Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
21-09-2022 23:12
Static task
static1
Behavioral task
behavioral1
Sample
29466d5093964da3c192dd90ae1af32d46d3161eabfc9181119fa899fd885af3.exe
Resource
win10-20220812-en
General
-
Target
29466d5093964da3c192dd90ae1af32d46d3161eabfc9181119fa899fd885af3.exe
-
Size
173KB
-
MD5
3f3748a9b0818417895430789d416bf3
-
SHA1
75a138817575cc8eff12163d019c0a6e16326c73
-
SHA256
29466d5093964da3c192dd90ae1af32d46d3161eabfc9181119fa899fd885af3
-
SHA512
e7173d1c2479272d9a88ca55af73407d92931a174cbb2240c5a3edc31f8347925a80351d320034d64f5ff6568d8bc3aabe88d0aeaa334dfbf5b938720d1009ef
-
SSDEEP
3072:p2NkLLeHk5SIh7gQK2Ke6XJE9eLu74mF+TYB91Y/Pk9Dn:8OL4FImQ/6X7y7PQTe
Malware Config
Extracted
redline
LogsDiller Cloud (Sup: @mr_golds)
77.73.134.27:8163
-
auth_value
56c6f7b9024c076f0a96931453da7e56
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2424-141-0x00000000001D0000-0x00000000001D9000-memory.dmp family_smokeloader -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/82676-286-0x000000000042217E-mapping.dmp family_redline behavioral1/memory/82676-471-0x0000000000400000-0x0000000000428000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
Processes:
setup1.exesetup.exesetup1.exesetup.exesetup1.exesetup.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ setup1.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ setup.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ setup1.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ setup.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ setup1.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ setup.exe -
Downloads MZ/PE file
-
Executes dropped EXE 9 IoCs
Processes:
1AFA.exe2A5D.exe2F5F.exesetup.exesetup1.exesetup.exesetup1.exesetup.exesetup1.exepid process 2132 1AFA.exe 5032 2A5D.exe 23972 2F5F.exe 8280 setup.exe 8708 setup1.exe 9344 setup.exe 9672 setup1.exe 10280 setup.exe 10372 setup1.exe -
Checks BIOS information in registry 2 TTPs 12 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
setup.exesetup1.exesetup.exesetup1.exesetup.exesetup1.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion setup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion setup1.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion setup1.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion setup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion setup1.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion setup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion setup1.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion setup1.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion setup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion setup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion setup1.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion setup.exe -
Deletes itself 1 IoCs
Processes:
pid process 2276 -
Identifies Wine through registry keys 2 TTPs 3 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
setup1.exesetup1.exesetup1.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Wine setup1.exe Key opened \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Wine setup1.exe Key opened \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Wine setup1.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\setup.exe themida C:\Users\Admin\AppData\Local\Temp\setup.exe themida behavioral1/memory/8280-1348-0x00007FF7B24E0000-0x00007FF7B2D9B000-memory.dmp themida behavioral1/memory/8280-1360-0x00007FF7B24E0000-0x00007FF7B2D9B000-memory.dmp themida C:\Users\Admin\AppData\Local\Temp\setup.exe themida C:\Users\Admin\AppData\Local\Temp\setup.exe themida -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Processes:
setup.exesetup.exesetup.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA setup.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA setup.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA setup.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
Processes:
setup.exesetup1.exesetup.exesetup1.exesetup.exesetup1.exepid process 8280 setup.exe 8708 setup1.exe 9344 setup.exe 9672 setup1.exe 10280 setup.exe 10372 setup1.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
2A5D.exedescription pid process target process PID 5032 set thread context of 82676 5032 2A5D.exe AppLaunch.exe -
Drops file in Windows directory 3 IoCs
Processes:
MicrosoftEdge.exeMicrosoftEdgeCP.exedescription ioc process File created C:\Windows\rescache\_merged\3720402701\2219095117.pri MicrosoftEdge.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File created C:\Windows\rescache\_merged\3720402701\2219095117.pri MicrosoftEdgeCP.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
29466d5093964da3c192dd90ae1af32d46d3161eabfc9181119fa899fd885af3.exedescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 29466d5093964da3c192dd90ae1af32d46d3161eabfc9181119fa899fd885af3.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 29466d5093964da3c192dd90ae1af32d46d3161eabfc9181119fa899fd885af3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 29466d5093964da3c192dd90ae1af32d46d3161eabfc9181119fa899fd885af3.exe -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 9192 schtasks.exe 10148 schtasks.exe 10844 schtasks.exe -
Processes:
MicrosoftEdge.exebrowser_broker.exeMicrosoftEdgeCP.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe -
Modifies registry class 64 IoCs
Processes:
MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exedescription ioc process Set value (data) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\MigrationTime = 03bc80556daed801 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DontShowMeThisDialogAgain MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionLow = "0" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaVR = "DebugPlugin" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaVR = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\en-US\\sidubm.table" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\Rating Prompt Shown = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$vBulletin 3 MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$http://www.typepad.com/ MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\DatabaseComplete = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CacheLimit = "1" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaVR = "%windir%\\Speech_OneCore\\Engines\\TTS\\en-US\\MSTTSLocenUS.dat" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\Total MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\FileNames MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\InternetRegistry MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\DatastoreSchemaVersion = "8" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaVR = "I 0069 Y 0079 IX 0268 YX 0289 UU 026F U 0075 IH 026A YH 028F UH 028A E 0065 EU 00F8 EX 0258 OX 0275 OU 0264 O 006F AX 0259 EH 025B OE 0153 ER 025C UR 025E AH 028C AO 0254 AE 00E6 AEX 0250 A 0061 AOE 0276 AA 0251 Q 0252 EI 006503610069 AU 00610361028A OI 025403610069 AI 006103610069 IYX 006903610259 UYX 007903610259 EHX 025B03610259 UWX 007503610259 OWX 006F03610259 AOX 025403610259 EN 00650303 AN 00610303 ON 006F0303 OEN 01530303 P 0070 B 0062 M 006D BB 0299 PH 0278 BH 03B2 MF 0271 F 0066 V 0076 VA 028B TH 03B8 DH 00F0 T 0074 D 0064 N 006E RR 0072 DX 027E S 0073 Z 007A LSH 026C LH 026E RA 0279 L 006C SH 0283 ZH 0292 TR 0288 DR 0256 NR 0273 DXR 027D SR 0282 ZR 0290 R 027B LR 026D CT 0063 JD 025F NJ 0272 C 00E7 CJ 029D J 006A LJ 028E W 0077 K 006B G 0067 NG 014B X 0078 GH 0263 GA 0270 GL 029F QT 0071 QD 0262 QN 0274 QQ 0280 QH 03C7 RH 0281 HH 0127 HG 0295 GT 0294 H 0068 WJ 0265 PF 007003610066 TS 007403610073 CH 007403610283 JH 006403610292 JJ 006A0361006A DZ 00640361007A CC 007403610255 JC 006403610291 TSR 007403610282 WH 028D ESH 029C EZH 02A2 ET 02A1 SC 0255 ZC 0291 LT 027A SHX 0267 HZ 0266 PCK 0298 TCK 01C0 NCK 0021 CCK 01C2 LCK 01C1 BIM 0253 DIM 0257 QIM 029B GIM 0260 JIM 0284 S1 02C8 S2 02CC . 002E _| 007C _|| 2016 lng 02D0 hlg 02D1 xsh 02D8 _^ 203F _! 0001 _& 0002 _, 0003 _s 0004 _. 2198 _? 2197 T5 030B T4 0301 T3 0304 T2 0300 T1 030F T- 2193 T+ 2191 vls 030A vcd 032C bvd 0324 cvd 0330 asp 02B0 mrd 0339 lrd 031C adv 031F ret 0331 cen 0308 mcn 033D syl 0329 nsy 032F rho 02DE lla 033C lab 02B7 pal 02B2 vel 02E0 phr 02E4 vph 0334 rai 031D low 031E atr 0318 rtr 0319 den 032A api 033A lam 033B nas 0303 nsr 207F lar 02E1 nar 031A ejc 02BC + 0361 bva 02B1 G2 0261 rte 0320 vsl 0325 NCK3 0297 NCK2 01C3 LCK2 0296 TCK2 0287 JC2 02A5 CC2 02A8 LG 026B DZ2 02A3 TS2 02A6 JH2 02A4 CH2 02A7 SHC 0286 rhz 02B4 QOM 02A0 xst 0306 T= 2192 ERR 025D AXR 025A ZHJ 0293" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content\CachePrefix MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CacheLimit = "1" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\FontSize = "3" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\FirstRecoveryTime = 03bc80556daed801 MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 23f1b38f20ced801 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\bestrealprizes.life\NumberOfS = "1" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$blogger MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\IsSignedIn = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaVR = "Microsoft Speech HW Voice Activation - English (United States)" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\FileVersion = "2016061511" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\Certificates MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\Certificates\83DA05A9886F7658B = 03000000010000001400000083da05a9886f7658be73acf0a4930c0f99b92f011400000001000000140000003656896549cb5b9b2f3cac4216504d91b933d79104000000010000001000000062455357dd57cb80c32ab295743cccc00f00000001000000200000006811c6215f18c75fdbe32cf56bd66248562a7fa3ba459cfee338745061e583941900000001000000100000002d581a49c8eb5b3b3c6ef9bb65314d705c000000010000000400000000100000180000000100000010000000bb048f1838395f6fc3a1f3d2b7e976542000000001000000dc060000308206d8308204c0a003020102020a613fb718000000000004300d06092a864886f70d01010b0500308188310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e31323030060355040313294d6963726f736f667420526f6f7420436572746966696361746520417574686f726974792032303131301e170d3131313031383232353531395a170d3236313031383233303531395a307e310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312830260603550403131f4d6963726f736f66742053656375726520536572766572204341203230313130820222300d06092a864886f70d01010105000382020f003082020a0282020100d00bc0a4a81981e236e5e2aae5f3b2155875beb4e549f1e084f9bb0d64ef85c18155b8f3e7f16d40553dce8b6ad18493f5757c5ba4d47410ca32f323d3aeeecf9e0458c2d947cbd17c004148711b01671718afc6fe73037ee4ef439cef01712a1f81264377985457739d552bf09e8e7d060eac1b54f326f7f82308228b9e061d3738fd72d2cae563c19a5a7db26db352a96ee9aeb5fc8b36f99efaf61c581b9756a511e5b752dbbbe9f054bfb4ff2c6cb85d26cea00ad7df93ed7fddacf12c731ad9193755badd22788ea1d49b09f807223171b094aee0b0e726445790819715ce61ec65e24bf185521632f8b578aa7ecd4dec8321a4a89bbe9a6a04e0a31ccd56186cfd6b2f423ee237f272abd07873727bdeec0058e52130a3083a99ef9fc3f77a169665b5c381aff4397049aff6a9f66a0038f9b40819e01a35a55676225f6af269ae3ead58464db854f68941441e72b1bc122753d2c1ffb2cd50981eb5f4bbb6c28239d9ac1bf23b27846ab0c6260bd73a10e7b3db7cd356ac534c0bfa3b313774d8592bf9007919067bfd1c1d42d4410d2f050ed56b4923ffcfcdf87a82cfda3c2ddfe8d8120418ba1e8877b8981f1007bbc8057e0b09bf6bdde34e5bb0f9c784a63bca4c9f5b6229f7c7a2a89588702ce5c13f3c52234f409ac33185832fbf29f11d508f219607ceeff280c2447d9b62ef2fc37789ab454d533e0279d30203010001a382014b30820147301006092b06010401823715010403020100301d0603551d0e041604143656896549cb5b9b2f3cac4216504d91b933d791301906092b0601040182371402040c1e0a00530075006200430041300b0603551d0f040403020186300f0603551d130101ff040530030101ff301f0603551d23041830168014722d3a02319043b914054ee1eaa7c731d1238934305a0603551d1f04533051304fa04da04b8649687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963526f6f436572417574323031315f323031315f30335f32322e63726c305e06082b0601050507010104523050304e06082b060105050730028642687474703a2f2f7777772e6d6963726f736f66742e636f6d2f706b692f63657274732f4d6963526f6f436572417574323031315f323031315f30335f32322e637274300d06092a864886f70d01010b0500038202010041c861c1f55b9e3e9131f1b0c6bf0901b49db69074d709dba62e0d9fc8e7763446af0760894c81b33cd5f4123575c273a5f54d848ccba45dafbf92f617085742957265057679adeed1bab82e54a35107ac68eb210ce32581c2cd2af2c3ffcfc2bd49189ac7f084c5f914bc6b95e596efb342d253d54aa012c4ae12765309560e9df7d3a6498850f28a2c9720a2be4e78ef0565b74ba11688de31c70842247ca47b9e9dbc60005e6297e393fca7fe5b7b25dfe4537f4bbee63ef0db0179421c6e856c7db64430fba5379293b2a5ee20ad3f53d5c9f4286b57c1f81d6ab7562ab627811ca62d9fe7f4d0318397a82ab6acbe1b41f5e4895f56fbda5ad35e7d5594107e5357f44a3d402ac8bd679f84e110eefdda6b158249fc461dff4506749c4214edc539d3b3cd0b832790435192f24482ae6e9a1517b219fac7456c98017bbf37a9b088a492bc3838e01de47c97981a2e5fef3865b7352fbd7f4f21fac48cd26f06f94935eadf200f25aaea60ab2c1f4b89fcb7fa5c54904b3ea2284f6ce45265c1fd901c8582886ee9a655dd21287945b014e50acce65fc4bbdb6134699fac2638f7c1294108152e4ca0f7f90c3ede5fab08092d83acac348362f4c949428925b56eb247c5b339a0b1201b2cb18e046fa530491cd046e9405bf4ad6ebadb824a87124a80094ddbdf76b9055b1be0bb20705f0025c7d30efa16ad7b229e7108 MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url1 = "https://www.facebook.com/" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaVR = "{2984A9DB-5689-43AD-877D-14999A15DD46}" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaVR = "6e-1" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\bestrealprizes.life\Total = "0" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaVR = "Microsoft Mark Mobile - English (United States)" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History\CacheLimit = "1" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main\OperationalData = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url3 = "https://signin.ebay.com/ws/ebayisapi.dll" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CacheLimit = "256000" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CacheLimit = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaVR = "- 0001 ! 0002 & 0003 , 0004 . 0005 ? 0006 _ 0007 + 0008 * 0009 1 000A 2 000B 3 000C 4 000D 5 000E a 000F ai 0010 an 0011 ang 0012 ao 0013 ba 0014 bai 0015 ban 0016 bang 0017 bao 0018 bei 0019 ben 001A beng 001B bi 001C bian 001D biao 001E bie 001F bin 0020 bing 0021 bo 0022 bu 0023 ca 0024 cai 0025 can 0026 cang 0027 cao 0028 ce 0029 cen 002A ceng 002B cha 002C chai 002D chan 002E chang 002F chao 0030 che 0031 chen 0032 cheng 0033 chi 0034 chong 0035 chou 0036 chu 0037 chuai 0038 chuan 0039 chuang 003A chui 003B chun 003C chuo 003D ci 003E cong 003F cou 0040 cu 0041 cuan 0042 cui 0043 cun 0044 cuo 0045 da 0046 dai 0047 dan 0048 dang 0049 dao 004A de 004B dei 004C den 004D deng 004E di 004F dia 0050 dian 0051 diao 0052 die 0053 ding 0054 diu 0055 dong 0056 dou 0057 du 0058 duan 0059 dui 005A dun 005B duo 005C e 005D ei 005E en 005F er 0060 fa 0061 fan 0062 fang 0063 fei 0064 fen 0065 feng 0066 fo 0067 fou 0068 fu 0069 ga 006A gai 006B gan 006C gang 006D gao 006E ge 006F gei 0070 gen 0071 geng 0072 gong 0073 gou 0074 gu 0075 gua 0076 guai 0077 guan 0078 guang 0079 gui 007A gun 007B guo 007C ha 007D hai 007E han 007F hang 0080 hao 0081 he 0082 hei 0083 hen 0084 heng 0085 hong 0086 hou 0087 hu 0088 hua 0089 huai 008A huan 008B huang 008C hui 008D hun 008E huo 008F ji 0090 jia 0091 jian 0092 jiang 0093 jiao 0094 jie 0095 jin 0096 jing 0097 jiong 0098 jiu 0099 ju 009A juan 009B jue 009C jun 009D ka 009E kai 009F kan 00A0 kang 00A1 kao 00A2 ke 00A3 kei 00A4 ken 00A5 keng 00A6 kong 00A7 kou 00A8 ku 00A9 kua 00AA kuai 00AB kuan 00AC kuang 00AD kui 00AE kun 00AF kuo 00B0 la 00B1 lai 00B2 lan 00B3 lang 00B4 lao 00B5 le 00B6 lei 00B7 leng 00B8 li 00B9 lia 00BA lian 00BB liang 00BC liao 00BD lie 00BE lin 00BF ling 00C0 liu 00C1 lo 00C2 long 00C3 lou 00C4 lu 00C5 luan 00C6 lue 00C7 lun 00C8 luo 00C9 lv 00CA ma 00CB mai 00CC man 00CD mang 00CE mao 00CF me 00D0 mei 00D1 men 00D2 meng 00D3 mi 00D4 mian 00D5 miao 00D6 mie 00D7 min 00D8 ming 00D9 miu 00DA mo 00DB mou 00DC mu 00DD na 00DE nai 00DF nan 00E0 nang 00E1 nao 00E2 ne 00E3 nei 00E4 nen 00E5 neng 00E6 ni 00E7 nian 00E8 niang 00E9 niao 00EA nie 00EB nin 00EC ning 00ED niu 00EE nong 00EF nou 00F0 nu 00F1 nuan 00F2 nue 00F3 nuo 00F4 nv 00F5 o 00F6 ou 00F7 pa 00F8 pai 00F9 pan 00FA pang 00FB pao 00FC pei 00FD pen 00FE peng 00FF pi 0100 pian 0101 piao 0102 pie 0103 pin 0104 ping 0105 po 0106 pou 0107 pu 0108 qi 0109 qia 010A qian 010B qiang 010C qiao 010D qie 010E qin 010F qing 0110 qiong 0111 qiu 0112 qu 0113 quan 0114 que 0115 qun 0116 ran 0117 rang 0118 rao 0119 re 011A ren 011B reng 011C ri 011D rong 011E rou 011F ru 0120 ruan 0121 rui 0122 run 0123 ruo 0124 sa 0125 sai 0126 san 0127 sang 0128 sao 0129 se 012A sen 012B seng 012C sha 012D shai 012E shan 012F shang 0130 shao 0131 she 0132 shei 0133 shen 0134 sheng 0135 shi 0136 shou 0137 shu 0138 shua 0139 shuai 013A shuan 013B shuang 013C shui 013D shun 013E shuo 013F si 0140 song 0141 sou 0142 su 0143 suan 0144 sui 0145 sun 0146 suo 0147 ta 0148 tai 0149 tan 014A tang 014B tao 014C te 014D tei 014E teng 014F ti 0150 tian 0151 tiao 0152 tie 0153 ting 0154 tong 0155 tou 0156 tu 0157 tuan 0158 tui 0159 tun 015A tuo 015B wa 015C wai 015D wan 015E wang 015F wei 0160 wen 0161 weng 0162 wo 0163 wu 0164 xi 0165 xia 0166 xian 0167 xiang 0168 xiao 0169 xie 016A xin 016B xing 016C xiong 016D xiu 016E xu 016F xuan 0170 xue 0171 xun 0172 ya 0173 yan 0174 yang 0175 yao 0176 ye 0177 yi 0178 yin 0179 ying 017A yo 017B yong 017C you 017D yu 017E yuan 017F yue 0180 yun 0181 za 0182 zai 0183 zan 0184 zang 0185 zao 0186 ze 0187 zei 0188 zen 0189 zeng 018A zha 018B zhai 018C zhan 018D zhang 018E zhao 018F zhe 0190 zhei 0191 zhen 0192 zheng 0193 zhi 0194 zhong 0195 zhou 0196 zhu 0197 zhua 0198 zhuai 0199 zhuan 019A zhuang 019B zhui 019C zhun 019D zhuo 019E zi 019F zong 01A0 zou 01A1 zu 01A2 zuan 01A3 zui 01A4 zun 01A5 zuo 01A6" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaVR = "Japanese Phone Converter" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DomStorageState\EdpState = "0" MicrosoftEdgeCP.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
29466d5093964da3c192dd90ae1af32d46d3161eabfc9181119fa899fd885af3.exepid process 2424 29466d5093964da3c192dd90ae1af32d46d3161eabfc9181119fa899fd885af3.exe 2424 29466d5093964da3c192dd90ae1af32d46d3161eabfc9181119fa899fd885af3.exe 2276 2276 2276 2276 2276 2276 2276 2276 2276 2276 2276 2276 2276 2276 2276 2276 2276 2276 2276 2276 2276 2276 2276 2276 2276 2276 2276 2276 2276 2276 2276 2276 2276 2276 2276 2276 2276 2276 2276 2276 2276 2276 2276 2276 2276 2276 2276 2276 2276 2276 2276 2276 2276 2276 2276 2276 2276 2276 2276 2276 2276 2276 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2276 -
Suspicious behavior: MapViewOfSection 41 IoCs
Processes:
29466d5093964da3c192dd90ae1af32d46d3161eabfc9181119fa899fd885af3.exeexplorer.exeexplorer.exeMicrosoftEdgeCP.exepid process 2424 29466d5093964da3c192dd90ae1af32d46d3161eabfc9181119fa899fd885af3.exe 2276 2276 2276 2276 2276 2276 2276 2276 2276 2276 2276 2276 2276 2276 2276 2276 2276 2276 61296 explorer.exe 61296 explorer.exe 61296 explorer.exe 61296 explorer.exe 82860 explorer.exe 82860 explorer.exe 82860 explorer.exe 82860 explorer.exe 7772 MicrosoftEdgeCP.exe 7772 MicrosoftEdgeCP.exe 82860 explorer.exe 82860 explorer.exe 61296 explorer.exe 61296 explorer.exe 61296 explorer.exe 61296 explorer.exe 61296 explorer.exe 61296 explorer.exe 82860 explorer.exe 82860 explorer.exe 82860 explorer.exe 82860 explorer.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
Processes:
powershell.exepowershell.exeAppLaunch.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exedescription pid process Token: SeShutdownPrivilege 2276 Token: SeCreatePagefilePrivilege 2276 Token: SeShutdownPrivilege 2276 Token: SeCreatePagefilePrivilege 2276 Token: SeShutdownPrivilege 2276 Token: SeCreatePagefilePrivilege 2276 Token: SeShutdownPrivilege 2276 Token: SeCreatePagefilePrivilege 2276 Token: SeShutdownPrivilege 2276 Token: SeCreatePagefilePrivilege 2276 Token: SeDebugPrivilege 3596 powershell.exe Token: SeDebugPrivilege 648 powershell.exe Token: SeDebugPrivilege 82676 AppLaunch.exe Token: SeShutdownPrivilege 2276 Token: SeCreatePagefilePrivilege 2276 Token: SeTakeOwnershipPrivilege 2276 Token: SeRestorePrivilege 2276 Token: SeShutdownPrivilege 2276 Token: SeCreatePagefilePrivilege 2276 Token: SeDebugPrivilege 7304 MicrosoftEdge.exe Token: SeDebugPrivilege 7304 MicrosoftEdge.exe Token: SeDebugPrivilege 7304 MicrosoftEdge.exe Token: SeDebugPrivilege 7304 MicrosoftEdge.exe Token: SeShutdownPrivilege 2276 Token: SeCreatePagefilePrivilege 2276 Token: SeDebugPrivilege 7864 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 7864 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 7864 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 7864 MicrosoftEdgeCP.exe Token: SeShutdownPrivilege 2276 Token: SeCreatePagefilePrivilege 2276 Token: SeShutdownPrivilege 2276 Token: SeCreatePagefilePrivilege 2276 Token: SeDebugPrivilege 8488 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 8488 MicrosoftEdgeCP.exe Token: SeShutdownPrivilege 2276 Token: SeCreatePagefilePrivilege 2276 Token: SeShutdownPrivilege 2276 Token: SeCreatePagefilePrivilege 2276 Token: SeShutdownPrivilege 2276 Token: SeCreatePagefilePrivilege 2276 Token: SeShutdownPrivilege 2276 Token: SeCreatePagefilePrivilege 2276 Token: SeShutdownPrivilege 2276 Token: SeCreatePagefilePrivilege 2276 -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
MicrosoftEdge.exeMicrosoftEdgeCP.exepid process 2276 7304 MicrosoftEdge.exe 7772 MicrosoftEdgeCP.exe 7772 MicrosoftEdgeCP.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2A5D.exe1AFA.exe2F5F.exeMicrosoftEdgeCP.exeAppLaunch.exedescription pid process target process PID 2276 wrote to memory of 2132 2276 1AFA.exe PID 2276 wrote to memory of 2132 2276 1AFA.exe PID 2276 wrote to memory of 2132 2276 1AFA.exe PID 2276 wrote to memory of 5032 2276 2A5D.exe PID 2276 wrote to memory of 5032 2276 2A5D.exe PID 2276 wrote to memory of 5032 2276 2A5D.exe PID 2276 wrote to memory of 23972 2276 2F5F.exe PID 2276 wrote to memory of 23972 2276 2F5F.exe PID 2276 wrote to memory of 23972 2276 2F5F.exe PID 2276 wrote to memory of 39516 2276 explorer.exe PID 2276 wrote to memory of 39516 2276 explorer.exe PID 2276 wrote to memory of 39516 2276 explorer.exe PID 2276 wrote to memory of 39516 2276 explorer.exe PID 2276 wrote to memory of 61296 2276 explorer.exe PID 2276 wrote to memory of 61296 2276 explorer.exe PID 2276 wrote to memory of 61296 2276 explorer.exe PID 5032 wrote to memory of 82676 5032 2A5D.exe AppLaunch.exe PID 5032 wrote to memory of 82676 5032 2A5D.exe AppLaunch.exe PID 5032 wrote to memory of 82676 5032 2A5D.exe AppLaunch.exe PID 2276 wrote to memory of 82692 2276 explorer.exe PID 2276 wrote to memory of 82692 2276 explorer.exe PID 2276 wrote to memory of 82692 2276 explorer.exe PID 2276 wrote to memory of 82692 2276 explorer.exe PID 5032 wrote to memory of 82676 5032 2A5D.exe AppLaunch.exe PID 5032 wrote to memory of 82676 5032 2A5D.exe AppLaunch.exe PID 2276 wrote to memory of 82860 2276 explorer.exe PID 2276 wrote to memory of 82860 2276 explorer.exe PID 2276 wrote to memory of 82860 2276 explorer.exe PID 2276 wrote to memory of 82372 2276 explorer.exe PID 2276 wrote to memory of 82372 2276 explorer.exe PID 2276 wrote to memory of 82372 2276 explorer.exe PID 2276 wrote to memory of 82372 2276 explorer.exe PID 2276 wrote to memory of 82556 2276 explorer.exe PID 2276 wrote to memory of 82556 2276 explorer.exe PID 2276 wrote to memory of 82556 2276 explorer.exe PID 2276 wrote to memory of 82556 2276 explorer.exe PID 2276 wrote to memory of 5036 2276 explorer.exe PID 2276 wrote to memory of 5036 2276 explorer.exe PID 2276 wrote to memory of 5036 2276 explorer.exe PID 2276 wrote to memory of 5036 2276 explorer.exe PID 2276 wrote to memory of 3456 2276 explorer.exe PID 2276 wrote to memory of 3456 2276 explorer.exe PID 2276 wrote to memory of 3456 2276 explorer.exe PID 2132 wrote to memory of 3596 2132 1AFA.exe powershell.exe PID 2132 wrote to memory of 3596 2132 1AFA.exe powershell.exe PID 2132 wrote to memory of 3596 2132 1AFA.exe powershell.exe PID 2276 wrote to memory of 4788 2276 explorer.exe PID 2276 wrote to memory of 4788 2276 explorer.exe PID 2276 wrote to memory of 4788 2276 explorer.exe PID 2276 wrote to memory of 4788 2276 explorer.exe PID 23972 wrote to memory of 648 23972 2F5F.exe powershell.exe PID 23972 wrote to memory of 648 23972 2F5F.exe powershell.exe PID 23972 wrote to memory of 648 23972 2F5F.exe powershell.exe PID 7772 wrote to memory of 7864 7772 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 7772 wrote to memory of 7864 7772 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 7772 wrote to memory of 7864 7772 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 7772 wrote to memory of 7864 7772 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 7772 wrote to memory of 7864 7772 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 7772 wrote to memory of 7864 7772 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 82676 wrote to memory of 8280 82676 AppLaunch.exe setup.exe PID 82676 wrote to memory of 8280 82676 AppLaunch.exe setup.exe PID 7772 wrote to memory of 7864 7772 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 7772 wrote to memory of 7864 7772 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 7772 wrote to memory of 7864 7772 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\29466d5093964da3c192dd90ae1af32d46d3161eabfc9181119fa899fd885af3.exe"C:\Users\Admin\AppData\Local\Temp\29466d5093964da3c192dd90ae1af32d46d3161eabfc9181119fa899fd885af3.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2424
-
C:\Users\Admin\AppData\Local\Temp\1AFA.exeC:\Users\Admin\AppData\Local\Temp\1AFA.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAyADMA2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3596
-
C:\Users\Admin\AppData\Local\Temp\2A5D.exeC:\Users\Admin\AppData\Local\Temp\2A5D.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:82676 -
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:8280 -
C:\Users\Admin\AppData\Local\Temp\setup1.exe"C:\Users\Admin\AppData\Local\Temp\setup1.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:8708 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /TN Cache-S-21-2946144819-3e21f723 /TR "C:\Users\Admin\AppData\Local\cache\MoUSO.exe"5⤵
- Creates scheduled task(s)
PID:9192 -
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:9344 -
C:\Users\Admin\AppData\Local\Temp\setup1.exe"C:\Users\Admin\AppData\Local\Temp\setup1.exe"5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:9672 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /TN Cache-S-21-2946144819-3e21f723 /TR "C:\Users\Admin\AppData\Local\cache\MoUSO.exe"6⤵
- Creates scheduled task(s)
PID:10148 -
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:10280 -
C:\Users\Admin\AppData\Local\Temp\setup1.exe"C:\Users\Admin\AppData\Local\Temp\setup1.exe"6⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:10372 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /TN Cache-S-21-2946144819-3e21f723 /TR "C:\Users\Admin\AppData\Local\cache\MoUSO.exe"7⤵
- Creates scheduled task(s)
PID:10844
-
C:\Users\Admin\AppData\Local\Temp\2F5F.exeC:\Users\Admin\AppData\Local\Temp\2F5F.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:23972 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAyADMA2⤵
- Suspicious use of AdjustPrivilegeToken
PID:648
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:39516
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
PID:61296
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:82692
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
PID:82860
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:82372
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:82556
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:5036
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:3456
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:4788
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:7304
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
PID:7360
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:7772
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:7864
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:8488
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:9400
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:9488
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751Filesize
717B
MD5ec8ff3b1ded0246437b1472c69dd1811
SHA1d813e874c2524e3a7da6c466c67854ad16800326
SHA256e634c2d1ed20e0638c95597adf4c9d392ebab932d3353f18af1e4421f4bb9cab
SHA512e967b804cbf2d6da30a532cbc62557d09bd236807790040c6bee5584a482dc09d724fc1d9ac0de6aa5b4e8b1fff72c8ab3206222cc2c95a91035754ac1257552
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2BC2D09D2C3B9097A22A2E8DDF9B7F10Filesize
503B
MD556441aaaa631085856e0e62a6ce06143
SHA11cde68dc58c5fcd2340544f601808ec14de745ea
SHA256e59b847e6bee0f8b70f352fd59be25cb5dada9f2366941dbe0baf6e184ef6eb5
SHA51241a88b6e76c6865dc6563bea5c7a6feba326dfcd02814a728cf8afb4b22cda1a240547a8f3aee13247e6cda227c09278263ab379a180d4b5f2340c0085053047
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27Filesize
1KB
MD5a7d26b4f14102aabc0885c9af8c8adcd
SHA10085a4097a3ad0f50cbdf6faef490cd8a66dd6be
SHA2564676b39887d2c4dcb2a94e0c7858b79ae044089f7991c92b7360b7a340611b47
SHA512698eb0eb52d842eab218d3c1a88c9cb452bf2ca989eab22e39b830943bcd291e86cc5e983458aa7dbb4244053487b43ddf66cf98e94cb169a5d4af524659d6c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9FF67FB3141440EED32363089565AE60_B0B75E4FA8953592512F0FA436A73A4EFilesize
279B
MD505bbcb3e1ef96cf12540a73b0d947281
SHA103e525daf19aa696b0edff58a5903881f6433cd6
SHA2568f99acba4efc4a9d8b98a894bf18236dcd2ef1992ef60c6759efe488684eacf1
SHA512a9dc5bd11bcf871c9dffb593fb11de2b57abbad2c5ec1af07ed59c0aab3db35a25c5ab16b2b83ed0c30a88d48ddbd07c954c2d0823d0caed36a1a18bbe8483f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751Filesize
192B
MD55708ab531b6b5e5f8d849abe3658dec6
SHA10a66af1468230fa60e262d940dc87c34fe4ed6ee
SHA2560c91cc034f5cf6c393870d1d587f20e83165edbfb68c0c1c635ffb2714137037
SHA512f36b461a9c0865badbb5b7159f7f3a55bacb1491bb2a11a63f9e80e817194830700f3579b6cfc984feb014ba2585178193d22b200c227e56a52633e5c5dff63a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2BC2D09D2C3B9097A22A2E8DDF9B7F10Filesize
548B
MD5c802c3b6e5324d711c7821200514b583
SHA1b8e3af61eafbad6045db9bdc241b3287511ce46d
SHA256a9e6494e13ba4586d73c38c443c95fbb8302dffea58ff851ddabf0c597928674
SHA512cf1845a5f0332707c7e6fe1ff22186473f21dfed11fca32f998339b267dbc9b2cbdd78173eb9bdeb72b6c3f954be64a37129948be0e4e819ca3bbbfa8404b25b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27Filesize
408B
MD55bce34bb0b3e6b1800597634932f4ef3
SHA190735a92190cde1e73abc2f60f800cfb2f47212d
SHA256152556e7ee6bea7dccbe7d3f47af5f80f6df1860ad2613ee4a159928b878a8c9
SHA512a4238587a8e4a2f9da452cec5815de33d711a7d1dfb05d17a47befefd5b9171174f8d877d3818f1bcc97d58a8ba3b37f4a0e70aa22e60c1c3c96af7de5141591
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9FF67FB3141440EED32363089565AE60_B0B75E4FA8953592512F0FA436A73A4EFilesize
396B
MD5241262cd089541c183a66a0dadf10615
SHA1275d8eaf34517742152d86aded250ceeb0234808
SHA256d98eabac19f8578169b1abfcd7aad0cd6d5aaaf928188390d222f820947bddba
SHA5123058b2507c5661e5c7d9897df30db196d27c49daffb417dfdbc3f83bb013e8e691d22a3488b40febc5a024e3305fe29f3f02e685ff585bb3f587c7c92f530863
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7C1KFYRT\configure[1].phpFilesize
5B
MD5fda44910deb1a460be4ac5d56d61d837
SHA1f6d0c643351580307b2eaa6a7560e76965496bc7
SHA256933b971c6388d594a23fa1559825db5bec8ade2db1240aa8fc9d0c684949e8c9
SHA51257dda9aa7c29f960cd7948a4e4567844d3289fa729e9e388e7f4edcbdf16bf6a94536598b4f9ff8942849f1f96bd3c00bc24a75e748a36fbf2a145f63bf904c1
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7C1KFYRT\configure[1].phpFilesize
1B
MD526b17225b626fb9238849fd60eabdf60
SHA1a979ef10cc6f6a36df6b8a323307ee3bb2e2db9c
SHA256a318c24216defe206feeb73ef5be00033fa9c4a74d0b967f6532a26ca5906d3b
SHA512603e4eaa411769b6d83a13bf2fde63289322343f8c683ff61d832201e1cf4d3e432a1d9819e327fe14da61ab65ee70dee39d4a3f88a71530bde2cae73d36710b
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8895F70B\configure[1].phpFilesize
1B
MD526b17225b626fb9238849fd60eabdf60
SHA1a979ef10cc6f6a36df6b8a323307ee3bb2e2db9c
SHA256a318c24216defe206feeb73ef5be00033fa9c4a74d0b967f6532a26ca5906d3b
SHA512603e4eaa411769b6d83a13bf2fde63289322343f8c683ff61d832201e1cf4d3e432a1d9819e327fe14da61ab65ee70dee39d4a3f88a71530bde2cae73d36710b
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\X4NN93UB\configure[1].phpFilesize
5B
MD5fda44910deb1a460be4ac5d56d61d837
SHA1f6d0c643351580307b2eaa6a7560e76965496bc7
SHA256933b971c6388d594a23fa1559825db5bec8ade2db1240aa8fc9d0c684949e8c9
SHA51257dda9aa7c29f960cd7948a4e4567844d3289fa729e9e388e7f4edcbdf16bf6a94536598b4f9ff8942849f1f96bd3c00bc24a75e748a36fbf2a145f63bf904c1
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCacheFilesize
45KB
MD55f640bd48e2547b4c1a7421f080f815f
SHA1a8f4a743f5b7da5cba7b8e6fb1d7ad4d67fefc6a
SHA256916c83c7c8d059aea295523b8b3f24e1e2436df894f7fae26c47c9bad04baa9c
SHA512a6ac100a351946b1bbb40c98aeda6e16e12f90f81063aff08c16d4d9afec8ed65c2cbcf25b42946627d67653f75740b1137dab625c99e9492ba35aba68b79a8e
-
C:\Users\Admin\AppData\Local\Temp\1AFA.exeFilesize
1.1MB
MD5137b9eea525bfc1e54784bb2f450b8b9
SHA1e34f7a90d8f1994413184f819d23869e7bb273b1
SHA2561b4b2a3aaa2f2c85b12f84e346b947230bbe6ae2af7883f2019549ba6c295d26
SHA5123aeff673467741685ff1819dc5089a7088c12d9d16cc0f72507c1703c4f85639eb28801feeec8bf71a1d500938cb556db724e6f0e4d3876aea7517b6fcdccb8c
-
C:\Users\Admin\AppData\Local\Temp\1AFA.exeFilesize
1.1MB
MD5137b9eea525bfc1e54784bb2f450b8b9
SHA1e34f7a90d8f1994413184f819d23869e7bb273b1
SHA2561b4b2a3aaa2f2c85b12f84e346b947230bbe6ae2af7883f2019549ba6c295d26
SHA5123aeff673467741685ff1819dc5089a7088c12d9d16cc0f72507c1703c4f85639eb28801feeec8bf71a1d500938cb556db724e6f0e4d3876aea7517b6fcdccb8c
-
C:\Users\Admin\AppData\Local\Temp\2A5D.exeFilesize
2.6MB
MD50b9978d5b7c98f448f01a37add0d1cab
SHA17faccb84b6e5f026ae2c9a57c85f44ae17ae8cfa
SHA256dc2879d1ea852d721808045d04e9c98dca28623ace248eb2efdd84701255cd68
SHA512e24b09ee83b9a4a36ca5594f1c12e9015b7f9eeb103de1a6bbe82ad5d453282fe834d5d5190886df7e8814bccd8dca7ec4009965717b6b57716f0907d8298b7e
-
C:\Users\Admin\AppData\Local\Temp\2A5D.exeFilesize
2.6MB
MD50b9978d5b7c98f448f01a37add0d1cab
SHA17faccb84b6e5f026ae2c9a57c85f44ae17ae8cfa
SHA256dc2879d1ea852d721808045d04e9c98dca28623ace248eb2efdd84701255cd68
SHA512e24b09ee83b9a4a36ca5594f1c12e9015b7f9eeb103de1a6bbe82ad5d453282fe834d5d5190886df7e8814bccd8dca7ec4009965717b6b57716f0907d8298b7e
-
C:\Users\Admin\AppData\Local\Temp\2F5F.exeFilesize
1.1MB
MD5137b9eea525bfc1e54784bb2f450b8b9
SHA1e34f7a90d8f1994413184f819d23869e7bb273b1
SHA2561b4b2a3aaa2f2c85b12f84e346b947230bbe6ae2af7883f2019549ba6c295d26
SHA5123aeff673467741685ff1819dc5089a7088c12d9d16cc0f72507c1703c4f85639eb28801feeec8bf71a1d500938cb556db724e6f0e4d3876aea7517b6fcdccb8c
-
C:\Users\Admin\AppData\Local\Temp\2F5F.exeFilesize
1.1MB
MD5137b9eea525bfc1e54784bb2f450b8b9
SHA1e34f7a90d8f1994413184f819d23869e7bb273b1
SHA2561b4b2a3aaa2f2c85b12f84e346b947230bbe6ae2af7883f2019549ba6c295d26
SHA5123aeff673467741685ff1819dc5089a7088c12d9d16cc0f72507c1703c4f85639eb28801feeec8bf71a1d500938cb556db724e6f0e4d3876aea7517b6fcdccb8c
-
C:\Users\Admin\AppData\Local\Temp\setup.exeFilesize
3.2MB
MD5d4bfc3207e75c9abec7f189615ea74b3
SHA13210f5a8f4d4a81a8f928fc1a5510cd7703c5fc6
SHA2561ebbaa7747ec547b511fa90255cc4cb1c6993bbe9a112a650cfbd2c532cf2cfa
SHA51202371b8da448c7de945174cd8a2b609046b2627270682a8e7384e42d9c7b9909d0f5f9c50d170965f92843ce649505b0ce4c833ba4158585b3cea219f5e5ca65
-
C:\Users\Admin\AppData\Local\Temp\setup.exeFilesize
3.2MB
MD5d4bfc3207e75c9abec7f189615ea74b3
SHA13210f5a8f4d4a81a8f928fc1a5510cd7703c5fc6
SHA2561ebbaa7747ec547b511fa90255cc4cb1c6993bbe9a112a650cfbd2c532cf2cfa
SHA51202371b8da448c7de945174cd8a2b609046b2627270682a8e7384e42d9c7b9909d0f5f9c50d170965f92843ce649505b0ce4c833ba4158585b3cea219f5e5ca65
-
C:\Users\Admin\AppData\Local\Temp\setup.exeFilesize
3.2MB
MD5d4bfc3207e75c9abec7f189615ea74b3
SHA13210f5a8f4d4a81a8f928fc1a5510cd7703c5fc6
SHA2561ebbaa7747ec547b511fa90255cc4cb1c6993bbe9a112a650cfbd2c532cf2cfa
SHA51202371b8da448c7de945174cd8a2b609046b2627270682a8e7384e42d9c7b9909d0f5f9c50d170965f92843ce649505b0ce4c833ba4158585b3cea219f5e5ca65
-
C:\Users\Admin\AppData\Local\Temp\setup.exeFilesize
3.2MB
MD5d4bfc3207e75c9abec7f189615ea74b3
SHA13210f5a8f4d4a81a8f928fc1a5510cd7703c5fc6
SHA2561ebbaa7747ec547b511fa90255cc4cb1c6993bbe9a112a650cfbd2c532cf2cfa
SHA51202371b8da448c7de945174cd8a2b609046b2627270682a8e7384e42d9c7b9909d0f5f9c50d170965f92843ce649505b0ce4c833ba4158585b3cea219f5e5ca65
-
C:\Users\Admin\AppData\Local\Temp\setup1.exeFilesize
1.3MB
MD5e70bfbf7289b66c7f21178f383c2add7
SHA1e2b4360ea38df22d9917ff8e421a0c39989b909b
SHA2568da15357512a82836f66ba3e01498e10ffd19cf2df6a49e3caa4bc6b36af4ac1
SHA512ed51286e5629ff76aa501d0453e7f3ec60a7d1b428cd4a474b7c059eda7137a82b154918b21cb746f305300e6c1671be01be7acfc3b947fbe8f21f0217ee3d0f
-
C:\Users\Admin\AppData\Local\Temp\setup1.exeFilesize
1.3MB
MD5e70bfbf7289b66c7f21178f383c2add7
SHA1e2b4360ea38df22d9917ff8e421a0c39989b909b
SHA2568da15357512a82836f66ba3e01498e10ffd19cf2df6a49e3caa4bc6b36af4ac1
SHA512ed51286e5629ff76aa501d0453e7f3ec60a7d1b428cd4a474b7c059eda7137a82b154918b21cb746f305300e6c1671be01be7acfc3b947fbe8f21f0217ee3d0f
-
C:\Users\Admin\AppData\Local\Temp\setup1.exeFilesize
1.3MB
MD5e70bfbf7289b66c7f21178f383c2add7
SHA1e2b4360ea38df22d9917ff8e421a0c39989b909b
SHA2568da15357512a82836f66ba3e01498e10ffd19cf2df6a49e3caa4bc6b36af4ac1
SHA512ed51286e5629ff76aa501d0453e7f3ec60a7d1b428cd4a474b7c059eda7137a82b154918b21cb746f305300e6c1671be01be7acfc3b947fbe8f21f0217ee3d0f
-
C:\Users\Admin\AppData\Local\Temp\setup1.exeFilesize
1.3MB
MD5e70bfbf7289b66c7f21178f383c2add7
SHA1e2b4360ea38df22d9917ff8e421a0c39989b909b
SHA2568da15357512a82836f66ba3e01498e10ffd19cf2df6a49e3caa4bc6b36af4ac1
SHA512ed51286e5629ff76aa501d0453e7f3ec60a7d1b428cd4a474b7c059eda7137a82b154918b21cb746f305300e6c1671be01be7acfc3b947fbe8f21f0217ee3d0f
-
C:\Users\Admin\AppData\Local\cache\MoUSO.exeFilesize
1.3MB
MD5e70bfbf7289b66c7f21178f383c2add7
SHA1e2b4360ea38df22d9917ff8e421a0c39989b909b
SHA2568da15357512a82836f66ba3e01498e10ffd19cf2df6a49e3caa4bc6b36af4ac1
SHA512ed51286e5629ff76aa501d0453e7f3ec60a7d1b428cd4a474b7c059eda7137a82b154918b21cb746f305300e6c1671be01be7acfc3b947fbe8f21f0217ee3d0f
-
memory/648-707-0x0000000000000000-mapping.dmp
-
memory/2132-338-0x0000000008010000-0x0000000008360000-memory.dmpFilesize
3.3MB
-
memory/2132-182-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2132-328-0x0000000005B50000-0x0000000005B72000-memory.dmpFilesize
136KB
-
memory/2132-324-0x0000000005A50000-0x0000000005AE2000-memory.dmpFilesize
584KB
-
memory/2132-208-0x0000000007DD0000-0x0000000007EF4000-memory.dmpFilesize
1.1MB
-
memory/2132-193-0x00000000000C0000-0x00000000001E4000-memory.dmpFilesize
1.1MB
-
memory/2132-186-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2132-185-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2132-153-0x0000000000000000-mapping.dmp
-
memory/2132-184-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2132-155-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2132-156-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2132-157-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2132-158-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2132-159-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2132-160-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2132-183-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2132-161-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2132-163-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2132-164-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2132-165-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2132-166-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2132-167-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2132-168-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2132-169-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2132-170-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2132-171-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2132-172-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2132-173-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2132-174-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2132-175-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2132-176-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2132-177-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2132-178-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2132-179-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2132-180-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2132-181-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-116-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-129-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-145-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-152-0x0000000000400000-0x0000000000586000-memory.dmpFilesize
1.5MB
-
memory/2424-151-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-140-0x0000000000590000-0x000000000063E000-memory.dmpFilesize
696KB
-
memory/2424-139-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-150-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-143-0x0000000000400000-0x0000000000586000-memory.dmpFilesize
1.5MB
-
memory/2424-149-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-146-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-142-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-117-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-141-0x00000000001D0000-0x00000000001D9000-memory.dmpFilesize
36KB
-
memory/2424-118-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-119-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-120-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-121-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-122-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-123-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-124-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-125-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-148-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-147-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-115-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-126-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-127-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-138-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-128-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-137-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-144-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-136-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-131-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-135-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-134-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-133-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-132-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/3456-476-0x0000000000000000-mapping.dmp
-
memory/3456-499-0x0000000000CC0000-0x0000000000CC7000-memory.dmpFilesize
28KB
-
memory/3456-506-0x0000000000CB0000-0x0000000000CBD000-memory.dmpFilesize
52KB
-
memory/3456-901-0x0000000000CC0000-0x0000000000CC7000-memory.dmpFilesize
28KB
-
memory/3596-842-0x0000000006DB0000-0x0000000006E16000-memory.dmpFilesize
408KB
-
memory/3596-785-0x0000000006E70000-0x0000000007498000-memory.dmpFilesize
6.2MB
-
memory/3596-865-0x0000000007DB0000-0x0000000007E26000-memory.dmpFilesize
472KB
-
memory/3596-890-0x0000000008B70000-0x0000000008B8A000-memory.dmpFilesize
104KB
-
memory/3596-839-0x0000000006D40000-0x0000000006DA6000-memory.dmpFilesize
408KB
-
memory/3596-859-0x00000000075B0000-0x00000000075CC000-memory.dmpFilesize
112KB
-
memory/3596-492-0x0000000000000000-mapping.dmp
-
memory/3596-889-0x0000000009460000-0x0000000009AD8000-memory.dmpFilesize
6.5MB
-
memory/3596-764-0x0000000000DF0000-0x0000000000E26000-memory.dmpFilesize
216KB
-
memory/4788-808-0x0000000000DD0000-0x0000000000DDB000-memory.dmpFilesize
44KB
-
memory/4788-519-0x0000000000000000-mapping.dmp
-
memory/4788-1171-0x0000000000DE0000-0x0000000000DE8000-memory.dmpFilesize
32KB
-
memory/4788-806-0x0000000000DE0000-0x0000000000DE8000-memory.dmpFilesize
32KB
-
memory/5032-187-0x0000000000000000-mapping.dmp
-
memory/5036-432-0x0000000000000000-mapping.dmp
-
memory/5036-804-0x0000000000CA0000-0x0000000000CAB000-memory.dmpFilesize
44KB
-
memory/5036-761-0x0000000000CB0000-0x0000000000CB6000-memory.dmpFilesize
24KB
-
memory/5036-1165-0x0000000000CB0000-0x0000000000CB6000-memory.dmpFilesize
24KB
-
memory/7772-1331-0x000002464CD90000-0x000002464CD9C000-memory.dmpFilesize
48KB
-
memory/7772-1329-0x000002464CD70000-0x000002464CD7F000-memory.dmpFilesize
60KB
-
memory/7864-1332-0x000002AA09BF0000-0x000002AA09BFC000-memory.dmpFilesize
48KB
-
memory/7864-1330-0x000002AA07F40000-0x000002AA07F4F000-memory.dmpFilesize
60KB
-
memory/8280-1361-0x00007FFB34190000-0x00007FFB3436B000-memory.dmpFilesize
1.9MB
-
memory/8280-1360-0x00007FF7B24E0000-0x00007FF7B2D9B000-memory.dmpFilesize
8.7MB
-
memory/8280-1352-0x00007FFB34190000-0x00007FFB3436B000-memory.dmpFilesize
1.9MB
-
memory/8280-1348-0x00007FF7B24E0000-0x00007FF7B2D9B000-memory.dmpFilesize
8.7MB
-
memory/8280-1345-0x0000000000000000-mapping.dmp
-
memory/8488-1359-0x000001BE501D0000-0x000001BE501DF000-memory.dmpFilesize
60KB
-
memory/8488-1358-0x000001B64F4E0000-0x000001B64F4EC000-memory.dmpFilesize
48KB
-
memory/8708-1362-0x0000000000000000-mapping.dmp
-
memory/8708-1384-0x0000000001180000-0x00000000014D9000-memory.dmpFilesize
3.3MB
-
memory/9192-1441-0x0000000000000000-mapping.dmp
-
memory/9344-1462-0x0000000000000000-mapping.dmp
-
memory/9672-1479-0x0000000000000000-mapping.dmp
-
memory/10148-1558-0x0000000000000000-mapping.dmp
-
memory/10280-1578-0x0000000000000000-mapping.dmp
-
memory/10372-1587-0x0000000000000000-mapping.dmp
-
memory/10844-1662-0x0000000000000000-mapping.dmp
-
memory/23972-209-0x0000000000000000-mapping.dmp
-
memory/39516-493-0x0000000000420000-0x000000000042B000-memory.dmpFilesize
44KB
-
memory/39516-216-0x0000000000000000-mapping.dmp
-
memory/39516-445-0x0000000000430000-0x0000000000437000-memory.dmpFilesize
28KB
-
memory/61296-267-0x0000000000520000-0x0000000000529000-memory.dmpFilesize
36KB
-
memory/61296-750-0x0000000000520000-0x0000000000529000-memory.dmpFilesize
36KB
-
memory/61296-273-0x0000000000510000-0x000000000051F000-memory.dmpFilesize
60KB
-
memory/61296-245-0x0000000000000000-mapping.dmp
-
memory/82372-1147-0x0000000000C00000-0x0000000000C22000-memory.dmpFilesize
136KB
-
memory/82372-708-0x00000000009C0000-0x00000000009E7000-memory.dmpFilesize
156KB
-
memory/82372-702-0x0000000000C00000-0x0000000000C22000-memory.dmpFilesize
136KB
-
memory/82372-345-0x0000000000000000-mapping.dmp
-
memory/82556-385-0x0000000000000000-mapping.dmp
-
memory/82556-759-0x0000000003390000-0x0000000003399000-memory.dmpFilesize
36KB
-
memory/82556-754-0x00000000033A0000-0x00000000033A5000-memory.dmpFilesize
20KB
-
memory/82556-1164-0x00000000033A0000-0x00000000033A5000-memory.dmpFilesize
20KB
-
memory/82676-642-0x00000000091D0000-0x000000000920E000-memory.dmpFilesize
248KB
-
memory/82676-903-0x000000000A0F0000-0x000000000A182000-memory.dmpFilesize
584KB
-
memory/82676-1172-0x000000000BC60000-0x000000000C18C000-memory.dmpFilesize
5.2MB
-
memory/82676-471-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/82676-891-0x000000000A250000-0x000000000A74E000-memory.dmpFilesize
5.0MB
-
memory/82676-616-0x0000000009240000-0x000000000934A000-memory.dmpFilesize
1.0MB
-
memory/82676-1170-0x000000000AC50000-0x000000000AE12000-memory.dmpFilesize
1.8MB
-
memory/82676-610-0x0000000009740000-0x0000000009D46000-memory.dmpFilesize
6.0MB
-
memory/82676-286-0x000000000042217E-mapping.dmp
-
memory/82676-1152-0x000000000A0A0000-0x000000000A0F0000-memory.dmpFilesize
320KB
-
memory/82676-629-0x0000000009160000-0x0000000009172000-memory.dmpFilesize
72KB
-
memory/82676-657-0x0000000009350000-0x000000000939B000-memory.dmpFilesize
300KB
-
memory/82692-264-0x0000000000000000-mapping.dmp
-
memory/82692-551-0x00000000033A0000-0x00000000033A5000-memory.dmpFilesize
20KB
-
memory/82692-605-0x0000000003390000-0x0000000003399000-memory.dmpFilesize
36KB
-
memory/82860-301-0x0000000000000000-mapping.dmp
-
memory/82860-803-0x00000000008F0000-0x00000000008F6000-memory.dmpFilesize
24KB
-
memory/82860-312-0x00000000008F0000-0x00000000008F6000-memory.dmpFilesize
24KB
-
memory/82860-317-0x00000000008E0000-0x00000000008EC000-memory.dmpFilesize
48KB