cryptbot | 83b3a04479c4310f0ac695041b3c1d60c144be650d4b8838a395ca5a46e722e2

Analysis

max time kernel
151s
max time network
152s
platform
windows10_x64
resource
win10v20210410
submitted
03-07-2021 08:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AD31B1AE880CACF5792155C485A35C84.exe
Size

3.2MB
MD5

ad31b1ae880cacf5792155c485a35c84
SHA1

5ae4d24619ae3ca6948c54df5966cfc551ea1b4a
SHA256

83b3a04479c4310f0ac695041b3c1d60c144be650d4b8838a395ca5a46e722e2
SHA512

ef12ff412f0f79406989aaa80a9631ad40458e359c188a27a6c649a967060fa164caf8541eb551c3a7dd3b459a68f384bc14e292b0211b488e850ea9a71b1cd5

Score

10^/10

cryptbot elysiumstealer raccoon redline smokeloader vidar 890 931 backdoor discovery evasion infostealer persistence spyware stealer trojan upx vmprotect

Malware Config

Extracted

Family

vidar

Version

39.4

Botnet

890

https://sergeevih43.tumblr.com

Attributes

profile_id
890

Extracted

Family

smokeloader

Version

2020

http://ppcspb.com/upload/

http://mebbing.com/upload/

http://twcamel.com/upload/

http://howdycash.com/upload/

http://lahuertasonora.com/upload/

http://kpotiques.com/upload/

rc4.i32

Extracted

Family

vidar

Version

39.4

Botnet

931

https://sergeevih43.tumblr.com

Attributes

profile_id
931

Extracted

Family

cryptbot

xeidor62.top

morksu06.top

Attributes

payload_url
http://lopywn08.top/download.php?file=lv.exe

Signatures

CryptBot
A C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot

CryptBot Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/5996-326-0x0000000000C00000-0x0000000000CE1000-memory.dmp	family_cryptbot
behavioral2/memory/5996-327-0x0000000000400000-0x000000000064B000-memory.dmp	family_cryptbot

ElysiumStealer
ElysiumStealer (previously known as ZeromaxStealer) is an info stealer that can steal login credentials for various accounts.
stealer elysiumstealer
Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3896-226-0x0000000003090000-0x00000000030D7000-memory.dmp	family_redline
behavioral2/memory/4536-275-0x0000000000417DEA-mapping.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Vidar Stealer 4 IoCs

stealer

Processes:

resource	yara_rule
behavioral2/memory/4308-211-0x0000000000B20000-0x0000000000BBD000-memory.dmp	family_vidar
behavioral2/memory/4308-227-0x0000000000400000-0x0000000000636000-memory.dmp	family_vidar
behavioral2/memory/5416-305-0x0000000000C00000-0x0000000000C9D000-memory.dmp	family_vidar
behavioral2/memory/5416-306-0x0000000000400000-0x0000000000633000-memory.dmp	family_vidar

Blocklisted process makes network request 3 IoCs

Processes:

rundll32.exeWScript.exe

flow pid process

171 5988 rundll32.exe
174 3888 WScript.exe
175 3888 WScript.exe
Downloads MZ/PE file

flow	pid	process
171	5988	rundll32.exe
174	3888	WScript.exe
175	3888	WScript.exe

Executes dropped EXE 32 IoCs

Processes:

Files.exeFile.exerun.exeKRSetp.exerun2.exejg3_3uag.exepzyh.exepub2.exeFolder.exeInstall.exejfiag3g_gg.exe5565832.exe6403253.exe2556239.exe6097905.exeWinHoster.exe6097905.exejfiag3g_gg.exe87180268513.exerun.exerun.exe02504765127.exe00378224556.exeGarbage Cleaner.exeedspolishpp.exeXelVTk.exe4.exevpn.exeSmartClock.exeDeclinante.exe.comDeclinante.exe.comkokjcnubfinq.exe

pid	process
1800	Files.exe
3516	File.exe
4276	run.exe
4268	KRSetp.exe
4308	run2.exe
4320	jg3_3uag.exe
4356	pzyh.exe
4424	pub2.exe
4480	Folder.exe
4516	Install.exe
4724	jfiag3g_gg.exe
4956	5565832.exe
5016	6403253.exe
3896	2556239.exe
4444	6097905.exe
5068	WinHoster.exe
4536	6097905.exe
5248	jfiag3g_gg.exe
5416	87180268513.exe
3172	run.exe
3440	run.exe
5996	02504765127.exe
6036	00378224556.exe
5440	Garbage Cleaner.exe
4344	edspolishpp.exe
5812	XelVTk.exe
4592	4.exe
4844	vpn.exe
5380	SmartClock.exe
5832	Declinante.exe.com
4104	Declinante.exe.com
5172	kokjcnubfinq.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe	upx
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe	upx
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe	upx
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe	upx

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\jg3_3uag.exe	vmprotect
behavioral2/memory/4320-143-0x0000000000400000-0x0000000000673000-memory.dmp	vmprotect
C:\Users\Admin\AppData\Local\Temp\jg3_3uag.exe	vmprotect

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

run.exeFolder.exeFiles.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation	run.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation	Folder.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation	Files.exe

Drops startup file 1 IoCs

Processes:

4.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SmartClock.lnk 4.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SmartClock.lnk	4.exe

Loads dropped DLL 14 IoCs

Processes:

pub2.exeMicrosoftEdgeCP.exerun2.exe87180268513.exerun.exeXelVTk.exerundll32.exe

pid	process
4424	pub2.exe
4800	MicrosoftEdgeCP.exe
4308	run2.exe
4308	run2.exe
5416	87180268513.exe
5416	87180268513.exe
3440	run.exe
3440	run.exe
3440	run.exe
3440	run.exe
3440	run.exe
5812	XelVTk.exe
5988	rundll32.exe
5988	rundll32.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

pzyh.exe6403253.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\haleng = "C:\\Users\\Admin\\AppData\\Local\\Temp\\haleng.e"	pzyh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe"	6403253.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

jg3_3uag.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA jg3_3uag.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

10 ip-api.com

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	jg3_3uag.exe

flow	ioc
10	ip-api.com

Drops file in System32 directory 3 IoCs

Processes:

svchost.exesvchost.exe

description	ioc	process
File opened for modification	C:\Windows\System32\Tasks\Firefox Default Browser Agent 38B32F1287323B0C	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Smart Clock	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	svchost.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

svchost.exe6097905.exerun.exe

description	pid	process	target process
PID 3884 set thread context of 4916	3884	svchost.exe	svchost.exe
PID 4444 set thread context of 4536	4444	6097905.exe	6097905.exe
PID 4276 set thread context of 3440	4276	run.exe	run.exe

autoit_exe 2 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\RarSFX0\File.exe	autoit_exe
C:\Users\Admin\AppData\Local\Temp\RarSFX0\File.exe	autoit_exe

Drops file in Program Files directory 4 IoCs

Processes:

XelVTk.exerundll32.exe

description	ioc	process
File created	C:\Program Files (x86)\foler\olader\acledit.dll	XelVTk.exe
File created	C:\PROGRA~3\Bklngfpngf\kgjocbpkfku.tmp	rundll32.exe
File created	C:\Program Files (x86)\foler\olader\acppage.dll	XelVTk.exe
File created	C:\Program Files (x86)\foler\olader\adprovider.dll	XelVTk.exe

Drops file in Windows directory 1 IoCs

Processes:

MicrosoftEdge.exe

description ioc process

File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

pub2.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	pub2.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	pub2.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	pub2.exe

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

run2.exe02504765127.exeDeclinante.exe.comsvchost.exe87180268513.exe00378224556.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	run2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	02504765127.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Declinante.exe.com
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	run2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	87180268513.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	87180268513.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	02504765127.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	00378224556.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	00378224556.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Declinante.exe.com
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Delays execution with timeout.exe 4 IoCs
evasion

Processes:

timeout.exetimeout.exetimeout.exetimeout.exe

pid process

2288 timeout.exe
2528 timeout.exe
2852 timeout.exe
6028 timeout.exe
Kills process with taskkill 3 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exe

pid process

5796 taskkill.exe
4292 taskkill.exe
4764 taskkill.exe

pid	process
2288	timeout.exe
2528	timeout.exe
2852	timeout.exe
6028	timeout.exe

pid	process
5796	taskkill.exe
4292	taskkill.exe
4764	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

Processes:

MicrosoftEdge.exebrowser_broker.exeMicrosoftEdgeCP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies data under HKEY_USERS 13 IoCs

Processes:

svchost.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\Version = "7"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	svchost.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeDeclinante.exe.comMicrosoftEdgeCP.exeMicrosoftEdgeCP.exesvchost.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = aac42b00e56fd701	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 62c43114e56fd701	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$MediaWiki	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\FileNames\en-US = "en-US.1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings	Declinante.exe.com
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\FileNames\	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\Certificates\83DA05A9886F7658BE	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url2 = "https://login.aliexpress.com/"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 325e8600e56fd701	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	MicrosoftEdgeCP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$http://www.typepad.com/	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\NextUpdateDate = "332132636"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url3 = "https://signin.ebay.com/ws/ebayisapi.dll"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\DetectPhoneNumberCompletedV = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 801594fee46fd701	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\Rating Prompt Shown = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\NextPromptBuild = "15063"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\TypedUrlsComplete = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\Certificates\83DA05A9886F7658BE = 03000000010000001400000083da05a9886f7658be73acf0a4930c0f99b92f011400000001000000140000003656896549cb5b9b2f3cac4216504d91b933d79104000000010000001000000062455357dd57cb80c32ab295743cccc00f00000001000000200000006811c6215f18c75fdbe32cf56bd66248562a7fa3ba459cfee338745061e583941900000001000000100000002d581a49c8eb5b3b3c6ef9bb65314d705c000000010000000400000000100000180000000100000010000000bb048f1838395f6fc3a1f3d2b7e976542000000001000000dc060000308206d8308204c0a003020102020a613fb718000000000004300d06092a864886f70d01010b0500308188310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e31323030060355040313294d6963726f736f667420526f6f7420436572746966696361746520417574686f726974792032303131301e170d3131313031383232353531395a170d3236313031383233303531395a307e310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312830260603550403131f4d6963726f736f66742053656375726520536572766572204341203230313130820222300d06092a864886f70d01010105000382020f003082020a0282020100d00bc0a4a81981e236e5e2aae5f3b2155875beb4e549f1e084f9bb0d64ef85c18155b8f3e7f16d40553dce8b6ad18493f5757c5ba4d47410ca32f323d3aeeecf9e0458c2d947cbd17c004148711b01671718afc6fe73037ee4ef439cef01712a1f81264377985457739d552bf09e8e7d060eac1b54f326f7f82308228b9e061d3738fd72d2cae563c19a5a7db26db352a96ee9aeb5fc8b36f99efaf61c581b9756a511e5b752dbbbe9f054bfb4ff2c6cb85d26cea00ad7df93ed7fddacf12c731ad9193755badd22788ea1d49b09f807223171b094aee0b0e726445790819715ce61ec65e24bf185521632f8b578aa7ecd4dec8321a4a89bbe9a6a04e0a31ccd56186cfd6b2f423ee237f272abd07873727bdeec0058e52130a3083a99ef9fc3f77a169665b5c381aff4397049aff6a9f66a0038f9b40819e01a35a55676225f6af269ae3ead58464db854f68941441e72b1bc122753d2c1ffb2cd50981eb5f4bbb6c28239d9ac1bf23b27846ab0c6260bd73a10e7b3db7cd356ac534c0bfa3b313774d8592bf9007919067bfd1c1d42d4410d2f050ed56b4923ffcfcdf87a82cfda3c2ddfe8d8120418ba1e8877b8981f1007bbc8057e0b09bf6bdde34e5bb0f9c784a63bca4c9f5b6229f7c7a2a89588702ce5c13f3c52234f409ac33185832fbf29f11d508f219607ceeff280c2447d9b62ef2fc37789ab454d533e0279d30203010001a382014b30820147301006092b06010401823715010403020100301d0603551d0e041604143656896549cb5b9b2f3cac4216504d91b933d791301906092b0601040182371402040c1e0a00530075006200430041300b0603551d0f040403020186300f0603551d130101ff040530030101ff301f0603551d23041830168014722d3a02319043b914054ee1eaa7c731d1238934305a0603551d1f04533051304fa04da04b8649687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963526f6f436572417574323031315f323031315f30335f32322e63726c305e06082b0601050507010104523050304e06082b060105050730028642687474703a2f2f7777772e6d6963726f736f66742e636f6d2f706b692f63657274732f4d6963526f6f436572417574323031315f323031315f30335f32322e637274300d06092a864886f70d01010b0500038202010041c861c1f55b9e3e9131f1b0c6bf0901b49db69074d709dba62e0d9fc8e7763446af0760894c81b33cd5f4123575c273a5f54d848ccba45dafbf92f617085742957265057679adeed1bab82e54a35107ac68eb210ce32581c2cd2af2c3ffcfc2bd49189ac7f084c5f914bc6b95e596efb342d253d54aa012c4ae12765309560e9df7d3a6498850f28a2c9720a2be4e78ef0565b74ba11688de31c70842247ca47b9e9dbc60005e6297e393fca7fe5b7b25dfe4537f4bbee63ef0db0179421c6e856c7db64430fba5379293b2a5ee20ad3f53d5c9f4286b57c1f81d6ab7562ab627811ca62d9fe7f4d0318397a82ab6acbe1b41f5e4895f56fbda5ad35e7d5594107e5357f44a3d402ac8bd679f84e110eefdda6b158249fc461dff4506749c4214edc539d3b3cd0b832790435192f24482ae6e9a1517b219fac7456c98017bbf37a9b088a492bc3838e01de47c97981a2e5fef3865b7352fbd7f4f21fac48cd26f06f94935eadf200f25aaea60ab2c1f4b89fcb7fa5c54904b3ea2284f6ce45265c1fd901c8582886ee9a655dd21287945b014e50acce65fc4bbdb6134699fac2638f7c1294108152e4ca0f7f90c3ede5fab08092d83acac348362f4c949428925b56eb247c5b339a0b1201b2cb18e046fa530491cd046e9405bf4ad6ebadb824a87124a80094ddbdf76b9055b1be0bb20705f0025c7d30efa16ad7b229e7108	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\ExtensionIn = "5"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. = 010000002c6f4bfd3e01505f3e574826b1317dc9b40df579b235fad2ab89949ec129f8357575a5c6650ec5ff96cfdf8378e83056178a6abb2fdfcdcec12cd008cc605d08c8704d9f8d3c640618e5bc42b48b3f6d78e4f0496c90d0028918	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Zoom	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdge.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

4352 PING.EXE
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

SmartClock.exe

pid process

5380 SmartClock.exe

pid	process
4352	PING.EXE

pid	process
5380	SmartClock.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

pub2.exeMicrosoftEdgeCP.exesvchost.exejfiag3g_gg.exe

pid	process
4424	pub2.exe
4424	pub2.exe
4800	MicrosoftEdgeCP.exe
4800	MicrosoftEdgeCP.exe
3884	svchost.exe
3884	svchost.exe
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
5248	jfiag3g_gg.exe
5248	jfiag3g_gg.exe

Suspicious behavior: MapViewOfSection 3 IoCs

Processes:

pub2.exeMicrosoftEdgeCP.exe

pid process

4424 pub2.exe
4996 MicrosoftEdgeCP.exe
4996 MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

MicrosoftEdge.exeKRSetp.exeMicrosoftEdgeCP.exesvchost.exe6097905.exe5565832.exesvchost.exe

description	pid	process
Token: SeDebugPrivilege	352	MicrosoftEdge.exe
Token: SeDebugPrivilege	352	MicrosoftEdge.exe
Token: SeDebugPrivilege	352	MicrosoftEdge.exe
Token: SeDebugPrivilege	352	MicrosoftEdge.exe
Token: SeDebugPrivilege	4268	KRSetp.exe
Token: SeDebugPrivilege	4800	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4800	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3884	svchost.exe
Token: SeDebugPrivilege	4800	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4800	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4800	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4800	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4800	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4444	6097905.exe
Token: SeDebugPrivilege	4956	5565832.exe
Token: SeDebugPrivilege	4800	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4800	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4800	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4800	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4800	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4800	MicrosoftEdgeCP.exe
Token: SeShutdownPrivilege	2716
Token: SeCreatePagefilePrivilege	2716
Token: SeAssignPrimaryTokenPrivilege	2796	svchost.exe
Token: SeIncreaseQuotaPrivilege	2796	svchost.exe
Token: SeSecurityPrivilege	2796	svchost.exe
Token: SeTakeOwnershipPrivilege	2796	svchost.exe
Token: SeLoadDriverPrivilege	2796	svchost.exe
Token: SeSystemtimePrivilege	2796	svchost.exe
Token: SeBackupPrivilege	2796	svchost.exe
Token: SeRestorePrivilege	2796	svchost.exe
Token: SeShutdownPrivilege	2796	svchost.exe
Token: SeSystemEnvironmentPrivilege	2796	svchost.exe
Token: SeUndockPrivilege	2796	svchost.exe
Token: SeManageVolumePrivilege	2796	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2796	svchost.exe
Token: SeIncreaseQuotaPrivilege	2796	svchost.exe
Token: SeSecurityPrivilege	2796	svchost.exe
Token: SeTakeOwnershipPrivilege	2796	svchost.exe
Token: SeLoadDriverPrivilege	2796	svchost.exe
Token: SeSystemtimePrivilege	2796	svchost.exe
Token: SeBackupPrivilege	2796	svchost.exe
Token: SeRestorePrivilege	2796	svchost.exe
Token: SeShutdownPrivilege	2796	svchost.exe
Token: SeSystemEnvironmentPrivilege	2796	svchost.exe
Token: SeUndockPrivilege	2796	svchost.exe
Token: SeManageVolumePrivilege	2796	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2796	svchost.exe
Token: SeIncreaseQuotaPrivilege	2796	svchost.exe
Token: SeSecurityPrivilege	2796	svchost.exe
Token: SeTakeOwnershipPrivilege	2796	svchost.exe
Token: SeLoadDriverPrivilege	2796	svchost.exe
Token: SeSystemtimePrivilege	2796	svchost.exe
Token: SeBackupPrivilege	2796	svchost.exe
Token: SeRestorePrivilege	2796	svchost.exe
Token: SeShutdownPrivilege	2796	svchost.exe
Token: SeSystemEnvironmentPrivilege	2796	svchost.exe
Token: SeUndockPrivilege	2796	svchost.exe
Token: SeManageVolumePrivilege	2796	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2796	svchost.exe
Token: SeIncreaseQuotaPrivilege	2796	svchost.exe
Token: SeSecurityPrivilege	2796	svchost.exe
Token: SeTakeOwnershipPrivilege	2796	svchost.exe
Token: SeLoadDriverPrivilege	2796	svchost.exe

Suspicious use of FindShellTrayWindow 8 IoCs

Processes:

File.exe02504765127.exe

pid process

3516 File.exe
3516 File.exe
3516 File.exe
3516 File.exe
3516 File.exe
3516 File.exe
5996 02504765127.exe
5996 02504765127.exe
Suspicious use of SendNotifyMessage 5 IoCs

Processes:

File.exe

pid process

3516 File.exe
3516 File.exe
3516 File.exe
3516 File.exe
3516 File.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exe

pid process

352 MicrosoftEdge.exe
4996 MicrosoftEdgeCP.exe
4996 MicrosoftEdgeCP.exe

pid	process
3516	File.exe
3516	File.exe
3516	File.exe
3516	File.exe
3516	File.exe
3516	File.exe
5996	02504765127.exe
5996	02504765127.exe

pid	process
3516	File.exe
3516	File.exe
3516	File.exe
3516	File.exe
3516	File.exe

pid	process
352	MicrosoftEdge.exe
4996	MicrosoftEdgeCP.exe
4996	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

AD31B1AE880CACF5792155C485A35C84.exeFiles.exerun.exeFile.exepzyh.exeFolder.exeMicrosoftEdgeCP.exesvchost.exeKRSetp.exe6097905.exe6403253.exe

description	pid	process	target process
PID 3172 wrote to memory of 1800	3172	AD31B1AE880CACF5792155C485A35C84.exe	Files.exe
PID 3172 wrote to memory of 1800	3172	AD31B1AE880CACF5792155C485A35C84.exe	Files.exe
PID 3172 wrote to memory of 1800	3172	AD31B1AE880CACF5792155C485A35C84.exe	Files.exe
PID 1800 wrote to memory of 3516	1800	Files.exe	File.exe
PID 1800 wrote to memory of 3516	1800	Files.exe	File.exe
PID 1800 wrote to memory of 3516	1800	Files.exe	File.exe
PID 3172 wrote to memory of 4268	3172	run.exe	KRSetp.exe
PID 3172 wrote to memory of 4268	3172	run.exe	KRSetp.exe
PID 3516 wrote to memory of 4276	3516	File.exe	run.exe
PID 3516 wrote to memory of 4276	3516	File.exe	run.exe
PID 3516 wrote to memory of 4276	3516	File.exe	run.exe
PID 3516 wrote to memory of 4308	3516	File.exe	run2.exe
PID 3516 wrote to memory of 4308	3516	File.exe	run2.exe
PID 3516 wrote to memory of 4308	3516	File.exe	run2.exe
PID 3172 wrote to memory of 4320	3172	run.exe	jg3_3uag.exe
PID 3172 wrote to memory of 4320	3172	run.exe	jg3_3uag.exe
PID 3172 wrote to memory of 4320	3172	run.exe	jg3_3uag.exe
PID 3172 wrote to memory of 4356	3172	run.exe	pzyh.exe
PID 3172 wrote to memory of 4356	3172	run.exe	pzyh.exe
PID 3172 wrote to memory of 4356	3172	run.exe	pzyh.exe
PID 3172 wrote to memory of 4424	3172	run.exe	pub2.exe
PID 3172 wrote to memory of 4424	3172	run.exe	pub2.exe
PID 3172 wrote to memory of 4424	3172	run.exe	pub2.exe
PID 3172 wrote to memory of 4480	3172	run.exe	Folder.exe
PID 3172 wrote to memory of 4480	3172	run.exe	Folder.exe
PID 3172 wrote to memory of 4480	3172	run.exe	Folder.exe
PID 3172 wrote to memory of 4516	3172	run.exe	Install.exe
PID 3172 wrote to memory of 4516	3172	run.exe	Install.exe
PID 3172 wrote to memory of 4516	3172	run.exe	Install.exe
PID 4356 wrote to memory of 4724	4356	pzyh.exe	jfiag3g_gg.exe
PID 4356 wrote to memory of 4724	4356	pzyh.exe	jfiag3g_gg.exe
PID 4356 wrote to memory of 4724	4356	pzyh.exe	jfiag3g_gg.exe
PID 4480 wrote to memory of 4800	4480	Folder.exe	MicrosoftEdgeCP.exe
PID 4480 wrote to memory of 4800	4480	Folder.exe	MicrosoftEdgeCP.exe
PID 4480 wrote to memory of 4800	4480	Folder.exe	MicrosoftEdgeCP.exe
PID 4800 wrote to memory of 3884	4800	MicrosoftEdgeCP.exe	svchost.exe
PID 4800 wrote to memory of 2856	4800	MicrosoftEdgeCP.exe	svchost.exe
PID 3884 wrote to memory of 4916	3884	svchost.exe	svchost.exe
PID 3884 wrote to memory of 4916	3884	svchost.exe	svchost.exe
PID 3884 wrote to memory of 4916	3884	svchost.exe	svchost.exe
PID 4268 wrote to memory of 4956	4268	KRSetp.exe	5565832.exe
PID 4268 wrote to memory of 4956	4268	KRSetp.exe	5565832.exe
PID 4268 wrote to memory of 4956	4268	KRSetp.exe	5565832.exe
PID 4800 wrote to memory of 996	4800	MicrosoftEdgeCP.exe	svchost.exe
PID 4268 wrote to memory of 5016	4268	KRSetp.exe	6403253.exe
PID 4268 wrote to memory of 5016	4268	KRSetp.exe	6403253.exe
PID 4268 wrote to memory of 5016	4268	KRSetp.exe	6403253.exe
PID 4268 wrote to memory of 3896	4268	KRSetp.exe	2556239.exe
PID 4268 wrote to memory of 3896	4268	KRSetp.exe	2556239.exe
PID 4268 wrote to memory of 3896	4268	KRSetp.exe	2556239.exe
PID 4268 wrote to memory of 4444	4268	KRSetp.exe	6097905.exe
PID 4268 wrote to memory of 4444	4268	KRSetp.exe	6097905.exe
PID 4268 wrote to memory of 4444	4268	KRSetp.exe	6097905.exe
PID 4800 wrote to memory of 2504	4800	MicrosoftEdgeCP.exe	svchost.exe
PID 4800 wrote to memory of 2540	4800	MicrosoftEdgeCP.exe	svchost.exe
PID 4800 wrote to memory of 1172	4800	MicrosoftEdgeCP.exe	svchost.exe
PID 4800 wrote to memory of 344	4800	MicrosoftEdgeCP.exe	svchost.exe
PID 4444 wrote to memory of 4536	4444	6097905.exe	6097905.exe
PID 4444 wrote to memory of 4536	4444	6097905.exe	6097905.exe
PID 4444 wrote to memory of 4536	4444	6097905.exe	6097905.exe
PID 4800 wrote to memory of 1352	4800	MicrosoftEdgeCP.exe	svchost.exe
PID 4800 wrote to memory of 1964	4800	MicrosoftEdgeCP.exe	svchost.exe
PID 5016 wrote to memory of 5068	5016	6403253.exe	WinHoster.exe
PID 5016 wrote to memory of 5068	5016	6403253.exe	WinHoster.exe

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
1⤵
PID:996

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s UserManager
1⤵
PID:1376

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s SENS
1⤵
PID:1352

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
1⤵
PID:1964

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
1⤵
PID:2540

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2796

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s WpnService
1⤵
PID:2804

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Browser
1⤵
PID:2856

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
1⤵
PID:2504

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Themes
1⤵
PID:1180

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
1⤵
PID:1172

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Schedule
1⤵
- Drops file in System32 directory
PID:344

C:\Users\Admin\AppData\Local\Temp\AD31B1AE880CACF5792155C485A35C84.exe
"C:\Users\Admin\AppData\Local\Temp\AD31B1AE880CACF5792155C485A35C84.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3172

C:\Users\Admin\AppData\Local\Temp\Files.exe
"C:\Users\Admin\AppData\Local\Temp\Files.exe"
2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1800

C:\Users\Admin\AppData\Local\Temp\RarSFX0\File.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\File.exe"
3⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3516

C:\Users\Public\run.exe
C:\Users\Public\run.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4276

C:\Users\Public\run.exe
C:\Users\Public\run.exe
5⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3172

C:\Users\Public\run.exe
C:\Users\Public\run.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3440

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Public\run.exe"
6⤵
PID:4572

C:\Windows\SysWOW64\timeout.exe
timeout /T 10 /NOBREAK
7⤵
- Delays execution with timeout.exe
PID:2288

C:\Users\Public\run2.exe
C:\Users\Public\run2.exe
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:4308

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im run2.exe /f & timeout /t 6 & del /f /q "C:\Users\Public\run2.exe" & del C:\ProgramData\*.dll & exit
5⤵
PID:5584

C:\Windows\SysWOW64\taskkill.exe
taskkill /im run2.exe /f
6⤵
- Kills process with taskkill
PID:5796

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
6⤵
- Delays execution with timeout.exe
PID:2852

C:\Users\Admin\AppData\Local\Temp\KRSetp.exe
"C:\Users\Admin\AppData\Local\Temp\KRSetp.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4268

C:\Users\Admin\AppData\Roaming\6403253.exe
"C:\Users\Admin\AppData\Roaming\6403253.exe"
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5016

C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
4⤵
- Executes dropped EXE
PID:5068

C:\Users\Admin\AppData\Roaming\5565832.exe
"C:\Users\Admin\AppData\Roaming\5565832.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4956

C:\Users\Admin\AppData\Roaming\2556239.exe
"C:\Users\Admin\AppData\Roaming\2556239.exe"
3⤵
- Executes dropped EXE
PID:3896

C:\Users\Admin\AppData\Roaming\6097905.exe
"C:\Users\Admin\AppData\Roaming\6097905.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4444

C:\Users\Admin\AppData\Roaming\6097905.exe
C:\Users\Admin\AppData\Roaming\6097905.exe
4⤵
- Executes dropped EXE
PID:4536

C:\Users\Admin\AppData\Local\Temp\jg3_3uag.exe
"C:\Users\Admin\AppData\Local\Temp\jg3_3uag.exe"
2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
PID:4320

C:\Users\Admin\AppData\Local\Temp\pzyh.exe
"C:\Users\Admin\AppData\Local\Temp\pzyh.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4356

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
3⤵
- Executes dropped EXE
PID:4724

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5248

C:\Users\Admin\AppData\Local\Temp\pub2.exe
"C:\Users\Admin\AppData\Local\Temp\pub2.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4424

C:\Users\Admin\AppData\Local\Temp\Install.exe
"C:\Users\Admin\AppData\Local\Temp\Install.exe"
2⤵
- Executes dropped EXE
PID:4516

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{jhkI-ciNI9-0EP8-iRNMX}\87180268513.exe"
3⤵
PID:5128

C:\Users\Admin\AppData\Local\Temp\{jhkI-ciNI9-0EP8-iRNMX}\87180268513.exe
"C:\Users\Admin\AppData\Local\Temp\{jhkI-ciNI9-0EP8-iRNMX}\87180268513.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:5416

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im 87180268513.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\{jhkI-ciNI9-0EP8-iRNMX}\87180268513.exe" & del C:\ProgramData\*.dll & exit
5⤵
PID:5796

C:\Windows\SysWOW64\taskkill.exe
taskkill /im 87180268513.exe /f
6⤵
- Kills process with taskkill
PID:4292

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
6⤵
- Delays execution with timeout.exe
PID:6028

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{jhkI-ciNI9-0EP8-iRNMX}\02504765127.exe" /mix
3⤵
PID:5676

C:\Users\Admin\AppData\Local\Temp\{jhkI-ciNI9-0EP8-iRNMX}\02504765127.exe
"C:\Users\Admin\AppData\Local\Temp\{jhkI-ciNI9-0EP8-iRNMX}\02504765127.exe" /mix
4⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
PID:5996

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\XelVTk.exe"
5⤵
PID:4700

C:\Users\Admin\AppData\Local\Temp\XelVTk.exe
"C:\Users\Admin\AppData\Local\Temp\XelVTk.exe"
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
PID:5812

C:\Users\Admin\AppData\Local\Temp\New Feature\4.exe
"C:\Users\Admin\AppData\Local\Temp\New Feature\4.exe"
7⤵
- Executes dropped EXE
- Drops startup file
PID:4592

C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe
"C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"
8⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
PID:5380

C:\Users\Admin\AppData\Local\Temp\New Feature\vpn.exe
"C:\Users\Admin\AppData\Local\Temp\New Feature\vpn.exe"
7⤵
- Executes dropped EXE
PID:4844

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c cmd < Vidi.mp4
8⤵
PID:6024

C:\Windows\SysWOW64\cmd.exe
cmd
9⤵
PID:5104

C:\Windows\SysWOW64\findstr.exe
findstr /V /R "^eYkYENAYpDGwecihpHApqCeYxzwbxntfNWYadMzzGejaCvnKzKWyTVNAWhElMrELndhuvOXbhiCYdJcXVsrJCZvSonveopHCnAUjpahFNmRMaPpjRGfcqUpmUcXYaUgtAqAQP$" Rifletti.mp4
10⤵
PID:5320

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Declinante.exe.com
Declinante.exe.com A
10⤵
- Executes dropped EXE
PID:5832

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Declinante.exe.com
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Declinante.exe.com A
11⤵
- Executes dropped EXE
- Checks processor information in registry
- Modifies registry class
PID:4104

C:\Users\Admin\AppData\Local\Temp\kokjcnubfinq.exe
"C:\Users\Admin\AppData\Local\Temp\kokjcnubfinq.exe"
12⤵
- Executes dropped EXE
PID:5172

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\KOKJCN~1.TMP,S C:\Users\Admin\AppData\Local\Temp\KOKJCN~1.EXE
13⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Drops file in Program Files directory
PID:5988

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\mldtfaywy.vbs"
12⤵
PID:5164

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\spwxpff.vbs"
12⤵
- Blocklisted process makes network request
PID:3888

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 30
10⤵
- Runs ping.exe
PID:4352

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\TBKuVZNT & timeout 3 & del /f /q "C:\Users\Admin\AppData\Local\Temp\{jhkI-ciNI9-0EP8-iRNMX}\02504765127.exe"
5⤵
PID:4616

C:\Windows\SysWOW64\timeout.exe
timeout 3
6⤵
- Delays execution with timeout.exe
PID:2528

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{jhkI-ciNI9-0EP8-iRNMX}\00378224556.exe" /mix
3⤵
PID:5252

C:\Users\Admin\AppData\Local\Temp\{jhkI-ciNI9-0EP8-iRNMX}\00378224556.exe
"C:\Users\Admin\AppData\Local\Temp\{jhkI-ciNI9-0EP8-iRNMX}\00378224556.exe" /mix
4⤵
- Executes dropped EXE
- Checks processor information in registry
PID:6036

C:\Users\Admin\AppData\Roaming\nailedp\edspolishpp.exe
edspolishpp.exe
5⤵
- Executes dropped EXE
PID:4344

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /I "" "C:\ProgramData\Garbage Cleaner\Garbage Cleaner.exe"
3⤵
PID:5272

C:\ProgramData\Garbage Cleaner\Garbage Cleaner.exe
"C:\ProgramData\Garbage Cleaner\Garbage Cleaner.exe"
4⤵
- Executes dropped EXE
PID:5440

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "Install.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\Install.exe" & exit
3⤵
PID:5364

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "Install.exe" /f
4⤵
- Kills process with taskkill
PID:4764

C:\Users\Admin\AppData\Local\Temp\Folder.exe
"C:\Users\Admin\AppData\Local\Temp\Folder.exe"
2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4480

C:\Windows\SysWOW64\rUNdlL32.eXe
"C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\axhub.dll",axhub
3⤵
PID:4800

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s BITS
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3884

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
2⤵
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies registry class
PID:4916

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:352

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:2488

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:4996

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:4336

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4800

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:5480

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:5344

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:5728

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Remote System Discovery

T1018

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\freebl3.dll
MD5
ef2834ac4ee7d6724f255beaf527e635

SHA1
5be8c1e73a21b49f353c2ecfa4108e43a883cb7b

SHA256
a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba

SHA512
c6ea0e4347cbd7ef5e80ae8c0afdca20ea23ac2bdd963361dfaf562a9aed58dcbc43f89dd826692a064d76c3f4b3e92361af7b79a6d16a75d9951591ae3544d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
MD5
12723304ff64e511329733a90d2e7103

SHA1
80bf45be94d205c9ef1caa8bfa518535208fcfca

SHA256
52997056bdb065f2445007c21ce1f08c3974658f4e3a14058e26560d23117db0

SHA512
29f76617e858fd482c8d3ec9b87fc37e23f7a050138cb7e9cbb5e6756f9d0a60d35ef6d6dfbc9ce28474259741f545472166e9fb1bd938deffc0969951494422

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
MD5
e2f4a6c57e0145c7051dd32e5d4a12e8

SHA1
3122b2d1915ee4788517dc2f1a01419c1450ac51

SHA256
ba16fcab364303681ec46d72d270a3e219697b48d6ec8f207ed4550b9d01d17a

SHA512
75b795460e38f1893603aabdf6b75dc227457bb1dabf58c50094a97ea52b5207d5e387715d467f96e1747e5bf04d3a45829065fb12362f17a068a2b1addde124

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D60690F7FEA5B18B88CB0D0627369D90
MD5
0812045a660f4d0e3ceafa7909231bd4

SHA1
f8206e14d509839acd6c989e2cb3adca3134faf6

SHA256
e7bf117b279f0e0daf02fb4bf2e10e4a30a875bfbba98b288b41782daf7bd3e5

SHA512
66dd69d72b630c0bdc018a1bd866f5f767dd096122325e824c6011fc6592c6d6ce2b3bd9f7246805909f1bac9ede84df30a57e6f29f4949435b6fd4e02f8a46e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
MD5
62cfc83b35032ad95bb96459e745ef9e

SHA1
9cf351a9670776fd94d7c96e299e961265523e1c

SHA256
8980f8ef5d162898a169aa5e0ec33e2dd85aaae7a674390b97db19f4af0cf53c

SHA512
b1679eb0baa1279d9d5025d7b0f301a2d94789f4f249c5fed0ba42a284cb038964add63db4e08b3312c6ca7d8fc7e00c6d474e5f7750ffc33372dc47a4cb7f9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
MD5
02e648a279e56267219a2f1058c21ab6

SHA1
d1b3e4922ad6072ae6cf08bce02058264d72e28b

SHA256
261e4f5edcbd279ef8e1ae0813ba36f176e380f46b854a6f36a9b6948e7d3ca5

SHA512
e29ff3028a485faa19f3e996513ba58ab409c00a607bf2033046ce6a6b49fd61625eee079d64b1e251a2bc3f3a15980ae6b3b87431488713fb667e21904977bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D60690F7FEA5B18B88CB0D0627369D90
MD5
3828743a69b7f4831de6d7427cb03602

SHA1
f0a0174bc5b90a37cdb53f5d34fb123d92fec711

SHA256
468a6ea26421c405d9bce3fff24c7a461260e23d87584fd96fafe51e4feb540e

SHA512
0038cc814f1b21850141fac18f78335f331a389c954b25ea7b1dfc175f4972f76b85f9200dc5ab2ea0007350502ba5c5d3e7a80690fd1840fc2bb1d91351d3a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\6097905.exe.log
MD5
808e884c00533a9eb0e13e64960d9c3a

SHA1
279d05181fc6179a12df1a669ff5d8b64c1380ae

SHA256
2f6a0aab99b1c228a6642f44f8992646ce84c5a2b3b9941b6cf1f2badf67bdd6

SHA512
9489bdb2ffdfeef3c52edcfe9b34c6688eba53eb86075e0564df1cd474723c86b5b5aedc12df1ff5fc12cf97bd1e3cf9701ff61dc4ce90155d70e9ccfd0fc299

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OVHLE5P6\freebl3[1].dll
MD5
ef2834ac4ee7d6724f255beaf527e635

SHA1
5be8c1e73a21b49f353c2ecfa4108e43a883cb7b

SHA256
a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba

SHA512
c6ea0e4347cbd7ef5e80ae8c0afdca20ea23ac2bdd963361dfaf562a9aed58dcbc43f89dd826692a064d76c3f4b3e92361af7b79a6d16a75d9951591ae3544d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\U0EJMF7X\mozglue[1].dll
MD5
8f73c08a9660691143661bf7332c3c27

SHA1
37fa65dd737c50fda710fdbde89e51374d0c204a

SHA256
3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

SHA512
0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\1BHMXNXI.cookie
MD5
6feb22c515531f423f3f2367f1522355

SHA1
18640f9252f66e714f88630d94deb8c6dfa4c96c

SHA256
1a26788ddb6b315cc3c3a1e21af8716191eb967cb1a957e1ba29e3ae27263814

SHA512
8b2fae6ab24cc8c173381c810148fd664a2b04f524e40141008d871f797d3f2a7138a2fd394b7cce172e6d221d605cde86a89dead17bb1fa8e54569528aead07

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\LTIXQSSU.cookie
MD5
0f0d318368701a32d14323ae3a31ea77

SHA1
f94d890472e65eabc579468260c31e34604885c0

SHA256
3a9639341223130adfa83c15c72cb3ef02be45b4a026ec52a44736e904cae222

SHA512
7007bb3919ffab174803d8ed1cec0bfc66833b1cdbe08aa2588884e68a9efd64ccee7653f844390bce0b1c48a156cfcfd69885dabe742c4ba72cbbd25d7856a9

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
MD5
12723304ff64e511329733a90d2e7103

SHA1
80bf45be94d205c9ef1caa8bfa518535208fcfca

SHA256
52997056bdb065f2445007c21ce1f08c3974658f4e3a14058e26560d23117db0

SHA512
29f76617e858fd482c8d3ec9b87fc37e23f7a050138cb7e9cbb5e6756f9d0a60d35ef6d6dfbc9ce28474259741f545472166e9fb1bd938deffc0969951494422

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\5EE9003E3DC4134E8CF26DC55FD926FA
MD5
cc99560aa0b1952cf36e7db3ec2f5d38

SHA1
8cd142acb598d159fc36e8b9f0c1844b588fb125

SHA256
47477da84f083e2dbfc2d2c0083b98d04fff41cda53925ffb9ed0682253ac4ec

SHA512
0cdfea5144b15ad77028d5b04643c0717023bf1b725ef4171a0da8b58dd5a2acfb05ae986fba169958e18255c95e6303a31232826b1bd9bdffcbd2fbe6aceefc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
MD5
e2f4a6c57e0145c7051dd32e5d4a12e8

SHA1
3122b2d1915ee4788517dc2f1a01419c1450ac51

SHA256
ba16fcab364303681ec46d72d270a3e219697b48d6ec8f207ed4550b9d01d17a

SHA512
75b795460e38f1893603aabdf6b75dc227457bb1dabf58c50094a97ea52b5207d5e387715d467f96e1747e5bf04d3a45829065fb12362f17a068a2b1addde124

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
MD5
cbb328a72e60be043092a6948b1b6bd5

SHA1
80b95371dd9db90370aeab363d8e0e414427c096

SHA256
4f76abff5f5b8d73638ad6e31d58b8a8299612cdd2be4b8d6c0b2cc5bef4fa41

SHA512
d08b853d1f00b199619ba99b5a05cdbfc06f9cf6604df19e5149bb53fc73e70ea598526f642d526189fcc05630d699b7d6bb4e1c985af00c8c2500cca6018363

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\5EE9003E3DC4134E8CF26DC55FD926FA
MD5
4d785f40db9d4c99efce4888b5c14cf2

SHA1
746aecd5e9705f6e3865a70eeac092fd5e1a574e

SHA256
129147eb1b9dda65072976245a9d4f3222c51994c7b7135c362ab126f3aab56f

SHA512
6d4fe540aa9faf56b1ac0c0a01d57fa25364899435ae9832087b2fab0a95c4bc0f58752b8443b97c25a44cd4a06220ecfec7bff76b5551bbc8a3cd5b7d73a098

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\5EE9003E3DC4134E8CF26DC55FD926FA
MD5
4d785f40db9d4c99efce4888b5c14cf2

SHA1
746aecd5e9705f6e3865a70eeac092fd5e1a574e

SHA256
129147eb1b9dda65072976245a9d4f3222c51994c7b7135c362ab126f3aab56f

SHA512
6d4fe540aa9faf56b1ac0c0a01d57fa25364899435ae9832087b2fab0a95c4bc0f58752b8443b97c25a44cd4a06220ecfec7bff76b5551bbc8a3cd5b7d73a098

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
MD5
aad8afe74cf52289a532d90cf991579a

SHA1
41fbde1cf5d2b83de3422ac17daf0e52cccaaada

SHA256
79dc837b86b16f8ff33899b3f0f86596ea7c5a1ec6e2d871376139a85b9adf8f

SHA512
b778ba82631aba14b81947606958ddde38b72facad6656cc2c1ca93636bc1998c4f6434d3f5a48171c48d7223041a311b9a5ed84a3111217b9557b42b0f79ed7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files.exe
MD5
d310379a0a1c56703f499694402acdca

SHA1
58391b9e550ea6f48d4074dc754020702e33d3ae

SHA256
32a05650b6d9c6e1d21ba338d0c3e69acdcb070168273f8d23fc448f5db1343e

SHA512
157c5318979f7a81dedfe5385e9c784611f4230582ed755ed75aef7bfe37fb550194774fc04c1e10293be9aba5913d58f03b298f4ad7799cd34a957ebdfa3eb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files.exe
MD5
d310379a0a1c56703f499694402acdca

SHA1
58391b9e550ea6f48d4074dc754020702e33d3ae

SHA256
32a05650b6d9c6e1d21ba338d0c3e69acdcb070168273f8d23fc448f5db1343e

SHA512
157c5318979f7a81dedfe5385e9c784611f4230582ed755ed75aef7bfe37fb550194774fc04c1e10293be9aba5913d58f03b298f4ad7799cd34a957ebdfa3eb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Folder.exe
MD5
6f247a83bc3a67c637a5ebe91fde109a

SHA1
827e9e2717e04f5768da944bc87386d03fe8c732

SHA256
1558f756b05cbfd9a303da3129a68cf7aeab568cc58388180d979a785296c7dd

SHA512
845cb5a95fecd0aac13aa4c1e47829ba84d1329ff9c9436d673f97da52a12c6e3c802c65af95d25eaae6f3f008a8fa557df9b95017ee468d72ed7e68d02284f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Folder.exe
MD5
6f247a83bc3a67c637a5ebe91fde109a

SHA1
827e9e2717e04f5768da944bc87386d03fe8c732

SHA256
1558f756b05cbfd9a303da3129a68cf7aeab568cc58388180d979a785296c7dd

SHA512
845cb5a95fecd0aac13aa4c1e47829ba84d1329ff9c9436d673f97da52a12c6e3c802c65af95d25eaae6f3f008a8fa557df9b95017ee468d72ed7e68d02284f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Install.exe
MD5
ea00ba7109d68e8be4531c852d536ebb

SHA1
bad4a64741cd6ffb9a443adc5f798260834badc4

SHA256
90630a7c211471e27a34ce4f95fb840926274b25c04876ce0d5892cc6352fab0

SHA512
9885129d9468d7f20f099ab2ff5c4916437215b5ed2f2070a41aa41e90efbc4b82e86babb674d2bf30721180503f264509f1a37cfccfbeadda92ec402921dd58

Download Submit
C:\Users\Admin\AppData\Local\Temp\Install.exe
MD5
ea00ba7109d68e8be4531c852d536ebb

SHA1
bad4a64741cd6ffb9a443adc5f798260834badc4

SHA256
90630a7c211471e27a34ce4f95fb840926274b25c04876ce0d5892cc6352fab0

SHA512
9885129d9468d7f20f099ab2ff5c4916437215b5ed2f2070a41aa41e90efbc4b82e86babb674d2bf30721180503f264509f1a37cfccfbeadda92ec402921dd58

Download Submit
C:\Users\Admin\AppData\Local\Temp\KRSetp.exe
MD5
d6d98b36ffa95d8566f97fa2e16861e4

SHA1
50621551973b14f33c4e506fe4f7e8def4936246

SHA256
a48d2aeb6349a456fb0b9706e263dfcdf1f276f4f48eda0e0d81d7eab2a09aa0

SHA512
40105e820212340dc0ccc794efec84e6c15c9f371c9cbf7a4066ba655364a243d1edbf95c2793b8c9414445821e77d3832a8feb0e12f2b21d697f0af679cad75

Download Submit
C:\Users\Admin\AppData\Local\Temp\KRSetp.exe
MD5
d6d98b36ffa95d8566f97fa2e16861e4

SHA1
50621551973b14f33c4e506fe4f7e8def4936246

SHA256
a48d2aeb6349a456fb0b9706e263dfcdf1f276f4f48eda0e0d81d7eab2a09aa0

SHA512
40105e820212340dc0ccc794efec84e6c15c9f371c9cbf7a4066ba655364a243d1edbf95c2793b8c9414445821e77d3832a8feb0e12f2b21d697f0af679cad75

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\File.exe
MD5
954264f2ba5b24bbeecb293be714832c

SHA1
fde3ad6e6d8ab951b002c7ca17e867bf3c1d9ba0

SHA256
db5906a6a58c5f7e8991fb5c3a7201843142844650eb5b89bdf89094aba9e96c

SHA512
8fb15e5888d713e10df04b64c0a24250547a978eac9a7b25d653c343f01afc204fa661937a76644a2dcd3f5b65225450d3aaecb67014125a50722df21467ee53

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\File.exe
MD5
954264f2ba5b24bbeecb293be714832c

SHA1
fde3ad6e6d8ab951b002c7ca17e867bf3c1d9ba0

SHA256
db5906a6a58c5f7e8991fb5c3a7201843142844650eb5b89bdf89094aba9e96c

SHA512
8fb15e5888d713e10df04b64c0a24250547a978eac9a7b25d653c343f01afc204fa661937a76644a2dcd3f5b65225450d3aaecb67014125a50722df21467ee53

Download Submit
C:\Users\Admin\AppData\Local\Temp\axhub.dat
MD5
5a38f117070c9f8aea5bc47895da5d86

SHA1
ee82419e489fe754eb9d93563e14b617b144998a

SHA256
a01473c5af434368d6ace81c3af935fc866c3ab17d8741288b14cb638e511d58

SHA512
17915e7ad849d5143d0eeaa626ff19389914e8cdd93c4cd1d515a0e4683c2f6c5652c88dd2b15dc1631933fed0c85609829db777c2be58af960c0f80737759a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\axhub.dll
MD5
89c739ae3bbee8c40a52090ad0641d31

SHA1
d0f7dc9a0a3e52af0f9f9736f26e401636c420a1

SHA256
10a122bd647c88aa23f96687e26b251862e83be9dbb89532f4a578689547972d

SHA512
cc5059e478e5f469fde39e4119ee75eed7066f2a2069590cb5046e478b812f87ab1fc21dcfe44c965061fa4f9f83d6a14accf0c0e9b2406ae51504d06a3f6480

Download Submit
C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
MD5
b7161c0845a64ff6d7345b67ff97f3b0

SHA1
d223f855da541fe8e4c1d5c50cb26da0a1deb5fc

SHA256
fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66

SHA512
98d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680

Download Submit
C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
MD5
b7161c0845a64ff6d7345b67ff97f3b0

SHA1
d223f855da541fe8e4c1d5c50cb26da0a1deb5fc

SHA256
fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66

SHA512
98d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680

Download Submit
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
MD5
7fee8223d6e4f82d6cd115a28f0b6d58

SHA1
1b89c25f25253df23426bd9ff6c9208f1202f58b

SHA256
a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

SHA512
3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

Download Submit
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
MD5
7fee8223d6e4f82d6cd115a28f0b6d58

SHA1
1b89c25f25253df23426bd9ff6c9208f1202f58b

SHA256
a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

SHA512
3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

Download Submit
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
MD5
a6279ec92ff948760ce53bba817d6a77

SHA1
5345505e12f9e4c6d569a226d50e71b5a572dce2

SHA256
8b581869bf8944a8e0aa169adea2a4afe47434123da477132880aff6a5032181

SHA512
213cb374f1273c899e0c88a20c0101a7c28024ce5046a2e0d7898bd182d918288bb80367fea4454c437c057ff9ed4fffd42be48a13ca73653021a6d63e1cfa9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
MD5
a6279ec92ff948760ce53bba817d6a77

SHA1
5345505e12f9e4c6d569a226d50e71b5a572dce2

SHA256
8b581869bf8944a8e0aa169adea2a4afe47434123da477132880aff6a5032181

SHA512
213cb374f1273c899e0c88a20c0101a7c28024ce5046a2e0d7898bd182d918288bb80367fea4454c437c057ff9ed4fffd42be48a13ca73653021a6d63e1cfa9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\jg3_3uag.exe
MD5
5dd17946bfddda82909ce34163a00617

SHA1
4fd8f4ea12accaa7eee7c8821886c93b22f81200

SHA256
dc6c4a0912e7d13d4ee856ee8f4a4f4b238a66913532aaf7cb1847b3772a4cc8

SHA512
ea33aaaa856b3103c7fd01ba1cabace2cd376d38e59f0d23978195774d135b1b42c62e1785ae19f96f9a9f6fe0ba08c20fd3222316e37a71aa5deab47e03b4b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\jg3_3uag.exe
MD5
5dd17946bfddda82909ce34163a00617

SHA1
4fd8f4ea12accaa7eee7c8821886c93b22f81200

SHA256
dc6c4a0912e7d13d4ee856ee8f4a4f4b238a66913532aaf7cb1847b3772a4cc8

SHA512
ea33aaaa856b3103c7fd01ba1cabace2cd376d38e59f0d23978195774d135b1b42c62e1785ae19f96f9a9f6fe0ba08c20fd3222316e37a71aa5deab47e03b4b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\pub2.exe
MD5
788eed4ef853724961d7051a21ae0928

SHA1
21d9fd76bc3aa1dbec4afc654ca3f48a2227d089

SHA256
93be9c8c1ef071442ba6c11cabbb269f26ef33c07854ce16c66ff5793e24951f

SHA512
e57ec6fadc6f7ddd9121ff1c2411cfe7ecce9c269d2d2f3ca1f87200337c96a1fd83b53caab7869c695b54b436354698d3ef0d255439424bf76241801f18b24f

Download Submit
C:\Users\Admin\AppData\Local\Temp\pub2.exe
MD5
788eed4ef853724961d7051a21ae0928

SHA1
21d9fd76bc3aa1dbec4afc654ca3f48a2227d089

SHA256
93be9c8c1ef071442ba6c11cabbb269f26ef33c07854ce16c66ff5793e24951f

SHA512
e57ec6fadc6f7ddd9121ff1c2411cfe7ecce9c269d2d2f3ca1f87200337c96a1fd83b53caab7869c695b54b436354698d3ef0d255439424bf76241801f18b24f

Download Submit
C:\Users\Admin\AppData\Local\Temp\pzyh.exe
MD5
ecec67e025fcd37f5d6069b5ff5105ed

SHA1
9a5a0bed2212f47071ad27b28fe407746ecfad18

SHA256
51ac8ea2c6cab10489188133a109aa4507b76ea459996173d0679d542780387c

SHA512
a9d59f137e8688bcee3f1fdc327b41b7f8d836c8e4753e1e9887e03a7c97ecfb851e9d88460f1003970fbaf8638eaa7dd94eb5875a30f51b2c2e7a20a1b51e33

Download Submit
C:\Users\Admin\AppData\Local\Temp\pzyh.exe
MD5
ecec67e025fcd37f5d6069b5ff5105ed

SHA1
9a5a0bed2212f47071ad27b28fe407746ecfad18

SHA256
51ac8ea2c6cab10489188133a109aa4507b76ea459996173d0679d542780387c

SHA512
a9d59f137e8688bcee3f1fdc327b41b7f8d836c8e4753e1e9887e03a7c97ecfb851e9d88460f1003970fbaf8638eaa7dd94eb5875a30f51b2c2e7a20a1b51e33

Download Submit
C:\Users\Admin\AppData\Local\Temp\{jhkI-ciNI9-0EP8-iRNMX}\87180268513.exe
MD5
37e20f76473a26539c8738b39adc8355

SHA1
17d65400dc70cbbff181604c3adecb9750b413e6

SHA256
05474ec47384f809841c2d0a5ff1eacfcd16098ae716bb73ec6e228646729179

SHA512
526de213b3f5d206812d02fde129565544d98ec5f8a35f125f49471f0d0d83d15b091c66a709889ef665d3f02867ee4e14dc6c36821da80cea4e306aabc10923

Download Submit
C:\Users\Admin\AppData\Local\Temp\{jhkI-ciNI9-0EP8-iRNMX}\87180268513.exe
MD5
37e20f76473a26539c8738b39adc8355

SHA1
17d65400dc70cbbff181604c3adecb9750b413e6

SHA256
05474ec47384f809841c2d0a5ff1eacfcd16098ae716bb73ec6e228646729179

SHA512
526de213b3f5d206812d02fde129565544d98ec5f8a35f125f49471f0d0d83d15b091c66a709889ef665d3f02867ee4e14dc6c36821da80cea4e306aabc10923

Download Submit
C:\Users\Admin\AppData\Roaming\2556239.exe
MD5
e61502fa2864a84b299051ec738bf39e

SHA1
c9e43f0cfedbca95902018e464750ceb430ebc71

SHA256
1279220e2851dd5cfeb851304b79df0bee795996c1f120131615637f1408c747

SHA512
0b495b6179993aae9d0830922ad1c5195a8cd32689c05bb61ddf4df700327cad1ed6c9abe837a0a696b471677ad3582f6226a99db3a232ad15cc03c864f24ea7

Download Submit
C:\Users\Admin\AppData\Roaming\2556239.exe
MD5
e61502fa2864a84b299051ec738bf39e

SHA1
c9e43f0cfedbca95902018e464750ceb430ebc71

SHA256
1279220e2851dd5cfeb851304b79df0bee795996c1f120131615637f1408c747

SHA512
0b495b6179993aae9d0830922ad1c5195a8cd32689c05bb61ddf4df700327cad1ed6c9abe837a0a696b471677ad3582f6226a99db3a232ad15cc03c864f24ea7

Download Submit
C:\Users\Admin\AppData\Roaming\5565832.exe
MD5
7e7cbd686bea09afd949c96709cf1cbb

SHA1
24b9b077882f890923b2b4203faea51a3ecd9b24

SHA256
7c40096572d9378927fbed69ad94812d91e577699cd6fded1656365b564bab1b

SHA512
fe0bc9320cad6f082915992644018f3216d0a3e2a3caa4b4ddf21b3b84f65eda1948e41622608dd1599fc7095931c7f38901ac142d1799f76e2f39fbb3db3896

Download Submit
C:\Users\Admin\AppData\Roaming\5565832.exe
MD5
7e7cbd686bea09afd949c96709cf1cbb

SHA1
24b9b077882f890923b2b4203faea51a3ecd9b24

SHA256
7c40096572d9378927fbed69ad94812d91e577699cd6fded1656365b564bab1b

SHA512
fe0bc9320cad6f082915992644018f3216d0a3e2a3caa4b4ddf21b3b84f65eda1948e41622608dd1599fc7095931c7f38901ac142d1799f76e2f39fbb3db3896

Download Submit
C:\Users\Admin\AppData\Roaming\6097905.exe
MD5
0607697ef14d6fd3c464595fefb1c3ce

SHA1
1fb897bd63021353c34bb4c520ce977f61844d89

SHA256
074bfceb4ffc34aa4d9e799e2751df3e1c85e7a11d917ebd22ed34c650376fba

SHA512
529d66a5dec9369e667931f1ee0691c8565f22cf6436885f82c02646f8920bea331b983fafafb8d241a2bc4231295a8eac1c05bc0cb3ea0dab0e6c0346b5345f

Download Submit
C:\Users\Admin\AppData\Roaming\6097905.exe
MD5
0607697ef14d6fd3c464595fefb1c3ce

SHA1
1fb897bd63021353c34bb4c520ce977f61844d89

SHA256
074bfceb4ffc34aa4d9e799e2751df3e1c85e7a11d917ebd22ed34c650376fba

SHA512
529d66a5dec9369e667931f1ee0691c8565f22cf6436885f82c02646f8920bea331b983fafafb8d241a2bc4231295a8eac1c05bc0cb3ea0dab0e6c0346b5345f

Download Submit
C:\Users\Admin\AppData\Roaming\6097905.exe
MD5
0607697ef14d6fd3c464595fefb1c3ce

SHA1
1fb897bd63021353c34bb4c520ce977f61844d89

SHA256
074bfceb4ffc34aa4d9e799e2751df3e1c85e7a11d917ebd22ed34c650376fba

SHA512
529d66a5dec9369e667931f1ee0691c8565f22cf6436885f82c02646f8920bea331b983fafafb8d241a2bc4231295a8eac1c05bc0cb3ea0dab0e6c0346b5345f

Download Submit
C:\Users\Admin\AppData\Roaming\6403253.exe
MD5
6d4b71775ce9d8a5f7f70ddcd8e4da81

SHA1
c3236a1324bc86b037a2770be75ecf868c37ed3e

SHA256
63ba1b32aabb60c03702755dc949acaba31f34b76876ca54c0460261e3578000

SHA512
dc9e44f37e6907d966adaaf581d764e2430c4fd716018738a3cec3d3faa6659e864070c4ba364e56b4a708cb4822d39b6efde5b552aba2c0298b2fcd992f0b76

Download Submit
C:\Users\Admin\AppData\Roaming\6403253.exe
MD5
6d4b71775ce9d8a5f7f70ddcd8e4da81

SHA1
c3236a1324bc86b037a2770be75ecf868c37ed3e

SHA256
63ba1b32aabb60c03702755dc949acaba31f34b76876ca54c0460261e3578000

SHA512
dc9e44f37e6907d966adaaf581d764e2430c4fd716018738a3cec3d3faa6659e864070c4ba364e56b4a708cb4822d39b6efde5b552aba2c0298b2fcd992f0b76

Download Submit
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
MD5
6d4b71775ce9d8a5f7f70ddcd8e4da81

SHA1
c3236a1324bc86b037a2770be75ecf868c37ed3e

SHA256
63ba1b32aabb60c03702755dc949acaba31f34b76876ca54c0460261e3578000

SHA512
dc9e44f37e6907d966adaaf581d764e2430c4fd716018738a3cec3d3faa6659e864070c4ba364e56b4a708cb4822d39b6efde5b552aba2c0298b2fcd992f0b76

Download Submit
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
MD5
6d4b71775ce9d8a5f7f70ddcd8e4da81

SHA1
c3236a1324bc86b037a2770be75ecf868c37ed3e

SHA256
63ba1b32aabb60c03702755dc949acaba31f34b76876ca54c0460261e3578000

SHA512
dc9e44f37e6907d966adaaf581d764e2430c4fd716018738a3cec3d3faa6659e864070c4ba364e56b4a708cb4822d39b6efde5b552aba2c0298b2fcd992f0b76

Download Submit
C:\Users\Public\run.exe
MD5
f0040b9b133ad6b4b5cfbae2e74cc4d7

SHA1
43c4e119e4f5b83dbf5cb014305ce7c462855034

SHA256
20cae931646b6eabea577ab84825c9aa381fdbb584e3371fb86513ee33f31d83

SHA512
1cf65b10a91ff3f8f2760959cf766f85e8231ce4eb894579148715657541968c96e5a06e662f56812b223961386efeecfe881f20cfa83937b33cb6450dbc4349

Download Submit
C:\Users\Public\run.exe
MD5
f0040b9b133ad6b4b5cfbae2e74cc4d7

SHA1
43c4e119e4f5b83dbf5cb014305ce7c462855034

SHA256
20cae931646b6eabea577ab84825c9aa381fdbb584e3371fb86513ee33f31d83

SHA512
1cf65b10a91ff3f8f2760959cf766f85e8231ce4eb894579148715657541968c96e5a06e662f56812b223961386efeecfe881f20cfa83937b33cb6450dbc4349

Download Submit
C:\Users\Public\run2.exe
MD5
56cd856f566074d0c1986a452453d2d1

SHA1
f273e650770beb5ab2dc23f2381558fef792adbb

SHA256
1a5782452fd8888959769c7b21d4811bc96b1871a0fc8df0ee9881430bf9dcea

SHA512
e08fc3bf0edbf3b9377848d827f2be66dada3803f18caf67aebc85a2bc66c3076e94f70363a3aa5f8867e9c9d981f2639e2d9da652b9a75209ed37261507aa36

Download Submit
C:\Users\Public\run2.exe
MD5
56cd856f566074d0c1986a452453d2d1

SHA1
f273e650770beb5ab2dc23f2381558fef792adbb

SHA256
1a5782452fd8888959769c7b21d4811bc96b1871a0fc8df0ee9881430bf9dcea

SHA512
e08fc3bf0edbf3b9377848d827f2be66dada3803f18caf67aebc85a2bc66c3076e94f70363a3aa5f8867e9c9d981f2639e2d9da652b9a75209ed37261507aa36

Download Submit
\ProgramData\mozglue.dll
MD5
8f73c08a9660691143661bf7332c3c27

SHA1
37fa65dd737c50fda710fdbde89e51374d0c204a

SHA256
3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

SHA512
0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

Download Submit
\ProgramData\nss3.dll
MD5
bfac4e3c5908856ba17d41edcd455a51

SHA1
8eec7e888767aa9e4cca8ff246eb2aacb9170428

SHA256
e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

SHA512
2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

Download Submit
\Users\Admin\AppData\Local\Temp\CC4F.tmp
MD5
50741b3f2d7debf5d2bed63d88404029

SHA1
56210388a627b926162b36967045be06ffb1aad3

SHA256
f2f8732ae464738372ff274b7e481366cecdd2337210d4a3cbcd089c958a730c

SHA512
fac6bfe35b1ee08b3d42d330516a260d9cdb4a90bbb0491411a583029b92a59d20af3552372ea8fb3f59442b3945bf524ef284127f397ae7179467080be8e9b3

Download Submit
\Users\Admin\AppData\Local\Temp\axhub.dll
MD5
89c739ae3bbee8c40a52090ad0641d31

SHA1
d0f7dc9a0a3e52af0f9f9736f26e401636c420a1

SHA256
10a122bd647c88aa23f96687e26b251862e83be9dbb89532f4a578689547972d

SHA512
cc5059e478e5f469fde39e4119ee75eed7066f2a2069590cb5046e478b812f87ab1fc21dcfe44c965061fa4f9f83d6a14accf0c0e9b2406ae51504d06a3f6480

Download Submit
memory/344-237-0x0000022347B50000-0x0000022347BC1000-memory.dmp

Filesize
452KB

Download
memory/996-192-0x0000028903C30000-0x0000028903CA1000-memory.dmp

Filesize
452KB

Download
memory/1172-229-0x0000020298280000-0x00000202982F1000-memory.dmp

Filesize
452KB

Download
memory/1180-273-0x0000028C5D6B0000-0x0000028C5D721000-memory.dmp

Filesize
452KB

Download
memory/1352-257-0x000001F2F2790000-0x000001F2F2801000-memory.dmp

Filesize
452KB

Download
memory/1376-258-0x00000186BEA00000-0x00000186BEA71000-memory.dmp

Filesize
452KB

Download
memory/1800-116-0x0000000000000000-mapping.dmp

Download
memory/1964-270-0x0000011193180000-0x00000111931F1000-memory.dmp

Filesize
452KB

Download
memory/2288-323-0x0000000000000000-mapping.dmp

Download
memory/2504-206-0x000002978EA40000-0x000002978EAB1000-memory.dmp

Filesize
452KB

Download
memory/2528-358-0x0000000000000000-mapping.dmp

Download
memory/2540-213-0x0000019891D20000-0x0000019891D91000-memory.dmp

Filesize
452KB

Download
memory/2716-271-0x0000000000C40000-0x0000000000C56000-memory.dmp

Filesize
88KB

Download
memory/2796-267-0x000001FE32860000-0x000001FE328D1000-memory.dmp

Filesize
452KB

Download
memory/2804-269-0x000002603B7A0000-0x000002603B811000-memory.dmp

Filesize
452KB

Download
memory/2852-302-0x0000000000000000-mapping.dmp

Download
memory/2856-172-0x00000272AB0A0000-0x00000272AB0EC000-memory.dmp

Filesize
304KB

Download
memory/2856-175-0x00000272AB160000-0x00000272AB1D1000-memory.dmp

Filesize
452KB

Download
memory/3440-318-0x0000000000400000-0x0000000000492000-memory.dmp

Filesize
584KB

Download
memory/3440-317-0x000000000043DC85-mapping.dmp

Download
memory/3516-121-0x0000000000000000-mapping.dmp

Download
memory/3884-236-0x0000024E043C0000-0x0000024E04431000-memory.dmp

Filesize
452KB

Download
memory/3888-362-0x0000000000000000-mapping.dmp

Download
memory/3896-239-0x0000000008590000-0x0000000008591000-memory.dmp

Filesize
4KB

Download
memory/3896-241-0x00000000059C0000-0x00000000059C1000-memory.dmp

Filesize
4KB

Download
memory/3896-242-0x0000000008140000-0x0000000008141000-memory.dmp

Filesize
4KB

Download
memory/3896-226-0x0000000003090000-0x00000000030D7000-memory.dmp

Filesize
284KB

Download
memory/3896-248-0x0000000008180000-0x0000000008181000-memory.dmp

Filesize
4KB

Download
memory/3896-212-0x00000000032C0000-0x00000000032C1000-memory.dmp

Filesize
4KB

Download
memory/3896-233-0x00000000030F0000-0x00000000030F1000-memory.dmp

Filesize
4KB

Download
memory/3896-217-0x00000000059F0000-0x00000000059F1000-memory.dmp

Filesize
4KB

Download
memory/3896-262-0x0000000008310000-0x0000000008311000-memory.dmp

Filesize
4KB

Download
memory/3896-186-0x0000000000000000-mapping.dmp

Download
memory/3896-203-0x0000000000F50000-0x0000000000F51000-memory.dmp

Filesize
4KB

Download
memory/4104-357-0x0000000000000000-mapping.dmp

Download
memory/4268-152-0x00000000015E0000-0x00000000015FD000-memory.dmp

Filesize
116KB

Download
memory/4268-125-0x0000000000000000-mapping.dmp

Download
memory/4268-153-0x000000001BEF0000-0x000000001BEF2000-memory.dmp

Filesize
8KB

Download
memory/4268-142-0x0000000000FA0000-0x0000000000FA1000-memory.dmp

Filesize
4KB

Download
memory/4276-124-0x0000000000000000-mapping.dmp

Download
memory/4276-137-0x0000000000D20000-0x0000000000D21000-memory.dmp

Filesize
4KB

Download
memory/4276-313-0x0000000005540000-0x0000000005541000-memory.dmp

Filesize
4KB

Download
memory/4292-320-0x0000000000000000-mapping.dmp

Download
memory/4308-227-0x0000000000400000-0x0000000000636000-memory.dmp

Filesize
2.2MB

Download
memory/4308-211-0x0000000000B20000-0x0000000000BBD000-memory.dmp

Filesize
628KB

Download
memory/4308-129-0x0000000000000000-mapping.dmp

Download
memory/4320-130-0x0000000000000000-mapping.dmp

Download
memory/4320-143-0x0000000000400000-0x0000000000673000-memory.dmp

Filesize
2.4MB

Download
memory/4344-342-0x0000000000A70000-0x0000000000A9F000-memory.dmp

Filesize
188KB

Download
memory/4344-345-0x0000000002612000-0x0000000002613000-memory.dmp

Filesize
4KB

Download
memory/4344-344-0x0000000002610000-0x0000000002611000-memory.dmp

Filesize
4KB

Download
memory/4344-343-0x0000000000400000-0x00000000005F3000-memory.dmp

Filesize
1.9MB

Download
memory/4344-338-0x0000000000000000-mapping.dmp

Download
memory/4352-355-0x0000000000000000-mapping.dmp

Download
memory/4356-136-0x0000000000000000-mapping.dmp

Download
memory/4424-138-0x0000000000000000-mapping.dmp

Download
memory/4424-161-0x0000000000400000-0x00000000043D2000-memory.dmp

Filesize
63.8MB

Download
memory/4424-159-0x0000000000030000-0x0000000000038000-memory.dmp

Filesize
32KB

Download
memory/4424-160-0x00000000001C0000-0x00000000001C9000-memory.dmp

Filesize
36KB

Download
memory/4444-220-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download
memory/4444-234-0x0000000004A50000-0x0000000004A51000-memory.dmp

Filesize
4KB

Download
memory/4444-194-0x0000000000000000-mapping.dmp

Download
memory/4480-144-0x0000000000000000-mapping.dmp

Download
memory/4516-148-0x0000000000000000-mapping.dmp

Download
memory/4516-284-0x0000000002070000-0x00000000020A0000-memory.dmp

Filesize
192KB

Download
memory/4516-285-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/4536-275-0x0000000000417DEA-mapping.dmp

Download
memory/4536-278-0x0000000005300000-0x0000000005301000-memory.dmp

Filesize
4KB

Download
memory/4572-322-0x0000000000000000-mapping.dmp

Download
memory/4592-348-0x0000000000000000-mapping.dmp

Download
memory/4616-356-0x0000000000000000-mapping.dmp

Download
memory/4700-346-0x0000000000000000-mapping.dmp

Download
memory/4724-155-0x0000000000000000-mapping.dmp

Download
memory/4764-333-0x0000000000000000-mapping.dmp

Download
memory/4800-168-0x0000000004534000-0x0000000004635000-memory.dmp

Filesize
1.0MB

Download
memory/4800-162-0x0000000000000000-mapping.dmp

Download
memory/4800-169-0x0000000004700000-0x000000000475D000-memory.dmp

Filesize
372KB

Download
memory/4844-349-0x0000000000000000-mapping.dmp

Download
memory/4916-303-0x000001A838EA0000-0x000001A838EBB000-memory.dmp

Filesize
108KB

Download
memory/4916-171-0x00007FF6E04B4060-mapping.dmp

Download
memory/4916-191-0x000001A837670000-0x000001A8376E1000-memory.dmp

Filesize
452KB

Download
memory/4916-304-0x000001A839F00000-0x000001A83A006000-memory.dmp

Filesize
1.0MB

Download
memory/4956-174-0x0000000000000000-mapping.dmp

Download
memory/4956-182-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/4956-197-0x0000000004920000-0x0000000004921000-memory.dmp

Filesize
4KB

Download
memory/4956-222-0x0000000002280000-0x00000000022AD000-memory.dmp

Filesize
180KB

Download
memory/5016-224-0x000000000AD80000-0x000000000AD81000-memory.dmp

Filesize
4KB

Download
memory/5016-230-0x000000000AD00000-0x000000000AD01000-memory.dmp

Filesize
4KB

Download
memory/5016-214-0x00000000056B0000-0x00000000056B1000-memory.dmp

Filesize
4KB

Download
memory/5016-209-0x0000000002F50000-0x0000000002F51000-memory.dmp

Filesize
4KB

Download
memory/5016-178-0x0000000000000000-mapping.dmp

Download
memory/5016-196-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Filesize
4KB

Download
memory/5016-215-0x00000000056A0000-0x00000000056B0000-memory.dmp

Filesize
64KB

Download
memory/5016-218-0x000000000B180000-0x000000000B181000-memory.dmp

Filesize
4KB

Download
memory/5068-259-0x00000000053D0000-0x00000000053D1000-memory.dmp

Filesize
4KB

Download
memory/5068-245-0x0000000000000000-mapping.dmp

Download
memory/5104-351-0x0000000000000000-mapping.dmp

Download
memory/5128-296-0x0000000000000000-mapping.dmp

Download
memory/5164-360-0x0000000000000000-mapping.dmp

Download
memory/5172-359-0x0000000000000000-mapping.dmp

Download
memory/5248-279-0x0000000000000000-mapping.dmp

Download
memory/5252-328-0x0000000000000000-mapping.dmp

Download
memory/5272-330-0x0000000000000000-mapping.dmp

Download
memory/5320-352-0x0000000000000000-mapping.dmp

Download
memory/5364-331-0x0000000000000000-mapping.dmp

Download
memory/5380-353-0x0000000000000000-mapping.dmp

Download
memory/5416-306-0x0000000000400000-0x0000000000633000-memory.dmp

Filesize
2.2MB

Download
memory/5416-297-0x0000000000000000-mapping.dmp

Download
memory/5416-305-0x0000000000C00000-0x0000000000C9D000-memory.dmp

Filesize
628KB

Download
memory/5440-337-0x000001F6EFD50000-0x000001F6EFD52000-memory.dmp

Filesize
8KB

Download
memory/5440-339-0x000001F6EFD54000-0x000001F6EFD55000-memory.dmp

Filesize
4KB

Download
memory/5440-340-0x000001F6EFD52000-0x000001F6EFD54000-memory.dmp

Filesize
8KB

Download
memory/5440-341-0x000001F6EFD55000-0x000001F6EFD57000-memory.dmp

Filesize
8KB

Download
memory/5440-332-0x0000000000000000-mapping.dmp

Download
memory/5584-300-0x0000000000000000-mapping.dmp

Download
memory/5676-324-0x0000000000000000-mapping.dmp

Download
memory/5796-301-0x0000000000000000-mapping.dmp

Download
memory/5796-319-0x0000000000000000-mapping.dmp

Download
memory/5812-347-0x0000000000000000-mapping.dmp

Download
memory/5832-354-0x0000000000000000-mapping.dmp

Download
memory/5988-361-0x0000000000000000-mapping.dmp

Download
memory/5996-327-0x0000000000400000-0x000000000064B000-memory.dmp

Filesize
2.3MB

Download
memory/5996-326-0x0000000000C00000-0x0000000000CE1000-memory.dmp

Filesize
900KB

Download
memory/5996-325-0x0000000000000000-mapping.dmp

Download
memory/6024-350-0x0000000000000000-mapping.dmp

Download
memory/6028-321-0x0000000000000000-mapping.dmp

Download
memory/6036-335-0x00000000049E0000-0x0000000004AAE000-memory.dmp

Filesize
824KB

Download
memory/6036-329-0x0000000000000000-mapping.dmp

Download
memory/6036-334-0x0000000004950000-0x00000000049BC000-memory.dmp

Filesize
432KB

Download
memory/6036-336-0x0000000000400000-0x000000000443A000-memory.dmp

Filesize
64.2MB

Download