fabookie | 518aecef5bf06256a9fac8534575ed87360c78e102cd27c55d0635cb98551668

Resubmissions

19/09/2023, 04:11

230919-er9tpagh34 10

19/09/2023, 03:45

230919-ebecvagg26 10

Analysis

max time kernel
300s
max time network
303s
platform
windows10-1703_x64
resource
win10-20230915-en
resource tags

arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
submitted
19/09/2023, 03:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

518aecef5bf06256a9fac8534575ed87360c78e102cd27c55d0635cb98551668.exe
Size

261KB
MD5

a02bd32ecd3b37c281c025342a64c82f
SHA1

3c1e86d948dc5edb0b5d76339cb516bbdf10cfb6
SHA256

518aecef5bf06256a9fac8534575ed87360c78e102cd27c55d0635cb98551668
SHA512

82d030db1ba5cbc617c69cdd801421c3981ab28c13df95d3de5c32d61b186ea39829dd6502067a755da851ad8cd72344bc92b36582b142a89c437de7057042a6
SSDEEP

6144:YJvJm09zORs+z/TMify9DAOnqQHtQhRLfgZ8/:Ypw09CK5NACQhy8/

Score

10^/10

fabookie glupteba redline smokeloader xmrig 0305 up3 backdoor discovery dropper infostealer loader miner spyware stealer trojan

Malware Config

Extracted

Family

smokeloader

Version

2022

http://77.91.68.29/fks/

rc4.i32

Extracted

Family

redline

Botnet

0305

185.215.113.25:10195

Attributes

auth_value
c86205ff1cc37b2da12f0190adfda52c

Extracted

Family

smokeloader

Botnet

up3

Extracted

Family

smokeloader

Version

2020

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32

Signatures

Detect Fabookie payload 2 IoCs

resource	yara_rule
behavioral2/memory/2072-167-0x00000000032C0000-0x00000000033F1000-memory.dmp	family_fabookie
behavioral2/memory/2072-397-0x00000000032C0000-0x00000000033F1000-memory.dmp	family_fabookie

Fabookie
Fabookie is facebook account info stealer.
spyware stealer fabookie
Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 6 IoCs

resource	yara_rule
behavioral2/memory/1840-150-0x0000000002ED0000-0x00000000037BB000-memory.dmp	family_glupteba
behavioral2/memory/1840-152-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral2/memory/1840-163-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral2/memory/1840-211-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral2/memory/1840-292-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral2/memory/1840-466-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral2/memory/3568-505-0x0000000140000000-0x00000001407CF000-memory.dmp	xmrig
behavioral2/memory/3568-593-0x0000000140000000-0x00000001407CF000-memory.dmp	xmrig

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
632	CE09.exe
2388	D1B4.exe
1524	E7FD.exe
2072	ss41.exe
1460	toolspub2.exe
1840	31839b57a4f11171d6abc8bbc4451ee4.exe
5020	EF41.exe
4640	F30B.exe
220	toolspub2.exe
2084	gjfgfsj
4240	urfgfsj

Loads dropped DLL 1 IoCs

pid	Process
4448	regsvr32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 4360 set thread context of 5096	4360	518aecef5bf06256a9fac8534575ed87360c78e102cd27c55d0635cb98551668.exe	70
PID 1460 set thread context of 220	1460	toolspub2.exe	89
PID 5020 set thread context of 3828	5020	EF41.exe	90
PID 3828 set thread context of 3568	3828	aspnet_compiler.exe	96

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub2.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub2.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub2.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = bff9f3f5abead901	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = b12e520dacead901	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = f529e2f8abead901	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\CRLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Extensible Cache	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListFirstRun = "3"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = f1bed111acead901	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = f8d454f7abead901	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 0000000000000000	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BingPageData	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{A8A88C49-5EB2-4990-A1A2-087602 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "395205405"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 34d3c511acead901	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\Extensions	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI	MicrosoftEdge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5096	AppLaunch.exe
5096	AppLaunch.exe
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3240	Process not Found

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
664	Process not Found

Suspicious behavior: MapViewOfSection 8 IoCs

pid	Process
5096	AppLaunch.exe
1792	MicrosoftEdgeCP.exe
1792	MicrosoftEdgeCP.exe
220	toolspub2.exe
1792	MicrosoftEdgeCP.exe
1792	MicrosoftEdgeCP.exe
1792	MicrosoftEdgeCP.exe
1792	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3240	Process not Found
Token: SeCreatePagefilePrivilege	3240	Process not Found
Token: SeShutdownPrivilege	3240	Process not Found
Token: SeCreatePagefilePrivilege	3240	Process not Found
Token: SeShutdownPrivilege	3240	Process not Found
Token: SeCreatePagefilePrivilege	3240	Process not Found
Token: SeShutdownPrivilege	3240	Process not Found
Token: SeCreatePagefilePrivilege	3240	Process not Found
Token: SeShutdownPrivilege	3240	Process not Found
Token: SeCreatePagefilePrivilege	3240	Process not Found
Token: SeShutdownPrivilege	3240	Process not Found
Token: SeCreatePagefilePrivilege	3240	Process not Found
Token: SeShutdownPrivilege	3240	Process not Found
Token: SeCreatePagefilePrivilege	3240	Process not Found
Token: SeShutdownPrivilege	3240	Process not Found
Token: SeCreatePagefilePrivilege	3240	Process not Found
Token: SeDebugPrivilege	5020	EF41.exe
Token: SeDebugPrivilege	4640	F30B.exe
Token: SeShutdownPrivilege	3240	Process not Found
Token: SeCreatePagefilePrivilege	3240	Process not Found
Token: SeShutdownPrivilege	3240	Process not Found
Token: SeCreatePagefilePrivilege	3240	Process not Found
Token: SeShutdownPrivilege	3240	Process not Found
Token: SeCreatePagefilePrivilege	3240	Process not Found
Token: SeShutdownPrivilege	3240	Process not Found
Token: SeCreatePagefilePrivilege	3240	Process not Found
Token: SeShutdownPrivilege	3240	Process not Found
Token: SeCreatePagefilePrivilege	3240	Process not Found
Token: SeShutdownPrivilege	3240	Process not Found
Token: SeCreatePagefilePrivilege	3240	Process not Found
Token: SeShutdownPrivilege	3240	Process not Found
Token: SeCreatePagefilePrivilege	3240	Process not Found
Token: SeDebugPrivilege	3828	aspnet_compiler.exe
Token: SeDebugPrivilege	4264	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4264	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4264	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4264	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	632	CE09.exe
Token: SeShutdownPrivilege	3240	Process not Found
Token: SeCreatePagefilePrivilege	3240	Process not Found
Token: SeDebugPrivilege	2472	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2472	MicrosoftEdgeCP.exe
Token: SeShutdownPrivilege	3240	Process not Found
Token: SeCreatePagefilePrivilege	3240	Process not Found
Token: SeShutdownPrivilege	3240	Process not Found
Token: SeCreatePagefilePrivilege	3240	Process not Found
Token: SeShutdownPrivilege	3240	Process not Found
Token: SeCreatePagefilePrivilege	3240	Process not Found
Token: SeLockMemoryPrivilege	3568	AddInProcess.exe
Token: SeLockMemoryPrivilege	3568	AddInProcess.exe
Token: SeShutdownPrivilege	3240	Process not Found
Token: SeCreatePagefilePrivilege	3240	Process not Found
Token: SeShutdownPrivilege	3240	Process not Found
Token: SeCreatePagefilePrivilege	3240	Process not Found
Token: SeShutdownPrivilege	3240	Process not Found
Token: SeCreatePagefilePrivilege	3240	Process not Found
Token: SeShutdownPrivilege	3240	Process not Found
Token: SeCreatePagefilePrivilege	3240	Process not Found
Token: SeShutdownPrivilege	3240	Process not Found
Token: SeCreatePagefilePrivilege	3240	Process not Found
Token: SeShutdownPrivilege	3240	Process not Found
Token: SeCreatePagefilePrivilege	3240	Process not Found
Token: SeShutdownPrivilege	3240	Process not Found
Token: SeCreatePagefilePrivilege	3240	Process not Found

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3568	AddInProcess.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
164	MicrosoftEdge.exe
1792	MicrosoftEdgeCP.exe
4264	MicrosoftEdgeCP.exe
1792	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4360 wrote to memory of 5096	4360	518aecef5bf06256a9fac8534575ed87360c78e102cd27c55d0635cb98551668.exe	70
PID 4360 wrote to memory of 5096	4360	518aecef5bf06256a9fac8534575ed87360c78e102cd27c55d0635cb98551668.exe	70
PID 4360 wrote to memory of 5096	4360	518aecef5bf06256a9fac8534575ed87360c78e102cd27c55d0635cb98551668.exe	70
PID 4360 wrote to memory of 5096	4360	518aecef5bf06256a9fac8534575ed87360c78e102cd27c55d0635cb98551668.exe	70
PID 4360 wrote to memory of 5096	4360	518aecef5bf06256a9fac8534575ed87360c78e102cd27c55d0635cb98551668.exe	70
PID 4360 wrote to memory of 5096	4360	518aecef5bf06256a9fac8534575ed87360c78e102cd27c55d0635cb98551668.exe	70
PID 3240 wrote to memory of 632	3240	Process not Found	71
PID 3240 wrote to memory of 632	3240	Process not Found	71
PID 3240 wrote to memory of 632	3240	Process not Found	71
PID 3240 wrote to memory of 2388	3240	Process not Found	73
PID 3240 wrote to memory of 2388	3240	Process not Found	73
PID 3240 wrote to memory of 2388	3240	Process not Found	73
PID 3240 wrote to memory of 2840	3240	Process not Found	74
PID 3240 wrote to memory of 2840	3240	Process not Found	74
PID 2388 wrote to memory of 4448	2388	D1B4.exe	76
PID 2388 wrote to memory of 4448	2388	D1B4.exe	76
PID 2388 wrote to memory of 4448	2388	D1B4.exe	76
PID 3240 wrote to memory of 1524	3240	Process not Found	79
PID 3240 wrote to memory of 1524	3240	Process not Found	79
PID 3240 wrote to memory of 1524	3240	Process not Found	79
PID 1524 wrote to memory of 2072	1524	E7FD.exe	80
PID 1524 wrote to memory of 2072	1524	E7FD.exe	80
PID 1524 wrote to memory of 1460	1524	E7FD.exe	81
PID 1524 wrote to memory of 1460	1524	E7FD.exe	81
PID 1524 wrote to memory of 1460	1524	E7FD.exe	81
PID 1524 wrote to memory of 1840	1524	E7FD.exe	82
PID 1524 wrote to memory of 1840	1524	E7FD.exe	82
PID 1524 wrote to memory of 1840	1524	E7FD.exe	82
PID 3240 wrote to memory of 5020	3240	Process not Found	83
PID 3240 wrote to memory of 5020	3240	Process not Found	83
PID 3240 wrote to memory of 4640	3240	Process not Found	85
PID 3240 wrote to memory of 4640	3240	Process not Found	85
PID 1460 wrote to memory of 220	1460	toolspub2.exe	89
PID 1460 wrote to memory of 220	1460	toolspub2.exe	89
PID 1460 wrote to memory of 220	1460	toolspub2.exe	89
PID 1460 wrote to memory of 220	1460	toolspub2.exe	89
PID 1460 wrote to memory of 220	1460	toolspub2.exe	89
PID 1460 wrote to memory of 220	1460	toolspub2.exe	89
PID 5020 wrote to memory of 3828	5020	EF41.exe	90
PID 5020 wrote to memory of 3828	5020	EF41.exe	90
PID 5020 wrote to memory of 3828	5020	EF41.exe	90
PID 5020 wrote to memory of 3828	5020	EF41.exe	90
PID 5020 wrote to memory of 3828	5020	EF41.exe	90
PID 5020 wrote to memory of 3828	5020	EF41.exe	90
PID 1792 wrote to memory of 4508	1792	MicrosoftEdgeCP.exe	88
PID 1792 wrote to memory of 4508	1792	MicrosoftEdgeCP.exe	88
PID 1792 wrote to memory of 4508	1792	MicrosoftEdgeCP.exe	88
PID 1792 wrote to memory of 4508	1792	MicrosoftEdgeCP.exe	88
PID 1792 wrote to memory of 4508	1792	MicrosoftEdgeCP.exe	88
PID 1792 wrote to memory of 4508	1792	MicrosoftEdgeCP.exe	88
PID 1792 wrote to memory of 4508	1792	MicrosoftEdgeCP.exe	88
PID 1792 wrote to memory of 4508	1792	MicrosoftEdgeCP.exe	88
PID 3828 wrote to memory of 3568	3828	aspnet_compiler.exe	96
PID 3828 wrote to memory of 3568	3828	aspnet_compiler.exe	96
PID 3828 wrote to memory of 3568	3828	aspnet_compiler.exe	96
PID 3828 wrote to memory of 3568	3828	aspnet_compiler.exe	96
PID 3828 wrote to memory of 3568	3828	aspnet_compiler.exe	96
PID 3828 wrote to memory of 3568	3828	aspnet_compiler.exe	96
PID 3828 wrote to memory of 3568	3828	aspnet_compiler.exe	96
PID 3828 wrote to memory of 3568	3828	aspnet_compiler.exe	96
PID 3828 wrote to memory of 3568	3828	aspnet_compiler.exe	96
PID 3828 wrote to memory of 3568	3828	aspnet_compiler.exe	96
PID 3828 wrote to memory of 3568	3828	aspnet_compiler.exe	96
PID 3828 wrote to memory of 3568	3828	aspnet_compiler.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\518aecef5bf06256a9fac8534575ed87360c78e102cd27c55d0635cb98551668.exe
"C:\Users\Admin\AppData\Local\Temp\518aecef5bf06256a9fac8534575ed87360c78e102cd27c55d0635cb98551668.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4360
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:5096

C:\Users\Admin\AppData\Local\Temp\CE09.exe
C:\Users\Admin\AppData\Local\Temp\CE09.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:632

C:\Users\Admin\AppData\Local\Temp\D1B4.exe
C:\Users\Admin\AppData\Local\Temp\D1B4.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" -u /s L2SDO.sS
  2⤵
  - Loads dropped DLL
  PID:4448

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\D2BE.bat" "
1⤵
- Checks computer location settings
PID:2840

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:164

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:4456

C:\Users\Admin\AppData\Local\Temp\E7FD.exe
C:\Users\Admin\AppData\Local\Temp\E7FD.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524
- C:\Users\Admin\AppData\Local\Temp\ss41.exe
  "C:\Users\Admin\AppData\Local\Temp\ss41.exe"
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
  "C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1460
- - C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
    "C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    - Suspicious behavior: MapViewOfSection
    PID:220
- C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
  "C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
  2⤵
  - Executes dropped EXE
  PID:1840

C:\Users\Admin\AppData\Local\Temp\EF41.exe
C:\Users\Admin\AppData\Local\Temp\EF41.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5020
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3828
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u RVN:RBvfugTGdvfZCHCgvSoHZdsYt2u1JwYhUP.RIG_CPU -p x --cpu-max-threads-hint=50
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:3568

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1792

C:\Users\Admin\AppData\Local\Temp\F30B.exe
C:\Users\Admin\AppData\Local\Temp\F30B.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4640

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4264

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4508

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:2364

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4472

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2472

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4988

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4376

C:\Users\Admin\AppData\Roaming\gjfgfsj
C:\Users\Admin\AppData\Roaming\gjfgfsj
1⤵
- Executes dropped EXE
PID:2084

C:\Users\Admin\AppData\Roaming\urfgfsj
C:\Users\Admin\AppData\Roaming\urfgfsj
1⤵
- Executes dropped EXE
PID:4240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2RZQZMR9\edgecompatviewlist[1].xml

Filesize
74KB

MD5
d4fc49dc14f63895d997fa4940f24378

SHA1
3efb1437a7c5e46034147cbbc8db017c69d02c31

SHA256
853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

SHA512
cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\L7R6DA2B\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\Y193SDXR\B8BxsscfVBr[1].ico

Filesize
1KB

MD5
e508eca3eafcc1fc2d7f19bafb29e06b

SHA1
a62fc3c2a027870d99aedc241e7d5babba9a891f

SHA256
e6d1d77403cd9f14fd2377d07e84350cfe768e3353e402bf42ebdc8593a58c9a

SHA512
49e3f31fd73e52ba274db9c7d306cc188e09c3ae683827f420fbb17534d197a503460e7ec2f1af46065f8d0b33f37400659bfa2ae165e502f97a8150e184a38c

Download Submit
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

Filesize
4.1MB

MD5
637f73095de9f62dc6fcfbe9b3f6d3d6

SHA1
708771d9413e7df69189d2a0c283ec72bd63d99e

SHA256
6a678e471f24d7560be7cda7a49a34b4f0c2cb279b779984e5f002be3dfacf1d

SHA512
00d4d05c7b894d4c52dcbc75d555c76f966defed1934747ffe4a29d8dc1b426fad021a02a5e221dd583ac86d67661a6b9cddde13ad1465546439f52ed567aeb5

Download Submit
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

Filesize
4.1MB

MD5
637f73095de9f62dc6fcfbe9b3f6d3d6

SHA1
708771d9413e7df69189d2a0c283ec72bd63d99e

SHA256
6a678e471f24d7560be7cda7a49a34b4f0c2cb279b779984e5f002be3dfacf1d

SHA512
00d4d05c7b894d4c52dcbc75d555c76f966defed1934747ffe4a29d8dc1b426fad021a02a5e221dd583ac86d67661a6b9cddde13ad1465546439f52ed567aeb5

Download Submit
C:\Users\Admin\AppData\Local\Temp\CE09.exe

Filesize
412KB

MD5
5200fbe07521eb001f145afb95d40283

SHA1
df6cfdf15b58a0bb24255b3902886dc375f3346f

SHA256
00c3f29f9a8aec0774256501c562275e2d866f0130a2b8a58d74003c6c77e812

SHA512
c38359959ce1083f94d2206d1b4b317e8c5d493168013b4e8c406acb5a55fd4f85ec7ce4d5e400b9105fd82eae3d6301d52346f040a64c09981185c66f2cbf75

Download Submit
C:\Users\Admin\AppData\Local\Temp\CE09.exe

Filesize
412KB

MD5
5200fbe07521eb001f145afb95d40283

SHA1
df6cfdf15b58a0bb24255b3902886dc375f3346f

SHA256
00c3f29f9a8aec0774256501c562275e2d866f0130a2b8a58d74003c6c77e812

SHA512
c38359959ce1083f94d2206d1b4b317e8c5d493168013b4e8c406acb5a55fd4f85ec7ce4d5e400b9105fd82eae3d6301d52346f040a64c09981185c66f2cbf75

Download Submit
C:\Users\Admin\AppData\Local\Temp\D1B4.exe

Filesize
1.8MB

MD5
ee83f124e1cc1e3d7238bd609631595e

SHA1
e248a55c5d4a76dd96875e6ce3043cc6bb78a09f

SHA256
4057647fc5807f142647778751835225236e0824c7c1690a80a0d5f7e9ab072e

SHA512
dba6668890c4726e4a35b0ea5a721234fa712ec1b9c21468d0f14d476571c997c0fb2b9d72132cde44be3f64d59b35c8dca5cb8066b09dbdf46247f39e1809e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\D1B4.exe

Filesize
1.8MB

MD5
ee83f124e1cc1e3d7238bd609631595e

SHA1
e248a55c5d4a76dd96875e6ce3043cc6bb78a09f

SHA256
4057647fc5807f142647778751835225236e0824c7c1690a80a0d5f7e9ab072e

SHA512
dba6668890c4726e4a35b0ea5a721234fa712ec1b9c21468d0f14d476571c997c0fb2b9d72132cde44be3f64d59b35c8dca5cb8066b09dbdf46247f39e1809e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\D2BE.bat

Filesize
79B

MD5
403991c4d18ac84521ba17f264fa79f2

SHA1
850cc068de0963854b0fe8f485d951072474fd45

SHA256
ef6e942aefe925fefac19fa816986ea25de6935c4f377c717e29b94e65f9019f

SHA512
a20aaa77065d30195e5893f2ff989979383c8d7f82d9e528d4833b1c1236aef4f85284f5250d0f190a174790b650280ffe1fbff7e00c98024ccf5ca746e5b576

Download Submit
C:\Users\Admin\AppData\Local\Temp\E7FD.exe

Filesize
4.6MB

MD5
b32d5a382373d7df0c1fec9f15f0724a

SHA1
472fc4c27859f39e8b9a0bf784949f72944dc52b

SHA256
010fe481ba6275ebbf71e102e66d73f5d819252f2b4b1893d2acf53c04f4200f

SHA512
1320be23719f86e043beaeea8affa9ab125a68a1210f596c4424d4a5a2a9ef72eb572578897722842ad0586afe1d669ff816648ea3eeb3aa0b8379c9066da3a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\E7FD.exe

Filesize
4.6MB

MD5
b32d5a382373d7df0c1fec9f15f0724a

SHA1
472fc4c27859f39e8b9a0bf784949f72944dc52b

SHA256
010fe481ba6275ebbf71e102e66d73f5d819252f2b4b1893d2acf53c04f4200f

SHA512
1320be23719f86e043beaeea8affa9ab125a68a1210f596c4424d4a5a2a9ef72eb572578897722842ad0586afe1d669ff816648ea3eeb3aa0b8379c9066da3a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\EF41.exe

Filesize
894KB

MD5
ef11a166e73f258d4159c1904485623c

SHA1
bc1f4c685f4ec4f617f79e3f3f8c82564cccfc4e

SHA256
dc24474e1211ef4554c63f4d70380cc71063466c3d0a07e1a4d0726e0f587747

SHA512
2db0b963f92ce1f0b965011f250361e0951702267e8502a7648a726c407941e6b95abb360545e61ff7914c66258ee33a86766b877da3ad4603d68901fbd95708

Download Submit
C:\Users\Admin\AppData\Local\Temp\EF41.exe

Filesize
894KB

MD5
ef11a166e73f258d4159c1904485623c

SHA1
bc1f4c685f4ec4f617f79e3f3f8c82564cccfc4e

SHA256
dc24474e1211ef4554c63f4d70380cc71063466c3d0a07e1a4d0726e0f587747

SHA512
2db0b963f92ce1f0b965011f250361e0951702267e8502a7648a726c407941e6b95abb360545e61ff7914c66258ee33a86766b877da3ad4603d68901fbd95708

Download Submit
C:\Users\Admin\AppData\Local\Temp\F30B.exe

Filesize
894KB

MD5
ef11a166e73f258d4159c1904485623c

SHA1
bc1f4c685f4ec4f617f79e3f3f8c82564cccfc4e

SHA256
dc24474e1211ef4554c63f4d70380cc71063466c3d0a07e1a4d0726e0f587747

SHA512
2db0b963f92ce1f0b965011f250361e0951702267e8502a7648a726c407941e6b95abb360545e61ff7914c66258ee33a86766b877da3ad4603d68901fbd95708

Download Submit
C:\Users\Admin\AppData\Local\Temp\F30B.exe

Filesize
894KB

MD5
ef11a166e73f258d4159c1904485623c

SHA1
bc1f4c685f4ec4f617f79e3f3f8c82564cccfc4e

SHA256
dc24474e1211ef4554c63f4d70380cc71063466c3d0a07e1a4d0726e0f587747

SHA512
2db0b963f92ce1f0b965011f250361e0951702267e8502a7648a726c407941e6b95abb360545e61ff7914c66258ee33a86766b877da3ad4603d68901fbd95708

Download Submit
C:\Users\Admin\AppData\Local\Temp\L2SDO.sS

Filesize
1.4MB

MD5
77215f662281f3c15a8b0bfbf81cdd45

SHA1
38ee74a575c4a637e4c71d848a21e19a4d9f914a

SHA256
fd909f406acae9820d03cd7c55b823ab05626918bd5842e5aa1ccb419cab0e06

SHA512
a10f4db5380367afca8cfe3eb30ed8a298213bbf81dc9e4d14b6a1604bf580c9ec188152fd06fcc898dfa95e2eff53072104ee4d7e775e3426515723cee27c24

Download Submit
C:\Users\Admin\AppData\Local\Temp\ss41.exe

Filesize
298KB

MD5
8bd874c0500c7112d04cfad6fda75524

SHA1
d04a20e3bb7ffe5663f69c870457ad4edeb00192

SHA256
22aa36bd2f8ace8d959f22cf0e99bfe1d3fd655c075aa14a3232fb9e0f35adc2

SHA512
d6c43d5a5d1bfca1dddfb6283eafcd1f274e52812ccfee877298dfc74930fe6a8ec7035f95107600742ef19a630bee3ca3fab1fc7ab3ff717bea8f8c05e384d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\ss41.exe

Filesize
298KB

MD5
8bd874c0500c7112d04cfad6fda75524

SHA1
d04a20e3bb7ffe5663f69c870457ad4edeb00192

SHA256
22aa36bd2f8ace8d959f22cf0e99bfe1d3fd655c075aa14a3232fb9e0f35adc2

SHA512
d6c43d5a5d1bfca1dddfb6283eafcd1f274e52812ccfee877298dfc74930fe6a8ec7035f95107600742ef19a630bee3ca3fab1fc7ab3ff717bea8f8c05e384d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

Filesize
227KB

MD5
fccd5785d54697b968ebe3c55641c4b3

SHA1
f3353f2cfb27100ea14ae6ad02a72f834694fbf3

SHA256
757568f5af7731014baf25b6941c179d14b2041d2aa8a43e482a942e99d86f82

SHA512
0360e3c3469219f6c13ab3bd0c47304c6bb1319463c4102433156400ebfbf468b88f9b469eeb01e78ed32021adb93d52e9dd410dcc9d44e5dbee67f9a51aed6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

Filesize
227KB

MD5
fccd5785d54697b968ebe3c55641c4b3

SHA1
f3353f2cfb27100ea14ae6ad02a72f834694fbf3

SHA256
757568f5af7731014baf25b6941c179d14b2041d2aa8a43e482a942e99d86f82

SHA512
0360e3c3469219f6c13ab3bd0c47304c6bb1319463c4102433156400ebfbf468b88f9b469eeb01e78ed32021adb93d52e9dd410dcc9d44e5dbee67f9a51aed6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

Filesize
227KB

MD5
fccd5785d54697b968ebe3c55641c4b3

SHA1
f3353f2cfb27100ea14ae6ad02a72f834694fbf3

SHA256
757568f5af7731014baf25b6941c179d14b2041d2aa8a43e482a942e99d86f82

SHA512
0360e3c3469219f6c13ab3bd0c47304c6bb1319463c4102433156400ebfbf468b88f9b469eeb01e78ed32021adb93d52e9dd410dcc9d44e5dbee67f9a51aed6d

Download Submit
C:\Users\Admin\AppData\Roaming\gjfgfsj

Filesize
96KB

MD5
7825cad99621dd288da81d8d8ae13cf5

SHA1
f3e1ab0c8e4f22e718cdeb6fa5faa87b0e61e73c

SHA256
529088553fe9cb3e497ef704ce9bc7bc07630f6ddfad44afb92acfe639789ec5

SHA512
2e81251a2c140a96f681fa95d82eee531b391e2654daa90da08d1dd00f13cba949136d465a2dc37507d40b4a708b6fc695baa716f19737591b1a89bd2a4b60b4

Download Submit
C:\Users\Admin\AppData\Roaming\gjfgfsj

Filesize
96KB

MD5
7825cad99621dd288da81d8d8ae13cf5

SHA1
f3e1ab0c8e4f22e718cdeb6fa5faa87b0e61e73c

SHA256
529088553fe9cb3e497ef704ce9bc7bc07630f6ddfad44afb92acfe639789ec5

SHA512
2e81251a2c140a96f681fa95d82eee531b391e2654daa90da08d1dd00f13cba949136d465a2dc37507d40b4a708b6fc695baa716f19737591b1a89bd2a4b60b4

Download Submit
C:\Users\Admin\AppData\Roaming\urfgfsj

Filesize
227KB

MD5
fccd5785d54697b968ebe3c55641c4b3

SHA1
f3353f2cfb27100ea14ae6ad02a72f834694fbf3

SHA256
757568f5af7731014baf25b6941c179d14b2041d2aa8a43e482a942e99d86f82

SHA512
0360e3c3469219f6c13ab3bd0c47304c6bb1319463c4102433156400ebfbf468b88f9b469eeb01e78ed32021adb93d52e9dd410dcc9d44e5dbee67f9a51aed6d

Download Submit
C:\Users\Admin\AppData\Roaming\urfgfsj

Filesize
227KB

MD5
fccd5785d54697b968ebe3c55641c4b3

SHA1
f3353f2cfb27100ea14ae6ad02a72f834694fbf3

SHA256
757568f5af7731014baf25b6941c179d14b2041d2aa8a43e482a942e99d86f82

SHA512
0360e3c3469219f6c13ab3bd0c47304c6bb1319463c4102433156400ebfbf468b88f9b469eeb01e78ed32021adb93d52e9dd410dcc9d44e5dbee67f9a51aed6d

Download Submit
C:\Users\Admin\AppData\Roaming\urfgfsj

Filesize
227KB

MD5
fccd5785d54697b968ebe3c55641c4b3

SHA1
f3353f2cfb27100ea14ae6ad02a72f834694fbf3

SHA256
757568f5af7731014baf25b6941c179d14b2041d2aa8a43e482a942e99d86f82

SHA512
0360e3c3469219f6c13ab3bd0c47304c6bb1319463c4102433156400ebfbf468b88f9b469eeb01e78ed32021adb93d52e9dd410dcc9d44e5dbee67f9a51aed6d

Download Submit
\Users\Admin\AppData\Local\Temp\L2SDO.ss

Filesize
1.4MB

MD5
77215f662281f3c15a8b0bfbf81cdd45

SHA1
38ee74a575c4a637e4c71d848a21e19a4d9f914a

SHA256
fd909f406acae9820d03cd7c55b823ab05626918bd5842e5aa1ccb419cab0e06

SHA512
a10f4db5380367afca8cfe3eb30ed8a298213bbf81dc9e4d14b6a1604bf580c9ec188152fd06fcc898dfa95e2eff53072104ee4d7e775e3426515723cee27c24

Download Submit
memory/164-36-0x0000020A3A520000-0x0000020A3A530000-memory.dmp

Filesize
64KB

Download
memory/164-56-0x0000020A3AA00000-0x0000020A3AA10000-memory.dmp

Filesize
64KB

Download
memory/164-79-0x0000020A3AB00000-0x0000020A3AB02000-memory.dmp

Filesize
8KB

Download
memory/220-142-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/220-146-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/220-181-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/632-134-0x0000000004EA0000-0x0000000004EB0000-memory.dmp

Filesize
64KB

Download
memory/632-58-0x0000000004EA0000-0x0000000004EB0000-memory.dmp

Filesize
64KB

Download
memory/632-51-0x00000000055C0000-0x0000000005BC6000-memory.dmp

Filesize
6.0MB

Download
memory/632-37-0x0000000071990000-0x000000007207E000-memory.dmp

Filesize
6.9MB

Download
memory/632-39-0x0000000001160000-0x0000000001166000-memory.dmp

Filesize
24KB

Download
memory/632-277-0x0000000071990000-0x000000007207E000-memory.dmp

Filesize
6.9MB

Download
memory/632-189-0x00000000064D0000-0x0000000006520000-memory.dmp

Filesize
320KB

Download
memory/632-57-0x0000000004E00000-0x0000000004E12000-memory.dmp

Filesize
72KB

Download
memory/632-178-0x0000000008330000-0x000000000885C000-memory.dmp

Filesize
5.2MB

Download
memory/632-54-0x00000000050C0000-0x00000000051CA000-memory.dmp

Filesize
1.0MB

Download
memory/632-175-0x00000000062B0000-0x0000000006472000-memory.dmp

Filesize
1.8MB

Download
memory/632-149-0x00000000065E0000-0x0000000006ADE000-memory.dmp

Filesize
5.0MB

Download
memory/632-60-0x0000000004E60000-0x0000000004E9E000-memory.dmp

Filesize
248KB

Download
memory/632-120-0x0000000071990000-0x000000007207E000-memory.dmp

Filesize
6.9MB

Download
memory/632-65-0x0000000004FB0000-0x0000000004FFB000-memory.dmp

Filesize
300KB

Download
memory/632-127-0x00000000053A0000-0x0000000005432000-memory.dmp

Filesize
584KB

Download
memory/632-126-0x0000000005280000-0x00000000052F6000-memory.dmp

Filesize
472KB

Download
memory/632-128-0x0000000005300000-0x0000000005366000-memory.dmp

Filesize
408KB

Download
memory/632-31-0x0000000001020000-0x0000000001050000-memory.dmp

Filesize
192KB

Download
memory/1460-139-0x0000000000950000-0x0000000000A50000-memory.dmp

Filesize
1024KB

Download
memory/1460-140-0x0000000000730000-0x0000000000739000-memory.dmp

Filesize
36KB

Download
memory/1840-211-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/1840-292-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/1840-188-0x0000000002AC0000-0x0000000002EC7000-memory.dmp

Filesize
4.0MB

Download
memory/1840-466-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/1840-163-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/1840-152-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/1840-150-0x0000000002ED0000-0x00000000037BB000-memory.dmp

Filesize
8.9MB

Download
memory/1840-147-0x0000000002AC0000-0x0000000002EC7000-memory.dmp

Filesize
4.0MB

Download
memory/2072-397-0x00000000032C0000-0x00000000033F1000-memory.dmp

Filesize
1.2MB

Download
memory/2072-91-0x00007FF72EAD0000-0x00007FF72EB1E000-memory.dmp

Filesize
312KB

Download
memory/2072-167-0x00000000032C0000-0x00000000033F1000-memory.dmp

Filesize
1.2MB

Download
memory/2072-166-0x0000000003140000-0x00000000032B1000-memory.dmp

Filesize
1.4MB

Download
memory/3240-4-0x00000000008F0000-0x0000000000906000-memory.dmp

Filesize
88KB

Download
memory/3240-179-0x0000000002950000-0x0000000002966000-memory.dmp

Filesize
88KB

Download
memory/3568-546-0x000001F811BD0000-0x000001F811C10000-memory.dmp

Filesize
256KB

Download
memory/3568-625-0x000001F801B80000-0x000001F801BA0000-memory.dmp

Filesize
128KB

Download
memory/3568-593-0x0000000140000000-0x00000001407CF000-memory.dmp

Filesize
7.8MB

Download
memory/3568-505-0x0000000140000000-0x00000001407CF000-memory.dmp

Filesize
7.8MB

Download
memory/3568-626-0x000001F801B80000-0x000001F801BA0000-memory.dmp

Filesize
128KB

Download
memory/3828-156-0x000002D6F5E60000-0x000002D6F5F62000-memory.dmp

Filesize
1.0MB

Download
memory/3828-190-0x000002D6F5E50000-0x000002D6F5E60000-memory.dmp

Filesize
64KB

Download
memory/3828-161-0x000002D6DBDD0000-0x000002D6DBDD8000-memory.dmp

Filesize
32KB

Download
memory/3828-160-0x000002D6F5E50000-0x000002D6F5E60000-memory.dmp

Filesize
64KB

Download
memory/3828-159-0x00007FFBC2210000-0x00007FFBC2BFC000-memory.dmp

Filesize
9.9MB

Download
memory/3828-544-0x000002D6F5E50000-0x000002D6F5E60000-memory.dmp

Filesize
64KB

Download
memory/3828-535-0x000002D6F5E50000-0x000002D6F5E60000-memory.dmp

Filesize
64KB

Download
memory/3828-153-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3828-255-0x000002D6F5E50000-0x000002D6F5E60000-memory.dmp

Filesize
64KB

Download
memory/3828-186-0x000002D6F5E50000-0x000002D6F5E60000-memory.dmp

Filesize
64KB

Download
memory/3828-162-0x000002D6F6060000-0x000002D6F60B6000-memory.dmp

Filesize
344KB

Download
memory/3828-253-0x00007FFBC2210000-0x00007FFBC2BFC000-memory.dmp

Filesize
9.9MB

Download
memory/4448-28-0x00000000007E0000-0x00000000007E6000-memory.dmp

Filesize
24KB

Download
memory/4448-133-0x0000000004940000-0x0000000004A2A000-memory.dmp

Filesize
936KB

Download
memory/4448-123-0x0000000010000000-0x0000000010161000-memory.dmp

Filesize
1.4MB

Download
memory/4448-29-0x0000000010000000-0x0000000010161000-memory.dmp

Filesize
1.4MB

Download
memory/4448-119-0x0000000004830000-0x0000000004933000-memory.dmp

Filesize
1.0MB

Download
memory/4448-130-0x0000000004940000-0x0000000004A2A000-memory.dmp

Filesize
936KB

Download
memory/4448-135-0x0000000004940000-0x0000000004A2A000-memory.dmp

Filesize
936KB

Download
memory/4508-241-0x0000026312200000-0x0000026312300000-memory.dmp

Filesize
1024KB

Download
memory/4508-295-0x0000026311200000-0x0000026311300000-memory.dmp

Filesize
1024KB

Download
memory/4508-311-0x0000026312060000-0x0000026312080000-memory.dmp

Filesize
128KB

Download
memory/4640-157-0x00007FFBC2210000-0x00007FFBC2BFC000-memory.dmp

Filesize
9.9MB

Download
memory/4640-111-0x00007FFBC2210000-0x00007FFBC2BFC000-memory.dmp

Filesize
9.9MB

Download
memory/4640-148-0x00007FFBC2210000-0x00007FFBC2BFC000-memory.dmp

Filesize
9.9MB

Download
memory/4640-114-0x00000269C5560000-0x00000269C5570000-memory.dmp

Filesize
64KB

Download
memory/5020-145-0x00007FFBC2210000-0x00007FFBC2BFC000-memory.dmp

Filesize
9.9MB

Download
memory/5020-110-0x0000018BC3DA0000-0x0000018BC3E82000-memory.dmp

Filesize
904KB

Download
memory/5020-104-0x0000018BA9860000-0x0000018BA9946000-memory.dmp

Filesize
920KB

Download
memory/5020-118-0x0000018BC3F50000-0x0000018BC3F9C000-memory.dmp

Filesize
304KB

Download
memory/5020-154-0x0000018BAB500000-0x0000018BAB510000-memory.dmp

Filesize
64KB

Download
memory/5020-112-0x0000018BC3E80000-0x0000018BC3F50000-memory.dmp

Filesize
832KB

Download
memory/5020-158-0x00007FFBC2210000-0x00007FFBC2BFC000-memory.dmp

Filesize
9.9MB

Download
memory/5020-113-0x0000018BAB500000-0x0000018BAB510000-memory.dmp

Filesize
64KB

Download
memory/5020-106-0x00007FFBC2210000-0x00007FFBC2BFC000-memory.dmp

Filesize
9.9MB

Download
memory/5096-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/5096-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/5096-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download