fabookie | 95313a9168076d5b4d739c0a96bb32afd0c0e08e0c469bea68cb31b1ec1d5abd

Analysis

max time kernel
150s
max time network
159s
platform
windows10-1703_x64
resource
win10-20230915-en
resource tags

arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
submitted
19-09-2023 06:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

95313a9168076d5b4d739c0a96bb32afd0c0e08e0c469bea68cb31b1ec1d5abd.exe
Size

255KB
MD5

59ac66aa45d20ce8f5471216d7cf3558
SHA1

90474662e4dd8cded698887b54e29f5a8bbe8542
SHA256

95313a9168076d5b4d739c0a96bb32afd0c0e08e0c469bea68cb31b1ec1d5abd
SHA512

0664932cef624dec10942855aea9651f35f2905aeba60e924a0f49134c5c0e716c972d6d6150217cb5011d889d980b1c22f559a5e907bba293d1e3152da339c4
SSDEEP

6144:TvDjEd2jicP5iOo2T8VrSd/sUAOiilD91p4y1Sa:TvDwqiG59ouwiDvp1Sa

Score

10^/10

fabookie glupteba redline smokeloader xmrig 0305 up3 backdoor google discovery dropper infostealer loader miner phishing spyware stealer trojan

Malware Config

Extracted

Family

smokeloader

Version

2022

http://77.91.68.29/fks/

rc4.i32

Extracted

Family

redline

Botnet

0305

185.215.113.25:10195

Attributes

auth_value
c86205ff1cc37b2da12f0190adfda52c

Extracted

Family

smokeloader

Botnet

up3

Extracted

Family

smokeloader

Version

2020

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32

Signatures

Detect Fabookie payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3984-156-0x0000000003710000-0x0000000003841000-memory.dmp	family_fabookie
behavioral1/memory/3984-328-0x0000000003710000-0x0000000003841000-memory.dmp	family_fabookie

Detected google phishing page
phishing google
Fabookie
Fabookie is facebook account info stealer.
spyware stealer fabookie
Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1264-117-0x0000000002EE0000-0x00000000037CB000-memory.dmp	family_glupteba
behavioral1/memory/1264-119-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral1/memory/1264-178-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral1/memory/1264-179-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral1/memory/1264-462-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 1 IoCs

miner

Processes:

resource	yara_rule
behavioral1/memory/4724-498-0x0000000140000000-0x00000001407CF000-memory.dmp	xmrig

Downloads MZ/PE file
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

cmd.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000\Control Panel\International\Geo\Nation cmd.exe
Executes dropped EXE 8 IoCs

Processes:

8B34.exe8FB9.exe9FD8.exess41.exetoolspub2.exe31839b57a4f11171d6abc8bbc4451ee4.exetoolspub2.exeA7B9.exe

pid process

3584 8B34.exe
4100 8FB9.exe
3960 9FD8.exe
3984 ss41.exe
1368 toolspub2.exe
1264 31839b57a4f11171d6abc8bbc4451ee4.exe
1592 toolspub2.exe
2484 A7B9.exe
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

2324 regsvr32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000\Control Panel\International\Geo\Nation	cmd.exe

pid	process
3584	8B34.exe
4100	8FB9.exe
3960	9FD8.exe
3984	ss41.exe
1368	toolspub2.exe
1264	31839b57a4f11171d6abc8bbc4451ee4.exe
1592	toolspub2.exe
2484	A7B9.exe

pid	process
2324	regsvr32.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

95313a9168076d5b4d739c0a96bb32afd0c0e08e0c469bea68cb31b1ec1d5abd.exetoolspub2.exeA7B9.exeaspnet_compiler.exe

description	pid	process	target process
PID 4544 set thread context of 3712	4544	95313a9168076d5b4d739c0a96bb32afd0c0e08e0c469bea68cb31b1ec1d5abd.exe	AppLaunch.exe
PID 1368 set thread context of 1592	1368	toolspub2.exe	toolspub2.exe
PID 2484 set thread context of 2672	2484	A7B9.exe	aspnet_compiler.exe
PID 2672 set thread context of 4724	2672	aspnet_compiler.exe	AddInProcess.exe

Drops file in Windows directory 7 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

toolspub2.exeAppLaunch.exe

description	ioc	process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub2.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub2.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

browser_broker.exeMicrosoftEdgeCP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{5DD05972-95C9-4A17-941C-DFE2C63D5EAD} = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\Next Rating Prompt = 50bee6f37c0eda01	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\FileNames\en-US = "en-US.1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\NextUpdateDate = "401888036"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$Telligent	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = c4450824c6ead901	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\OneTimeCleanup = "1"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\FileNames	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 1c2c6f28c6ead901	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 9eb2de3fc6ead901	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\NextUpdateDate = "401871443"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "268435456"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 0000000000000000	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\Extensions	MicrosoftEdge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

AppLaunch.exe

pid	process
3712	AppLaunch.exe
3712	AppLaunch.exe
3044
3044
3044
3044
3044
3044
3044
3044
3044
3044
3044
3044
3044
3044
3044
3044
3044
3044
3044
3044
3044
3044
3044
3044
3044
3044
3044
3044
3044
3044
3044
3044
3044
3044
3044
3044
3044
3044
3044
3044
3044
3044
3044
3044
3044
3044
3044
3044
3044
3044
3044
3044
3044
3044
3044
3044
3044
3044
3044
3044
3044
3044

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

3044
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

616

pid	process
3044

pid	process
616

Suspicious behavior: MapViewOfSection 12 IoCs

Processes:

AppLaunch.exetoolspub2.exeMicrosoftEdgeCP.exe

pid	process
3712	AppLaunch.exe
1592	toolspub2.exe
3080	MicrosoftEdgeCP.exe
3080	MicrosoftEdgeCP.exe
3080	MicrosoftEdgeCP.exe
3080	MicrosoftEdgeCP.exe
3080	MicrosoftEdgeCP.exe
3080	MicrosoftEdgeCP.exe
3080	MicrosoftEdgeCP.exe
3080	MicrosoftEdgeCP.exe
3080	MicrosoftEdgeCP.exe
3080	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

A7B9.exeaspnet_compiler.exeMicrosoftEdgeCP.exe8B34.exeMicrosoftEdgeCP.exepowershell.exeAddInProcess.exe

description	pid	process
Token: SeShutdownPrivilege	3044
Token: SeCreatePagefilePrivilege	3044
Token: SeShutdownPrivilege	3044
Token: SeCreatePagefilePrivilege	3044
Token: SeShutdownPrivilege	3044
Token: SeCreatePagefilePrivilege	3044
Token: SeShutdownPrivilege	3044
Token: SeCreatePagefilePrivilege	3044
Token: SeShutdownPrivilege	3044
Token: SeCreatePagefilePrivilege	3044
Token: SeShutdownPrivilege	3044
Token: SeCreatePagefilePrivilege	3044
Token: SeShutdownPrivilege	3044
Token: SeCreatePagefilePrivilege	3044
Token: SeShutdownPrivilege	3044
Token: SeCreatePagefilePrivilege	3044
Token: SeShutdownPrivilege	3044
Token: SeCreatePagefilePrivilege	3044
Token: SeShutdownPrivilege	3044
Token: SeCreatePagefilePrivilege	3044
Token: SeDebugPrivilege	2484	A7B9.exe
Token: SeShutdownPrivilege	3044
Token: SeCreatePagefilePrivilege	3044
Token: SeDebugPrivilege	2672	aspnet_compiler.exe
Token: SeShutdownPrivilege	3044
Token: SeCreatePagefilePrivilege	3044
Token: SeShutdownPrivilege	3044
Token: SeCreatePagefilePrivilege	3044
Token: SeShutdownPrivilege	3044
Token: SeCreatePagefilePrivilege	3044
Token: SeShutdownPrivilege	3044
Token: SeCreatePagefilePrivilege	3044
Token: SeShutdownPrivilege	3044
Token: SeCreatePagefilePrivilege	3044
Token: SeShutdownPrivilege	3044
Token: SeCreatePagefilePrivilege	3044
Token: SeDebugPrivilege	2100	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2100	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2100	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2100	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3584	8B34.exe
Token: SeShutdownPrivilege	3044
Token: SeCreatePagefilePrivilege	3044
Token: SeDebugPrivilege	4276	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4276	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3840	powershell.exe
Token: SeLockMemoryPrivilege	4724	AddInProcess.exe
Token: SeLockMemoryPrivilege	4724	AddInProcess.exe
Token: SeShutdownPrivilege	3044
Token: SeCreatePagefilePrivilege	3044
Token: SeShutdownPrivilege	3044
Token: SeCreatePagefilePrivilege	3044
Token: SeShutdownPrivilege	3044
Token: SeCreatePagefilePrivilege	3044
Token: SeShutdownPrivilege	3044
Token: SeCreatePagefilePrivilege	3044
Token: SeShutdownPrivilege	3044
Token: SeCreatePagefilePrivilege	3044
Token: SeShutdownPrivilege	3044
Token: SeCreatePagefilePrivilege	3044
Token: SeShutdownPrivilege	3044
Token: SeCreatePagefilePrivilege	3044
Token: SeShutdownPrivilege	3044
Token: SeCreatePagefilePrivilege	3044

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

AddInProcess.exe

pid process

4724 AddInProcess.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

pid process

2252 MicrosoftEdge.exe
3080 MicrosoftEdgeCP.exe
2100 MicrosoftEdgeCP.exe
3080 MicrosoftEdgeCP.exe

pid	process
4724	AddInProcess.exe

pid	process
2252	MicrosoftEdge.exe
3080	MicrosoftEdgeCP.exe
2100	MicrosoftEdgeCP.exe
3080	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

95313a9168076d5b4d739c0a96bb32afd0c0e08e0c469bea68cb31b1ec1d5abd.exe8FB9.exe9FD8.exetoolspub2.exeA7B9.exeMicrosoftEdgeCP.exe31839b57a4f11171d6abc8bbc4451ee4.exeaspnet_compiler.exe

description	pid	process	target process
PID 4544 wrote to memory of 3712	4544	95313a9168076d5b4d739c0a96bb32afd0c0e08e0c469bea68cb31b1ec1d5abd.exe	AppLaunch.exe
PID 4544 wrote to memory of 3712	4544	95313a9168076d5b4d739c0a96bb32afd0c0e08e0c469bea68cb31b1ec1d5abd.exe	AppLaunch.exe
PID 4544 wrote to memory of 3712	4544	95313a9168076d5b4d739c0a96bb32afd0c0e08e0c469bea68cb31b1ec1d5abd.exe	AppLaunch.exe
PID 4544 wrote to memory of 3712	4544	95313a9168076d5b4d739c0a96bb32afd0c0e08e0c469bea68cb31b1ec1d5abd.exe	AppLaunch.exe
PID 4544 wrote to memory of 3712	4544	95313a9168076d5b4d739c0a96bb32afd0c0e08e0c469bea68cb31b1ec1d5abd.exe	AppLaunch.exe
PID 4544 wrote to memory of 3712	4544	95313a9168076d5b4d739c0a96bb32afd0c0e08e0c469bea68cb31b1ec1d5abd.exe	AppLaunch.exe
PID 3044 wrote to memory of 3584	3044		8B34.exe
PID 3044 wrote to memory of 3584	3044		8B34.exe
PID 3044 wrote to memory of 3584	3044		8B34.exe
PID 3044 wrote to memory of 4100	3044		8FB9.exe
PID 3044 wrote to memory of 4100	3044		8FB9.exe
PID 3044 wrote to memory of 4100	3044		8FB9.exe
PID 3044 wrote to memory of 4300	3044		cmd.exe
PID 3044 wrote to memory of 4300	3044		cmd.exe
PID 4100 wrote to memory of 2324	4100	8FB9.exe	regsvr32.exe
PID 4100 wrote to memory of 2324	4100	8FB9.exe	regsvr32.exe
PID 4100 wrote to memory of 2324	4100	8FB9.exe	regsvr32.exe
PID 3044 wrote to memory of 3960	3044		9FD8.exe
PID 3044 wrote to memory of 3960	3044		9FD8.exe
PID 3044 wrote to memory of 3960	3044		9FD8.exe
PID 3960 wrote to memory of 3984	3960	9FD8.exe	ss41.exe
PID 3960 wrote to memory of 3984	3960	9FD8.exe	ss41.exe
PID 3960 wrote to memory of 1368	3960	9FD8.exe	toolspub2.exe
PID 3960 wrote to memory of 1368	3960	9FD8.exe	toolspub2.exe
PID 3960 wrote to memory of 1368	3960	9FD8.exe	toolspub2.exe
PID 3960 wrote to memory of 1264	3960	9FD8.exe	31839b57a4f11171d6abc8bbc4451ee4.exe
PID 3960 wrote to memory of 1264	3960	9FD8.exe	31839b57a4f11171d6abc8bbc4451ee4.exe
PID 3960 wrote to memory of 1264	3960	9FD8.exe	31839b57a4f11171d6abc8bbc4451ee4.exe
PID 1368 wrote to memory of 1592	1368	toolspub2.exe	toolspub2.exe
PID 1368 wrote to memory of 1592	1368	toolspub2.exe	toolspub2.exe
PID 1368 wrote to memory of 1592	1368	toolspub2.exe	toolspub2.exe
PID 1368 wrote to memory of 1592	1368	toolspub2.exe	toolspub2.exe
PID 1368 wrote to memory of 1592	1368	toolspub2.exe	toolspub2.exe
PID 1368 wrote to memory of 1592	1368	toolspub2.exe	toolspub2.exe
PID 3044 wrote to memory of 2484	3044		A7B9.exe
PID 3044 wrote to memory of 2484	3044		A7B9.exe
PID 2484 wrote to memory of 2672	2484	A7B9.exe	aspnet_compiler.exe
PID 2484 wrote to memory of 2672	2484	A7B9.exe	aspnet_compiler.exe
PID 2484 wrote to memory of 2672	2484	A7B9.exe	aspnet_compiler.exe
PID 2484 wrote to memory of 2672	2484	A7B9.exe	aspnet_compiler.exe
PID 2484 wrote to memory of 2672	2484	A7B9.exe	aspnet_compiler.exe
PID 2484 wrote to memory of 2672	2484	A7B9.exe	aspnet_compiler.exe
PID 3080 wrote to memory of 68	3080	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3080 wrote to memory of 68	3080	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3080 wrote to memory of 68	3080	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1264 wrote to memory of 3840	1264	31839b57a4f11171d6abc8bbc4451ee4.exe	powershell.exe
PID 1264 wrote to memory of 3840	1264	31839b57a4f11171d6abc8bbc4451ee4.exe	powershell.exe
PID 1264 wrote to memory of 3840	1264	31839b57a4f11171d6abc8bbc4451ee4.exe	powershell.exe
PID 3080 wrote to memory of 68	3080	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3080 wrote to memory of 68	3080	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3080 wrote to memory of 68	3080	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3080 wrote to memory of 68	3080	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3080 wrote to memory of 68	3080	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3080 wrote to memory of 68	3080	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3080 wrote to memory of 68	3080	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3080 wrote to memory of 68	3080	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3080 wrote to memory of 68	3080	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3080 wrote to memory of 68	3080	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2672 wrote to memory of 4724	2672	aspnet_compiler.exe	AddInProcess.exe
PID 2672 wrote to memory of 4724	2672	aspnet_compiler.exe	AddInProcess.exe
PID 2672 wrote to memory of 4724	2672	aspnet_compiler.exe	AddInProcess.exe
PID 2672 wrote to memory of 4724	2672	aspnet_compiler.exe	AddInProcess.exe
PID 2672 wrote to memory of 4724	2672	aspnet_compiler.exe	AddInProcess.exe
PID 2672 wrote to memory of 4724	2672	aspnet_compiler.exe	AddInProcess.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\95313a9168076d5b4d739c0a96bb32afd0c0e08e0c469bea68cb31b1ec1d5abd.exe
"C:\Users\Admin\AppData\Local\Temp\95313a9168076d5b4d739c0a96bb32afd0c0e08e0c469bea68cb31b1ec1d5abd.exe"
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4544

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3712

C:\Users\Admin\AppData\Local\Temp\8B34.exe
C:\Users\Admin\AppData\Local\Temp\8B34.exe
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3584

C:\Users\Admin\AppData\Local\Temp\8FB9.exe
C:\Users\Admin\AppData\Local\Temp\8FB9.exe
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /U -S .\LpH0dGGB.LP
- Loads dropped DLL
PID:2324

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\917F.bat" "
- Checks computer location settings
PID:4300

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2252

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
- Modifies Internet Explorer settings
PID:5016

C:\Users\Admin\AppData\Local\Temp\9FD8.exe
C:\Users\Admin\AppData\Local\Temp\9FD8.exe
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1368

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:1592

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
- Suspicious use of AdjustPrivilegeToken
PID:3840

C:\Users\Admin\AppData\Local\Temp\ss41.exe
"C:\Users\Admin\AppData\Local\Temp\ss41.exe"
- Executes dropped EXE
PID:3984

C:\Users\Admin\AppData\Local\Temp\A7B9.exe
C:\Users\Admin\AppData\Local\Temp\A7B9.exe
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2484

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2672

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u RVN:RBvfugTGdvfZCHCgvSoHZdsYt2u1JwYhUP.RIG_CPU -p x --cpu-max-threads-hint=50
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4724

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3080

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2100

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
- Drops file in Windows directory
- Modifies registry class
PID:68

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
- Drops file in Windows directory
- Modifies registry class
PID:3688

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4276

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
- Drops file in Windows directory
- Modifies registry class
PID:4896

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
- Drops file in Windows directory
- Modifies registry class
PID:1992

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
- Modifies registry class
PID:2728

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\9TVXN1W7\edgecompatviewlist[1].xml
Filesize
74KB

MD5
d4fc49dc14f63895d997fa4940f24378

SHA1
3efb1437a7c5e46034147cbbc8db017c69d02c31

SHA256
853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

SHA512
cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\BSF6S60H\B8BxsscfVBr[1].ico
Filesize
1KB

MD5
e508eca3eafcc1fc2d7f19bafb29e06b

SHA1
a62fc3c2a027870d99aedc241e7d5babba9a891f

SHA256
e6d1d77403cd9f14fd2377d07e84350cfe768e3353e402bf42ebdc8593a58c9a

SHA512
49e3f31fd73e52ba274db9c7d306cc188e09c3ae683827f420fbb17534d197a503460e7ec2f1af46065f8d0b33f37400659bfa2ae165e502f97a8150e184a38c

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\SZI8ATL0\suggestions[1].en-US
Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize
1KB

MD5
badf87a9976acc2f048aac6a7ea8c1d0

SHA1
19235ce11141fcc63469e4beedee0009972f16eb

SHA256
d6c5015d58404ef4e62f6c73f1c03afcf5c560fe956ea103faa0c00b4d31b7aa

SHA512
76ce64276529b84ae1671629987e8503d7a9ffa3d33c6f818916cc0ef1dcc17fb636605faeec69507ce19dacaba298a0ababc7af3b9ff036c7aa8b302b22eece

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_BA0BAB2D4C396325C2233CA4C6557724
Filesize
472B

MD5
3dcd85134a74117cae6e0a89dc81d9f5

SHA1
b8e6545c5acbbe429e57a71e830c6d3f6546a00c

SHA256
8e40e2fd520c12e7684ca0295a39e784a54e95870c5d95d2ed0c723649fd6ae7

SHA512
1931ad43a28f5b85bccc48398753ded12a04b5ede3f4f199bdc25ab8291bcdbbab0cf26f8e9e811990655d653df4bd7241cda923ab492883a5218446c84b25a1

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
Filesize
724B

MD5
ac89a852c2aaa3d389b2d2dd312ad367

SHA1
8f421dd6493c61dbda6b839e2debb7b50a20c930

SHA256
0b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45

SHA512
c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize
410B

MD5
8a469bb7c66ed99c81653122ced6e258

SHA1
f61767aaf02036a07b0dc896c6bd2cf2155cdefc

SHA256
7e1f83a0604b4996977aaeb641486e6bca40e141d4c0cc4bad671da6e8c99184

SHA512
3f8be5e4682a9090e672c0f1bd2b36abf61c68fef64aedfa1bc9b1412a63019cb3e1a3fde5abc6b31d28b488438f6baaf231599097abb3efac20f20c7dcdb6a6

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_BA0BAB2D4C396325C2233CA4C6557724
Filesize
410B

MD5
a76b948bdd69fba1538bbbdcc7c1d52a

SHA1
f5e6ff26bcf283c7e45e8e369b709d6443abd3b6

SHA256
5455d07ce2c6c67e43318c8fcf3c7e7c40ec3d5c5438f59e1ac688b73878149f

SHA512
c530808b23690b5c73b1bc04318b64530f44ba53c4317c4b0cd1a48a487a1c221b7ed63c1016a6fabedc138f8e97739384d6e2c8207f4194c8d8ff3a37a5b1bc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
Filesize
392B

MD5
030cf7243c94ceb873d857b2219b2d2a

SHA1
fabdaba2422c03020161e5fb30308c3578f9e817

SHA256
9769173c133806835acc6b3239d55aad3f26bb52c4f10478e1da623281cec9aa

SHA512
437cfca2162ff40dd941574b326c18d46e9e7c9713ebfbd952ca2cfc893a3eb7869268ffffd07d8a207cfebe55785bcfa3b7dc8914eee9f952d7330dff375e72

Download Submit
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
Filesize
4MB

MD5
637f73095de9f62dc6fcfbe9b3f6d3d6

SHA1
708771d9413e7df69189d2a0c283ec72bd63d99e

SHA256
6a678e471f24d7560be7cda7a49a34b4f0c2cb279b779984e5f002be3dfacf1d

SHA512
00d4d05c7b894d4c52dcbc75d555c76f966defed1934747ffe4a29d8dc1b426fad021a02a5e221dd583ac86d67661a6b9cddde13ad1465546439f52ed567aeb5

Download Submit
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
Filesize
4MB

MD5
637f73095de9f62dc6fcfbe9b3f6d3d6

SHA1
708771d9413e7df69189d2a0c283ec72bd63d99e

SHA256
6a678e471f24d7560be7cda7a49a34b4f0c2cb279b779984e5f002be3dfacf1d

SHA512
00d4d05c7b894d4c52dcbc75d555c76f966defed1934747ffe4a29d8dc1b426fad021a02a5e221dd583ac86d67661a6b9cddde13ad1465546439f52ed567aeb5

Download Submit
C:\Users\Admin\AppData\Local\Temp\8B34.exe
Filesize
412KB

MD5
5200fbe07521eb001f145afb95d40283

SHA1
df6cfdf15b58a0bb24255b3902886dc375f3346f

SHA256
00c3f29f9a8aec0774256501c562275e2d866f0130a2b8a58d74003c6c77e812

SHA512
c38359959ce1083f94d2206d1b4b317e8c5d493168013b4e8c406acb5a55fd4f85ec7ce4d5e400b9105fd82eae3d6301d52346f040a64c09981185c66f2cbf75

Download Submit
C:\Users\Admin\AppData\Local\Temp\8B34.exe
Filesize
412KB

MD5
5200fbe07521eb001f145afb95d40283

SHA1
df6cfdf15b58a0bb24255b3902886dc375f3346f

SHA256
00c3f29f9a8aec0774256501c562275e2d866f0130a2b8a58d74003c6c77e812

SHA512
c38359959ce1083f94d2206d1b4b317e8c5d493168013b4e8c406acb5a55fd4f85ec7ce4d5e400b9105fd82eae3d6301d52346f040a64c09981185c66f2cbf75

Download Submit
C:\Users\Admin\AppData\Local\Temp\8FB9.exe
Filesize
1MB

MD5
d4fb44bf4974c88fa13fbda528992a0d

SHA1
18d9bcffa7b2372bca4ab13eaee08e925b68cfa6

SHA256
0ddb7999190c5af4a17b79963203c5ea63903e2d6cb0773f7e809c4e1d5a31cb

SHA512
ced3dda0101f6753c5d2cd03f9dccd830312f36f0b732f4ab84a5ceea54e57d9a35a78862f0b206b52eb36cc8a35e66c73043b126d8dacf6db8fd261acaf766e

Download Submit
C:\Users\Admin\AppData\Local\Temp\8FB9.exe
Filesize
1MB

MD5
d4fb44bf4974c88fa13fbda528992a0d

SHA1
18d9bcffa7b2372bca4ab13eaee08e925b68cfa6

SHA256
0ddb7999190c5af4a17b79963203c5ea63903e2d6cb0773f7e809c4e1d5a31cb

SHA512
ced3dda0101f6753c5d2cd03f9dccd830312f36f0b732f4ab84a5ceea54e57d9a35a78862f0b206b52eb36cc8a35e66c73043b126d8dacf6db8fd261acaf766e

Download Submit
C:\Users\Admin\AppData\Local\Temp\917F.bat
Filesize
79B

MD5
403991c4d18ac84521ba17f264fa79f2

SHA1
850cc068de0963854b0fe8f485d951072474fd45

SHA256
ef6e942aefe925fefac19fa816986ea25de6935c4f377c717e29b94e65f9019f

SHA512
a20aaa77065d30195e5893f2ff989979383c8d7f82d9e528d4833b1c1236aef4f85284f5250d0f190a174790b650280ffe1fbff7e00c98024ccf5ca746e5b576

Download Submit
C:\Users\Admin\AppData\Local\Temp\9FD8.exe
Filesize
4MB

MD5
b32d5a382373d7df0c1fec9f15f0724a

SHA1
472fc4c27859f39e8b9a0bf784949f72944dc52b

SHA256
010fe481ba6275ebbf71e102e66d73f5d819252f2b4b1893d2acf53c04f4200f

SHA512
1320be23719f86e043beaeea8affa9ab125a68a1210f596c4424d4a5a2a9ef72eb572578897722842ad0586afe1d669ff816648ea3eeb3aa0b8379c9066da3a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\9FD8.exe
Filesize
4MB

MD5
b32d5a382373d7df0c1fec9f15f0724a

SHA1
472fc4c27859f39e8b9a0bf784949f72944dc52b

SHA256
010fe481ba6275ebbf71e102e66d73f5d819252f2b4b1893d2acf53c04f4200f

SHA512
1320be23719f86e043beaeea8affa9ab125a68a1210f596c4424d4a5a2a9ef72eb572578897722842ad0586afe1d669ff816648ea3eeb3aa0b8379c9066da3a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\A7B9.exe
Filesize
894KB

MD5
ef11a166e73f258d4159c1904485623c

SHA1
bc1f4c685f4ec4f617f79e3f3f8c82564cccfc4e

SHA256
dc24474e1211ef4554c63f4d70380cc71063466c3d0a07e1a4d0726e0f587747

SHA512
2db0b963f92ce1f0b965011f250361e0951702267e8502a7648a726c407941e6b95abb360545e61ff7914c66258ee33a86766b877da3ad4603d68901fbd95708

Download Submit
C:\Users\Admin\AppData\Local\Temp\A7B9.exe
Filesize
894KB

MD5
ef11a166e73f258d4159c1904485623c

SHA1
bc1f4c685f4ec4f617f79e3f3f8c82564cccfc4e

SHA256
dc24474e1211ef4554c63f4d70380cc71063466c3d0a07e1a4d0726e0f587747

SHA512
2db0b963f92ce1f0b965011f250361e0951702267e8502a7648a726c407941e6b95abb360545e61ff7914c66258ee33a86766b877da3ad4603d68901fbd95708

Download Submit
C:\Users\Admin\AppData\Local\Temp\LpH0dGGB.LP
Filesize
1MB

MD5
9fab521111943372140fc72f81812369

SHA1
dd1ac64fdc2ea6e7c41fa506cdfd86c6c659c759

SHA256
12c41acc5cfe0dcfc3c2379b13d0447afd3beaf061009f75335e5dfd79a8d368

SHA512
8d791b2374ba2b18ed4544011550dba8a9dae72e4f6007b5efef07467ed81f3a0258bf88aae0cb4d1bfdeca5ca7b99dbef5837e91cf7b716720591d8c0585f02

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fhp51dok.aic.ps1
Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\ss41.exe
Filesize
298KB

MD5
8bd874c0500c7112d04cfad6fda75524

SHA1
d04a20e3bb7ffe5663f69c870457ad4edeb00192

SHA256
22aa36bd2f8ace8d959f22cf0e99bfe1d3fd655c075aa14a3232fb9e0f35adc2

SHA512
d6c43d5a5d1bfca1dddfb6283eafcd1f274e52812ccfee877298dfc74930fe6a8ec7035f95107600742ef19a630bee3ca3fab1fc7ab3ff717bea8f8c05e384d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\ss41.exe
Filesize
298KB

MD5
8bd874c0500c7112d04cfad6fda75524

SHA1
d04a20e3bb7ffe5663f69c870457ad4edeb00192

SHA256
22aa36bd2f8ace8d959f22cf0e99bfe1d3fd655c075aa14a3232fb9e0f35adc2

SHA512
d6c43d5a5d1bfca1dddfb6283eafcd1f274e52812ccfee877298dfc74930fe6a8ec7035f95107600742ef19a630bee3ca3fab1fc7ab3ff717bea8f8c05e384d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
Filesize
227KB

MD5
fccd5785d54697b968ebe3c55641c4b3

SHA1
f3353f2cfb27100ea14ae6ad02a72f834694fbf3

SHA256
757568f5af7731014baf25b6941c179d14b2041d2aa8a43e482a942e99d86f82

SHA512
0360e3c3469219f6c13ab3bd0c47304c6bb1319463c4102433156400ebfbf468b88f9b469eeb01e78ed32021adb93d52e9dd410dcc9d44e5dbee67f9a51aed6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
Filesize
227KB

MD5
fccd5785d54697b968ebe3c55641c4b3

SHA1
f3353f2cfb27100ea14ae6ad02a72f834694fbf3

SHA256
757568f5af7731014baf25b6941c179d14b2041d2aa8a43e482a942e99d86f82

SHA512
0360e3c3469219f6c13ab3bd0c47304c6bb1319463c4102433156400ebfbf468b88f9b469eeb01e78ed32021adb93d52e9dd410dcc9d44e5dbee67f9a51aed6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
Filesize
227KB

MD5
fccd5785d54697b968ebe3c55641c4b3

SHA1
f3353f2cfb27100ea14ae6ad02a72f834694fbf3

SHA256
757568f5af7731014baf25b6941c179d14b2041d2aa8a43e482a942e99d86f82

SHA512
0360e3c3469219f6c13ab3bd0c47304c6bb1319463c4102433156400ebfbf468b88f9b469eeb01e78ed32021adb93d52e9dd410dcc9d44e5dbee67f9a51aed6d

Download Submit
C:\Users\Admin\AppData\Roaming\fhtucge
Filesize
227KB

MD5
fccd5785d54697b968ebe3c55641c4b3

SHA1
f3353f2cfb27100ea14ae6ad02a72f834694fbf3

SHA256
757568f5af7731014baf25b6941c179d14b2041d2aa8a43e482a942e99d86f82

SHA512
0360e3c3469219f6c13ab3bd0c47304c6bb1319463c4102433156400ebfbf468b88f9b469eeb01e78ed32021adb93d52e9dd410dcc9d44e5dbee67f9a51aed6d

Download Submit
\Users\Admin\AppData\Local\Temp\lpH0dgGB.lP
Filesize
1MB

MD5
9fab521111943372140fc72f81812369

SHA1
dd1ac64fdc2ea6e7c41fa506cdfd86c6c659c759

SHA256
12c41acc5cfe0dcfc3c2379b13d0447afd3beaf061009f75335e5dfd79a8d368

SHA512
8d791b2374ba2b18ed4544011550dba8a9dae72e4f6007b5efef07467ed81f3a0258bf88aae0cb4d1bfdeca5ca7b99dbef5837e91cf7b716720591d8c0585f02

Download Submit
memory/68-244-0x000002663FD20000-0x000002663FD22000-memory.dmp

Filesize
8KB

Download
memory/68-239-0x000002663FCF0000-0x000002663FCF2000-memory.dmp

Filesize
8KB

Download
memory/68-309-0x0000026640370000-0x0000026640372000-memory.dmp

Filesize
8KB

Download
memory/68-235-0x000002663FE00000-0x000002663FE02000-memory.dmp

Filesize
8KB

Download
memory/1264-111-0x0000000002AD0000-0x0000000002ED5000-memory.dmp

Filesize
4MB

Download
memory/1264-178-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9MB

Download
memory/1264-117-0x0000000002EE0000-0x00000000037CB000-memory.dmp

Filesize
8MB

Download
memory/1264-462-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9MB

Download
memory/1264-164-0x0000000002AD0000-0x0000000002ED5000-memory.dmp

Filesize
4MB

Download
memory/1264-179-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9MB

Download
memory/1264-119-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9MB

Download
memory/1368-103-0x0000000000770000-0x0000000000779000-memory.dmp

Filesize
36KB

Download
memory/1368-102-0x0000000000800000-0x0000000000900000-memory.dmp

Filesize
1024KB

Download
memory/1592-144-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1592-107-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1592-104-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2252-41-0x00000213D9E20000-0x00000213D9E30000-memory.dmp

Filesize
64KB

Download
memory/2252-86-0x00000213D90E0000-0x00000213D90E2000-memory.dmp

Filesize
8KB

Download
memory/2252-61-0x00000213DA0E0000-0x00000213DA0F0000-memory.dmp

Filesize
64KB

Download
memory/2324-37-0x00000000004B0000-0x00000000004B6000-memory.dmp

Filesize
24KB

Download
memory/2324-34-0x0000000010000000-0x0000000010161000-memory.dmp

Filesize
1MB

Download
memory/2324-147-0x0000000000CD0000-0x0000000000DD3000-memory.dmp

Filesize
1MB

Download
memory/2324-152-0x0000000010000000-0x0000000010161000-memory.dmp

Filesize
1MB

Download
memory/2324-157-0x0000000000DE0000-0x0000000000ECA000-memory.dmp

Filesize
936KB

Download
memory/2324-161-0x0000000000DE0000-0x0000000000ECA000-memory.dmp

Filesize
936KB

Download
memory/2324-163-0x0000000000DE0000-0x0000000000ECA000-memory.dmp

Filesize
936KB

Download
memory/2484-115-0x00007FFFD2A00000-0x00007FFFD33EC000-memory.dmp

Filesize
9MB

Download
memory/2484-138-0x00007FFFD2A00000-0x00007FFFD33EC000-memory.dmp

Filesize
9MB

Download
memory/2484-114-0x0000027489A00000-0x0000027489AE6000-memory.dmp

Filesize
920KB

Download
memory/2484-116-0x00000274A3F20000-0x00000274A4002000-memory.dmp

Filesize
904KB

Download
memory/2484-118-0x00000274A4090000-0x00000274A4160000-memory.dmp

Filesize
832KB

Download
memory/2484-122-0x00000274A4000000-0x00000274A404C000-memory.dmp

Filesize
304KB

Download
memory/2484-121-0x00000274A4080000-0x00000274A4090000-memory.dmp

Filesize
64KB

Download
memory/2672-139-0x0000016395530000-0x0000016395540000-memory.dmp

Filesize
64KB

Download
memory/2672-533-0x0000016395530000-0x0000016395540000-memory.dmp

Filesize
64KB

Download
memory/2672-150-0x0000016393B40000-0x0000016393B48000-memory.dmp

Filesize
32KB

Download
memory/2672-151-0x0000016393D10000-0x0000016393D66000-memory.dmp

Filesize
344KB

Download
memory/2672-300-0x00007FFFD2A00000-0x00007FFFD33EC000-memory.dmp

Filesize
9MB

Download
memory/2672-490-0x0000016395530000-0x0000016395540000-memory.dmp

Filesize
64KB

Download
memory/2672-301-0x0000016395530000-0x0000016395540000-memory.dmp

Filesize
64KB

Download
memory/2672-132-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2672-135-0x00000163ADC20000-0x00000163ADD22000-memory.dmp

Filesize
1MB

Download
memory/2672-137-0x00007FFFD2A00000-0x00007FFFD33EC000-memory.dmp

Filesize
9MB

Download
memory/2672-180-0x0000016395530000-0x0000016395540000-memory.dmp

Filesize
64KB

Download
memory/2672-165-0x0000016395530000-0x0000016395540000-memory.dmp

Filesize
64KB

Download
memory/3044-4-0x0000000000DA0000-0x0000000000DB6000-memory.dmp

Filesize
88KB

Download
memory/3044-140-0x0000000002E40000-0x0000000002E56000-memory.dmp

Filesize
88KB

Download
memory/3584-39-0x000000000A820000-0x000000000AE26000-memory.dmp

Filesize
6MB

Download
memory/3584-27-0x00000000004B0000-0x00000000004E0000-memory.dmp

Filesize
192KB

Download
memory/3584-136-0x000000000A5F0000-0x000000000A656000-memory.dmp

Filesize
408KB

Download
memory/3584-193-0x000000000B620000-0x000000000B670000-memory.dmp

Filesize
320KB

Download
memory/3584-131-0x000000000A570000-0x000000000A5E6000-memory.dmp

Filesize
472KB

Download
memory/3584-120-0x0000000004D80000-0x0000000004D90000-memory.dmp

Filesize
64KB

Download
memory/3584-108-0x00000000727D0000-0x0000000072EBE000-memory.dmp

Filesize
6MB

Download
memory/3584-49-0x000000000A290000-0x000000000A2DB000-memory.dmp

Filesize
300KB

Download
memory/3584-177-0x000000000C160000-0x000000000C68C000-memory.dmp

Filesize
5MB

Download
memory/3584-176-0x000000000B400000-0x000000000B5C2000-memory.dmp

Filesize
1MB

Download
memory/3584-460-0x00000000727D0000-0x0000000072EBE000-memory.dmp

Filesize
6MB

Download
memory/3584-133-0x000000000A690000-0x000000000A722000-memory.dmp

Filesize
584KB

Download
memory/3584-36-0x00000000727D0000-0x0000000072EBE000-memory.dmp

Filesize
6MB

Download
memory/3584-38-0x0000000000570000-0x0000000000576000-memory.dmp

Filesize
24KB

Download
memory/3584-46-0x000000000A250000-0x000000000A28E000-memory.dmp

Filesize
248KB

Download
memory/3584-42-0x0000000004D60000-0x0000000004D72000-memory.dmp

Filesize
72KB

Download
memory/3584-40-0x000000000A320000-0x000000000A42A000-memory.dmp

Filesize
1MB

Download
memory/3584-44-0x0000000004D80000-0x0000000004D90000-memory.dmp

Filesize
64KB

Download
memory/3584-149-0x000000000B730000-0x000000000BC2E000-memory.dmp

Filesize
4MB

Download
memory/3688-266-0x00000205F90C0000-0x00000205F90E0000-memory.dmp

Filesize
128KB

Download
memory/3712-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3712-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3712-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3840-511-0x00000000097D0000-0x000000000980C000-memory.dmp

Filesize
240KB

Download
memory/3840-307-0x0000000007320000-0x0000000007330000-memory.dmp

Filesize
64KB

Download
memory/3840-303-0x0000000007290000-0x00000000072C6000-memory.dmp

Filesize
216KB

Download
memory/3840-352-0x0000000008310000-0x0000000008660000-memory.dmp

Filesize
3MB

Download
memory/3840-342-0x00000000081A0000-0x0000000008206000-memory.dmp

Filesize
408KB

Download
memory/3840-338-0x0000000007F90000-0x0000000007FB2000-memory.dmp

Filesize
136KB

Download
memory/3840-598-0x00000000727D0000-0x0000000072EBE000-memory.dmp

Filesize
6MB

Download
memory/3840-382-0x0000000008700000-0x000000000871C000-memory.dmp

Filesize
112KB

Download
memory/3840-333-0x0000000007320000-0x0000000007330000-memory.dmp

Filesize
64KB

Download
memory/3840-327-0x0000000007960000-0x0000000007F88000-memory.dmp

Filesize
6MB

Download
memory/3840-306-0x00000000727D0000-0x0000000072EBE000-memory.dmp

Filesize
6MB

Download
memory/3984-97-0x00007FF7F20A0000-0x00007FF7F20EE000-memory.dmp

Filesize
312KB

Download
memory/3984-328-0x0000000003710000-0x0000000003841000-memory.dmp

Filesize
1MB

Download
memory/3984-156-0x0000000003710000-0x0000000003841000-memory.dmp

Filesize
1MB

Download
memory/3984-155-0x0000000003590000-0x0000000003701000-memory.dmp

Filesize
1MB

Download
memory/4724-498-0x0000000140000000-0x00000001407CF000-memory.dmp

Filesize
7MB

Download