wrote to memory of 3628	2056	msedge.exe	83
PID 2056 wrote to memory of 3628	2056	msedge.exe	83
PID 2056 wrote to memory of 3628	2056	msedge.exe	83
PID 2056 wrote to memory of 3628	2056	msedge.exe	83
PID 2056 wrote to memory of 3628	2056	msedge.exe	83
PID 2056 wrote to memory of 3628	2056	msedge.exe	83
PID 2056 wrote to memory of 3628	2056	msedge.exe	83
PID 2056 wrote to memory of 3628	2056	msedge.exe	83
PID 2056 wrote to memory of 3628	2056	msedge.exe	83
PID 2056 wrote to memory of 3628	2056	msedge.exe	83
PID 2056 wrote to memory of 3628	2056	msedge.exe	83
PID 2056 wrote to memory of 3628	2056	msedge.exe	83
PID 2056 wrote to memory of 3628	2056	msedge.exe	83
PID 2056 wrote to memory of 3628	2056	msedge.exe	83
PID 2056 wrote to memory of 3628	2056	msedge.exe	83
PID 2056 wrote to memory of 3628	2056	msedge.exe	83
PID 2056 wrote to memory of 3628	2056	msedge.exe	83
PID 2056 wrote to memory of 4268	2056	msedge.exe	84
PID 2056 wrote to memory of 4268	2056	msedge.exe	84
PID 2056 wrote to memory of 3344	2056	msedge.exe	85
PID 2056 wrote to memory of 3344	2056	msedge.exe	85
PID 2056 wrote to memory of 3344	2056	msedge.exe	85
PID 2056 wrote to memory of 3344	2056	msedge.exe	85
PID 2056 wrote to memory of 3344	2056	msedge.exe	85
PID 2056 wrote to memory of 3344	2056	msedge.exe	85
PID 2056 wrote to memory of 3344	2056	msedge.exe	85
PID 2056 wrote to memory of 3344	2056	msedge.exe	85
PID 2056 wrote to memory of 3344	2056	msedge.exe	85
PID 2056 wrote to memory of 3344	2056	msedge.exe	85
PID 2056 wrote to memory of 3344	2056	msedge.exe	85
PID 2056 wrote to memory of 3344	2056	msedge.exe	85
PID 2056 wrote to memory of 3344	2056	msedge.exe	85
PID 2056 wrote to memory of 3344	2056	msedge.exe	85
PID 2056 wrote to memory of 3344	2056	msedge.exe	85
PID 2056 wrote to memory of 3344	2056	msedge.exe	85
PID 2056 wrote to memory of 3344	2056	msedge.exe	85
PID 2056 wrote to memory of 3344	2056	msedge.exe	85
PID 2056 wrote to memory of 3344	2056	msedge.exe	85
PID 2056 wrote to memory of 3344	2056	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://gofile.io/d/FI8E7i
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff952c546f8,0x7ff952c54708,0x7ff952c54718
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,13650821651750492717,14292192123911842409,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2264 /prefetch:2
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,13650821651750492717,14292192123911842409,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,13650821651750492717,14292192123911842409,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13650821651750492717,14292192123911842409,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13650821651750492717,14292192123911842409,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13650821651750492717,14292192123911842409,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4644 /prefetch:1
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,13650821651750492717,14292192123911842409,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4972 /prefetch:8
  2⤵
  PID:736
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,13650821651750492717,14292192123911842409,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4972 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13650821651750492717,14292192123911842409,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13650821651750492717,14292192123911842409,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2152,13650821651750492717,14292192123911842409,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5108 /prefetch:8
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13650821651750492717,14292192123911842409,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2152,13650821651750492717,14292192123911842409,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13650821651750492717,14292192123911842409,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13650821651750492717,14292192123911842409,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2152,13650821651750492717,14292192123911842409,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4768 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13650821651750492717,14292192123911842409,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6224 /prefetch:1
  2⤵
  PID:800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13650821651750492717,14292192123911842409,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6248 /prefetch:1
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2152,13650821651750492717,14292192123911842409,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6264 /prefetch:8
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2152,13650821651750492717,14292192123911842409,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4744 /prefetch:8
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13650821651750492717,14292192123911842409,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13650821651750492717,14292192123911842409,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2152,13650821651750492717,14292192123911842409,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,13650821651750492717,14292192123911842409,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5640 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5596

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2804

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3132

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5168

C:\Users\Admin\AppData\Local\Temp\Temp1_njCrypter.zip\njCryper.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_njCrypter.zip\njCryper.exe"
1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5240
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ugtnx1vw.cmdline"
  2⤵
  PID:5688

C:\Users\Admin\Downloads\njCrypter\njCryper.exe
"C:\Users\Admin\Downloads\njCrypter\njCryper.exe"
1⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:6124
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3bwypoxq.cmdline"
  2⤵
  PID:5216
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wud40agm.cmdline"
  2⤵
  PID:5320

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault137ea1fbhfcfbh4dc1h916dh6bd7c2ccc261
1⤵
PID:5936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ff952c546f8,0x7ff952c54708,0x7ff952c54718
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,12443596508320040581,17630322968299401781,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,12443596508320040581,17630322968299401781,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3012

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4304

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5168

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6000

C:\Users\Admin\Downloads\Anon Drainer.exe
"C:\Users\Admin\Downloads\Anon Drainer.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5572
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe delete "SDFGGRDL"
  2⤵
  - Launches sc.exe
  PID:2324
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe create "SDFGGRDL" binpath= "C:\ProgramData\jujroeiragoc\vpsvpbtuonsc.exe" start= "auto"
  2⤵
  - Launches sc.exe
  PID:1748
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop eventlog
  2⤵
  - Launches sc.exe
  PID:3388
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe start "SDFGGRDL"
  2⤵
  - Launches sc.exe
  PID:4568

C:\ProgramData\jujroeiragoc\vpsvpbtuonsc.exe
C:\ProgramData\jujroeiragoc\vpsvpbtuonsc.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:3184
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:4376
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4828

C:\Users\Admin\Downloads\Anon Drainer.exe
"C:\Users\Admin\Downloads\Anon Drainer.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4596
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop eventlog
  2⤵
  - Launches sc.exe
  PID:1580
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe start "SDFGGRDL"
  2⤵
  - Launches sc.exe
  PID:1244

C:\Users\Admin\Downloads\Anon Drainer.exe
"C:\Users\Admin\Downloads\Anon Drainer.exe"
1⤵
- Executes dropped EXE
PID:5996

C:\Users\Admin\Downloads\Anon Drainer.exe
"C:\Users\Admin\Downloads\Anon Drainer.exe"
1⤵
- Executes dropped EXE
PID:1564

C:\ProgramData\jujroeiragoc\vpsvpbtuonsc.exe
C:\ProgramData\jujroeiragoc\vpsvpbtuonsc.exe
1⤵
- Executes dropped EXE
PID:5700

C:\Users\Admin\Downloads\Anon Drainer.exe
"C:\Users\Admin\Downloads\Anon Drainer.exe"
1⤵
- Executes dropped EXE
PID:516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9e26da1b29a3c8cc97fe4711eb07a2b3

SHA1
b5152b6130757f920c2e20a55510b2e878f6a17e

SHA256
4fb90f4906bb05bcb697a13269ba075f02a7b3b9b1c9630fc10c34d336a0fc7b

SHA512
431ea106b2059d9d31649a82e7fd76d9e3097f88df466c50fc1a8c289b999c34d54297e0a8c0704924f4cc93a8bd925c29d782fa24be6791d2f472ffca286148

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c5bf5c93e78963c50b471adb48706c41

SHA1
a8b119e854b9e8d7dad2c42d98a596fda1b0409c

SHA256
86e1a5d7b96d12f539f55819fc194b8b516e7475e170f909402ee4ce43caead0

SHA512
d9d82a747a060970c1b400131af675b9b46c075d34e927235028b51dae49e198b633fe90cea581750e1caae22e072e2701e9be811997436377c1fcf9cf45e757

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
786f7e9c031857831e3c5df7c7575458

SHA1
9662461dfedf563ee5e90f64056a67722a348438

SHA256
51ef9ceb76f485a6bc6fdfdf6a3b758eae95f3beeb16026815cb5d67fd7ac856

SHA512
0d09bbb907229d94afd6b10cb7709cc0ad417d3cc623a2946e3ac24fab9536fc2a4a48f9578cae2343579b4fdc641a6bd430443b0e9e7a6524df5b9c8566337c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
547B

MD5
6c1f298c621bb9f9cc12bc7d16e190ea

SHA1
5868e286facca0fe728304e1ed5e1030ac12e0ca

SHA256
f2a3747a6b0acda2553f3739f6ddcff835e4dd3fb62014f902db737e5f6a1458

SHA512
be4c5091cdaea0b0dd39b2ca67d5767c3c036b27e48dc99e92ff605bbb5ff7fcd7a0db4d9b7dae6c155a1ee5e354a427a0dd92201cd7ee4a6a221de7ade3281b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4844cc3ff775d7c4bd44be64489c49b7

SHA1
58c2073fd0a050e5ac8b5fdecc72baec280a5333

SHA256
7e04b14cc54574d17535ad809b009914b741eac95c315b0a120dc378552ff44b

SHA512
6b81bc3181e97a2f8faf151e60f9a59fcce8b1df515754e3dbef1d92e0c0739cf5c633d427b8c4dfe644e6f41f043905ebaa2fa261f838221c440b145d993cd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bb6befe45530cce0612a62db698c1b48

SHA1
000c7c8985bb56abffd06e3354007809e1e0684e

SHA256
453d9c2fb88d34da4a67e3d1f15b7c2f1d0bc846a3834754612b0219b4d571f6

SHA512
8c97824e0d1ca5d87d99256a357bdb33218a61f21395617e4a85d826af6999ab4a560f054360d8a4bfe47fd01ceb1ac63853aa0a36f16f6dbd44ad60283809e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
53643eaada9c596331654bbc1b00d17f

SHA1
ccffdfb0845539ba646013f6e127c97ab981667a

SHA256
6fe6aa8536fb150efd759bea0e1f1ce064b7a5e25ebf35d46728b59d70807f4a

SHA512
cc62015aaee2f09de33957b1e25fb848c4d7b3ef8c2ed2382e5c2e5ec2660528e371e8d56669bb572601fdeb46fc357a80823266fe10860efe8b6e189bc10c74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
dc41346fa4cddae47d5cd0eb06407686

SHA1
06643c21d0b1f07416311ea238924c961a2eb859

SHA256
3e5f5df73183254825d6db76fb7a3c39b8da1fa0b5d942dde19f522bd3657fc4

SHA512
07dc05b1a6464601295cf6110bc7a60f26d04ecb81f5cb617a8909134b5e167e2e459a601a70e34cde60ca17613bab26b14d91b44e46492af7bfa8ae579c1d2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
999c0554be8e3f62c56070e6eb860784

SHA1
486277936555045a7345fe2ee32392a44c80fda2

SHA256
2bb3b08efcd75d54165577648e625830e242d6cbee2087ea325460d18a5d537c

SHA512
a6844938214c0b57fe75213f703a98a6185b9f38f0b6e5bd5725bc1c6eab1d8a78cc774656f6d8220db841b54d9aeb0af0602cc60429fb848dc2a8dbfe8037d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5c2a0c3060f60708c449fc93cd16d205

SHA1
bd34116704644ebde07f0c641cea05f6113e9866

SHA256
d2a95c3d1312896346932fb47b8bc50a72c65a6049d5740fac872d348ce58fe4

SHA512
7e141cee77f69bec12c1b9ab9538856e5e2669835c942931041ac81ea723781369d87d55abc197da44faa505198e0b954f8eab11bc7e6a7d4e753f552c98c76b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b607e58feab19beeda7d038106074d7b

SHA1
284190f2da288d56544b579a21ee71095f322ee8

SHA256
dfe7f0fd347d9534612baa5bf9b8b69e38733f409912c9966a68fc851bc50e77

SHA512
3e5b43857017f4621b064456eb8195d0ecf2a7ca3475cf8bbe0e4836cb8562693b3a6f929744a0861aea8abac4ce8abcdd9191e9f739469302eebfb132476a92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0bba02c0b2fda11a4bf299991b34f5ad

SHA1
3882d164e65864a002fd3f22af4a1104eec85840

SHA256
5919c8146e85c898a8e43938c65497ea3ff546e39d8d00e81a68c65fc1fbb01f

SHA512
4564807711d15721efe3bc13b421153a8bb95ba6789a81941e98333693283379645182391332813fb04742c1fd7de5c282b96bc46fbcf8bd366ae7a8b9530e94

Download Submit
C:\Users\Admin\Downloads\2529602.ico

Filesize
212KB

MD5
63b1c215412103355abfcc378ba1ce3b

SHA1
097216e080c5eb4172f8e132cbd3f431452586e0

SHA256
edf307f74bfd24cc954b8d9a07fa7a1692dcebabe57bf44025ee802578d47eeb

SHA512
dedb06e6c2da376f6616e28136d8a1f5e230543e842e2b7fd84daef664f717d0085ee10e0c3a31604c3619758e8c2008aa23a6843eff2bafbf59fcc68ab72edf

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 462124.crdownload

Filesize
2.5MB

MD5
bb983aac149a7dba632b23f8fc0792d1

SHA1
7c603119d33ac9741655f4553e85e38de70ceb00

SHA256
59acf9e3b9d5e419da62702a096218fee803e554d7c93972bb4ce91a5faa6ae5

SHA512
1875b7352879e3e6e3afcb617fd7620e29a916900e0b7437c4a00902eb9fe7a5913a1e52d52533fb35592189fabc475f02db8937eabfdc7d988ecea72d445082

Download Submit
C:\Windows\TEMP\cypsdrrlsskw.sys

Filesize
14KB

MD5
0c0195c48b6b8582fa6f6373032118da

SHA1
d25340ae8e92a6d29f599fef426a2bc1b5217299

SHA256
11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5

SHA512
ab28e99659f219fec553155a0810de90f0c5b07dc9b66bda86d7686499fb0ec5fddeb7cd7a3c5b77dccb5e865f2715c2d81f4d40df4431c92ac7860c7e01720d

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\3bwypoxq.0.cs

Filesize
1KB

MD5
ad63dc4e291e703a9e4c22650565dd50

SHA1
0cc880b5cba24fac8a9a9f7cf86776b3e89b4a7c

SHA256
738695d3ccd61b2cb2fb5a6ae56908d963bfc61f40265422ce1a4afac492da7d

SHA512
7fb159499d0dff0248249fc466c0df2c6a9e3b2c70eb37271af3f31288d41cdeaa9a7de9292a4af59c846e138163b9ed13c4792b8ea68408a2d5afb5b0658e41

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\3bwypoxq.cmdline

Filesize
324B

MD5
701c5c0d87eb8415d4f71d823736259a

SHA1
44b117f203e9bbefa3b82b7bc35ce8e4be87b3dd

SHA256
1b09d9a7b64eab2a2935c1ad8ebf6040edac5038a1f2c8399d6f29a84d7a3bfe

SHA512
58eac6a815333e25cd9639dccf4803c160c25f5f37e1944e5dcd7f2aa2e34524d42f7c8f64ac5ed86884c3fefe167e6c05fb5e39ba80c122431d38bed8876c8e

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ugtnx1vw.0.cs

Filesize
1KB

MD5
af69f55d11190417675aef2e4549ebfd

SHA1
9fc121c09835c3faa28b1737c9eb5d46928e1315

SHA256
8a0bb9894eb82c8aaf99da0ae66c7c4677f651f89c2cdb7f58a8f816c6c1eb96

SHA512
964abf0e51f4e2f7f750217618306878762c675f4499269bf2ac9b10e4acb0f28177e56ed3eed2b12b78300346d433f4cfca598b29200585bdf7dc29b990489c

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ugtnx1vw.cmdline

Filesize
334B

MD5
0b926a28066990d68e12a9ae7dbaf4b2

SHA1
59b4816cc697e7eb4f1290569296ba6e47884b06

SHA256
53fb08fdd8ba1fd11799298e0732a13b5799d33681f1194c53fb108c95eea52c

SHA512
9baf809c6030888f25a022803d96730f83374fedad7964e19f7a5992ba418128c1505ff2c27c331a2e0314e0ab82dba2fbb3b8070de953072adce7e33ec02641

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\wud40agm.0.cs

Filesize
1KB

MD5
b7644b9fed07d1a5aa5f6a9cdfadfb51

SHA1
299affd04e11b18b913943f1acb0eeb9dfe09380

SHA256
7b302f4b91fa5935999ed1bc9dea943554b5aade24c6d89659b2ea3d0dfd30a9

SHA512
73135bf1a124d5c35dc8ab4c50fb4c497127824d0d3abeb59c086fe1e0704febdaca7f1e23448b4c7ba66565d301cc31810d6cc67f1a734ff6e329133225d3c0

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\wud40agm.cmdline

Filesize
325B

MD5
59bb8850bd95825f99758bf35930dc1a

SHA1
7fc14794a1235cc9c1a884ba5857c082ef5271f5

SHA256
92817dbcda6139eef63d7e911a81213fbd35958a4dcc5e16ce98a0a591c87ebc

SHA512
96650004ded9bd087b800e4a3ebac256890d6ecd57af35979c880ebc6817c170e94e2be4cf7edba7a18ca58b8f53709c825a064119f5a5cc7e58fcf51c3899de

Download Submit
\??\c:\Users\Admin\Downloads\njCrypter\3NHCU3A1

Filesize
2.5MB

MD5
272585cd2d9627b71118ec161b167057

SHA1
faec9e544f35c2c38e733453135369353f29eb1f

SHA256
172db271eb5b6848b78fadddc5f65cad52a175cadb41afe9aa1d3e6e54bc5850

SHA512
197150b6fbfa0b5da1849da61352efa1046add45c291ddf7be37896d9901040fd760945f3861a5b1d7982273a4d536461c5ab1278602af430926ff1ca5a61af7

Download Submit
\??\c:\Users\Admin\Downloads\njCrypter\864ZLSLU

Filesize
2.5MB

MD5
c3db3fc7eb0b32247c77b98387d4aaf0

SHA1
4ac86bae8cf2095275f596a45ee0b31cbfe9e112

SHA256
6702291d328264a17bb149e084e3fa9294ddc0c34d50ddb6ac5b405f3b31c476

SHA512
3a023fc2b7269e2b44da3bc623af3e844ee1c0fa8300424014c6fe556d24d8776d7bc7c717bd89a4db1dfe1040834c10595c35cd8b22748f6570faaa8cc67cee

Download Submit
\??\c:\Windows\System32\ET68GOXG

Filesize
2.5MB

MD5
95ad359f15c6067e7359fd1aa9496cad

SHA1
9b505ebf85ccd8faff9ba551027d470638ef9af9

SHA256
04eaa08ac46903ae20866ba393fd43a53938476df6e1e6031c3a9bd297557d7d

SHA512
1ee2fe22d2cb5e5dbc22b6b7c577fef17517a74371626bc53906b321bff645b4aea1ad164c89cb1adf6bc58d3101381ebcbc75a533c8426fdbb532c7df13f82d

Download Submit
memory/4376-258-0x0000000140000000-0x000000014000D000-memory.dmp

Filesize
52KB

Download
memory/4376-256-0x0000000140000000-0x000000014000D000-memory.dmp

Filesize
52KB

Download
memory/4376-254-0x0000000140000000-0x000000014000D000-memory.dmp

Filesize
52KB

Download
memory/4376-255-0x0000000140000000-0x000000014000D000-memory.dmp

Filesize
52KB

Download
memory/4376-257-0x0000000140000000-0x000000014000D000-memory.dmp

Filesize
52KB

Download
memory/4376-268-0x0000000140000000-0x000000014000D000-memory.dmp

Filesize
52KB

Download
memory/4828-271-0x0000000140000000-0x0000000140835000-memory.dmp

Filesize
8.2MB

Download
memory/4828-272-0x0000000140000000-0x0000000140835000-memory.dmp

Filesize
8.2MB

Download
memory/4828-274-0x0000000140000000-0x0000000140835000-memory.dmp

Filesize
8.2MB

Download
memory/4828-265-0x0000000140000000-0x0000000140835000-memory.dmp

Filesize
8.2MB

Download
memory/4828-264-0x0000000140000000-0x0000000140835000-memory.dmp

Filesize
8.2MB

Download
memory/4828-273-0x0000000140000000-0x0000000140835000-memory.dmp

Filesize
8.2MB

Download
memory/4828-262-0x0000000140000000-0x0000000140835000-memory.dmp

Filesize
8.2MB

Download
memory/4828-263-0x0000000140000000-0x0000000140835000-memory.dmp

Filesize
8.2MB

Download
memory/4828-270-0x0000000140000000-0x0000000140835000-memory.dmp

Filesize
8.2MB

Download
memory/4828-267-0x0000000140000000-0x0000000140835000-memory.dmp

Filesize
8.2MB

Download
memory/4828-266-0x0000000140000000-0x0000000140835000-memory.dmp

Filesize
8.2MB

Download
memory/4828-269-0x0000000001340000-0x0000000001360000-memory.dmp

Filesize
128KB

Download
memory/4828-261-0x0000000140000000-0x0000000140835000-memory.dmp

Filesize
8.2MB

Download
memory/5240-134-0x0000000001020000-0x0000000001028000-memory.dmp

Filesize
32KB

Download
memory/5240-133-0x000000001BF60000-0x000000001BFFC000-memory.dmp

Filesize
624KB

Download
memory/5240-132-0x000000001B9F0000-0x000000001BEBE000-memory.dmp

Filesize
4.8MB

Download