remcos | de8a8e788979f605ae68981ec3bf84711e957bfa4746d5f23c2015a8ec928c32

Analysis

max time kernel
150s
max time network
152s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
31-01-2023 00:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

de8a8e788979f605ae68981ec3bf84711e957bfa4746d5f23c2015a8ec928c32.exe
Size

3.3MB
MD5

68fdb669425ec2a155ac6d508aa7a8a3
SHA1

bda890389cdf441841377119c2eb81b29f5780a9
SHA256

de8a8e788979f605ae68981ec3bf84711e957bfa4746d5f23c2015a8ec928c32
SHA512

7428da2d05f145f738bf41b8a978475797d664d0d8896ca3a10e2f467e47bfd3c59ad171092675315d86c5ee6c979575115c86620476bca8d198279d95e45a67
SSDEEP

24576:gAzFN9Z2XBQFio7Qg/pAqqE96RoS3p/PmV08YKwTQok4U02409htjRjLYBS7Rt2c:gA36Iio7Qg2UX0TSLjRj

Score

10^/10

remcos remotehost microsoft phishing rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

rem.unionbindinqcompany.it:3361

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-F4O94O
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Deletes itself 1 IoCs

Processes:

WScript.exe

pid process

5700 WScript.exe
Detected potential entity reuse from brand microsoft.
phishing microsoft

pid	process
5700	WScript.exe

Suspicious use of SetThreadContext 8 IoCs

Processes:

de8a8e788979f605ae68981ec3bf84711e957bfa4746d5f23c2015a8ec928c32.exede8a8e788979f605ae68981ec3bf84711e957bfa4746d5f23c2015a8ec928c32.exe

description	pid	process	target process
PID 2668 set thread context of 4716	2668	de8a8e788979f605ae68981ec3bf84711e957bfa4746d5f23c2015a8ec928c32.exe	de8a8e788979f605ae68981ec3bf84711e957bfa4746d5f23c2015a8ec928c32.exe
PID 4716 set thread context of 2304	4716	de8a8e788979f605ae68981ec3bf84711e957bfa4746d5f23c2015a8ec928c32.exe	svchost.exe
PID 4716 set thread context of 2180	4716	de8a8e788979f605ae68981ec3bf84711e957bfa4746d5f23c2015a8ec928c32.exe	svchost.exe
PID 4716 set thread context of 4372	4716	de8a8e788979f605ae68981ec3bf84711e957bfa4746d5f23c2015a8ec928c32.exe	svchost.exe
PID 4716 set thread context of 2964	4716	de8a8e788979f605ae68981ec3bf84711e957bfa4746d5f23c2015a8ec928c32.exe	svchost.exe
PID 4716 set thread context of 6096	4716	de8a8e788979f605ae68981ec3bf84711e957bfa4746d5f23c2015a8ec928c32.exe	svchost.exe
PID 4716 set thread context of 2764	4716	de8a8e788979f605ae68981ec3bf84711e957bfa4746d5f23c2015a8ec928c32.exe	svchost.exe
PID 4716 set thread context of 5924	4716	de8a8e788979f605ae68981ec3bf84711e957bfa4746d5f23c2015a8ec928c32.exe	svchost.exe

Drops file in Windows directory 14 IoCs

Processes:

MicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exe

description	ioc	process
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

Processes:

MicrosoftEdge.exebrowser_broker.exeMicrosoftEdgeCP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = 01000000460b94eef0143ba9c863d8f4f332f9c7ee919c720411d1f4b5bf47dda32f57b6cf6bbe945b13f819a0086dd1fa643a9c9d9cd2d3990f8ce18f6272e7ae6520262269a7a1c33a2dcf8e327d463735f667b62557e6ba6507f9777f	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\Extensions	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = e3199d881335d901	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 68d1d88b1335d901	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows\AllowInPrivate	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Zoom	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\ExtensionI = "5"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f4d02a535b821c4eae8d83239bdc681200000000020000000000106600000001000020000000e447f3d2a84dec022fbd7f688a3790b8c07f1bcd0684260037f30202722060f4000000000e8000000002000020000000d7176883ad87b3017ab87818f87554c5f1cb7c72037b02ca5d523c2b5f8602b2700200002cce97faedaf0e03dbf534009ab1ef04ed86deae7d372079fbef5fbbd884d2c2da072fe58e9c104df664734fb952786ea65b32d321bda6869bd3a189ea0c087982a8d8a00eb8d9170f2096fd4332ce90559fb17b322d43c1387efc8313f696ad81be201301242adde6d76029329737ced5dfca9a9344854833e2fa7a9855ef329e0f0a8ecda9f88e3bd09476f1517f158553c3b61b6adfde4898c020881aab6062adeb3495bffde735235e422c506bdabcf10055f6c61f7fccc5fee7eda8ea9afd5a0d880dbd26da33daa690eeae97f35134e3b86ae6ad7704576b7d3d43a36479ffb107ec2e7a88e0849a847ab7d291ef45151c67ca9fa8f79133a01785b5265270cc65b312698bb89506d54c8753152101eceafffb4f7a4ec65034846fcd5b78184f69815960df89fde3d10beb95bc99b5333a4a5d2a1a6d771a837ba5bf772857bdaa20f8ccae9b7da206fa998cb76713e3dacfe24b2465ddc0c228ff02e476b0b31f842d289eb03dfb8d27701060edc9cfd0ee3a5a569456b1f44defdfdf8903b201489285cab5c39cd666c4faeeeacbf51f5cd4a654520d028e1ef102d73480ccc53e8861c318673da89ce2bd4c690001bf5e381b5a07c38ef09616e5fc8b2e4a7131e6e5a70155458970fd9bdf725d98c62576af60fa34552a70ca8fd308e6042bdac5e6f4b2d274778444321b14d75ff99b0143acd2616524e61f545675119f0be136ad19155fe528ebbe696bc7653d22a81b052403e29683b05d4a9ca1156df6cf018a968770a208a09a34c231364643a2e1f1279c8fc6aba49de9d7e6363d8ab2641b77b487e06de076f9c326b21400130282a1b952f0c181aa98caa229373327dc082336656617a41d27e9400000003dd0cdca3397d9f8e75f7225b01cdd058ae4ea74cbf7ca55a72fa9ded9028ecffcd46d357a292105ba1371ebcb2e3deab6d954e0ecd7111684597ce22016a565	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 679ac79a1335d901	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = e72b18a61335d901	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\AllComplete = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 728eb7821335d901	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\SmartScreenCompletedVersio = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$Discuz!	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\Rating Prompt Shown = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 094ea6a91335d901	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url3 = "https://signin.ebay.com/ws/ebayisapi.dll"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\TypedUrlsComplete = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DOMStorage	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

de8a8e788979f605ae68981ec3bf84711e957bfa4746d5f23c2015a8ec928c32.exe

pid process

4716 de8a8e788979f605ae68981ec3bf84711e957bfa4746d5f23c2015a8ec928c32.exe

Suspicious behavior: MapViewOfSection 31 IoCs

Processes:

de8a8e788979f605ae68981ec3bf84711e957bfa4746d5f23c2015a8ec928c32.exeMicrosoftEdgeCP.exe

pid	process
4716	de8a8e788979f605ae68981ec3bf84711e957bfa4746d5f23c2015a8ec928c32.exe
3232	MicrosoftEdgeCP.exe
3232	MicrosoftEdgeCP.exe
4716	de8a8e788979f605ae68981ec3bf84711e957bfa4746d5f23c2015a8ec928c32.exe
3232	MicrosoftEdgeCP.exe
3232	MicrosoftEdgeCP.exe
3232	MicrosoftEdgeCP.exe
3232	MicrosoftEdgeCP.exe
4716	de8a8e788979f605ae68981ec3bf84711e957bfa4746d5f23c2015a8ec928c32.exe
3232	MicrosoftEdgeCP.exe
3232	MicrosoftEdgeCP.exe
3232	MicrosoftEdgeCP.exe
3232	MicrosoftEdgeCP.exe
4716	de8a8e788979f605ae68981ec3bf84711e957bfa4746d5f23c2015a8ec928c32.exe
3232	MicrosoftEdgeCP.exe
3232	MicrosoftEdgeCP.exe
3232	MicrosoftEdgeCP.exe
3232	MicrosoftEdgeCP.exe
4716	de8a8e788979f605ae68981ec3bf84711e957bfa4746d5f23c2015a8ec928c32.exe
3232	MicrosoftEdgeCP.exe
3232	MicrosoftEdgeCP.exe
3232	MicrosoftEdgeCP.exe
3232	MicrosoftEdgeCP.exe
4716	de8a8e788979f605ae68981ec3bf84711e957bfa4746d5f23c2015a8ec928c32.exe
3232	MicrosoftEdgeCP.exe
3232	MicrosoftEdgeCP.exe
3232	MicrosoftEdgeCP.exe
3232	MicrosoftEdgeCP.exe
4716	de8a8e788979f605ae68981ec3bf84711e957bfa4746d5f23c2015a8ec928c32.exe
3232	MicrosoftEdgeCP.exe
3232	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	pid	process
Token: SeDebugPrivilege	2280	MicrosoftEdge.exe
Token: SeDebugPrivilege	2280	MicrosoftEdge.exe
Token: SeDebugPrivilege	2280	MicrosoftEdge.exe
Token: SeDebugPrivilege	2280	MicrosoftEdge.exe
Token: SeDebugPrivilege	1044	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1044	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1044	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1044	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1260	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1260	MicrosoftEdgeCP.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

de8a8e788979f605ae68981ec3bf84711e957bfa4746d5f23c2015a8ec928c32.exeMicrosoftEdge.exeMicrosoftEdgeCP.exe

pid	process
4716	de8a8e788979f605ae68981ec3bf84711e957bfa4746d5f23c2015a8ec928c32.exe
2280	MicrosoftEdge.exe
3232	MicrosoftEdgeCP.exe
3232	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

de8a8e788979f605ae68981ec3bf84711e957bfa4746d5f23c2015a8ec928c32.exede8a8e788979f605ae68981ec3bf84711e957bfa4746d5f23c2015a8ec928c32.exeMicrosoftEdgeCP.exe

description	pid	process	target process
PID 2668 wrote to memory of 4716	2668	de8a8e788979f605ae68981ec3bf84711e957bfa4746d5f23c2015a8ec928c32.exe	de8a8e788979f605ae68981ec3bf84711e957bfa4746d5f23c2015a8ec928c32.exe
PID 2668 wrote to memory of 4716	2668	de8a8e788979f605ae68981ec3bf84711e957bfa4746d5f23c2015a8ec928c32.exe	de8a8e788979f605ae68981ec3bf84711e957bfa4746d5f23c2015a8ec928c32.exe
PID 2668 wrote to memory of 4716	2668	de8a8e788979f605ae68981ec3bf84711e957bfa4746d5f23c2015a8ec928c32.exe	de8a8e788979f605ae68981ec3bf84711e957bfa4746d5f23c2015a8ec928c32.exe
PID 2668 wrote to memory of 4716	2668	de8a8e788979f605ae68981ec3bf84711e957bfa4746d5f23c2015a8ec928c32.exe	de8a8e788979f605ae68981ec3bf84711e957bfa4746d5f23c2015a8ec928c32.exe
PID 2668 wrote to memory of 4716	2668	de8a8e788979f605ae68981ec3bf84711e957bfa4746d5f23c2015a8ec928c32.exe	de8a8e788979f605ae68981ec3bf84711e957bfa4746d5f23c2015a8ec928c32.exe
PID 2668 wrote to memory of 4716	2668	de8a8e788979f605ae68981ec3bf84711e957bfa4746d5f23c2015a8ec928c32.exe	de8a8e788979f605ae68981ec3bf84711e957bfa4746d5f23c2015a8ec928c32.exe
PID 2668 wrote to memory of 4716	2668	de8a8e788979f605ae68981ec3bf84711e957bfa4746d5f23c2015a8ec928c32.exe	de8a8e788979f605ae68981ec3bf84711e957bfa4746d5f23c2015a8ec928c32.exe
PID 2668 wrote to memory of 4716	2668	de8a8e788979f605ae68981ec3bf84711e957bfa4746d5f23c2015a8ec928c32.exe	de8a8e788979f605ae68981ec3bf84711e957bfa4746d5f23c2015a8ec928c32.exe
PID 2668 wrote to memory of 4716	2668	de8a8e788979f605ae68981ec3bf84711e957bfa4746d5f23c2015a8ec928c32.exe	de8a8e788979f605ae68981ec3bf84711e957bfa4746d5f23c2015a8ec928c32.exe
PID 2668 wrote to memory of 4716	2668	de8a8e788979f605ae68981ec3bf84711e957bfa4746d5f23c2015a8ec928c32.exe	de8a8e788979f605ae68981ec3bf84711e957bfa4746d5f23c2015a8ec928c32.exe
PID 2668 wrote to memory of 4716	2668	de8a8e788979f605ae68981ec3bf84711e957bfa4746d5f23c2015a8ec928c32.exe	de8a8e788979f605ae68981ec3bf84711e957bfa4746d5f23c2015a8ec928c32.exe
PID 2668 wrote to memory of 4716	2668	de8a8e788979f605ae68981ec3bf84711e957bfa4746d5f23c2015a8ec928c32.exe	de8a8e788979f605ae68981ec3bf84711e957bfa4746d5f23c2015a8ec928c32.exe
PID 4716 wrote to memory of 2304	4716	de8a8e788979f605ae68981ec3bf84711e957bfa4746d5f23c2015a8ec928c32.exe	svchost.exe
PID 4716 wrote to memory of 2304	4716	de8a8e788979f605ae68981ec3bf84711e957bfa4746d5f23c2015a8ec928c32.exe	svchost.exe
PID 4716 wrote to memory of 2304	4716	de8a8e788979f605ae68981ec3bf84711e957bfa4746d5f23c2015a8ec928c32.exe	svchost.exe
PID 4716 wrote to memory of 2304	4716	de8a8e788979f605ae68981ec3bf84711e957bfa4746d5f23c2015a8ec928c32.exe	svchost.exe
PID 3232 wrote to memory of 1044	3232	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3232 wrote to memory of 1044	3232	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3232 wrote to memory of 1044	3232	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3232 wrote to memory of 1044	3232	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3232 wrote to memory of 1044	3232	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3232 wrote to memory of 1044	3232	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4716 wrote to memory of 2180	4716	de8a8e788979f605ae68981ec3bf84711e957bfa4746d5f23c2015a8ec928c32.exe	svchost.exe
PID 4716 wrote to memory of 2180	4716	de8a8e788979f605ae68981ec3bf84711e957bfa4746d5f23c2015a8ec928c32.exe	svchost.exe
PID 4716 wrote to memory of 2180	4716	de8a8e788979f605ae68981ec3bf84711e957bfa4746d5f23c2015a8ec928c32.exe	svchost.exe
PID 4716 wrote to memory of 2180	4716	de8a8e788979f605ae68981ec3bf84711e957bfa4746d5f23c2015a8ec928c32.exe	svchost.exe
PID 3232 wrote to memory of 3344	3232	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3232 wrote to memory of 3344	3232	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3232 wrote to memory of 3344	3232	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3232 wrote to memory of 3344	3232	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3232 wrote to memory of 3344	3232	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3232 wrote to memory of 3344	3232	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3232 wrote to memory of 3504	3232	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3232 wrote to memory of 3504	3232	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3232 wrote to memory of 3504	3232	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3232 wrote to memory of 3504	3232	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3232 wrote to memory of 3504	3232	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3232 wrote to memory of 3504	3232	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4716 wrote to memory of 4372	4716	de8a8e788979f605ae68981ec3bf84711e957bfa4746d5f23c2015a8ec928c32.exe	svchost.exe
PID 4716 wrote to memory of 4372	4716	de8a8e788979f605ae68981ec3bf84711e957bfa4746d5f23c2015a8ec928c32.exe	svchost.exe
PID 4716 wrote to memory of 4372	4716	de8a8e788979f605ae68981ec3bf84711e957bfa4746d5f23c2015a8ec928c32.exe	svchost.exe
PID 4716 wrote to memory of 4372	4716	de8a8e788979f605ae68981ec3bf84711e957bfa4746d5f23c2015a8ec928c32.exe	svchost.exe
PID 3232 wrote to memory of 2136	3232	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3232 wrote to memory of 2136	3232	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3232 wrote to memory of 2136	3232	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3232 wrote to memory of 2136	3232	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3232 wrote to memory of 2136	3232	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3232 wrote to memory of 2136	3232	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3232 wrote to memory of 2212	3232	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3232 wrote to memory of 2212	3232	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3232 wrote to memory of 2212	3232	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3232 wrote to memory of 2212	3232	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3232 wrote to memory of 2212	3232	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3232 wrote to memory of 2212	3232	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4716 wrote to memory of 2964	4716	de8a8e788979f605ae68981ec3bf84711e957bfa4746d5f23c2015a8ec928c32.exe	svchost.exe
PID 4716 wrote to memory of 2964	4716	de8a8e788979f605ae68981ec3bf84711e957bfa4746d5f23c2015a8ec928c32.exe	svchost.exe
PID 4716 wrote to memory of 2964	4716	de8a8e788979f605ae68981ec3bf84711e957bfa4746d5f23c2015a8ec928c32.exe	svchost.exe
PID 4716 wrote to memory of 2964	4716	de8a8e788979f605ae68981ec3bf84711e957bfa4746d5f23c2015a8ec928c32.exe	svchost.exe
PID 3232 wrote to memory of 4276	3232	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3232 wrote to memory of 4276	3232	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3232 wrote to memory of 4276	3232	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3232 wrote to memory of 4276	3232	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3232 wrote to memory of 4276	3232	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3232 wrote to memory of 4276	3232	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe

C:\Users\Admin\AppData\Local\Temp\de8a8e788979f605ae68981ec3bf84711e957bfa4746d5f23c2015a8ec928c32.exe
"C:\Users\Admin\AppData\Local\Temp\de8a8e788979f605ae68981ec3bf84711e957bfa4746d5f23c2015a8ec928c32.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2668

C:\Users\Admin\AppData\Local\Temp\de8a8e788979f605ae68981ec3bf84711e957bfa4746d5f23c2015a8ec928c32.exe
"C:\Users\Admin\AppData\Local\Temp\de8a8e788979f605ae68981ec3bf84711e957bfa4746d5f23c2015a8ec928c32.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4716

C:\Windows\SysWOW64\svchost.exe
svchost.exe
3⤵
PID:2304

C:\Windows\SysWOW64\svchost.exe
svchost.exe
3⤵
PID:2180

C:\Windows\SysWOW64\svchost.exe
svchost.exe
3⤵
PID:4372

C:\Windows\SysWOW64\svchost.exe
svchost.exe
3⤵
PID:2964

C:\Windows\SysWOW64\svchost.exe
svchost.exe
3⤵
PID:6096

C:\Windows\SysWOW64\svchost.exe
svchost.exe
3⤵
PID:2764

C:\Windows\SysWOW64\svchost.exe
svchost.exe
3⤵
PID:5924

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\lryesxyvemwkxy.vbs"
3⤵
- Deletes itself
PID:5700

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2280

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:3700

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3232

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1044

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:3344

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1260

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:3504

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
PID:2136

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:2212

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4276

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:5472

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:5752

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:6120

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
PID:5608

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4728

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:5992

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4712

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\8DOYDJI4\application-not-started[1].htm
Filesize
41KB

MD5
74ebc7115fe7f806846da5d8d68dedaf

SHA1
372d50f548eb4da8cd72a3d80b22128bfeb4b3f1

SHA256
945455f5d280f9f31064aa06abe01b57272c1c35d4c635ecfeab2c389f1d83bc

SHA512
3ca75a5230e7aea5c474ab0ce7afbc466247a560ae26fdd2bf3466ac678d113d1164d1a9a35b9b206b39b21c0ed6ee9e5a8338027d3511e36ec71e4b58598602

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\8DOYDJI4\docons.9a89adae[1].woff2
Filesize
14KB

MD5
a53f8027bbfcfce1be65d1b49cc3a321

SHA1
ccf8a4f4ba28daf30bd3c47e0c35555306e8d20b

SHA256
b1673b864f292c9da91c42ffdde9d60a2df7c6b72bbb3d2c3a390a02d351b637

SHA512
c14de842a5b8906cde96ece9a448803a8f608a851e515b1bd6238cc2d5729e66b07fabc1764ea03737b6bca689262d12f719ffd21e212e8b74c86db5bc11e39f

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\8DOYDJI4\repair-tool-changes-complete[1].png
Filesize
13KB

MD5
512625cf8f40021445d74253dc7c28c0

SHA1
f6b27ce0f7d4e48e34fddca8a96337f07cffe730

SHA256
1d4dcee8511d5371fec911660d6049782e12901c662b409a5c675772e9b87369

SHA512
ae02319d03884d758a86c286b6f593bdffd067885d56d82eeb8215fdcb41637c7bb9109039e7fbc93ad246d030c368fb285b3161976ed485abc5a8df6df9a38c

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\8DOYDJI4\wcp-consent[1].js
Filesize
51KB

MD5
413fcc759cc19821b61b6941808b29b5

SHA1
1ad23b8a202043539c20681b1b3e9f3bc5d55133

SHA256
daf7759fedd9af6c4d7e374b0d056547ae7cb245ec24a1c4acf02932f30dc536

SHA512
e9bf8a74fef494990aafd15a0f21e0398dc28b4939c8f9f8aa1f3ffbd18056c8d1ab282b081f5c56f0928c48e30e768f7e347929304b55547f9ca8c1aabd80b8

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\9R49C0Q2\4d43f682.index-docs[1].js
Filesize
1.9MB

MD5
549442b2f5387b50f347baebe0176ba2

SHA1
1a943f8f8f288c4954ff7fbcf2fe688418b457f1

SHA256
296f7d024905e368fff412ad229f78fdb5b987fff14483d37f9e56b4ace599ce

SHA512
b2d5ea247e9b36729457cef7c70d084e3f8b62fd0ef5fee1d587eab4319e29b12df0513fa713bac6d6fc43b946dfc52222f88aa07248124a6f92400bbac7acde

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\9R49C0Q2\MathJax[1].js
Filesize
61KB

MD5
7a3737a82ea79217ebe20f896bceb623

SHA1
96b575bbae7dac6a442095996509b498590fbbf7

SHA256
002a60f162fd4d3081f435860d408ffce6f6ef87398f75bd791cadc8dae0771d

SHA512
e0d1f62bae160008e486a6f4ef8b57aa74c1945980c00deb37b083958f4291f0a47b994e5fdb348c2d4618346b93636ce4c323c6f510ab2fbd7a6547359d28d5

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\9R49C0Q2\f16c3189.site-ltr[1].css
Filesize
467KB

MD5
4ac7ff5f82244744e2e8c5f3aa90ca5f

SHA1
8a34ce72caadc54a7cbeebde778c5d6010bdd74e

SHA256
758f83aa3dfcaf5f83d4916f1e0156c44011416ec4629718405b5c530b64b1f5

SHA512
9ae855b1e027e7bf4a8b1c13bd06ab0fea03d4019f543eecb5976a1e395c366549a5be253baeb3a6e4a745e882c870a409ed24187374fd82711d49333f565db5

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\9R49C0Q2\install-3-5[1].png
Filesize
13KB

MD5
f6ec97c43480d41695065ad55a97b382

SHA1
d9c3d0895a5ed1a3951b8774b519b8217f0a54c5

SHA256
07a599fab1e66babc430e5fed3029f25ff3f4ea2dd0ec8968ffba71ef1872f68

SHA512
22462763178409d60609761a2af734f97b35b9a818ec1fd9046afab489aad83ce34896ee8586efe402ea7739ecf088bc2db5c1c8e4fb39e6a0fc5b3adc6b4a9b

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\9R49C0Q2\repair-tool-no-resolution[1].png
Filesize
17KB

MD5
240c4cc15d9fd65405bb642ab81be615

SHA1
5a66783fe5dd932082f40811ae0769526874bfd3

SHA256
030272ce6ba1beca700ec83fded9dbdc89296fbde0633a7f5943ef5831876c07

SHA512
267fe31bc25944dd7b6071c2c2c271ccc188ae1f6a0d7e587dcf9198b81598da6b058d1b413f228df0cb37c8304329e808089388359651e81b5f3dec566d0ee0

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\P4JOXR4N\TeX-AMS_CHTML[1].js
Filesize
214KB

MD5
a7d2b67197a986636d79842a081ea85e

SHA1
b5e05ef7d8028a2741ec475f21560cf4e8cb2136

SHA256
9e0394a3a7bf16a1effb14fcc5557be82d9b2d662ba83bd84e303b4bdf791ef9

SHA512
ad234df68e34eb185222c24c30b384201f1e1793ad6c3dca2f54d510c7baa67eabdc39225f10e6b783757c0db859ce2ea32d6e78317c30a02d1765aee9f07109

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\P4JOXR4N\ms.jsll-3.min[1].js
Filesize
178KB

MD5
cab91ff466755efcfa1d8382745fe74f

SHA1
62eb6f132eb7f324bd3aab6de2cdf61925deb553

SHA256
cacd215430aa66f1391abd136f23ddb729b3fe44c6385a43b62d7a9e8479ea03

SHA512
b0ce8fbc6e83ad21fa1a8778b9ce46be0b27c1dc773dc795ba0ab2e7b0c88269260d5ff98685a99b636e08cd3b81a7c059d6c78aaa37e0a63528da7927795296

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\P4JOXR4N\repair-tool-recommended-changes[1].png
Filesize
15KB

MD5
3062488f9d119c0d79448be06ed140d8

SHA1
8a148951c894fc9e968d3e46589a2e978267650e

SHA256
c47a383de6dd60149b37dd24825d42d83cb48be0ed094e3fc3b228d0a7bb9332

SHA512
00bba6bcbfbf44b977129594a47f732809dce7d4e2d22d050338e4eea91fcc02a9b333c45eeb4c9024df076cbda0b46b621bf48309c0d037d19bbeae0367f5ed

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\WALZJPJ5\67a45209.deprecation[1].js
Filesize
1KB

MD5
020629eba820f2e09d8cda1a753c032b

SHA1
d91a65036e4c36b07ae3641e32f23f8dd616bd17

SHA256
f8ae8a1dc7ce7877b9fb9299183d2ebb3befad0b6489ae785d99047ec2eb92d1

SHA512
ef5a5c7a301de55d103b1be375d988970d9c4ecd62ce464f730c49e622128f431761d641e1dfaa32ca03f8280b435ae909486806df62a538b48337725eb63ce1

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\WALZJPJ5\SegoeUI-Roman-VF_web[1].woff2
Filesize
115KB

MD5
bca97218dca3cb15ce0284cbcb452890

SHA1
635298cbbd72b74b1762acc7dad6c79de4b3670d

SHA256
63c12051016796d92bcf4bc20b4881057475e6dfa4937c29c9e16054814ab47d

SHA512
6e850842d1e353a5457262c5c78d20704e8bd24b532368ba5e5dfc7a4b63059d536296b597fd3ccbd541aa8f89083a79d50aaa1b5e65b4d23fc37bfd806f0545

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\WALZJPJ5\app-could-not-be-started[1].png
Filesize
34KB

MD5
522037f008e03c9448ae0aaaf09e93cb

SHA1
8a32997eab79246beed5a37db0c92fbfb006bef2

SHA256
983c35607c4fb0b529ca732be42115d3fcaac947cee9c9632f7cacdbdecaf5a7

SHA512
643ec613b2e7bdbb2f61e1799c189b0e3392ea5ae10845eb0b1f1542a03569e886f4b54d5b38af10e78db49c71357108c94589474b181f6a4573b86cf2d6f0d8

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\WALZJPJ5\latest[1].woff2
Filesize
26KB

MD5
2835ee281b077ca8ac7285702007c894

SHA1
2e3d4d912aaf1c3f1f30d95c2c4fcea1b7bbc29a

SHA256
e172a02b68f977a57a1690507df809db1e43130f0161961709a36dbd70b4d25f

SHA512
80881c074df064795f9cc5aa187bea92f0e258bf9f6b970e61e9d50ee812913bf454cecbe7fd9e151bdaef700ce68253697f545ac56d4e7ef7ade7814a1dbc5a

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
Filesize
471B

MD5
3346f8d487463659749eb3f5ae8ee532

SHA1
a9775e9c229c89b545a28ecd21b242985e28d265

SHA256
e0432015822e889bd2778f39d1cd681ba469127309f1393451c5aa43a04bf688

SHA512
f89c8322e8606840cbc2245f478209f3defd3351016b28c7ec1471689e32dfccd9f8b2e4405640fbb1e4766e10a5353a053452dd625baa1d9812e3bf4956a0d5

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
Filesize
412B

MD5
044dbb80536d13e9627b436593a090ec

SHA1
12231d536b4ab14cec6bbe62d1bd6a9b88a27ca9

SHA256
26f3af47e5406da8dcf874bfc0ef9f9e0134c930e8175368f3d24d975b298866

SHA512
2534fc3a23f30ca58c3b7c6c94c32786b1fddf77ccef293a7dd9bd4b21c26da62ce8cda7a8895ed98f6401884f48018f34b42d06e2f3c2fb0d695e2463797efb

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\Windows\3720402701\2219095117.pri
Filesize
207KB

MD5
e2b88765ee31470114e866d939a8f2c6

SHA1
e0a53b8511186ff308a0507b6304fb16cabd4e1f

SHA256
523e419d2fa2e780239812d36caa37e92f8c3e6a5cd9f18f0d807c593effa45e

SHA512
462e8e6b4e63fc6781b6a9935b332a1dc77bfb88e1de49134f86fd46bd1598d2e842902dd9415a328e325bd7cdee766bd9473f2695acdfa769ffe7ba9ae1953d

Download Submit
C:\Users\Admin\AppData\Local\Temp\lryesxyvemwkxy.vbs
Filesize
728B

MD5
abaa210feaf3b27209e1d66a51c36909

SHA1
b2365fb87b2f6816ed36bea83ba8626f149f1d01

SHA256
a51014f92f9f1e3072770c9187fda80e96166a2767312a1f5658944c4da8bd81

SHA512
080f39d82ff3cac6f57b163f8cb6a7b0ebb44d2aadb2937004b4c755d239368563e44d3b406a3e262a2533472440ef2cd110442cf84c8133d97bc3839890259a

Download Submit
memory/2180-321-0x0000000002C414B6-mapping.dmp

Download
memory/2304-209-0x0000000002F514B6-mapping.dmp

Download
memory/2668-143-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-131-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-142-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-118-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-144-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-145-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-146-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-147-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-148-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-149-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-150-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-151-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-152-0x00000000004C0000-0x0000000000816000-memory.dmp

Filesize
3.3MB

Download
memory/2668-153-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-154-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-155-0x0000000005700000-0x0000000005BFE000-memory.dmp

Filesize
5.0MB

Download
memory/2668-156-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-157-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-158-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-159-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-160-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-161-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-162-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-163-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-164-0x0000000000FB0000-0x0000000000FC2000-memory.dmp

Filesize
72KB

Download
memory/2668-165-0x0000000002A10000-0x0000000002A18000-memory.dmp

Filesize
32KB

Download
memory/2668-119-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-120-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-121-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-122-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-123-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-171-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-125-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-124-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-126-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-127-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-128-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-129-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-130-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-141-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-132-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-133-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-134-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-135-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-136-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-137-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-138-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-140-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-139-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2764-910-0x0000000002F514B6-mapping.dmp

Download
memory/2964-543-0x00000000032314B6-mapping.dmp

Download
memory/4372-440-0x00000000031514B6-mapping.dmp

Download
memory/4716-181-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4716-170-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4716-183-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4716-182-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4716-258-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4716-180-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4716-178-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4716-179-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4716-177-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4716-176-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4716-175-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4716-173-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4716-174-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4716-185-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4716-172-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4716-169-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4716-167-0x0000000000432C26-mapping.dmp

Download
memory/4716-168-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4716-184-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4716-323-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4716-166-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4716-186-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4716-1117-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/5700-1112-0x0000000000000000-mapping.dmp

Download
memory/5924-1058-0x00000000007514B6-mapping.dmp

Download
memory/6096-718-0x00000000034214B6-mapping.dmp

Download