Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
22-09-2022 15:49
Static task
static1
Behavioral task
behavioral1
Sample
ea5ad364a786e5d33f445948ecf0c5d0cdf3c3c52c7a3062a85eb232bba629c9.exe
Resource
win10-20220812-en
General
-
Target
ea5ad364a786e5d33f445948ecf0c5d0cdf3c3c52c7a3062a85eb232bba629c9.exe
-
Size
280KB
-
MD5
3721cccc80ae2f1eb447ce704bf52d2f
-
SHA1
c7c456c71f43f128e4905b3bb5273af5c5422d7c
-
SHA256
ea5ad364a786e5d33f445948ecf0c5d0cdf3c3c52c7a3062a85eb232bba629c9
-
SHA512
e8ef610ecdb1f28738801da00f8a7f09f78796169254d80ab16be1fe57d10082f8f63b1833eac7c0896833914e1ea2cf62701a2b07b27e35cbc6ea3e05872abc
-
SSDEEP
6144:eFuVYw16+7LeH4C24iDEBwKOcmY2R0YBy5igavwVfQr:eFaJbG4C24iQBFmYDF8F
Malware Config
Extracted
raccoon
7394a7fc5da9794209d8b0503ca4abf4
http://45.8.145.203
Extracted
djvu
http://winnlinne.com/lancer/get.php
-
extension
.ofww
-
offline_id
xkNzhkB1wvgoDI7Uo0HPNLY3qCuwoFpP7nlhlut1
-
payload_url
http://rgyui.top/dl/build2.exe
http://winnlinne.com/files/1/build3.exe
-
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-EWKSsSJiVn Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: support@bestyourmail.ch Reserve e-mail address to contact us: datarestorehelp@airmail.cc Your personal ID: 0569Jhyjd
Extracted
redline
LogsDiller Cloud (Sup: @mr_golds)
77.73.134.27:8163
-
auth_value
56c6f7b9024c076f0a96931453da7e56
Extracted
tofsee
svartalfheim.top
jotunheim.name
Signatures
-
Detected Djvu ransomware 7 IoCs
Processes:
resource yara_rule behavioral1/memory/2640-404-0x0000000002240000-0x000000000235B000-memory.dmp family_djvu behavioral1/memory/1344-405-0x0000000000424141-mapping.dmp family_djvu behavioral1/memory/1344-472-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/1344-517-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/1288-547-0x0000000000424141-mapping.dmp family_djvu behavioral1/memory/1288-622-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/1288-842-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu -
Detects Smokeloader packer 2 IoCs
Processes:
resource yara_rule behavioral1/memory/4364-151-0x0000000000530000-0x0000000000539000-memory.dmp family_smokeloader behavioral1/memory/3512-354-0x0000000000680000-0x0000000000689000-memory.dmp family_smokeloader -
Djvu Ransomware
Ransomware which is a variant of the STOP family.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/75480-939-0x000000000042217A-mapping.dmp family_redline behavioral1/memory/75480-1005-0x0000000000400000-0x0000000000428000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
Processes:
setup.exesetup.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ setup.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ setup.exe -
Creates new service(s) 1 TTPs
-
Downloads MZ/PE file
-
Executes dropped EXE 16 IoCs
Processes:
C52A.exeD539.exeDA2B.exeDA2B.exeDA2B.exeDA2B.exebuild2.exebuild2.exebuild3.exe809E.exe860D.exe8D81.exepxdqvyrm.exesetup.exemstsca.exesetup.exepid process 3512 C52A.exe 4956 D539.exe 2640 DA2B.exe 1344 DA2B.exe 4560 DA2B.exe 1288 DA2B.exe 5072 build2.exe 4760 build2.exe 2072 build3.exe 4604 809E.exe 61540 860D.exe 75732 8D81.exe 5692 pxdqvyrm.exe 9880 setup.exe 10056 mstsca.exe 10588 setup.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\iwfcyrwv\ImagePath = "C:\\Windows\\SysWOW64\\iwfcyrwv\\pxdqvyrm.exe" svchost.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
setup.exesetup.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion setup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion setup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion setup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion setup.exe -
Deletes itself 1 IoCs
Processes:
pid process 2676 -
Loads dropped DLL 3 IoCs
Processes:
regsvr32.exebuild2.exepid process 2656 regsvr32.exe 4760 build2.exe 4760 build2.exe -
Modifies file permissions 1 TTPs 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\setup.exe themida C:\Users\Admin\AppData\Local\Temp\setup.exe themida C:\Users\Admin\AppData\Local\Temp\setup.exe themida -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
DA2B.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\995af1ec-32e3-4c60-9232-b54c595f92a0\\DA2B.exe\" --AutoStart" DA2B.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
setup.exesetup.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA setup.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA setup.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 8 api.2ip.ua 15 api.2ip.ua 7 api.2ip.ua -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
D539.exesetup.exesetup.exepid process 4956 D539.exe 4956 D539.exe 9880 setup.exe 10588 setup.exe -
Suspicious use of SetThreadContext 5 IoCs
Processes:
DA2B.exeDA2B.exebuild2.exe809E.exepxdqvyrm.exedescription pid process target process PID 2640 set thread context of 1344 2640 DA2B.exe DA2B.exe PID 4560 set thread context of 1288 4560 DA2B.exe DA2B.exe PID 5072 set thread context of 4760 5072 build2.exe build2.exe PID 4604 set thread context of 75480 4604 809E.exe AppLaunch.exe PID 5692 set thread context of 7096 5692 pxdqvyrm.exe svchost.exe -
Drops file in Windows directory 3 IoCs
Processes:
MicrosoftEdge.exeMicrosoftEdgeCP.exedescription ioc process File created C:\Windows\rescache\_merged\3720402701\2219095117.pri MicrosoftEdge.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File created C:\Windows\rescache\_merged\3720402701\2219095117.pri MicrosoftEdgeCP.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exepid process 4364 sc.exe 4052 sc.exe 720 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2616 4760 WerFault.exe build2.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
C52A.exeea5ad364a786e5d33f445948ecf0c5d0cdf3c3c52c7a3062a85eb232bba629c9.exedescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C52A.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C52A.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ea5ad364a786e5d33f445948ecf0c5d0cdf3c3c52c7a3062a85eb232bba629c9.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ea5ad364a786e5d33f445948ecf0c5d0cdf3c3c52c7a3062a85eb232bba629c9.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ea5ad364a786e5d33f445948ecf0c5d0cdf3c3c52c7a3062a85eb232bba629c9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C52A.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
build2.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 build2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString build2.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 224 schtasks.exe 10256 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 4228 timeout.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 4468 taskkill.exe -
Processes:
MicrosoftEdge.exebrowser_broker.exeMicrosoftEdgeCP.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe -
Modifies registry class 64 IoCs
Processes:
MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\SOFTWARE\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Speech_OneCore\\AudioInput\\TokenEnums\\MMAudioIn\\" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\DisallowDefaultBrowserPrompt = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\SharedCookie_MRACMigrationDone = "1" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\DetectPhoneNumberComplete = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\bestrealprizes.life\NumberOf = "0" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CacheLimit = "1" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\SOFTWARE\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV = "%windir%\\Speech_OneCore\\Engines\\SR\\en-US-N\\r1033sr.lxa" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\SOFTWARE\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV = "SR en-US Lookup Lexicon" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\SOFTWARE\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV = "%windir%\\Speech_OneCore\\Engines\\SR\\en-US-N\\L1033" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\SOFTWARE\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV = 322d9a43ff74693161317f9e26a7d6bb591a6f276432e10543a70c26e1b357a5 MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\bestrealprizes.life\Total = "0" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 0000000000000000 MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\bestrealprizes.life\ = "16" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url2 = "https://login.aliexpress.com/" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Toolbar\WebBrowser MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\SOFTWARE\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV = "436;41c;401;801;c01;1001;1401;1801;1c01;2001;2401;2801;2c01;3001;3401;3801;3c01;4001;42b;42c;82c;42d;423;402;455;403;c04;1004;1404;41a;405;406;465;413;813;809;c09;1009;1409;1809;1c09;2009;2409;2809;2c09;3009;3409;425;438;429;40b;80c;c0c;100c;140c;180c;456;437;807;c07;1007;1407;408;447;40d;439;40e;40f;421;410;810;44b;457;412;812;440;426;427;827;42f;43e;83e;44e;450;414;814;415;416;816;446;418;419;44f;c1a;81a;41b;424;80a;100a;140a;180a;1c0a;200a;240a;280a;2c0a;300a;340a;380a;3c0a;400a;440a;480a;4c0a;500a;430;441;41d;81d;45a;449;444;44a;41e;41f;422;420;820;443;843;42a;540a" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\SOFTWARE\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV = "%windir%\\Speech_OneCore\\Engines\\SR\\en-US-N\\lsr1033.lxa" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\SOFTWARE\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV = "%windir%\\Speech_OneCore\\Engines\\SR\\en-US-N\\tn1033.bin" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\SOFTWARE\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV = "Microsoft Mark Mobile" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main\OperationalData = "1" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\SOFTWARE\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV = "0" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\SOFTWARE\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV = "Near" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PageSetup MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\SOFTWARE\Microsoft\Speech_OneCore MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\SOFTWARE\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV = "Microsoft Speech Recognition Engine - en-US Embedded DNN v11.1" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\SOFTWARE\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV = "{6BFCACDC-A6A6-4343-9CF6-83A83727367B}" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\MigrationTime = d581f14b6daed801 MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\SOFTWARE\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV = "Microsoft Mark Mobile - English (United States)" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = c10ff613acced801 MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url1 = "https://www.facebook.com/" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 7711e200acced801 MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\SOFTWARE\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV = "{14E74C62-DC97-43B0-8F2F-581496A65D60}" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\SOFTWARE\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV = "{179F3D56-1B0B-42B2-A962-59B7EF59FE1B}" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\SOFTWARE\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV = "{E164F996-FF93-4675-BDD8-6C47AB0B86B1}" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListInPrivateBrowsingAllowed = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\FlipAheadCompletedVersion = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\DatastoreSchemaVersion = "8" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CacheLimit = "1" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory\UUID = "{0FA33AB1-B56E-4ACB-9BF4-AC3385790346}" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\SOFTWARE\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV = "11.0.2013.1022" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\SOFTWARE\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV = "Microsoft Zira Mobile" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache MicrosoftEdge.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
ea5ad364a786e5d33f445948ecf0c5d0cdf3c3c52c7a3062a85eb232bba629c9.exepid process 4364 ea5ad364a786e5d33f445948ecf0c5d0cdf3c3c52c7a3062a85eb232bba629c9.exe 4364 ea5ad364a786e5d33f445948ecf0c5d0cdf3c3c52c7a3062a85eb232bba629c9.exe 2676 2676 2676 2676 2676 2676 2676 2676 2676 2676 2676 2676 2676 2676 2676 2676 2676 2676 2676 2676 2676 2676 2676 2676 2676 2676 2676 2676 2676 2676 2676 2676 2676 2676 2676 2676 2676 2676 2676 2676 2676 2676 2676 2676 2676 2676 2676 2676 2676 2676 2676 2676 2676 2676 2676 2676 2676 2676 2676 2676 2676 2676 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2676 -
Suspicious behavior: MapViewOfSection 46 IoCs
Processes:
ea5ad364a786e5d33f445948ecf0c5d0cdf3c3c52c7a3062a85eb232bba629c9.exeC52A.exeexplorer.exeexplorer.exeMicrosoftEdgeCP.exepid process 4364 ea5ad364a786e5d33f445948ecf0c5d0cdf3c3c52c7a3062a85eb232bba629c9.exe 2676 2676 2676 2676 3512 C52A.exe 2676 2676 2676 2676 2676 2676 2676 2676 2676 2676 2676 2676 2676 2676 2676 2676 2676 2676 3196 explorer.exe 3196 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 3196 explorer.exe 3196 explorer.exe 9436 MicrosoftEdgeCP.exe 9436 MicrosoftEdgeCP.exe 3196 explorer.exe 3196 explorer.exe 1912 explorer.exe 1912 explorer.exe 3196 explorer.exe 3196 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 3196 explorer.exe 3196 explorer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
taskkill.exeAppLaunch.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exedescription pid process Token: SeShutdownPrivilege 2676 Token: SeCreatePagefilePrivilege 2676 Token: SeShutdownPrivilege 2676 Token: SeCreatePagefilePrivilege 2676 Token: SeShutdownPrivilege 2676 Token: SeCreatePagefilePrivilege 2676 Token: SeShutdownPrivilege 2676 Token: SeCreatePagefilePrivilege 2676 Token: SeShutdownPrivilege 2676 Token: SeCreatePagefilePrivilege 2676 Token: SeDebugPrivilege 4468 taskkill.exe Token: SeShutdownPrivilege 2676 Token: SeCreatePagefilePrivilege 2676 Token: SeShutdownPrivilege 2676 Token: SeCreatePagefilePrivilege 2676 Token: SeShutdownPrivilege 2676 Token: SeCreatePagefilePrivilege 2676 Token: SeShutdownPrivilege 2676 Token: SeCreatePagefilePrivilege 2676 Token: SeShutdownPrivilege 2676 Token: SeCreatePagefilePrivilege 2676 Token: SeShutdownPrivilege 2676 Token: SeCreatePagefilePrivilege 2676 Token: SeShutdownPrivilege 2676 Token: SeCreatePagefilePrivilege 2676 Token: SeShutdownPrivilege 2676 Token: SeCreatePagefilePrivilege 2676 Token: SeShutdownPrivilege 2676 Token: SeCreatePagefilePrivilege 2676 Token: SeShutdownPrivilege 2676 Token: SeCreatePagefilePrivilege 2676 Token: SeShutdownPrivilege 2676 Token: SeCreatePagefilePrivilege 2676 Token: SeShutdownPrivilege 2676 Token: SeCreatePagefilePrivilege 2676 Token: SeShutdownPrivilege 2676 Token: SeCreatePagefilePrivilege 2676 Token: SeDebugPrivilege 75480 AppLaunch.exe Token: SeShutdownPrivilege 2676 Token: SeCreatePagefilePrivilege 2676 Token: SeShutdownPrivilege 2676 Token: SeCreatePagefilePrivilege 2676 Token: SeShutdownPrivilege 2676 Token: SeCreatePagefilePrivilege 2676 Token: SeTakeOwnershipPrivilege 2676 Token: SeRestorePrivilege 2676 Token: SeShutdownPrivilege 2676 Token: SeCreatePagefilePrivilege 2676 Token: SeDebugPrivilege 8972 MicrosoftEdge.exe Token: SeDebugPrivilege 8972 MicrosoftEdge.exe Token: SeDebugPrivilege 8972 MicrosoftEdge.exe Token: SeDebugPrivilege 8972 MicrosoftEdge.exe Token: SeShutdownPrivilege 2676 Token: SeCreatePagefilePrivilege 2676 Token: SeDebugPrivilege 9540 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 9540 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 9540 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 9540 MicrosoftEdgeCP.exe Token: SeShutdownPrivilege 2676 Token: SeCreatePagefilePrivilege 2676 Token: SeShutdownPrivilege 2676 Token: SeCreatePagefilePrivilege 2676 Token: SeDebugPrivilege 10404 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 10404 MicrosoftEdgeCP.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
MicrosoftEdge.exeMicrosoftEdgeCP.exepid process 2676 8972 MicrosoftEdge.exe 9436 MicrosoftEdgeCP.exe 9436 MicrosoftEdgeCP.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
regsvr32.exeDA2B.exeDA2B.exeDA2B.exeDA2B.exebuild2.exebuild3.exedescription pid process target process PID 2676 wrote to memory of 2696 2676 regsvr32.exe PID 2676 wrote to memory of 2696 2676 regsvr32.exe PID 2696 wrote to memory of 2656 2696 regsvr32.exe regsvr32.exe PID 2696 wrote to memory of 2656 2696 regsvr32.exe regsvr32.exe PID 2696 wrote to memory of 2656 2696 regsvr32.exe regsvr32.exe PID 2676 wrote to memory of 3512 2676 C52A.exe PID 2676 wrote to memory of 3512 2676 C52A.exe PID 2676 wrote to memory of 3512 2676 C52A.exe PID 2676 wrote to memory of 4956 2676 D539.exe PID 2676 wrote to memory of 4956 2676 D539.exe PID 2676 wrote to memory of 4956 2676 D539.exe PID 2676 wrote to memory of 2640 2676 DA2B.exe PID 2676 wrote to memory of 2640 2676 DA2B.exe PID 2676 wrote to memory of 2640 2676 DA2B.exe PID 2676 wrote to memory of 5056 2676 explorer.exe PID 2676 wrote to memory of 5056 2676 explorer.exe PID 2676 wrote to memory of 5056 2676 explorer.exe PID 2676 wrote to memory of 5056 2676 explorer.exe PID 2676 wrote to memory of 4724 2676 explorer.exe PID 2676 wrote to memory of 4724 2676 explorer.exe PID 2676 wrote to memory of 4724 2676 explorer.exe PID 2640 wrote to memory of 1344 2640 DA2B.exe DA2B.exe PID 2640 wrote to memory of 1344 2640 DA2B.exe DA2B.exe PID 2640 wrote to memory of 1344 2640 DA2B.exe DA2B.exe PID 2640 wrote to memory of 1344 2640 DA2B.exe DA2B.exe PID 2640 wrote to memory of 1344 2640 DA2B.exe DA2B.exe PID 2640 wrote to memory of 1344 2640 DA2B.exe DA2B.exe PID 2640 wrote to memory of 1344 2640 DA2B.exe DA2B.exe PID 2640 wrote to memory of 1344 2640 DA2B.exe DA2B.exe PID 2640 wrote to memory of 1344 2640 DA2B.exe DA2B.exe PID 2640 wrote to memory of 1344 2640 DA2B.exe DA2B.exe PID 1344 wrote to memory of 4024 1344 DA2B.exe icacls.exe PID 1344 wrote to memory of 4024 1344 DA2B.exe icacls.exe PID 1344 wrote to memory of 4024 1344 DA2B.exe icacls.exe PID 1344 wrote to memory of 4560 1344 DA2B.exe DA2B.exe PID 1344 wrote to memory of 4560 1344 DA2B.exe DA2B.exe PID 1344 wrote to memory of 4560 1344 DA2B.exe DA2B.exe PID 4560 wrote to memory of 1288 4560 DA2B.exe DA2B.exe PID 4560 wrote to memory of 1288 4560 DA2B.exe DA2B.exe PID 4560 wrote to memory of 1288 4560 DA2B.exe DA2B.exe PID 4560 wrote to memory of 1288 4560 DA2B.exe DA2B.exe PID 4560 wrote to memory of 1288 4560 DA2B.exe DA2B.exe PID 4560 wrote to memory of 1288 4560 DA2B.exe DA2B.exe PID 4560 wrote to memory of 1288 4560 DA2B.exe DA2B.exe PID 4560 wrote to memory of 1288 4560 DA2B.exe DA2B.exe PID 4560 wrote to memory of 1288 4560 DA2B.exe DA2B.exe PID 4560 wrote to memory of 1288 4560 DA2B.exe DA2B.exe PID 1288 wrote to memory of 5072 1288 DA2B.exe build2.exe PID 1288 wrote to memory of 5072 1288 DA2B.exe build2.exe PID 1288 wrote to memory of 5072 1288 DA2B.exe build2.exe PID 5072 wrote to memory of 4760 5072 build2.exe build2.exe PID 5072 wrote to memory of 4760 5072 build2.exe build2.exe PID 5072 wrote to memory of 4760 5072 build2.exe build2.exe PID 5072 wrote to memory of 4760 5072 build2.exe build2.exe PID 5072 wrote to memory of 4760 5072 build2.exe build2.exe PID 5072 wrote to memory of 4760 5072 build2.exe build2.exe PID 5072 wrote to memory of 4760 5072 build2.exe build2.exe PID 5072 wrote to memory of 4760 5072 build2.exe build2.exe PID 5072 wrote to memory of 4760 5072 build2.exe build2.exe PID 1288 wrote to memory of 2072 1288 DA2B.exe build3.exe PID 1288 wrote to memory of 2072 1288 DA2B.exe build3.exe PID 1288 wrote to memory of 2072 1288 DA2B.exe build3.exe PID 2072 wrote to memory of 224 2072 build3.exe schtasks.exe PID 2072 wrote to memory of 224 2072 build3.exe schtasks.exe -
outlook_office_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
outlook_win_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ea5ad364a786e5d33f445948ecf0c5d0cdf3c3c52c7a3062a85eb232bba629c9.exe"C:\Users\Admin\AppData\Local\Temp\ea5ad364a786e5d33f445948ecf0c5d0cdf3c3c52c7a3062a85eb232bba629c9.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\C1FD.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\C1FD.dll2⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\C52A.exeC:\Users\Admin\AppData\Local\Temp\C52A.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\D539.exeC:\Users\Admin\AppData\Local\Temp\D539.exe1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\DA2B.exeC:\Users\Admin\AppData\Local\Temp\DA2B.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DA2B.exeC:\Users\Admin\AppData\Local\Temp\DA2B.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\995af1ec-32e3-4c60-9232-b54c595f92a0" /deny *S-1-1-0:(OI)(CI)(DE,DC)3⤵
- Modifies file permissions
-
C:\Users\Admin\AppData\Local\Temp\DA2B.exe"C:\Users\Admin\AppData\Local\Temp\DA2B.exe" --Admin IsNotAutoStart IsNotTask3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DA2B.exe"C:\Users\Admin\AppData\Local\Temp\DA2B.exe" --Admin IsNotAutoStart IsNotTask4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\b1dc73e4-6627-4e13-b4c9-76b5fcc2a27b\build2.exe"C:\Users\Admin\AppData\Local\b1dc73e4-6627-4e13-b4c9-76b5fcc2a27b\build2.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\b1dc73e4-6627-4e13-b4c9-76b5fcc2a27b\build2.exe"C:\Users\Admin\AppData\Local\b1dc73e4-6627-4e13-b4c9-76b5fcc2a27b\build2.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" \/c taskkill /im build2.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\b1dc73e4-6627-4e13-b4c9-76b5fcc2a27b\build2.exe" & del C:\PrograData\*.dll & exit7⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im build2.exe /f8⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\timeout.exetimeout /t 68⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4760 -s 18727⤵
- Program crash
-
C:\Users\Admin\AppData\Local\b1dc73e4-6627-4e13-b4c9-76b5fcc2a27b\build3.exe"C:\Users\Admin\AppData\Local\b1dc73e4-6627-4e13-b4c9-76b5fcc2a27b\build3.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"6⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\809E.exeC:\Users\Admin\AppData\Local\Temp\809E.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\860D.exeC:\Users\Admin\AppData\Local\Temp\860D.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\iwfcyrwv\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\pxdqvyrm.exe" C:\Windows\SysWOW64\iwfcyrwv\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create iwfcyrwv binPath= "C:\Windows\SysWOW64\iwfcyrwv\pxdqvyrm.exe /d\"C:\Users\Admin\AppData\Local\Temp\860D.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description iwfcyrwv "wifi internet conection"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start iwfcyrwv2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
-
C:\Users\Admin\AppData\Local\Temp\8D81.exeC:\Users\Admin\AppData\Local\Temp\8D81.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\iwfcyrwv\pxdqvyrm.exeC:\Windows\SysWOW64\iwfcyrwv\pxdqvyrm.exe /d"C:\Users\Admin\AppData\Local\Temp\860D.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Sets service image path in registry
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"2⤵
- Creates scheduled task(s)
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
Network
MITRE ATT&CK Matrix ATT&CK v6
Persistence
New Service
1Modify Existing Service
1Registry Run Keys / Startup Folder
2Scheduled Task
1Defense Evasion
Virtualization/Sandbox Evasion
1Modify Registry
3File Permissions Modification
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850DFilesize
2KB
MD532958182234a80a5b2589418864f6117
SHA1598276140fd27d8931dbe02625e3378ad9085b8d
SHA256a6f4c0928ecef1052acb557bf148d4d06206afaa0d334d30ef676d8b4b89fdb2
SHA51204157e1f291fb8e11e8134fa321d6473ff7ed55c7848170ac9c6db4dd9e42d8303c40746ce56f4112f26c5ea730703ad00fa52fdf57377c81221473210e49dfa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751Filesize
717B
MD5ec8ff3b1ded0246437b1472c69dd1811
SHA1d813e874c2524e3a7da6c466c67854ad16800326
SHA256e634c2d1ed20e0638c95597adf4c9d392ebab932d3353f18af1e4421f4bb9cab
SHA512e967b804cbf2d6da30a532cbc62557d09bd236807790040c6bee5584a482dc09d724fc1d9ac0de6aa5b4e8b1fff72c8ab3206222cc2c95a91035754ac1257552
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2BC2D09D2C3B9097A22A2E8DDF9B7F10Filesize
503B
MD537a43fd4b91d6a0677fc77730fbd23ff
SHA1f733a6b6feddaf37a1db1d0b93a72cc5324db38d
SHA256dc1ad8c6fbffaee84a5e2fdcb7a02e85204f943eae63c14c73ed8bc360201d6b
SHA5120520405d9234e06899fb90bd9a98b35f3b34e5ace58d52208ab425866ab47a0faba740ab495755f7aaa59ebef64e3f6ace81261391318b96031ac7750ebb03be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711EFilesize
1KB
MD50d870ca424457579d4bd345ac1ec6c3c
SHA1fc3d8924e13b4fc5eca7cabd4967eea3d4db1690
SHA256cf9df8d62ec78ca20a50633047af6c913dc2d10f15823795e8d86042c7b05ed0
SHA512a1e731ae03b1a2259f8e1afc86058aabb3b8ce3b0141f08ea18b6c7003c55aeb135d40bba38ebf1f76174eb1ad758fbec10841dee1ed704fb0285e36b2f7d66b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850DFilesize
488B
MD5562fce76ba6f549e9622aa7961cd1ffb
SHA1ab6a6f34377a396d3099fe55b8f1a0d1ff845ced
SHA256c58729f47838bd2bf99325bae3f6e64efa4d39af8b697b0e065379cb38f3b533
SHA512ba0b3cdc46c1dd1bf28855a7b871db365a407b1859686f63a7e9669ffc0f8ba72bc23856789f255eaabecfa0317d4d9b9a0fff204764cb6bb8ba2d73148eb23c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751Filesize
192B
MD5a046af4de63466f5bce80ffe18a7ae9d
SHA1233533bea8e640d615aefcf96ac70c64798016a0
SHA2565279f6a2751424f1d73d85e5e75cd6ae4ab6828752ab552b2486f1fe26a609f7
SHA5129bfb67f7ca479f82f20cbe408b1f8e02c466095e258e19900728d4a15d2b5e002e76f2b1010a3743b26fe29182ded204e74ec7c92476dd5c56acdf2a8742dc6d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2BC2D09D2C3B9097A22A2E8DDF9B7F10Filesize
548B
MD5776435b026ed226562c44e9f935453f5
SHA150cdbdd85b518bb354eb660a8b97256af975d17d
SHA256ea8860d073a0ecfc01f8840b5d1bd64a52fc086f14c382e2bbb24c28c3d20f1f
SHA51202306e68b0a9076c515af8010ec2942c93f31bcdd2472044682102b5ce355065156d1b27ceeb4487264e8b4d23a492a22913e828287eea3f90304f7f5f627fd0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711EFilesize
482B
MD5a090541ca6d1a6b75b127b7a31b39ff2
SHA1b7bba8e127ec994d3e4612034b33255db1be8da9
SHA256cdaf5b99945ebae914cb19c6fe0e75e7ea364754d7fb839bdb99dc4fa5816bd8
SHA5121cfd03899ecce74034c6c48cde516c0596c9b2db7ea9f1c84920e5b639b947c7b7c8eb2af376eefade04ff2352d4c75082de2a9a2f64c0c3e1594495803a81f0
-
C:\Users\Admin\AppData\Local\995af1ec-32e3-4c60-9232-b54c595f92a0\DA2B.exeFilesize
801KB
MD532db669d0bcf9714b344df2c5eb1c0db
SHA1109a87ae86cb9d890d8a40f0a6c3500168fafc0c
SHA256981da46c6d2b7743d2234e5f5e03071870466d776ef7461e6983072967bcd2eb
SHA51285b01e3039f704638226358cde2f07ba02f1b2f5b6483d70d321f6800829af966ce947ea08af93ddc6c4078fab3b5d602cdba8ddcbdce536bbb3c4eb4c24157b
-
C:\Users\Admin\AppData\Local\Temp\809E.exeFilesize
2.6MB
MD5d5ecc2fd366dbd8d0cd3e9e8c8f5dbd8
SHA1ed7413773b7c9154c9aeed9d173f61577522e0db
SHA256576f224909dc7872b8c5bb4902d177f273c8d680c783454b1d43ad46bed7e983
SHA512858db48785bef29d7d58bf2ff2b7e6c00537e63d2c571741d86ccd293d77abdaa19deab3a68352dae67e650e8da8a20ed7f38e1716af66e589c1c0d58de94bd5
-
C:\Users\Admin\AppData\Local\Temp\809E.exeFilesize
2.6MB
MD5d5ecc2fd366dbd8d0cd3e9e8c8f5dbd8
SHA1ed7413773b7c9154c9aeed9d173f61577522e0db
SHA256576f224909dc7872b8c5bb4902d177f273c8d680c783454b1d43ad46bed7e983
SHA512858db48785bef29d7d58bf2ff2b7e6c00537e63d2c571741d86ccd293d77abdaa19deab3a68352dae67e650e8da8a20ed7f38e1716af66e589c1c0d58de94bd5
-
C:\Users\Admin\AppData\Local\Temp\860D.exeFilesize
279KB
MD53ea4bfa165d8bff56b0ab7a286ea4d48
SHA1aafc6f81e12ac29c5b9d0f9732db360410dd5ee5
SHA2563f73f4d23f25969b1759df9b29a244ccc145d8f81dd37b71fde38f3ecf93a939
SHA512da35ee3da31a844be1ff51df3258afb22aef16e7b87eb3f4405ce8f9dcc9bf55c504d26120f7f440f18d8295ddd940b4950036512eefdbf002bcf1cf0d608b1d
-
C:\Users\Admin\AppData\Local\Temp\860D.exeFilesize
279KB
MD53ea4bfa165d8bff56b0ab7a286ea4d48
SHA1aafc6f81e12ac29c5b9d0f9732db360410dd5ee5
SHA2563f73f4d23f25969b1759df9b29a244ccc145d8f81dd37b71fde38f3ecf93a939
SHA512da35ee3da31a844be1ff51df3258afb22aef16e7b87eb3f4405ce8f9dcc9bf55c504d26120f7f440f18d8295ddd940b4950036512eefdbf002bcf1cf0d608b1d
-
C:\Users\Admin\AppData\Local\Temp\8D81.exeFilesize
395KB
MD5a864c7dcd49506486eb4a15632a34c03
SHA16f247530bd632cb53cdc0b7a8c466e2144c16d84
SHA256dc69e3a17aba90423107dc5915e8a32e76d92aca74323131b36cf9fb144ecdbf
SHA51271ea6c60927c29d24a5cb992490e0b71b2c5355b01b4de739a44b4fed2b2315eb6b5081ee44c65b71b08f9c5e0d6591b9b6b7e136cb31a47581420bbe92b7a72
-
C:\Users\Admin\AppData\Local\Temp\8D81.exeFilesize
395KB
MD5a864c7dcd49506486eb4a15632a34c03
SHA16f247530bd632cb53cdc0b7a8c466e2144c16d84
SHA256dc69e3a17aba90423107dc5915e8a32e76d92aca74323131b36cf9fb144ecdbf
SHA51271ea6c60927c29d24a5cb992490e0b71b2c5355b01b4de739a44b4fed2b2315eb6b5081ee44c65b71b08f9c5e0d6591b9b6b7e136cb31a47581420bbe92b7a72
-
C:\Users\Admin\AppData\Local\Temp\C1FD.dllFilesize
1.4MB
MD53ee96204441d27dcc2de050ede40c2a3
SHA13b2d387ca9663b7b1abf4531f85545c9df0cb076
SHA2564061b94fcb0ddf184beead8d29d4d5b135e4d813b3b6ba237b1ddcc5e62c8cda
SHA512133688d048d6dc96e8df8d792e46c247da24879fb07467fcd5a35b9631083816fc90aa9a4d74a5e63d1d85901e75973d827e41a32b9eb34596a2532a27384e39
-
C:\Users\Admin\AppData\Local\Temp\C52A.exeFilesize
280KB
MD513f29cd8ac9782f446c79e83d5e099bf
SHA18ac177202195726fd8b917281dce14f3cf6a8c50
SHA2561534960155795912767f0c903aab042c816efddbaae315f03b53f590501d8fbe
SHA5124fa8579bc977c561d142f466ee22ba6b7bf8014f60930234bd7364fa017408beb4e1924d32eb6bc8dc3887c2cd4af6bd69031827e2580b76e3c3aaddd7eecaba
-
C:\Users\Admin\AppData\Local\Temp\C52A.exeFilesize
280KB
MD513f29cd8ac9782f446c79e83d5e099bf
SHA18ac177202195726fd8b917281dce14f3cf6a8c50
SHA2561534960155795912767f0c903aab042c816efddbaae315f03b53f590501d8fbe
SHA5124fa8579bc977c561d142f466ee22ba6b7bf8014f60930234bd7364fa017408beb4e1924d32eb6bc8dc3887c2cd4af6bd69031827e2580b76e3c3aaddd7eecaba
-
C:\Users\Admin\AppData\Local\Temp\D539.exeFilesize
6.6MB
MD54c9e48dcb47c4b46eca3a51605c71d2d
SHA1581847ba15f650291ebc111e95ed938476d16090
SHA256baa1661c6a590204e4e87e5ab7c5ed622c988f28d9c4ccf72a5db2883dc8c47e
SHA51299932cb133e382a3416e56690b4ab670f7d279e466abbb50f562705f41d8cf1ef4547357c8e310d7358c4de5c47b201d6e573426f8ef0912e9c03deee5314ec0
-
C:\Users\Admin\AppData\Local\Temp\D539.exeFilesize
6.6MB
MD54c9e48dcb47c4b46eca3a51605c71d2d
SHA1581847ba15f650291ebc111e95ed938476d16090
SHA256baa1661c6a590204e4e87e5ab7c5ed622c988f28d9c4ccf72a5db2883dc8c47e
SHA51299932cb133e382a3416e56690b4ab670f7d279e466abbb50f562705f41d8cf1ef4547357c8e310d7358c4de5c47b201d6e573426f8ef0912e9c03deee5314ec0
-
C:\Users\Admin\AppData\Local\Temp\DA2B.exeFilesize
801KB
MD532db669d0bcf9714b344df2c5eb1c0db
SHA1109a87ae86cb9d890d8a40f0a6c3500168fafc0c
SHA256981da46c6d2b7743d2234e5f5e03071870466d776ef7461e6983072967bcd2eb
SHA51285b01e3039f704638226358cde2f07ba02f1b2f5b6483d70d321f6800829af966ce947ea08af93ddc6c4078fab3b5d602cdba8ddcbdce536bbb3c4eb4c24157b
-
C:\Users\Admin\AppData\Local\Temp\DA2B.exeFilesize
801KB
MD532db669d0bcf9714b344df2c5eb1c0db
SHA1109a87ae86cb9d890d8a40f0a6c3500168fafc0c
SHA256981da46c6d2b7743d2234e5f5e03071870466d776ef7461e6983072967bcd2eb
SHA51285b01e3039f704638226358cde2f07ba02f1b2f5b6483d70d321f6800829af966ce947ea08af93ddc6c4078fab3b5d602cdba8ddcbdce536bbb3c4eb4c24157b
-
C:\Users\Admin\AppData\Local\Temp\DA2B.exeFilesize
801KB
MD532db669d0bcf9714b344df2c5eb1c0db
SHA1109a87ae86cb9d890d8a40f0a6c3500168fafc0c
SHA256981da46c6d2b7743d2234e5f5e03071870466d776ef7461e6983072967bcd2eb
SHA51285b01e3039f704638226358cde2f07ba02f1b2f5b6483d70d321f6800829af966ce947ea08af93ddc6c4078fab3b5d602cdba8ddcbdce536bbb3c4eb4c24157b
-
C:\Users\Admin\AppData\Local\Temp\DA2B.exeFilesize
801KB
MD532db669d0bcf9714b344df2c5eb1c0db
SHA1109a87ae86cb9d890d8a40f0a6c3500168fafc0c
SHA256981da46c6d2b7743d2234e5f5e03071870466d776ef7461e6983072967bcd2eb
SHA51285b01e3039f704638226358cde2f07ba02f1b2f5b6483d70d321f6800829af966ce947ea08af93ddc6c4078fab3b5d602cdba8ddcbdce536bbb3c4eb4c24157b
-
C:\Users\Admin\AppData\Local\Temp\DA2B.exeFilesize
801KB
MD532db669d0bcf9714b344df2c5eb1c0db
SHA1109a87ae86cb9d890d8a40f0a6c3500168fafc0c
SHA256981da46c6d2b7743d2234e5f5e03071870466d776ef7461e6983072967bcd2eb
SHA51285b01e3039f704638226358cde2f07ba02f1b2f5b6483d70d321f6800829af966ce947ea08af93ddc6c4078fab3b5d602cdba8ddcbdce536bbb3c4eb4c24157b
-
C:\Users\Admin\AppData\Local\Temp\pxdqvyrm.exeFilesize
10.6MB
MD5d60ceb0507f018615e0bac902cfb7598
SHA178eb1097cc6ac2e47412b4683c5fad790ca6474d
SHA2560ff5d25b80d7d5aca050b58d2c204f9459f72f9bdccceea3efbe75c70eff2f87
SHA51209fddc0ced6e5bde5db45a95485a6a1e00c7d78aff510e313f84602f7e884d48f734e0bc3f7f53535df3671e53a3b1fc3154c660da9684404746954280e3575a
-
C:\Users\Admin\AppData\Local\Temp\setup.exeFilesize
3.2MB
MD5d4bfc3207e75c9abec7f189615ea74b3
SHA13210f5a8f4d4a81a8f928fc1a5510cd7703c5fc6
SHA2561ebbaa7747ec547b511fa90255cc4cb1c6993bbe9a112a650cfbd2c532cf2cfa
SHA51202371b8da448c7de945174cd8a2b609046b2627270682a8e7384e42d9c7b9909d0f5f9c50d170965f92843ce649505b0ce4c833ba4158585b3cea219f5e5ca65
-
C:\Users\Admin\AppData\Local\Temp\setup.exeFilesize
3.2MB
MD5d4bfc3207e75c9abec7f189615ea74b3
SHA13210f5a8f4d4a81a8f928fc1a5510cd7703c5fc6
SHA2561ebbaa7747ec547b511fa90255cc4cb1c6993bbe9a112a650cfbd2c532cf2cfa
SHA51202371b8da448c7de945174cd8a2b609046b2627270682a8e7384e42d9c7b9909d0f5f9c50d170965f92843ce649505b0ce4c833ba4158585b3cea219f5e5ca65
-
C:\Users\Admin\AppData\Local\Temp\setup.exeFilesize
3.2MB
MD5d4bfc3207e75c9abec7f189615ea74b3
SHA13210f5a8f4d4a81a8f928fc1a5510cd7703c5fc6
SHA2561ebbaa7747ec547b511fa90255cc4cb1c6993bbe9a112a650cfbd2c532cf2cfa
SHA51202371b8da448c7de945174cd8a2b609046b2627270682a8e7384e42d9c7b9909d0f5f9c50d170965f92843ce649505b0ce4c833ba4158585b3cea219f5e5ca65
-
C:\Users\Admin\AppData\Local\Temp\setup1.exeFilesize
2KB
MD5d20634d44180db8f3b9a91a5f4d15bef
SHA1c70671e0cea00cd04c8cd7cd4d4f60184987dbf8
SHA256797f6b84c020232ea7deb6ab76f22af22ff65970a539821c52d632b535e8dd8c
SHA512adeece86245730f9a4ac27da5dc52a01c055b44cdf99950e0a9646e3bb56f9238dd1e98d356484881906cf4c2767ed19bc164096f6e56af885a163b55041c090
-
C:\Users\Admin\AppData\Local\b1dc73e4-6627-4e13-b4c9-76b5fcc2a27b\build2.exeFilesize
246KB
MD54e08ecaa075b90f30327bf200d23130b
SHA1f7b67a7abbe3815bd758933f7c4712bd4d4ec4b2
SHA2566c11af0bbd346329224255d38a07fb9db5828881d3520ab4623c7a5fc09ecd47
SHA512e7deeafe000b034cd4d71776cd1285e33d295a830f3459506dd7332e8c1c61b43ec2fdc406c22ba5262aa62a795421492f7e54602bfe08102b8b2a000d150bb7
-
C:\Users\Admin\AppData\Local\b1dc73e4-6627-4e13-b4c9-76b5fcc2a27b\build2.exeFilesize
246KB
MD54e08ecaa075b90f30327bf200d23130b
SHA1f7b67a7abbe3815bd758933f7c4712bd4d4ec4b2
SHA2566c11af0bbd346329224255d38a07fb9db5828881d3520ab4623c7a5fc09ecd47
SHA512e7deeafe000b034cd4d71776cd1285e33d295a830f3459506dd7332e8c1c61b43ec2fdc406c22ba5262aa62a795421492f7e54602bfe08102b8b2a000d150bb7
-
C:\Users\Admin\AppData\Local\b1dc73e4-6627-4e13-b4c9-76b5fcc2a27b\build2.exeFilesize
246KB
MD54e08ecaa075b90f30327bf200d23130b
SHA1f7b67a7abbe3815bd758933f7c4712bd4d4ec4b2
SHA2566c11af0bbd346329224255d38a07fb9db5828881d3520ab4623c7a5fc09ecd47
SHA512e7deeafe000b034cd4d71776cd1285e33d295a830f3459506dd7332e8c1c61b43ec2fdc406c22ba5262aa62a795421492f7e54602bfe08102b8b2a000d150bb7
-
C:\Users\Admin\AppData\Local\b1dc73e4-6627-4e13-b4c9-76b5fcc2a27b\build3.exeFilesize
9KB
MD59ead10c08e72ae41921191f8db39bc16
SHA1abe3bce01cd34afc88e2c838173f8c2bd0090ae1
SHA2568d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0
SHA512aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a
-
C:\Users\Admin\AppData\Local\b1dc73e4-6627-4e13-b4c9-76b5fcc2a27b\build3.exeFilesize
9KB
MD59ead10c08e72ae41921191f8db39bc16
SHA1abe3bce01cd34afc88e2c838173f8c2bd0090ae1
SHA2568d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0
SHA512aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeFilesize
9KB
MD59ead10c08e72ae41921191f8db39bc16
SHA1abe3bce01cd34afc88e2c838173f8c2bd0090ae1
SHA2568d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0
SHA512aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeFilesize
9KB
MD59ead10c08e72ae41921191f8db39bc16
SHA1abe3bce01cd34afc88e2c838173f8c2bd0090ae1
SHA2568d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0
SHA512aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a
-
C:\Windows\SysWOW64\iwfcyrwv\pxdqvyrm.exeFilesize
10.6MB
MD5d60ceb0507f018615e0bac902cfb7598
SHA178eb1097cc6ac2e47412b4683c5fad790ca6474d
SHA2560ff5d25b80d7d5aca050b58d2c204f9459f72f9bdccceea3efbe75c70eff2f87
SHA51209fddc0ced6e5bde5db45a95485a6a1e00c7d78aff510e313f84602f7e884d48f734e0bc3f7f53535df3671e53a3b1fc3154c660da9684404746954280e3575a
-
\ProgramData\mozglue.dllFilesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
\ProgramData\nss3.dllFilesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
-
\Users\Admin\AppData\Local\Temp\C1FD.dllFilesize
1.4MB
MD53ee96204441d27dcc2de050ede40c2a3
SHA13b2d387ca9663b7b1abf4531f85545c9df0cb076
SHA2564061b94fcb0ddf184beead8d29d4d5b135e4d813b3b6ba237b1ddcc5e62c8cda
SHA512133688d048d6dc96e8df8d792e46c247da24879fb07467fcd5a35b9631083816fc90aa9a4d74a5e63d1d85901e75973d827e41a32b9eb34596a2532a27384e39
-
memory/200-1169-0x0000000000000000-mapping.dmp
-
memory/200-1395-0x00000000027A0000-0x00000000027C2000-memory.dmpFilesize
136KB
-
memory/200-1400-0x0000000002770000-0x0000000002797000-memory.dmpFilesize
156KB
-
memory/224-776-0x0000000000000000-mapping.dmp
-
memory/516-1206-0x0000000000000000-mapping.dmp
-
memory/720-1293-0x0000000000000000-mapping.dmp
-
memory/1288-842-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/1288-547-0x0000000000424141-mapping.dmp
-
memory/1288-622-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/1344-405-0x0000000000424141-mapping.dmp
-
memory/1344-472-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/1344-517-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/1912-1137-0x0000000000560000-0x0000000000566000-memory.dmpFilesize
24KB
-
memory/1912-1118-0x0000000000000000-mapping.dmp
-
memory/1912-1583-0x0000000000560000-0x0000000000566000-memory.dmpFilesize
24KB
-
memory/1912-1139-0x0000000000550000-0x000000000055C000-memory.dmpFilesize
48KB
-
memory/2072-737-0x0000000000000000-mapping.dmp
-
memory/2640-404-0x0000000002240000-0x000000000235B000-memory.dmpFilesize
1.1MB
-
memory/2640-401-0x0000000000980000-0x0000000000A20000-memory.dmpFilesize
640KB
-
memory/2640-248-0x0000000000000000-mapping.dmp
-
memory/2656-156-0x0000000000000000-mapping.dmp
-
memory/2656-158-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/2656-188-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/2656-186-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/2656-484-0x0000000004E90000-0x0000000004F77000-memory.dmpFilesize
924KB
-
memory/2656-183-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/2656-161-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/2656-179-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/2656-172-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/2656-182-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/2656-168-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/2656-162-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/2656-165-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/2656-160-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/2656-176-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/2656-178-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/2656-167-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/2656-159-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/2656-164-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/2656-174-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/2656-163-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/2656-383-0x0000000004C70000-0x0000000004D9C000-memory.dmpFilesize
1.2MB
-
memory/2656-362-0x0000000004E90000-0x0000000004F77000-memory.dmpFilesize
924KB
-
memory/2656-157-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/2696-154-0x0000000000000000-mapping.dmp
-
memory/2808-1545-0x0000000002870000-0x0000000002876000-memory.dmpFilesize
24KB
-
memory/2808-1579-0x0000000002860000-0x000000000286B000-memory.dmpFilesize
44KB
-
memory/2808-1262-0x0000000000000000-mapping.dmp
-
memory/3084-1198-0x00000000030B0000-0x00000000030BB000-memory.dmpFilesize
44KB
-
memory/3084-1026-0x0000000000000000-mapping.dmp
-
memory/3084-1191-0x00000000030C0000-0x00000000030C7000-memory.dmpFilesize
28KB
-
memory/3084-1656-0x00000000030C0000-0x00000000030C7000-memory.dmpFilesize
28KB
-
memory/3196-1541-0x0000000000D80000-0x0000000000D89000-memory.dmpFilesize
36KB
-
memory/3196-1058-0x0000000000D80000-0x0000000000D89000-memory.dmpFilesize
36KB
-
memory/3196-1055-0x0000000000000000-mapping.dmp
-
memory/3196-1060-0x0000000000D70000-0x0000000000D7F000-memory.dmpFilesize
60KB
-
memory/3512-175-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/3512-187-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/3512-442-0x00000000006FC000-0x000000000070D000-memory.dmpFilesize
68KB
-
memory/3512-177-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/3512-180-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/3512-354-0x0000000000680000-0x0000000000689000-memory.dmpFilesize
36KB
-
memory/3512-358-0x0000000000400000-0x000000000044B000-memory.dmpFilesize
300KB
-
memory/3512-351-0x00000000006FC000-0x000000000070D000-memory.dmpFilesize
68KB
-
memory/3512-170-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/3512-171-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/3512-166-0x0000000000000000-mapping.dmp
-
memory/3512-444-0x0000000000400000-0x000000000044B000-memory.dmpFilesize
300KB
-
memory/3512-173-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/3512-181-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/3512-185-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/3512-189-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4000-835-0x0000000000000000-mapping.dmp
-
memory/4024-488-0x0000000000000000-mapping.dmp
-
memory/4052-1261-0x0000000000000000-mapping.dmp
-
memory/4180-1178-0x0000000000000000-mapping.dmp
-
memory/4228-888-0x0000000000000000-mapping.dmp
-
memory/4364-139-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4364-136-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4364-146-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4364-144-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4364-117-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4364-143-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4364-142-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4364-141-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4364-118-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4364-147-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4364-140-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4364-116-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4364-119-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4364-120-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4364-121-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4364-149-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4364-138-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4364-122-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4364-137-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4364-133-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4364-123-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4364-124-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4364-135-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4364-134-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4364-125-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4364-148-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4364-126-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4364-127-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4364-128-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4364-129-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4364-130-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4364-131-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4364-145-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4364-150-0x000000000070C000-0x000000000071D000-memory.dmpFilesize
68KB
-
memory/4364-1232-0x0000000000000000-mapping.dmp
-
memory/4364-151-0x0000000000530000-0x0000000000539000-memory.dmpFilesize
36KB
-
memory/4364-132-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4364-153-0x0000000000400000-0x000000000044B000-memory.dmpFilesize
300KB
-
memory/4364-152-0x0000000000400000-0x000000000044B000-memory.dmpFilesize
300KB
-
memory/4468-841-0x0000000000000000-mapping.dmp
-
memory/4560-514-0x0000000000000000-mapping.dmp
-
memory/4604-911-0x0000000000000000-mapping.dmp
-
memory/4724-293-0x00000000005D0000-0x00000000005DC000-memory.dmpFilesize
48KB
-
memory/4724-280-0x0000000000000000-mapping.dmp
-
memory/4760-881-0x0000000000400000-0x000000000045B000-memory.dmpFilesize
364KB
-
memory/4760-752-0x0000000000400000-0x000000000045B000-memory.dmpFilesize
364KB
-
memory/4760-670-0x000000000042094D-mapping.dmp
-
memory/4908-1495-0x0000000002860000-0x0000000002869000-memory.dmpFilesize
36KB
-
memory/4908-1215-0x0000000000000000-mapping.dmp
-
memory/4908-1447-0x0000000002870000-0x0000000002875000-memory.dmpFilesize
20KB
-
memory/4924-1081-0x0000000000000000-mapping.dmp
-
memory/4924-1247-0x00000000030E0000-0x00000000030E9000-memory.dmpFilesize
36KB
-
memory/4924-1243-0x00000000030F0000-0x00000000030F5000-memory.dmpFilesize
20KB
-
memory/4956-830-0x0000000000400000-0x0000000000E43000-memory.dmpFilesize
10.3MB
-
memory/4956-541-0x0000000000400000-0x0000000000E43000-memory.dmpFilesize
10.3MB
-
memory/4956-229-0x0000000000000000-mapping.dmp
-
memory/4956-307-0x0000000000400000-0x0000000000E43000-memory.dmpFilesize
10.3MB
-
memory/5056-390-0x0000000002E00000-0x0000000002E6B000-memory.dmpFilesize
428KB
-
memory/5056-385-0x0000000002E70000-0x0000000002EE5000-memory.dmpFilesize
468KB
-
memory/5056-260-0x0000000000000000-mapping.dmp
-
memory/5072-639-0x0000000000000000-mapping.dmp
-
memory/5072-673-0x0000000000836000-0x000000000085F000-memory.dmpFilesize
164KB
-
memory/5148-1312-0x0000000000000000-mapping.dmp
-
memory/5148-1350-0x00000000003E0000-0x00000000003ED000-memory.dmpFilesize
52KB
-
memory/5148-1341-0x00000000003F0000-0x00000000003F7000-memory.dmpFilesize
28KB
-
memory/5252-1327-0x0000000000000000-mapping.dmp
-
memory/5424-1620-0x0000000003250000-0x000000000325B000-memory.dmpFilesize
44KB
-
memory/5424-1360-0x0000000000000000-mapping.dmp
-
memory/5424-1616-0x0000000003260000-0x0000000003268000-memory.dmpFilesize
32KB
-
memory/7096-1752-0x00000000030C9A6B-mapping.dmp
-
memory/9880-2205-0x0000000000000000-mapping.dmp
-
memory/10256-2251-0x0000000000000000-mapping.dmp
-
memory/10588-2276-0x0000000000000000-mapping.dmp
-
memory/61540-922-0x0000000000000000-mapping.dmp
-
memory/61540-1345-0x00000000004A0000-0x00000000004B3000-memory.dmpFilesize
76KB
-
memory/61540-1195-0x0000000000400000-0x000000000044B000-memory.dmpFilesize
300KB
-
memory/61540-1132-0x00000000004A0000-0x00000000004B3000-memory.dmpFilesize
76KB
-
memory/61540-1337-0x0000000000400000-0x000000000044B000-memory.dmpFilesize
300KB
-
memory/61540-1128-0x00000000004F0000-0x000000000059E000-memory.dmpFilesize
696KB
-
memory/75480-1040-0x0000000009710000-0x0000000009722000-memory.dmpFilesize
72KB
-
memory/75480-1033-0x0000000009C80000-0x000000000A286000-memory.dmpFilesize
6.0MB
-
memory/75480-1005-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/75480-939-0x000000000042217A-mapping.dmp
-
memory/75480-1035-0x00000000097E0000-0x00000000098EA000-memory.dmpFilesize
1.0MB
-
memory/75480-1046-0x00000000097A0000-0x00000000097DE000-memory.dmpFilesize
248KB
-
memory/75480-1423-0x000000000A670000-0x000000000A702000-memory.dmpFilesize
584KB
-
memory/75480-1306-0x000000000A790000-0x000000000AC8E000-memory.dmpFilesize
5.0MB
-
memory/75480-1331-0x0000000009AA0000-0x0000000009B06000-memory.dmpFilesize
408KB
-
memory/75480-1051-0x00000000098F0000-0x000000000993B000-memory.dmpFilesize
300KB
-
memory/75480-1484-0x000000000B010000-0x000000000B1D2000-memory.dmpFilesize
1.8MB
-
memory/75480-1491-0x000000000B710000-0x000000000BC3C000-memory.dmpFilesize
5.2MB
-
memory/75732-986-0x0000000000000000-mapping.dmp