Analysis
-
max time kernel
27s -
max time network
153s -
platform
windows10-1703_x64 -
resource
win10-20231020-en -
resource tags
arch:x64arch:x86image:win10-20231020-enlocale:en-usos:windows10-1703-x64system -
submitted
01-11-2023 10:52
Static task
static1
Behavioral task
behavioral1
Sample
4eddaa51ba45eb60dc012ea690fedceb509fe99f75531a500681f71cf3a258aa.exe
Resource
win10-20231020-en
General
-
Target
4eddaa51ba45eb60dc012ea690fedceb509fe99f75531a500681f71cf3a258aa.exe
-
Size
1.6MB
-
MD5
424c73fa30cef83dc2de8767f3bb8228
-
SHA1
aa36b8ad6e5ab7ac02b6ffc71a1cd91864c082d6
-
SHA256
4eddaa51ba45eb60dc012ea690fedceb509fe99f75531a500681f71cf3a258aa
-
SHA512
c8058eac0e5861772894ce9e3b030ab66e74d10c3e080e34307fb0e943fc9421af611158844333ff239792c811196933485e0cd276fdb0c997cb2ad346dffde0
-
SSDEEP
24576:2y9NBrwjZKnTw5cEObwP1Xr9NaI+tQ5ClP4/dQqk7OqcQlxAYI2ByZFPqE8NTEXy:FvBrwdoFhwRrL7+tQKP4/CCFhpqiXcW
Malware Config
Extracted
smokeloader
2022
http://77.91.68.29/fks/
Extracted
redline
grome
77.91.124.86:19084
Extracted
amadey
3.89
http://77.91.124.1/theme/index.php
-
install_dir
fefffe8cea
-
install_file
explothe.exe
-
strings_key
36a96139c1118a354edf72b1080d4b2f
Signatures
-
Processes:
AppLaunch.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" AppLaunch.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/5024-84-0x0000000000400000-0x000000000043E000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
cmd.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000\Control Panel\International\Geo\Nation cmd.exe -
Executes dropped EXE 13 IoCs
Processes:
LY8VE46.exetY6DQ68.exeEY0ad16.exepu3KI23.exeoK4AK76.exe1uY35rq6.exe2Vo3428.exe3QM83Ao.exe4zz663FW.exe5Lh1vz6.exeexplothe.exe6gU3BY9.exe7SO5BJ97.exepid process 4440 LY8VE46.exe 4484 tY6DQ68.exe 4904 EY0ad16.exe 2116 pu3KI23.exe 4332 oK4AK76.exe 4452 1uY35rq6.exe 1200 2Vo3428.exe 4808 3QM83Ao.exe 5116 4zz663FW.exe 2604 5Lh1vz6.exe 4220 explothe.exe 2096 6gU3BY9.exe 5052 7SO5BJ97.exe -
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
pu3KI23.exeoK4AK76.exe4eddaa51ba45eb60dc012ea690fedceb509fe99f75531a500681f71cf3a258aa.exeLY8VE46.exetY6DQ68.exeEY0ad16.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" pu3KI23.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup5 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP005.TMP\\\"" oK4AK76.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 4eddaa51ba45eb60dc012ea690fedceb509fe99f75531a500681f71cf3a258aa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" LY8VE46.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" tY6DQ68.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" EY0ad16.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
1uY35rq6.exe2Vo3428.exe4zz663FW.exedescription pid process target process PID 4452 set thread context of 4608 4452 1uY35rq6.exe AppLaunch.exe PID 1200 set thread context of 5036 1200 2Vo3428.exe AppLaunch.exe PID 5116 set thread context of 5024 5116 4zz663FW.exe AppLaunch.exe -
Drops file in Windows directory 13 IoCs
Processes:
MicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exedescription ioc process File created C:\Windows\rescache\_merged\3720402701\2219095117.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\2219095117.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\2219095117.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\2219095117.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\2219095117.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\2219095117.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\2219095117.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\2219095117.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\2219095117.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\2219095117.pri MicrosoftEdge.exe File created C:\Windows\rescache\_merged\3720402701\2219095117.pri MicrosoftEdgeCP.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File created C:\Windows\rescache\_merged\3720402701\2219095117.pri MicrosoftEdgeCP.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4564 5036 WerFault.exe AppLaunch.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
3QM83Ao.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3QM83Ao.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3QM83Ao.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3QM83Ao.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Processes:
browser_broker.exeMicrosoftEdgeCP.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe -
Modifies registry class 64 IoCs
Processes:
MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\epicgames.com\ = "0" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\"" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\epicgames.com MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 8d77bba5b10cda01 MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\"" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\epicgames.com MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B72164 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer\Main MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer\Main\OperationalData = "1" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 4cea2da6b10cda01 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = ccf337a4b10cda01 MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\epicgames.com\ = "0" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\epicgames.com\NumberOfSubd = "0" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\SplashScreen Key created \REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus MicrosoftEdgeCP.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
AppLaunch.exe3QM83Ao.exepid process 4608 AppLaunch.exe 4608 AppLaunch.exe 4808 3QM83Ao.exe 4808 3QM83Ao.exe 3244 3244 3244 3244 3244 3244 3244 3244 3244 3244 3244 3244 3244 3244 3244 3244 3244 3244 3244 3244 3244 3244 3244 3244 3244 3244 3244 3244 3244 3244 3244 3244 3244 3244 3244 3244 3244 3244 3244 3244 3244 3244 3244 3244 3244 3244 3244 3244 3244 3244 3244 3244 3244 3244 3244 3244 3244 3244 3244 3244 -
Suspicious behavior: MapViewOfSection 19 IoCs
Processes:
3QM83Ao.exeMicrosoftEdgeCP.exepid process 4808 3QM83Ao.exe 1188 MicrosoftEdgeCP.exe 1188 MicrosoftEdgeCP.exe 1188 MicrosoftEdgeCP.exe 1188 MicrosoftEdgeCP.exe 1188 MicrosoftEdgeCP.exe 1188 MicrosoftEdgeCP.exe 1188 MicrosoftEdgeCP.exe 1188 MicrosoftEdgeCP.exe 1188 MicrosoftEdgeCP.exe 1188 MicrosoftEdgeCP.exe 1188 MicrosoftEdgeCP.exe 1188 MicrosoftEdgeCP.exe 1188 MicrosoftEdgeCP.exe 1188 MicrosoftEdgeCP.exe 1188 MicrosoftEdgeCP.exe 1188 MicrosoftEdgeCP.exe 1188 MicrosoftEdgeCP.exe 1188 MicrosoftEdgeCP.exe -
Suspicious use of AdjustPrivilegeToken 31 IoCs
Processes:
AppLaunch.exeMicrosoftEdgeCP.exedescription pid process Token: SeDebugPrivilege 4608 AppLaunch.exe Token: SeShutdownPrivilege 3244 Token: SeCreatePagefilePrivilege 3244 Token: SeShutdownPrivilege 3244 Token: SeCreatePagefilePrivilege 3244 Token: SeShutdownPrivilege 3244 Token: SeCreatePagefilePrivilege 3244 Token: SeShutdownPrivilege 3244 Token: SeCreatePagefilePrivilege 3244 Token: SeShutdownPrivilege 3244 Token: SeCreatePagefilePrivilege 3244 Token: SeDebugPrivilege 4112 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4112 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4112 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4112 MicrosoftEdgeCP.exe Token: SeShutdownPrivilege 3244 Token: SeCreatePagefilePrivilege 3244 Token: SeShutdownPrivilege 3244 Token: SeCreatePagefilePrivilege 3244 Token: SeShutdownPrivilege 3244 Token: SeCreatePagefilePrivilege 3244 Token: SeShutdownPrivilege 3244 Token: SeCreatePagefilePrivilege 3244 Token: SeShutdownPrivilege 3244 Token: SeCreatePagefilePrivilege 3244 Token: SeShutdownPrivilege 3244 Token: SeCreatePagefilePrivilege 3244 Token: SeShutdownPrivilege 3244 Token: SeCreatePagefilePrivilege 3244 Token: SeShutdownPrivilege 3244 Token: SeCreatePagefilePrivilege 3244 -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exepid process 428 MicrosoftEdge.exe 1188 MicrosoftEdgeCP.exe 4112 MicrosoftEdgeCP.exe 1188 MicrosoftEdgeCP.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
4eddaa51ba45eb60dc012ea690fedceb509fe99f75531a500681f71cf3a258aa.exeLY8VE46.exetY6DQ68.exeEY0ad16.exepu3KI23.exeoK4AK76.exe1uY35rq6.exe2Vo3428.exe4zz663FW.exe5Lh1vz6.exedescription pid process target process PID 5016 wrote to memory of 4440 5016 4eddaa51ba45eb60dc012ea690fedceb509fe99f75531a500681f71cf3a258aa.exe LY8VE46.exe PID 5016 wrote to memory of 4440 5016 4eddaa51ba45eb60dc012ea690fedceb509fe99f75531a500681f71cf3a258aa.exe LY8VE46.exe PID 5016 wrote to memory of 4440 5016 4eddaa51ba45eb60dc012ea690fedceb509fe99f75531a500681f71cf3a258aa.exe LY8VE46.exe PID 4440 wrote to memory of 4484 4440 LY8VE46.exe tY6DQ68.exe PID 4440 wrote to memory of 4484 4440 LY8VE46.exe tY6DQ68.exe PID 4440 wrote to memory of 4484 4440 LY8VE46.exe tY6DQ68.exe PID 4484 wrote to memory of 4904 4484 tY6DQ68.exe EY0ad16.exe PID 4484 wrote to memory of 4904 4484 tY6DQ68.exe EY0ad16.exe PID 4484 wrote to memory of 4904 4484 tY6DQ68.exe EY0ad16.exe PID 4904 wrote to memory of 2116 4904 EY0ad16.exe pu3KI23.exe PID 4904 wrote to memory of 2116 4904 EY0ad16.exe pu3KI23.exe PID 4904 wrote to memory of 2116 4904 EY0ad16.exe pu3KI23.exe PID 2116 wrote to memory of 4332 2116 pu3KI23.exe oK4AK76.exe PID 2116 wrote to memory of 4332 2116 pu3KI23.exe oK4AK76.exe PID 2116 wrote to memory of 4332 2116 pu3KI23.exe oK4AK76.exe PID 4332 wrote to memory of 4452 4332 oK4AK76.exe 1uY35rq6.exe PID 4332 wrote to memory of 4452 4332 oK4AK76.exe 1uY35rq6.exe PID 4332 wrote to memory of 4452 4332 oK4AK76.exe 1uY35rq6.exe PID 4452 wrote to memory of 4608 4452 1uY35rq6.exe AppLaunch.exe PID 4452 wrote to memory of 4608 4452 1uY35rq6.exe AppLaunch.exe PID 4452 wrote to memory of 4608 4452 1uY35rq6.exe AppLaunch.exe PID 4452 wrote to memory of 4608 4452 1uY35rq6.exe AppLaunch.exe PID 4452 wrote to memory of 4608 4452 1uY35rq6.exe AppLaunch.exe PID 4452 wrote to memory of 4608 4452 1uY35rq6.exe AppLaunch.exe PID 4452 wrote to memory of 4608 4452 1uY35rq6.exe AppLaunch.exe PID 4452 wrote to memory of 4608 4452 1uY35rq6.exe AppLaunch.exe PID 4332 wrote to memory of 1200 4332 oK4AK76.exe 2Vo3428.exe PID 4332 wrote to memory of 1200 4332 oK4AK76.exe 2Vo3428.exe PID 4332 wrote to memory of 1200 4332 oK4AK76.exe 2Vo3428.exe PID 1200 wrote to memory of 648 1200 2Vo3428.exe AppLaunch.exe PID 1200 wrote to memory of 648 1200 2Vo3428.exe AppLaunch.exe PID 1200 wrote to memory of 648 1200 2Vo3428.exe AppLaunch.exe PID 1200 wrote to memory of 4260 1200 2Vo3428.exe AppLaunch.exe PID 1200 wrote to memory of 4260 1200 2Vo3428.exe AppLaunch.exe PID 1200 wrote to memory of 4260 1200 2Vo3428.exe AppLaunch.exe PID 1200 wrote to memory of 5036 1200 2Vo3428.exe AppLaunch.exe PID 1200 wrote to memory of 5036 1200 2Vo3428.exe AppLaunch.exe PID 1200 wrote to memory of 5036 1200 2Vo3428.exe AppLaunch.exe PID 1200 wrote to memory of 5036 1200 2Vo3428.exe AppLaunch.exe PID 1200 wrote to memory of 5036 1200 2Vo3428.exe AppLaunch.exe PID 1200 wrote to memory of 5036 1200 2Vo3428.exe AppLaunch.exe PID 1200 wrote to memory of 5036 1200 2Vo3428.exe AppLaunch.exe PID 1200 wrote to memory of 5036 1200 2Vo3428.exe AppLaunch.exe PID 1200 wrote to memory of 5036 1200 2Vo3428.exe AppLaunch.exe PID 1200 wrote to memory of 5036 1200 2Vo3428.exe AppLaunch.exe PID 2116 wrote to memory of 4808 2116 pu3KI23.exe 3QM83Ao.exe PID 2116 wrote to memory of 4808 2116 pu3KI23.exe 3QM83Ao.exe PID 2116 wrote to memory of 4808 2116 pu3KI23.exe 3QM83Ao.exe PID 4904 wrote to memory of 5116 4904 EY0ad16.exe 4zz663FW.exe PID 4904 wrote to memory of 5116 4904 EY0ad16.exe 4zz663FW.exe PID 4904 wrote to memory of 5116 4904 EY0ad16.exe 4zz663FW.exe PID 5116 wrote to memory of 5024 5116 4zz663FW.exe AppLaunch.exe PID 5116 wrote to memory of 5024 5116 4zz663FW.exe AppLaunch.exe PID 5116 wrote to memory of 5024 5116 4zz663FW.exe AppLaunch.exe PID 5116 wrote to memory of 5024 5116 4zz663FW.exe AppLaunch.exe PID 5116 wrote to memory of 5024 5116 4zz663FW.exe AppLaunch.exe PID 5116 wrote to memory of 5024 5116 4zz663FW.exe AppLaunch.exe PID 5116 wrote to memory of 5024 5116 4zz663FW.exe AppLaunch.exe PID 5116 wrote to memory of 5024 5116 4zz663FW.exe AppLaunch.exe PID 4484 wrote to memory of 2604 4484 tY6DQ68.exe 5Lh1vz6.exe PID 4484 wrote to memory of 2604 4484 tY6DQ68.exe 5Lh1vz6.exe PID 4484 wrote to memory of 2604 4484 tY6DQ68.exe 5Lh1vz6.exe PID 2604 wrote to memory of 4220 2604 5Lh1vz6.exe explothe.exe PID 2604 wrote to memory of 4220 2604 5Lh1vz6.exe explothe.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4eddaa51ba45eb60dc012ea690fedceb509fe99f75531a500681f71cf3a258aa.exe"C:\Users\Admin\AppData\Local\Temp\4eddaa51ba45eb60dc012ea690fedceb509fe99f75531a500681f71cf3a258aa.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\LY8VE46.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\LY8VE46.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tY6DQ68.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tY6DQ68.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\EY0ad16.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\EY0ad16.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\pu3KI23.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\pu3KI23.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\oK4AK76.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\oK4AK76.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1uY35rq6.exeC:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1uY35rq6.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"8⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2Vo3428.exeC:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2Vo3428.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"8⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"8⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"8⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5036 -s 5689⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\3QM83Ao.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\3QM83Ao.exe6⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\4zz663FW.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\4zz663FW.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\5Lh1vz6.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\5Lh1vz6.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F6⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "explothe.exe" /P "Admin:N"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "explothe.exe" /P "Admin:R" /E7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:N"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:R" /E7⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\6gU3BY9.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\6gU3BY9.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7SO5BJ97.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7SO5BJ97.exe2⤵
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\D90A.tmp\D91B.tmp\D91C.bat C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7SO5BJ97.exe"3⤵
- Checks computer location settings
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\0MO3CWL3\buttons[1].cssFilesize
32KB
MD5b91ff88510ff1d496714c07ea3f1ea20
SHA19c4b0ad541328d67a8cde137df3875d824891e41
SHA2560be99fd30134de50d457729cebd0e08342777af747caf503108178cb4c375085
SHA512e82438186bfc3e9ca690af8e099aafbfbc71c9310f9d1c8cb87ffa9e7f0f11f33982c63a2dac95c9b83fef1aaa59178b73212fc76e895d13a1ffbbe3c1adfa4c
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\H253ZYJ6\shared_global[1].cssFilesize
84KB
MD515dd9a8ffcda0554150891ba63d20d76
SHA1bdb7de4df9a42a684fa2671516c10a5995668f85
SHA2566f42b906118e3b3aebcc1a31c162520c95e3b649146a02efd3a0fd8fcddebb21
SHA5122ceeb8b83590fc35e83576fe8058ddf0e7a942960b0564e9867b45677c665ac20e19c25a7a6a8d5115b60ab33b80104ea492e872cc784b424b105cc049b217e9
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\V6SH49B0\B8BxsscfVBr[1].icoFilesize
1KB
MD5e508eca3eafcc1fc2d7f19bafb29e06b
SHA1a62fc3c2a027870d99aedc241e7d5babba9a891f
SHA256e6d1d77403cd9f14fd2377d07e84350cfe768e3353e402bf42ebdc8593a58c9a
SHA51249e3f31fd73e52ba274db9c7d306cc188e09c3ae683827f420fbb17534d197a503460e7ec2f1af46065f8d0b33f37400659bfa2ae165e502f97a8150e184a38c
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\V6SH49B0\favicon[1].icoFilesize
1KB
MD5630d203cdeba06df4c0e289c8c8094f6
SHA1eee14e8a36b0512c12ba26c0516b4553618dea36
SHA256bbce71345828a27c5572637dbe88a3dd1e065266066600c8a841985588bf2902
SHA51209f4e204960f4717848bf970ac4305f10201115e45dd5fe0196a6346628f0011e7bc17d73ec946b68731a5e179108fd39958cecf41125f44094f63fe5f2aeb2c
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157Filesize
4KB
MD51bfe591a4fe3d91b03cdf26eaacd8f89
SHA1719c37c320f518ac168c86723724891950911cea
SHA2569cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8
SHA51202f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\BHI2172K.cookieFilesize
263B
MD545d3522e2beca88c98e81804f44eaaf7
SHA178c029ffd35c085d0b5b1f7e2e49c3bbfe977443
SHA25683f6015497c97bdd6a9cc1163ce6ab13b2029671342eaa3d0313c24787dc22f6
SHA512baead7f8648344bc137e2ae989ccd9a8154eb8dec7f6b04d79c23c8461a2940c2279e4f8388153f92e2312e151b24681937f54f152da13066b7b31b60b4c2488
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\O1CYL3FW.cookieFilesize
854B
MD5eab3e386b7b61a856ee9b77ddcf2ccb8
SHA1e88c273db8122086c0e1b03c0761d04a2231e6e0
SHA256a1c8817bff5d57cebdb34dacd213fd1bab59bd0b87bf3ce523e09e1327535cd0
SHA5124c1449f9bd264bb72abd191d8e0a7f4d1958465009284e9a41e193401a30bfcbf1f3c6abcee162c3073c3fb1e3c2ead501eaf294fa623b1ca8e1f9bc472a146c
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\SR9FFLND.cookieFilesize
132B
MD528c933700b522a4a75a641b6701b7039
SHA1bfdf92bc25cf7974117b46bd05e8135a58a5901f
SHA256f1866e2b1ae7a405e97109c16462e51f69f26720c1ce38d427d6884be8831d29
SHA512626dbeadeec617f91a5e35b839a080ca37439b09b86072a8f2f7fe1800a987e1efc97178481824e97f576ed3ab72ae575a654977a26d0b693bf92453101028cf
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\XXSIPX1E.cookieFilesize
854B
MD5b697b5146f33d8d59c11d82b61991f8c
SHA141c75a446f98555cd452ceb39029b7ae8f82febb
SHA25647aa3f47b60419b2c8c7b5c3282910d55a82a6d91968e0df00ef8b63b3c7240f
SHA51264fb74bcdc2bf683b50ee0011b1ba7f0d4ee07b29c5f3d5c8b48cf9b9410d4850f1df58ab3157dba8f9ca8a90347d6527792fb495f6b4fb08dcaaf9e8a31ab19
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\YRSP34VV.cookieFilesize
132B
MD57f94ee260484bd9c673a72a5a1bed6e3
SHA1549e183c5577a4b6516b2f62a4dc72954e9f65b6
SHA2568d91eac7b6751bd32ce28d8f8c365eb3f39001dddad843a0b3a340b3c4cde51b
SHA512335a66e294b309a51ab23554758bfc30f1ebccce4dbf3995c7b3b3d8f920340c0b8b881235d121ddff0075b978e6d2b6281530cf1e5bd00fc2fba0969c457a6f
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAFilesize
1KB
MD5ff569e747923de1d85f07d82019f15f1
SHA1ee6322d0170eb974695a777fee55c41f1f2f613d
SHA256a8a9bdfa0ffd0dfdde8f0e0180c4b1f292a41ef94121c09aede5e0c1ba5e77bb
SHA512bdf9d27f620dfced8d2270d05f67e4d9a6ad6937abf0aee0ac465ea9c78a8a9f6c6db8229c492fb93d93627ffba340b955d20be79d32f329b6e3f08c89fe1a05
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157Filesize
4KB
MD51bfe591a4fe3d91b03cdf26eaacd8f89
SHA1719c37c320f518ac168c86723724891950911cea
SHA2569cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8
SHA51202f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27Filesize
1KB
MD5947e4f16c47960895dfe4e8dbbad83c0
SHA1f18925076e744dd1813c544ca0d2c6fae401e176
SHA2563dc6830b4d1ff3a78c8458643c104682c4905c3da982051de5c8958246ff5673
SHA512fc22715fa70a4815bc7b880116fdb540223707bd92d80cea5cd92f1a4e41906f0e294764f7907d87410fa9c855ee5e3965493a1b8aefd7e3b1fdc5fb3c6c4864
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAFilesize
724B
MD5ac89a852c2aaa3d389b2d2dd312ad367
SHA18f421dd6493c61dbda6b839e2debb7b50a20c930
SHA2560b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45
SHA512c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAFilesize
724B
MD5ac89a852c2aaa3d389b2d2dd312ad367
SHA18f421dd6493c61dbda6b839e2debb7b50a20c930
SHA2560b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45
SHA512c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_70445D979E6BDC085A06FAD3F5B6E186Filesize
472B
MD5d408235a533f534ab67cc86f4b3541bc
SHA15e0c537d01bcc340efc286cf1aa5a4e07fb0a232
SHA256d6e9007ef49b3214ad7ca371840f265a1743ed1b68b7b666ca4918b87dab59cb
SHA5126614e472b1bafad3efe0cb87e8fe9468edb3fe8f1df10f2b9101944a2b06aad3e048130fe4e1a6ffbe4be659768ba8f2b361c47a4633b7f10d2d14d900e11788
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619Filesize
471B
MD53a40f4e714b12a17e81e5416f4274a3b
SHA193aef1a485143a56520d250b4682ff83cda3e651
SHA256f1c72c3599a519891f9a8c98b1367c46f4d8f835b20506ceda1e2e8ce637aeaa
SHA5121905587aab6516665c3fbb5b3e5f0956d249c20d04f8a01c0a105c7fa401821fac1d0acad49b66c459cd34a1cb21a8b78d15a602b08effe2c2ea91d5f36d4de0
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_524BBAFA66E109E6A3AAE054ADFDA005Filesize
471B
MD59f40f27df63aa6e20ded1e8fed4329b9
SHA16d97c619daf1c68aeff426dfb5a8bbbd88385450
SHA256dc4c8fe75711ab5307393093066f9f1b48f645af3e6fe2f97a542392059beff1
SHA5120b72d710996179fefbbe77c4debdeaf31b64e2f51643713e690b81e4a315013e9aecb3716eb9ab50f909c09552807578d9faf0bd6a28b38dd6c1d9acb43febb5
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAFilesize
410B
MD53db84f966ecd260896a3dd15aff4acda
SHA1868975075596748c0b5c9c571682b9720b9821b1
SHA256e57826eaeea1ec3b8eb76e33ae482ba80f7edb1eb66374a5fe06219f8ac782f5
SHA512671736b5c103549c3f49218f6d994eb7bd5840c4b7d1028b5808f0cddc825b22b8c7e956a437a0ee884250f816744dce7dc501053aafe7b806bbb2d5d378b0ba
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157Filesize
302B
MD5637d5faaf410f508beae1e3e10f6eda7
SHA1049a94cc7e261f819518d09dc638e89541e350f1
SHA256351d634d65e5af03a24fb4438d9f676b34ffb2f38f0c8dbc881ee7471ba1631a
SHA5120f0d8f84d351702791a9eddda866c1489306989187000f7cafbde3264988518b1acdbb4672e979091b4ff52bcd69b5c126bf45f632e246f90d7b29209331794b
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27Filesize
408B
MD5acc06e798cdbadd12667012f0b081e3a
SHA1b73966f1f28ede15d40e82a4b1ef63bd9296ca30
SHA25674b6a4944260b85004c21067cbfd4f49bd0185035a886272ec702de2f56a98cd
SHA512c911bf673ab69521a06224e4698aecd660ee9dea3ed0d847081f4b3c240321c3a3844aac1fb4c504760a5aa10dbcab069e249ff50078e8e47622bdaa54c1d12a
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAFilesize
392B
MD532cf75854e1c7d024624959f180522d3
SHA109a3e0f414c4ab897a122cc45753fcd24f6b6774
SHA25601b8c8146a47c49d5ebdf31bd53186628f3104e8798f3c0c88bf4d8d97b1e7f9
SHA512894e37a98f53f824c1c735d8fc013bed256dce6633ab516e5d15cdbc03f7fdfa14b6148f0ff52f329bafa0442b28578ef2b1295a3fdfa0d5b33a7835d5574652
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAFilesize
392B
MD58e48348c0bcfb02bf46b2985ed70ae05
SHA12447052d221a452f361902547f59744120da742e
SHA256e839aef3db7381b9377e460f32902cfccea5461973d557bbca1aee98ea80c095
SHA5121404d6f01aef1edee08cf8828212767881b1f1f863be922b01ca869430fcfde399981366b59d1eafc1112330adf8c5e8e528fbed7aa13ccb7654a70410920536
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_70445D979E6BDC085A06FAD3F5B6E186Filesize
406B
MD5c84d0615cb005738891a01b1398ceccd
SHA1bd72aaaeee8fdc0c4f013690ed029224feb5bd2f
SHA2562c47bc1ead0fa8b713ba0a6515d98979768d91d631fe402f35dbba8776aa057d
SHA5125b5c342acff33c285f6a6a3299ec6675aca83d6ae7e1eacb73f85ff9133fc52c5bfb670994aef17208fb57f975a2d6e26fe1cd54c1b7eb74aa167d188a502178
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619Filesize
400B
MD53e894f5ce4ee932f936167ffed0227b6
SHA1f09fd1e71d8187b7ad973767eaf83bd457587d9c
SHA256e6a6b9eef0506b8aaebab663ed44941f45d1302199994a09abce044575db7fa2
SHA512e071ec4ab77096519872d006310ee6f135b1644e7399ecf9f25b409740240eb41418a4b2567400f6d7724f920f8e0887bbdc92f0cd560771e07bf6f708c9b390
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_524BBAFA66E109E6A3AAE054ADFDA005Filesize
406B
MD523ae15ee21b88edf81056f4995613539
SHA11fe7a2c37775681bf479846e4136c19af10fdf2b
SHA256f6040e0eb8255751d13520f03b87453b6d63f49c4704df1a1e8e008a54e0277b
SHA51249180e0987bc1c41059074386af5c25d1082adcdee283912e99c3026c855e0aa0d611da2903802a52308fe0ad76d10cef4b9577ddc8d2ffcdebb0605d8f7629e
-
C:\Users\Admin\AppData\Local\Temp\D90A.tmp\D91B.tmp\D91C.batFilesize
429B
MD50769624c4307afb42ff4d8602d7815ec
SHA1786853c829f4967a61858c2cdf4891b669ac4df9
SHA2567da27df04c56cf1aa11d427d9a3dff48b0d0df8c11f7090eb849abee6bfe421f
SHA512df8e4c6e50c74f5daf89b3585a98980ac1dbacf4cce641571f8999e4263078e5d14863dae9cf64be4c987671a21ebdce3bf8e210715f68c5e383cc4d55f53106
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7SO5BJ97.exeFilesize
89KB
MD5acb049d2f2fef0d1e3d42f7572586eaa
SHA1ab8825a6a38d9d2b1e98d2638de3329305f1a63e
SHA2563ad033b485fbbfce2232df24231020791dc43ef99bc1f9a6df383c16e0f9c757
SHA5128d8af9a5bcdf1c119289155cbfdc55a2c7dedbb057aa9b24254af6c028e56b3cddd15cfb62ce214a8be7f167ed64bd66467f391a1c4f0d75d0ef9b847cde8fb3
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7SO5BJ97.exeFilesize
89KB
MD5acb049d2f2fef0d1e3d42f7572586eaa
SHA1ab8825a6a38d9d2b1e98d2638de3329305f1a63e
SHA2563ad033b485fbbfce2232df24231020791dc43ef99bc1f9a6df383c16e0f9c757
SHA5128d8af9a5bcdf1c119289155cbfdc55a2c7dedbb057aa9b24254af6c028e56b3cddd15cfb62ce214a8be7f167ed64bd66467f391a1c4f0d75d0ef9b847cde8fb3
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\LY8VE46.exeFilesize
1.4MB
MD570aaff804916e50f7b2b5cbe9ecb0a3d
SHA181db1b91b40b5e08f7231d1d57bbee5020a7071c
SHA25623fd463ccc9ea3e18d7f63ab15d0583b66d41709a0b52377788ea60800978999
SHA5128a5c34884f9ef0f6fced002c94c519c511b494d7daa15c4ff66823fd0daa32feda2f2d886ff0d5c90b60d5ecf838ea422fda67aa022b824197b05ddd60cd5839
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\LY8VE46.exeFilesize
1.4MB
MD570aaff804916e50f7b2b5cbe9ecb0a3d
SHA181db1b91b40b5e08f7231d1d57bbee5020a7071c
SHA25623fd463ccc9ea3e18d7f63ab15d0583b66d41709a0b52377788ea60800978999
SHA5128a5c34884f9ef0f6fced002c94c519c511b494d7daa15c4ff66823fd0daa32feda2f2d886ff0d5c90b60d5ecf838ea422fda67aa022b824197b05ddd60cd5839
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\6gU3BY9.exeFilesize
184KB
MD5d1ac671a24d94eb92df530a4ae2b91b1
SHA1cdb0e1dd02feadae9dc44d491a08ee4e039f2aaf
SHA2563c60613779541a69596e82cb25088381b074dfd6ee5e0925243cef2c8cce5fbc
SHA512eabb100dae48f7968c20cda577c69421479c736869fc04905198d8b6bf54d683c897b84409663b51e6bb8a7f2e2bc93d3990752432a23796f65dfad7e31df77a
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\6gU3BY9.exeFilesize
184KB
MD5d1ac671a24d94eb92df530a4ae2b91b1
SHA1cdb0e1dd02feadae9dc44d491a08ee4e039f2aaf
SHA2563c60613779541a69596e82cb25088381b074dfd6ee5e0925243cef2c8cce5fbc
SHA512eabb100dae48f7968c20cda577c69421479c736869fc04905198d8b6bf54d683c897b84409663b51e6bb8a7f2e2bc93d3990752432a23796f65dfad7e31df77a
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tY6DQ68.exeFilesize
1.2MB
MD51f91f03e5b3a91d1d4c9a4c700d2292e
SHA1247aaf8e71a03186757dcd0f73f2447cb28d7267
SHA256dc2c81b37e43ccdff59aa06e61d47465358357f7aaee066beaf431fc916a7866
SHA512d7f149aaf9a44a3a652cac61b87ec1464d7a495a9cf1d38ad0f09cdb30ddde8b41a253784903dac53df36639cadae18514d5cf4516bbdf3c67a48cb315b6445c
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tY6DQ68.exeFilesize
1.2MB
MD51f91f03e5b3a91d1d4c9a4c700d2292e
SHA1247aaf8e71a03186757dcd0f73f2447cb28d7267
SHA256dc2c81b37e43ccdff59aa06e61d47465358357f7aaee066beaf431fc916a7866
SHA512d7f149aaf9a44a3a652cac61b87ec1464d7a495a9cf1d38ad0f09cdb30ddde8b41a253784903dac53df36639cadae18514d5cf4516bbdf3c67a48cb315b6445c
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\5Lh1vz6.exeFilesize
221KB
MD52d664fd1eb307fc50a02b2923f628e22
SHA12f6b5b8915ee7a98061769c7da0133ac3f0b6c3f
SHA2564fb84f1032f9c9b82db413dc78640b0815e5ac13121b79bfda45b02dacca5c1b
SHA5124b0f621f5ea9c5474318fb1f87db0410e24fa75738a609c6b49a0f94b615fe192f763f0be9b71e849d065045bf8b4cceb9b617168534c7d798cf134da5cd0c00
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\5Lh1vz6.exeFilesize
221KB
MD52d664fd1eb307fc50a02b2923f628e22
SHA12f6b5b8915ee7a98061769c7da0133ac3f0b6c3f
SHA2564fb84f1032f9c9b82db413dc78640b0815e5ac13121b79bfda45b02dacca5c1b
SHA5124b0f621f5ea9c5474318fb1f87db0410e24fa75738a609c6b49a0f94b615fe192f763f0be9b71e849d065045bf8b4cceb9b617168534c7d798cf134da5cd0c00
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\EY0ad16.exeFilesize
1.1MB
MD519c7e58769282c2a7137d4d531ad5d3d
SHA138b8a6e34d236e71506cc6de6d9328823211828b
SHA256069a3987985eaf1dc609083329b012af5545dbc70a114afb5e9e71493b471f40
SHA512cc270929fff2c51cc991653f43197b7f6b8aa9ffca90306b9307770993a1bb457e2ee620581b955518435fd01d14d295937c923a49eaa0758dd08b938426b455
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\EY0ad16.exeFilesize
1.1MB
MD519c7e58769282c2a7137d4d531ad5d3d
SHA138b8a6e34d236e71506cc6de6d9328823211828b
SHA256069a3987985eaf1dc609083329b012af5545dbc70a114afb5e9e71493b471f40
SHA512cc270929fff2c51cc991653f43197b7f6b8aa9ffca90306b9307770993a1bb457e2ee620581b955518435fd01d14d295937c923a49eaa0758dd08b938426b455
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\4zz663FW.exeFilesize
1.2MB
MD5f6ade91e09c52bf2a6d7bd9ebd2be520
SHA1778c149e719fba2b38168f1644b0271cff1a4b39
SHA256d12e5bb7cbacb4ee94bc876823f859190f3c5b650f82494aec743e76a7742cae
SHA512bbdece55607f14950b4e9d1d4336b9e52abe3d1c6064569d4e62851bcc63285813cf8f9625b68f5391ac26bc0deecb93326905dea5e36a446532cd7aa191e0ec
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\4zz663FW.exeFilesize
1.2MB
MD5f6ade91e09c52bf2a6d7bd9ebd2be520
SHA1778c149e719fba2b38168f1644b0271cff1a4b39
SHA256d12e5bb7cbacb4ee94bc876823f859190f3c5b650f82494aec743e76a7742cae
SHA512bbdece55607f14950b4e9d1d4336b9e52abe3d1c6064569d4e62851bcc63285813cf8f9625b68f5391ac26bc0deecb93326905dea5e36a446532cd7aa191e0ec
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\pu3KI23.exeFilesize
668KB
MD54b302af8c0e50de760dd44b751ad02e5
SHA10be8a8543cd524b68305c452dcaff0396d8b42bd
SHA2563fdb189ee6b506a01fb92674dab23459a576149d2c13b950627b0e177845b53a
SHA512a042d70dd9a7e6544eba15ffed2c2570366724dfb4b6135774f0f04645eeb4b06cfb771d9673db475c049653394cf7076c5a48d9a296fff3b5906f76b2b469f3
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\pu3KI23.exeFilesize
668KB
MD54b302af8c0e50de760dd44b751ad02e5
SHA10be8a8543cd524b68305c452dcaff0396d8b42bd
SHA2563fdb189ee6b506a01fb92674dab23459a576149d2c13b950627b0e177845b53a
SHA512a042d70dd9a7e6544eba15ffed2c2570366724dfb4b6135774f0f04645eeb4b06cfb771d9673db475c049653394cf7076c5a48d9a296fff3b5906f76b2b469f3
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\3QM83Ao.exeFilesize
31KB
MD5fd619845aa833758160bf164d62d8737
SHA1b45c70417f7c7d86179859f6d73a564b8d6b66aa
SHA256bd38248ab34c3c96ff583214468595637ba1cb8a43b14d8aec986e6d5fabd913
SHA51292b1fb8f05d9f0de02f5a319d6fa487647bb9cbf878aecb965e5c5c640e3001be1cdfbceaa6ba817836a71cda95ddbd8a5fbe318ec4b0cf22eb0c233c10dba9b
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\3QM83Ao.exeFilesize
31KB
MD5fd619845aa833758160bf164d62d8737
SHA1b45c70417f7c7d86179859f6d73a564b8d6b66aa
SHA256bd38248ab34c3c96ff583214468595637ba1cb8a43b14d8aec986e6d5fabd913
SHA51292b1fb8f05d9f0de02f5a319d6fa487647bb9cbf878aecb965e5c5c640e3001be1cdfbceaa6ba817836a71cda95ddbd8a5fbe318ec4b0cf22eb0c233c10dba9b
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\oK4AK76.exeFilesize
544KB
MD5d1b24aa793244a8016b84200435a54a6
SHA16c053aa4cc5a055e1d8b46cd052d3e6cc464c227
SHA2563f5ad95af5df9b113c5b51fbab82d7148ab9f4ce039272f9dc67c059b665eca4
SHA51296cc9715453d847b9ea6081e48017aacb51cf5a6822f400bd74e3832c7b718af30875113c94be7d6c1ee53196b65b11614f0c8c784bcfa64f4ef4534d496190e
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\oK4AK76.exeFilesize
544KB
MD5d1b24aa793244a8016b84200435a54a6
SHA16c053aa4cc5a055e1d8b46cd052d3e6cc464c227
SHA2563f5ad95af5df9b113c5b51fbab82d7148ab9f4ce039272f9dc67c059b665eca4
SHA51296cc9715453d847b9ea6081e48017aacb51cf5a6822f400bd74e3832c7b718af30875113c94be7d6c1ee53196b65b11614f0c8c784bcfa64f4ef4534d496190e
-
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1uY35rq6.exeFilesize
933KB
MD550fabb18a76bcadfe2f3f65c05969db3
SHA1a0706e95f8bbaf3cf79e6943b372b99471709c15
SHA256af491dee6378e63e2eaa764691343da5c9b06422cb3cf2625a18020db3366cc3
SHA51249cca17b7802bdc8fe61938f8f481261d9ca0620270b287eb9b3d04e300722927af4334cb038dda77720551922ea1028885fe5f34a7f7a40490f0ec4f5c1dc35
-
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1uY35rq6.exeFilesize
933KB
MD550fabb18a76bcadfe2f3f65c05969db3
SHA1a0706e95f8bbaf3cf79e6943b372b99471709c15
SHA256af491dee6378e63e2eaa764691343da5c9b06422cb3cf2625a18020db3366cc3
SHA51249cca17b7802bdc8fe61938f8f481261d9ca0620270b287eb9b3d04e300722927af4334cb038dda77720551922ea1028885fe5f34a7f7a40490f0ec4f5c1dc35
-
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2Vo3428.exeFilesize
1.1MB
MD56c78b0350723bbc55ff79a03cf8b93ae
SHA1954bf88a168bed3732a47df82bbc66815d28c2e9
SHA256f6f8fdd9e8632fa480df91d7a14412e6930bd5005d56b7187eac8a60437d532f
SHA51260f085101a003a48e375a78105be39e7dcb7bb64b5a551e86d38f3da1454064f7905975cce1fbbe591e3ac6efa984f8cdfb8e1a3eb6944003db456742e3fc4ea
-
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2Vo3428.exeFilesize
1.1MB
MD56c78b0350723bbc55ff79a03cf8b93ae
SHA1954bf88a168bed3732a47df82bbc66815d28c2e9
SHA256f6f8fdd9e8632fa480df91d7a14412e6930bd5005d56b7187eac8a60437d532f
SHA51260f085101a003a48e375a78105be39e7dcb7bb64b5a551e86d38f3da1454064f7905975cce1fbbe591e3ac6efa984f8cdfb8e1a3eb6944003db456742e3fc4ea
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
221KB
MD52d664fd1eb307fc50a02b2923f628e22
SHA12f6b5b8915ee7a98061769c7da0133ac3f0b6c3f
SHA2564fb84f1032f9c9b82db413dc78640b0815e5ac13121b79bfda45b02dacca5c1b
SHA5124b0f621f5ea9c5474318fb1f87db0410e24fa75738a609c6b49a0f94b615fe192f763f0be9b71e849d065045bf8b4cceb9b617168534c7d798cf134da5cd0c00
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
221KB
MD52d664fd1eb307fc50a02b2923f628e22
SHA12f6b5b8915ee7a98061769c7da0133ac3f0b6c3f
SHA2564fb84f1032f9c9b82db413dc78640b0815e5ac13121b79bfda45b02dacca5c1b
SHA5124b0f621f5ea9c5474318fb1f87db0410e24fa75738a609c6b49a0f94b615fe192f763f0be9b71e849d065045bf8b4cceb9b617168534c7d798cf134da5cd0c00
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
221KB
MD52d664fd1eb307fc50a02b2923f628e22
SHA12f6b5b8915ee7a98061769c7da0133ac3f0b6c3f
SHA2564fb84f1032f9c9b82db413dc78640b0815e5ac13121b79bfda45b02dacca5c1b
SHA5124b0f621f5ea9c5474318fb1f87db0410e24fa75738a609c6b49a0f94b615fe192f763f0be9b71e849d065045bf8b4cceb9b617168534c7d798cf134da5cd0c00
-
memory/428-141-0x000001F532B00000-0x000001F532B10000-memory.dmpFilesize
64KB
-
memory/428-121-0x000001F532220000-0x000001F532230000-memory.dmpFilesize
64KB
-
memory/428-689-0x000001F539390000-0x000001F539421000-memory.dmpFilesize
580KB
-
memory/428-160-0x000001F5323F0000-0x000001F5323F2000-memory.dmpFilesize
8KB
-
memory/428-440-0x000001F539D60000-0x000001F539D61000-memory.dmpFilesize
4KB
-
memory/428-471-0x000001F539D70000-0x000001F539D71000-memory.dmpFilesize
4KB
-
memory/924-452-0x00000211718A0000-0x00000211718C0000-memory.dmpFilesize
128KB
-
memory/924-525-0x0000021172320000-0x0000021172340000-memory.dmpFilesize
128KB
-
memory/924-522-0x0000021172160000-0x0000021172180000-memory.dmpFilesize
128KB
-
memory/1112-682-0x000001893CF00000-0x000001893CF20000-memory.dmpFilesize
128KB
-
memory/2196-609-0x000002D116270000-0x000002D116290000-memory.dmpFilesize
128KB
-
memory/2196-732-0x000002D117BB0000-0x000002D117BD0000-memory.dmpFilesize
128KB
-
memory/2196-727-0x000002D116B20000-0x000002D116C20000-memory.dmpFilesize
1024KB
-
memory/2196-725-0x000002D116B20000-0x000002D116C20000-memory.dmpFilesize
1024KB
-
memory/3244-68-0x0000000000B00000-0x0000000000B16000-memory.dmpFilesize
88KB
-
memory/3588-342-0x000001954EAE0000-0x000001954EAE2000-memory.dmpFilesize
8KB
-
memory/3588-351-0x000001954EEA0000-0x000001954EEA2000-memory.dmpFilesize
8KB
-
memory/3588-349-0x000001954EDE0000-0x000001954EDE2000-memory.dmpFilesize
8KB
-
memory/3588-346-0x000001954ED20000-0x000001954ED22000-memory.dmpFilesize
8KB
-
memory/3588-344-0x000001954ED00000-0x000001954ED02000-memory.dmpFilesize
8KB
-
memory/3588-339-0x000001954EAB0000-0x000001954EAB2000-memory.dmpFilesize
8KB
-
memory/4416-255-0x000002242E200000-0x000002242E220000-memory.dmpFilesize
128KB
-
memory/4496-774-0x000001E30B7C0000-0x000001E30B851000-memory.dmpFilesize
580KB
-
memory/4608-42-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/4608-100-0x0000000073AA0000-0x000000007418E000-memory.dmpFilesize
6.9MB
-
memory/4608-75-0x0000000073AA0000-0x000000007418E000-memory.dmpFilesize
6.9MB
-
memory/4608-48-0x0000000073AA0000-0x000000007418E000-memory.dmpFilesize
6.9MB
-
memory/4624-529-0x00000225EA110000-0x00000225EA130000-memory.dmpFilesize
128KB
-
memory/4808-69-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/4808-60-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/5024-92-0x0000000073AA0000-0x000000007418E000-memory.dmpFilesize
6.9MB
-
memory/5024-116-0x000000000CA40000-0x000000000D046000-memory.dmpFilesize
6.0MB
-
memory/5024-117-0x000000000C430000-0x000000000C53A000-memory.dmpFilesize
1.0MB
-
memory/5024-110-0x000000000BBD0000-0x000000000BBDA000-memory.dmpFilesize
40KB
-
memory/5024-119-0x000000000BDF0000-0x000000000BE2E000-memory.dmpFilesize
248KB
-
memory/5024-120-0x000000000BE30000-0x000000000BE7B000-memory.dmpFilesize
300KB
-
memory/5024-106-0x000000000BB20000-0x000000000BBB2000-memory.dmpFilesize
584KB
-
memory/5024-118-0x000000000BD90000-0x000000000BDA2000-memory.dmpFilesize
72KB
-
memory/5024-101-0x000000000BF30000-0x000000000C42E000-memory.dmpFilesize
5.0MB
-
memory/5024-434-0x0000000073AA0000-0x000000007418E000-memory.dmpFilesize
6.9MB
-
memory/5024-84-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5036-59-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/5036-53-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/5036-61-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/5036-63-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/5608-696-0x000001EAAC7E0000-0x000001EAAC800000-memory.dmpFilesize
128KB