Analysis
-
max time kernel
150s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
10-04-2024 10:12
Behavioral task
behavioral1
Sample
ead49efd7212c6db7581dd0a0289da0d_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
ead49efd7212c6db7581dd0a0289da0d_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
ead49efd7212c6db7581dd0a0289da0d_JaffaCakes118.exe
-
Size
19KB
-
MD5
ead49efd7212c6db7581dd0a0289da0d
-
SHA1
aebda29d201d12901d62e2986ae8df64402ef7db
-
SHA256
84f122fef590559137031773773218340a7e39af5e23a0167feacca2226406b8
-
SHA512
9cd1dc5b963ff8e8d69836da908cd12dbb2c1b9e9cd5cffcbd6cb8792f89d0f9dece74b79e84b63140f216b8cc59885113eb512e0fd9c233abdf1a638f08614d
-
SSDEEP
384:3HKZfuH87GowDqGoMwevqxP6k6zIDwPVBSHGuwa3BDLx6Q7R:aZfuHUvwDKP6kMpaGux1Iy
Malware Config
Signatures
-
Detect XtremeRAT payload 52 IoCs
Processes:
resource yara_rule behavioral2/memory/1712-11-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral2/memory/1696-23-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral2/memory/3396-25-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral2/memory/3396-36-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral2/memory/3564-37-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral2/memory/3564-49-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral2/memory/2444-62-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral2/memory/5904-61-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral2/memory/2444-74-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral2/memory/436-75-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral2/memory/436-87-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral2/memory/4680-99-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral2/memory/4732-100-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral2/memory/4732-112-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral2/memory/5296-113-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral2/memory/5296-125-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral2/memory/4184-126-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral2/memory/4184-138-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral2/memory/4544-139-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral2/memory/4544-151-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral2/memory/3784-163-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral2/memory/824-175-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral2/memory/1464-176-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral2/memory/1464-188-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral2/memory/5196-189-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral2/memory/5196-201-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral2/memory/3384-202-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral2/memory/3384-214-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral2/memory/4928-226-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral2/memory/2788-227-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral2/memory/2788-239-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral2/memory/2348-240-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral2/memory/2348-252-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral2/memory/4084-253-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral2/memory/4084-265-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral2/memory/1376-277-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral2/memory/3232-278-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral2/memory/3232-287-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral2/memory/6056-288-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral2/memory/6056-297-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral2/memory/5596-306-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral2/memory/2936-316-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral2/memory/6108-315-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral2/memory/2936-325-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral2/memory/5420-326-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral2/memory/5420-335-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral2/memory/1908-336-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral2/memory/1908-345-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral2/memory/2992-346-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral2/memory/2992-355-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral2/memory/2348-364-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral2/memory/3244-365-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat -
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Modifies Installed Components in the registry 2 TTPs 64 IoCs
Processes:
windll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exeead49efd7212c6db7581dd0a0289da0d_JaffaCakes118.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{R1F1O22J-AK52-3J3M-S068-W4I3RG1Q5V4U}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\windll.exe restart" windll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{R1F1O22J-AK52-3J3M-S068-W4I3RG1Q5V4U}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\windll.exe restart" windll.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{R1F1O22J-AK52-3J3M-S068-W4I3RG1Q5V4U} windll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{R1F1O22J-AK52-3J3M-S068-W4I3RG1Q5V4U}\StubPath = "C:\\Windows\\system32\\InstallDir\\windll.exe restart" windll.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{R1F1O22J-AK52-3J3M-S068-W4I3RG1Q5V4U} windll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{R1F1O22J-AK52-3J3M-S068-W4I3RG1Q5V4U}\StubPath = "C:\\Windows\\system32\\InstallDir\\windll.exe restart" windll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{R1F1O22J-AK52-3J3M-S068-W4I3RG1Q5V4U}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\windll.exe restart" windll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{R1F1O22J-AK52-3J3M-S068-W4I3RG1Q5V4U}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\windll.exe restart" windll.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{R1F1O22J-AK52-3J3M-S068-W4I3RG1Q5V4U} windll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{R1F1O22J-AK52-3J3M-S068-W4I3RG1Q5V4U}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\windll.exe restart" windll.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{R1F1O22J-AK52-3J3M-S068-W4I3RG1Q5V4U} windll.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{R1F1O22J-AK52-3J3M-S068-W4I3RG1Q5V4U} windll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{R1F1O22J-AK52-3J3M-S068-W4I3RG1Q5V4U}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\windll.exe restart" windll.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{R1F1O22J-AK52-3J3M-S068-W4I3RG1Q5V4U} windll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{R1F1O22J-AK52-3J3M-S068-W4I3RG1Q5V4U}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\windll.exe restart" windll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{R1F1O22J-AK52-3J3M-S068-W4I3RG1Q5V4U}\StubPath = "C:\\Windows\\system32\\InstallDir\\windll.exe restart" windll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{R1F1O22J-AK52-3J3M-S068-W4I3RG1Q5V4U}\StubPath = "C:\\Windows\\system32\\InstallDir\\windll.exe restart" windll.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{R1F1O22J-AK52-3J3M-S068-W4I3RG1Q5V4U} windll.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{R1F1O22J-AK52-3J3M-S068-W4I3RG1Q5V4U} windll.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{R1F1O22J-AK52-3J3M-S068-W4I3RG1Q5V4U} windll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{R1F1O22J-AK52-3J3M-S068-W4I3RG1Q5V4U}\StubPath = "C:\\Windows\\system32\\InstallDir\\windll.exe restart" windll.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{R1F1O22J-AK52-3J3M-S068-W4I3RG1Q5V4U} windll.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{R1F1O22J-AK52-3J3M-S068-W4I3RG1Q5V4U} windll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{R1F1O22J-AK52-3J3M-S068-W4I3RG1Q5V4U}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\windll.exe restart" windll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{R1F1O22J-AK52-3J3M-S068-W4I3RG1Q5V4U}\StubPath = "C:\\Windows\\system32\\InstallDir\\windll.exe restart" windll.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{R1F1O22J-AK52-3J3M-S068-W4I3RG1Q5V4U} ead49efd7212c6db7581dd0a0289da0d_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{R1F1O22J-AK52-3J3M-S068-W4I3RG1Q5V4U}\StubPath = "C:\\Windows\\system32\\InstallDir\\windll.exe restart" windll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{R1F1O22J-AK52-3J3M-S068-W4I3RG1Q5V4U}\StubPath = "C:\\Windows\\system32\\InstallDir\\windll.exe restart" windll.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{R1F1O22J-AK52-3J3M-S068-W4I3RG1Q5V4U} windll.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{R1F1O22J-AK52-3J3M-S068-W4I3RG1Q5V4U} windll.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{R1F1O22J-AK52-3J3M-S068-W4I3RG1Q5V4U} windll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{R1F1O22J-AK52-3J3M-S068-W4I3RG1Q5V4U}\StubPath = "C:\\Windows\\system32\\InstallDir\\windll.exe restart" windll.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{R1F1O22J-AK52-3J3M-S068-W4I3RG1Q5V4U} windll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{R1F1O22J-AK52-3J3M-S068-W4I3RG1Q5V4U}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\windll.exe restart" windll.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{R1F1O22J-AK52-3J3M-S068-W4I3RG1Q5V4U} windll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{R1F1O22J-AK52-3J3M-S068-W4I3RG1Q5V4U}\StubPath = "C:\\Windows\\system32\\InstallDir\\windll.exe restart" windll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{R1F1O22J-AK52-3J3M-S068-W4I3RG1Q5V4U}\StubPath = "C:\\Windows\\system32\\InstallDir\\windll.exe restart" windll.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{R1F1O22J-AK52-3J3M-S068-W4I3RG1Q5V4U} windll.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{R1F1O22J-AK52-3J3M-S068-W4I3RG1Q5V4U} windll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{R1F1O22J-AK52-3J3M-S068-W4I3RG1Q5V4U}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\windll.exe restart" windll.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{R1F1O22J-AK52-3J3M-S068-W4I3RG1Q5V4U} windll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{R1F1O22J-AK52-3J3M-S068-W4I3RG1Q5V4U}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\windll.exe restart" windll.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{R1F1O22J-AK52-3J3M-S068-W4I3RG1Q5V4U} windll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{R1F1O22J-AK52-3J3M-S068-W4I3RG1Q5V4U}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\windll.exe restart" windll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{R1F1O22J-AK52-3J3M-S068-W4I3RG1Q5V4U}\StubPath = "C:\\Windows\\system32\\InstallDir\\windll.exe restart" windll.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{R1F1O22J-AK52-3J3M-S068-W4I3RG1Q5V4U} windll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{R1F1O22J-AK52-3J3M-S068-W4I3RG1Q5V4U}\StubPath = "C:\\Windows\\system32\\InstallDir\\windll.exe restart" windll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{R1F1O22J-AK52-3J3M-S068-W4I3RG1Q5V4U}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\windll.exe restart" windll.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{R1F1O22J-AK52-3J3M-S068-W4I3RG1Q5V4U} windll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{R1F1O22J-AK52-3J3M-S068-W4I3RG1Q5V4U}\StubPath = "C:\\Windows\\system32\\InstallDir\\windll.exe restart" ead49efd7212c6db7581dd0a0289da0d_JaffaCakes118.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{R1F1O22J-AK52-3J3M-S068-W4I3RG1Q5V4U} windll.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{R1F1O22J-AK52-3J3M-S068-W4I3RG1Q5V4U} windll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{R1F1O22J-AK52-3J3M-S068-W4I3RG1Q5V4U}\StubPath = "C:\\Windows\\system32\\InstallDir\\windll.exe restart" windll.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{R1F1O22J-AK52-3J3M-S068-W4I3RG1Q5V4U} windll.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{R1F1O22J-AK52-3J3M-S068-W4I3RG1Q5V4U} windll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{R1F1O22J-AK52-3J3M-S068-W4I3RG1Q5V4U}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\windll.exe restart" windll.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{R1F1O22J-AK52-3J3M-S068-W4I3RG1Q5V4U} windll.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{R1F1O22J-AK52-3J3M-S068-W4I3RG1Q5V4U} windll.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{R1F1O22J-AK52-3J3M-S068-W4I3RG1Q5V4U} windll.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{R1F1O22J-AK52-3J3M-S068-W4I3RG1Q5V4U} windll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{R1F1O22J-AK52-3J3M-S068-W4I3RG1Q5V4U}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\windll.exe restart" windll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{R1F1O22J-AK52-3J3M-S068-W4I3RG1Q5V4U}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\windll.exe restart" windll.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{R1F1O22J-AK52-3J3M-S068-W4I3RG1Q5V4U} windll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{R1F1O22J-AK52-3J3M-S068-W4I3RG1Q5V4U}\StubPath = "C:\\Windows\\system32\\InstallDir\\windll.exe restart" windll.exe -
Checks computer location settings 2 TTPs 31 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
ead49efd7212c6db7581dd0a0289da0d_JaffaCakes118.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation ead49efd7212c6db7581dd0a0289da0d_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation windll.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation windll.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation windll.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation windll.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation windll.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation windll.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation windll.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation windll.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation windll.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation windll.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation windll.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation windll.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation windll.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation windll.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation windll.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation windll.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation windll.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation windll.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation windll.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation windll.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation windll.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation windll.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation windll.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation windll.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation windll.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation windll.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation windll.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation windll.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation windll.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation windll.exe -
Executes dropped EXE 31 IoCs
Processes:
windll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exepid process 1696 windll.exe 3396 windll.exe 3564 windll.exe 5904 windll.exe 2444 windll.exe 436 windll.exe 4680 windll.exe 4732 windll.exe 5296 windll.exe 4184 windll.exe 4544 windll.exe 3784 windll.exe 824 windll.exe 1464 windll.exe 5196 windll.exe 3384 windll.exe 4928 windll.exe 2788 windll.exe 2348 windll.exe 4084 windll.exe 1376 windll.exe 3232 windll.exe 6056 windll.exe 5596 windll.exe 6108 windll.exe 2936 windll.exe 5420 windll.exe 1908 windll.exe 2992 windll.exe 2348 windll.exe 3244 windll.exe -
Processes:
resource yara_rule behavioral2/memory/1712-0-0x0000000000C80000-0x0000000000C95000-memory.dmp upx C:\Windows\SysWOW64\InstallDir\windll.exe upx behavioral2/memory/1712-11-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/1696-12-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/1696-23-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/3396-25-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/3396-36-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/3564-37-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/3564-49-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/2444-62-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/5904-61-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/2444-74-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/436-75-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/436-87-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/4680-99-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/4732-100-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/4732-112-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/5296-113-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/5296-125-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/4184-126-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/4184-138-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/4544-139-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/4544-151-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/3784-163-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/824-175-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/1464-176-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/1464-188-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/5196-189-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/5196-201-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/3384-202-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/3384-214-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/4928-226-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/2788-227-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/2788-239-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/2348-240-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/2348-252-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/4084-253-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/4084-265-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/1376-277-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/3232-278-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/3232-287-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/6056-288-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/6056-297-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/5596-306-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/2936-316-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/6108-315-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/2936-325-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/5420-326-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/5420-335-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/1908-336-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/1908-345-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/2992-346-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/2992-355-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/2348-364-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/3244-365-0x0000000000C80000-0x0000000000C95000-memory.dmp upx -
Adds Run key to start application 2 TTPs 64 IoCs
Processes:
windll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exeead49efd7212c6db7581dd0a0289da0d_JaffaCakes118.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\windll.exe" windll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\windll.exe" windll.exe Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\InstallDir\\windll.exe" windll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\InstallDir\\windll.exe" windll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\InstallDir\\windll.exe" windll.exe Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\windll.exe" windll.exe Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\windll.exe" windll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\windll.exe" windll.exe Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\InstallDir\\windll.exe" windll.exe Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\InstallDir\\windll.exe" windll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\InstallDir\\windll.exe" windll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\windll.exe" windll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\windll.exe" windll.exe Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\windll.exe" windll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\InstallDir\\windll.exe" ead49efd7212c6db7581dd0a0289da0d_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\windll.exe" windll.exe Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\windll.exe" windll.exe Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\InstallDir\\windll.exe" windll.exe Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\windll.exe" windll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\InstallDir\\windll.exe" windll.exe Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\InstallDir\\windll.exe" windll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\InstallDir\\windll.exe" windll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\windll.exe" windll.exe Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\windll.exe" windll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\windll.exe" windll.exe Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\windll.exe" windll.exe Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\InstallDir\\windll.exe" windll.exe Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\InstallDir\\windll.exe" windll.exe Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\InstallDir\\windll.exe" windll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\windll.exe" windll.exe Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\windll.exe" windll.exe Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\windll.exe" windll.exe Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\InstallDir\\windll.exe" windll.exe Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\windll.exe" windll.exe Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\windll.exe" windll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\InstallDir\\windll.exe" windll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\windll.exe" windll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\InstallDir\\windll.exe" windll.exe Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\InstallDir\\windll.exe" windll.exe Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\windll.exe" windll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\InstallDir\\windll.exe" windll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\InstallDir\\windll.exe" windll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\windll.exe" windll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\InstallDir\\windll.exe" windll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\windll.exe" windll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\windll.exe" windll.exe Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\InstallDir\\windll.exe" ead49efd7212c6db7581dd0a0289da0d_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\InstallDir\\windll.exe" windll.exe Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\windll.exe" windll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\windll.exe" windll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\InstallDir\\windll.exe" windll.exe Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\InstallDir\\windll.exe" windll.exe Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\InstallDir\\windll.exe" windll.exe Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\InstallDir\\windll.exe" windll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\InstallDir\\windll.exe" windll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\windll.exe" windll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\InstallDir\\windll.exe" windll.exe Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\InstallDir\\windll.exe" windll.exe Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\windll.exe" windll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\InstallDir\\windll.exe" windll.exe Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\windll.exe" windll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\windll.exe" windll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\windll.exe" windll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\InstallDir\\windll.exe" windll.exe -
Drops file in System32 directory 49 IoCs
Processes:
windll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exeead49efd7212c6db7581dd0a0289da0d_JaffaCakes118.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exewindll.exedescription ioc process File opened for modification C:\Windows\SysWOW64\InstallDir\windll.exe windll.exe File opened for modification C:\Windows\SysWOW64\InstallDir\windll.exe windll.exe File opened for modification C:\Windows\SysWOW64\InstallDir\windll.exe windll.exe File opened for modification C:\Windows\SysWOW64\InstallDir\windll.exe windll.exe File created C:\Windows\SysWOW64\InstallDir\windll.exe windll.exe File created C:\Windows\SysWOW64\InstallDir\windll.exe windll.exe File created C:\Windows\SysWOW64\InstallDir\windll.exe windll.exe File created C:\Windows\SysWOW64\InstallDir\windll.exe windll.exe File created C:\Windows\SysWOW64\InstallDir\windll.exe windll.exe File created C:\Windows\SysWOW64\InstallDir\windll.exe windll.exe File opened for modification C:\Windows\SysWOW64\InstallDir\windll.exe windll.exe File opened for modification C:\Windows\SysWOW64\InstallDir\windll.exe windll.exe File opened for modification C:\Windows\SysWOW64\InstallDir\windll.exe windll.exe File opened for modification C:\Windows\SysWOW64\InstallDir\windll.exe windll.exe File opened for modification C:\Windows\SysWOW64\InstallDir\windll.exe windll.exe File opened for modification C:\Windows\SysWOW64\InstallDir\windll.exe windll.exe File opened for modification C:\Windows\SysWOW64\InstallDir\windll.exe windll.exe File created C:\Windows\SysWOW64\InstallDir\windll.exe windll.exe File created C:\Windows\SysWOW64\InstallDir\windll.exe windll.exe File created C:\Windows\SysWOW64\InstallDir\windll.exe windll.exe File created C:\Windows\SysWOW64\InstallDir\windll.exe windll.exe File created C:\Windows\SysWOW64\InstallDir\windll.exe windll.exe File created C:\Windows\SysWOW64\InstallDir\windll.exe windll.exe File opened for modification C:\Windows\SysWOW64\InstallDir\windll.exe windll.exe File opened for modification C:\Windows\SysWOW64\InstallDir\windll.exe windll.exe File created C:\Windows\SysWOW64\InstallDir\windll.exe windll.exe File opened for modification C:\Windows\SysWOW64\InstallDir\windll.exe windll.exe File opened for modification C:\Windows\SysWOW64\InstallDir\windll.exe windll.exe File opened for modification C:\Windows\SysWOW64\InstallDir\windll.exe windll.exe File created C:\Windows\SysWOW64\InstallDir\windll.exe windll.exe File opened for modification C:\Windows\SysWOW64\InstallDir\windll.exe windll.exe File created C:\Windows\SysWOW64\InstallDir\windll.exe windll.exe File opened for modification C:\Windows\SysWOW64\InstallDir\windll.exe windll.exe File created C:\Windows\SysWOW64\InstallDir\windll.exe ead49efd7212c6db7581dd0a0289da0d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\InstallDir\windll.exe windll.exe File opened for modification C:\Windows\SysWOW64\InstallDir\windll.exe windll.exe File opened for modification C:\Windows\SysWOW64\InstallDir\windll.exe windll.exe File opened for modification C:\Windows\SysWOW64\InstallDir\windll.exe windll.exe File opened for modification C:\Windows\SysWOW64\InstallDir\windll.exe windll.exe File opened for modification C:\Windows\SysWOW64\InstallDir\windll.exe ead49efd7212c6db7581dd0a0289da0d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\InstallDir\windll.exe windll.exe File opened for modification C:\Windows\SysWOW64\InstallDir\windll.exe windll.exe File opened for modification C:\Windows\SysWOW64\InstallDir\windll.exe windll.exe File opened for modification C:\Windows\SysWOW64\InstallDir\windll.exe windll.exe File opened for modification C:\Windows\SysWOW64\InstallDir\windll.exe windll.exe File opened for modification C:\Windows\SysWOW64\InstallDir\windll.exe windll.exe File opened for modification C:\Windows\SysWOW64\InstallDir\windll.exe windll.exe File opened for modification C:\Windows\SysWOW64\InstallDir\windll.exe windll.exe File created C:\Windows\SysWOW64\InstallDir\windll.exe windll.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
ead49efd7212c6db7581dd0a0289da0d_JaffaCakes118.exewindll.exewindll.exedescription pid process target process PID 1712 wrote to memory of 2052 1712 ead49efd7212c6db7581dd0a0289da0d_JaffaCakes118.exe msedge.exe PID 1712 wrote to memory of 2052 1712 ead49efd7212c6db7581dd0a0289da0d_JaffaCakes118.exe msedge.exe PID 1712 wrote to memory of 2052 1712 ead49efd7212c6db7581dd0a0289da0d_JaffaCakes118.exe msedge.exe PID 1712 wrote to memory of 5848 1712 ead49efd7212c6db7581dd0a0289da0d_JaffaCakes118.exe msedge.exe PID 1712 wrote to memory of 5848 1712 ead49efd7212c6db7581dd0a0289da0d_JaffaCakes118.exe msedge.exe PID 1712 wrote to memory of 5848 1712 ead49efd7212c6db7581dd0a0289da0d_JaffaCakes118.exe msedge.exe PID 1712 wrote to memory of 5172 1712 ead49efd7212c6db7581dd0a0289da0d_JaffaCakes118.exe msedge.exe PID 1712 wrote to memory of 5172 1712 ead49efd7212c6db7581dd0a0289da0d_JaffaCakes118.exe msedge.exe PID 1712 wrote to memory of 5172 1712 ead49efd7212c6db7581dd0a0289da0d_JaffaCakes118.exe msedge.exe PID 1712 wrote to memory of 408 1712 ead49efd7212c6db7581dd0a0289da0d_JaffaCakes118.exe msedge.exe PID 1712 wrote to memory of 408 1712 ead49efd7212c6db7581dd0a0289da0d_JaffaCakes118.exe msedge.exe PID 1712 wrote to memory of 408 1712 ead49efd7212c6db7581dd0a0289da0d_JaffaCakes118.exe msedge.exe PID 1712 wrote to memory of 1836 1712 ead49efd7212c6db7581dd0a0289da0d_JaffaCakes118.exe msedge.exe PID 1712 wrote to memory of 1836 1712 ead49efd7212c6db7581dd0a0289da0d_JaffaCakes118.exe msedge.exe PID 1712 wrote to memory of 1836 1712 ead49efd7212c6db7581dd0a0289da0d_JaffaCakes118.exe msedge.exe PID 1712 wrote to memory of 1276 1712 ead49efd7212c6db7581dd0a0289da0d_JaffaCakes118.exe msedge.exe PID 1712 wrote to memory of 1276 1712 ead49efd7212c6db7581dd0a0289da0d_JaffaCakes118.exe msedge.exe PID 1712 wrote to memory of 1276 1712 ead49efd7212c6db7581dd0a0289da0d_JaffaCakes118.exe msedge.exe PID 1712 wrote to memory of 1812 1712 ead49efd7212c6db7581dd0a0289da0d_JaffaCakes118.exe msedge.exe PID 1712 wrote to memory of 1812 1712 ead49efd7212c6db7581dd0a0289da0d_JaffaCakes118.exe msedge.exe PID 1712 wrote to memory of 1812 1712 ead49efd7212c6db7581dd0a0289da0d_JaffaCakes118.exe msedge.exe PID 1712 wrote to memory of 1180 1712 ead49efd7212c6db7581dd0a0289da0d_JaffaCakes118.exe msedge.exe PID 1712 wrote to memory of 1180 1712 ead49efd7212c6db7581dd0a0289da0d_JaffaCakes118.exe msedge.exe PID 1712 wrote to memory of 1696 1712 ead49efd7212c6db7581dd0a0289da0d_JaffaCakes118.exe windll.exe PID 1712 wrote to memory of 1696 1712 ead49efd7212c6db7581dd0a0289da0d_JaffaCakes118.exe windll.exe PID 1712 wrote to memory of 1696 1712 ead49efd7212c6db7581dd0a0289da0d_JaffaCakes118.exe windll.exe PID 1696 wrote to memory of 3416 1696 windll.exe msedge.exe PID 1696 wrote to memory of 3416 1696 windll.exe msedge.exe PID 1696 wrote to memory of 3416 1696 windll.exe msedge.exe PID 1696 wrote to memory of 4640 1696 windll.exe msedge.exe PID 1696 wrote to memory of 4640 1696 windll.exe msedge.exe PID 1696 wrote to memory of 4640 1696 windll.exe msedge.exe PID 1696 wrote to memory of 5604 1696 windll.exe msedge.exe PID 1696 wrote to memory of 5604 1696 windll.exe msedge.exe PID 1696 wrote to memory of 5604 1696 windll.exe msedge.exe PID 1696 wrote to memory of 1204 1696 windll.exe msedge.exe PID 1696 wrote to memory of 1204 1696 windll.exe msedge.exe PID 1696 wrote to memory of 1204 1696 windll.exe msedge.exe PID 1696 wrote to memory of 4712 1696 windll.exe msedge.exe PID 1696 wrote to memory of 4712 1696 windll.exe msedge.exe PID 1696 wrote to memory of 4712 1696 windll.exe msedge.exe PID 1696 wrote to memory of 684 1696 windll.exe msedge.exe PID 1696 wrote to memory of 684 1696 windll.exe msedge.exe PID 1696 wrote to memory of 684 1696 windll.exe msedge.exe PID 1696 wrote to memory of 1228 1696 windll.exe msedge.exe PID 1696 wrote to memory of 1228 1696 windll.exe msedge.exe PID 1696 wrote to memory of 1228 1696 windll.exe msedge.exe PID 1696 wrote to memory of 4128 1696 windll.exe msedge.exe PID 1696 wrote to memory of 4128 1696 windll.exe msedge.exe PID 1696 wrote to memory of 3396 1696 windll.exe windll.exe PID 1696 wrote to memory of 3396 1696 windll.exe windll.exe PID 1696 wrote to memory of 3396 1696 windll.exe windll.exe PID 3396 wrote to memory of 4248 3396 windll.exe msedge.exe PID 3396 wrote to memory of 4248 3396 windll.exe msedge.exe PID 3396 wrote to memory of 4248 3396 windll.exe msedge.exe PID 3396 wrote to memory of 5240 3396 windll.exe msedge.exe PID 3396 wrote to memory of 5240 3396 windll.exe msedge.exe PID 3396 wrote to memory of 5240 3396 windll.exe msedge.exe PID 3396 wrote to memory of 3336 3396 windll.exe msedge.exe PID 3396 wrote to memory of 3336 3396 windll.exe msedge.exe PID 3396 wrote to memory of 3336 3396 windll.exe msedge.exe PID 3396 wrote to memory of 228 3396 windll.exe msedge.exe PID 3396 wrote to memory of 228 3396 windll.exe msedge.exe PID 3396 wrote to memory of 228 3396 windll.exe msedge.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ead49efd7212c6db7581dd0a0289da0d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ead49efd7212c6db7581dd0a0289da0d_JaffaCakes118.exe"1⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"2⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"2⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"2⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"2⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"2⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"2⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"2⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"2⤵
-
C:\Windows\SysWOW64\InstallDir\windll.exe"C:\Windows\system32\InstallDir\windll.exe"2⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\InstallDir\windll.exe"C:\Users\Admin\AppData\Roaming\InstallDir\windll.exe"3⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"4⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"4⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"4⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"4⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"4⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"4⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"4⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"4⤵
-
C:\Windows\SysWOW64\InstallDir\windll.exe"C:\Windows\system32\InstallDir\windll.exe"4⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"5⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"5⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"5⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"5⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"5⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"5⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"5⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"5⤵
-
C:\Users\Admin\AppData\Roaming\InstallDir\windll.exe"C:\Users\Admin\AppData\Roaming\InstallDir\windll.exe"5⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"6⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"6⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"6⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"6⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"6⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"6⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"6⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"6⤵
-
C:\Windows\SysWOW64\InstallDir\windll.exe"C:\Windows\system32\InstallDir\windll.exe"6⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"7⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"7⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"7⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"7⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"7⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"7⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"7⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"7⤵
-
C:\Users\Admin\AppData\Roaming\InstallDir\windll.exe"C:\Users\Admin\AppData\Roaming\InstallDir\windll.exe"7⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵
-
C:\Windows\SysWOW64\InstallDir\windll.exe"C:\Windows\system32\InstallDir\windll.exe"8⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"9⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"9⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"9⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"9⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"9⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"9⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"9⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"9⤵
-
C:\Users\Admin\AppData\Roaming\InstallDir\windll.exe"C:\Users\Admin\AppData\Roaming\InstallDir\windll.exe"9⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"10⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"10⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"10⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"10⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"10⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"10⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"10⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"10⤵
-
C:\Windows\SysWOW64\InstallDir\windll.exe"C:\Windows\system32\InstallDir\windll.exe"10⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"11⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"11⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"11⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"11⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"11⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"11⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"11⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"11⤵
-
C:\Users\Admin\AppData\Roaming\InstallDir\windll.exe"C:\Users\Admin\AppData\Roaming\InstallDir\windll.exe"11⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"12⤵
-
C:\Windows\SysWOW64\InstallDir\windll.exe"C:\Windows\system32\InstallDir\windll.exe"12⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"13⤵
-
C:\Users\Admin\AppData\Roaming\InstallDir\windll.exe"C:\Users\Admin\AppData\Roaming\InstallDir\windll.exe"13⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"14⤵
-
C:\Windows\SysWOW64\InstallDir\windll.exe"C:\Windows\system32\InstallDir\windll.exe"14⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"15⤵
-
C:\Users\Admin\AppData\Roaming\InstallDir\windll.exe"C:\Users\Admin\AppData\Roaming\InstallDir\windll.exe"15⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"16⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"16⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"16⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"16⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"16⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"16⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"16⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"16⤵
-
C:\Windows\SysWOW64\InstallDir\windll.exe"C:\Windows\system32\InstallDir\windll.exe"16⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"17⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"17⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"17⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"17⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"17⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"17⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"17⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"17⤵
-
C:\Users\Admin\AppData\Roaming\InstallDir\windll.exe"C:\Users\Admin\AppData\Roaming\InstallDir\windll.exe"17⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"18⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"18⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"18⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"18⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"18⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"18⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"18⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"18⤵
-
C:\Windows\SysWOW64\InstallDir\windll.exe"C:\Windows\system32\InstallDir\windll.exe"18⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"19⤵
-
C:\Users\Admin\AppData\Roaming\InstallDir\windll.exe"C:\Users\Admin\AppData\Roaming\InstallDir\windll.exe"19⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"20⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"20⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"20⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"20⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"20⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"20⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"20⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"20⤵
-
C:\Windows\SysWOW64\InstallDir\windll.exe"C:\Windows\system32\InstallDir\windll.exe"20⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"21⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"21⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"21⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"21⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"21⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"21⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"21⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"21⤵
-
C:\Users\Admin\AppData\Roaming\InstallDir\windll.exe"C:\Users\Admin\AppData\Roaming\InstallDir\windll.exe"21⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"22⤵
-
C:\Windows\SysWOW64\InstallDir\windll.exe"C:\Windows\system32\InstallDir\windll.exe"22⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"23⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"23⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"23⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"23⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"23⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"23⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"23⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"23⤵
-
C:\Users\Admin\AppData\Roaming\InstallDir\windll.exe"C:\Users\Admin\AppData\Roaming\InstallDir\windll.exe"23⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"24⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"24⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"24⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"24⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"24⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"24⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"24⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"24⤵
-
C:\Windows\SysWOW64\InstallDir\windll.exe"C:\Windows\system32\InstallDir\windll.exe"24⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"25⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"25⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"25⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"25⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"25⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"25⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"25⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"25⤵
-
C:\Users\Admin\AppData\Roaming\InstallDir\windll.exe"C:\Users\Admin\AppData\Roaming\InstallDir\windll.exe"25⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"26⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"26⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"26⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"26⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"26⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"26⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"26⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"26⤵
-
C:\Windows\SysWOW64\InstallDir\windll.exe"C:\Windows\system32\InstallDir\windll.exe"26⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"27⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"27⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"27⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"27⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"27⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"27⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"27⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"27⤵
-
C:\Users\Admin\AppData\Roaming\InstallDir\windll.exe"C:\Users\Admin\AppData\Roaming\InstallDir\windll.exe"27⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"28⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"28⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"28⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"28⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"28⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"28⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"28⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"28⤵
-
C:\Windows\SysWOW64\InstallDir\windll.exe"C:\Windows\system32\InstallDir\windll.exe"28⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"29⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"29⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"29⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"29⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"29⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"29⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"29⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"29⤵
-
C:\Users\Admin\AppData\Roaming\InstallDir\windll.exe"C:\Users\Admin\AppData\Roaming\InstallDir\windll.exe"29⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"30⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"30⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"30⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"30⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"30⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"30⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"30⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"30⤵
-
C:\Windows\SysWOW64\InstallDir\windll.exe"C:\Windows\system32\InstallDir\windll.exe"30⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"31⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"31⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"31⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"31⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"31⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"31⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"31⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"31⤵
-
C:\Users\Admin\AppData\Roaming\InstallDir\windll.exe"C:\Users\Admin\AppData\Roaming\InstallDir\windll.exe"31⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"32⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"32⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"32⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"32⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"32⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"32⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"32⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"32⤵
-
C:\Windows\SysWOW64\InstallDir\windll.exe"C:\Windows\system32\InstallDir\windll.exe"32⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"33⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"33⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"33⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\pX4P6l.cfgFilesize
1KB
MD5e9c605174383871ec3bcced0f7ef6ef2
SHA13a2386b8fdad2f0600403d7673e5d527d211fd17
SHA25673480e281f141b198c24992a73e35f702b13e14b47c1974dbafcd67ec10d9fb4
SHA512627d2fc05a9f3cc5f059cf6209a1019bfa6e4f8f411b2c91b8e246203f0b99593106e9f2140012aa96fc200547c0e764aafce340be05c1e2b98af986d0819fef
-
C:\Windows\SysWOW64\InstallDir\windll.exeFilesize
19KB
MD5ead49efd7212c6db7581dd0a0289da0d
SHA1aebda29d201d12901d62e2986ae8df64402ef7db
SHA25684f122fef590559137031773773218340a7e39af5e23a0167feacca2226406b8
SHA5129cd1dc5b963ff8e8d69836da908cd12dbb2c1b9e9cd5cffcbd6cb8792f89d0f9dece74b79e84b63140f216b8cc59885113eb512e0fd9c233abdf1a638f08614d
-
memory/436-75-0x0000000000C80000-0x0000000000C95000-memory.dmpFilesize
84KB
-
memory/436-87-0x0000000000C80000-0x0000000000C95000-memory.dmpFilesize
84KB
-
memory/824-175-0x0000000000C80000-0x0000000000C95000-memory.dmpFilesize
84KB
-
memory/1376-277-0x0000000000C80000-0x0000000000C95000-memory.dmpFilesize
84KB
-
memory/1464-176-0x0000000000C80000-0x0000000000C95000-memory.dmpFilesize
84KB
-
memory/1464-188-0x0000000000C80000-0x0000000000C95000-memory.dmpFilesize
84KB
-
memory/1696-12-0x0000000000C80000-0x0000000000C95000-memory.dmpFilesize
84KB
-
memory/1696-23-0x0000000000C80000-0x0000000000C95000-memory.dmpFilesize
84KB
-
memory/1712-0-0x0000000000C80000-0x0000000000C95000-memory.dmpFilesize
84KB
-
memory/1712-11-0x0000000000C80000-0x0000000000C95000-memory.dmpFilesize
84KB
-
memory/1908-345-0x0000000000C80000-0x0000000000C95000-memory.dmpFilesize
84KB
-
memory/1908-336-0x0000000000C80000-0x0000000000C95000-memory.dmpFilesize
84KB
-
memory/2348-240-0x0000000000C80000-0x0000000000C95000-memory.dmpFilesize
84KB
-
memory/2348-364-0x0000000000C80000-0x0000000000C95000-memory.dmpFilesize
84KB
-
memory/2348-252-0x0000000000C80000-0x0000000000C95000-memory.dmpFilesize
84KB
-
memory/2444-74-0x0000000000C80000-0x0000000000C95000-memory.dmpFilesize
84KB
-
memory/2444-62-0x0000000000C80000-0x0000000000C95000-memory.dmpFilesize
84KB
-
memory/2788-227-0x0000000000C80000-0x0000000000C95000-memory.dmpFilesize
84KB
-
memory/2788-239-0x0000000000C80000-0x0000000000C95000-memory.dmpFilesize
84KB
-
memory/2936-316-0x0000000000C80000-0x0000000000C95000-memory.dmpFilesize
84KB
-
memory/2936-325-0x0000000000C80000-0x0000000000C95000-memory.dmpFilesize
84KB
-
memory/2992-346-0x0000000000C80000-0x0000000000C95000-memory.dmpFilesize
84KB
-
memory/2992-355-0x0000000000C80000-0x0000000000C95000-memory.dmpFilesize
84KB
-
memory/3232-278-0x0000000000C80000-0x0000000000C95000-memory.dmpFilesize
84KB
-
memory/3232-287-0x0000000000C80000-0x0000000000C95000-memory.dmpFilesize
84KB
-
memory/3244-365-0x0000000000C80000-0x0000000000C95000-memory.dmpFilesize
84KB
-
memory/3384-202-0x0000000000C80000-0x0000000000C95000-memory.dmpFilesize
84KB
-
memory/3384-214-0x0000000000C80000-0x0000000000C95000-memory.dmpFilesize
84KB
-
memory/3396-36-0x0000000000C80000-0x0000000000C95000-memory.dmpFilesize
84KB
-
memory/3396-25-0x0000000000C80000-0x0000000000C95000-memory.dmpFilesize
84KB
-
memory/3564-49-0x0000000000C80000-0x0000000000C95000-memory.dmpFilesize
84KB
-
memory/3564-37-0x0000000000C80000-0x0000000000C95000-memory.dmpFilesize
84KB
-
memory/3784-163-0x0000000000C80000-0x0000000000C95000-memory.dmpFilesize
84KB
-
memory/4084-253-0x0000000000C80000-0x0000000000C95000-memory.dmpFilesize
84KB
-
memory/4084-265-0x0000000000C80000-0x0000000000C95000-memory.dmpFilesize
84KB
-
memory/4184-138-0x0000000000C80000-0x0000000000C95000-memory.dmpFilesize
84KB
-
memory/4184-126-0x0000000000C80000-0x0000000000C95000-memory.dmpFilesize
84KB
-
memory/4544-151-0x0000000000C80000-0x0000000000C95000-memory.dmpFilesize
84KB
-
memory/4544-139-0x0000000000C80000-0x0000000000C95000-memory.dmpFilesize
84KB
-
memory/4680-99-0x0000000000C80000-0x0000000000C95000-memory.dmpFilesize
84KB
-
memory/4732-112-0x0000000000C80000-0x0000000000C95000-memory.dmpFilesize
84KB
-
memory/4732-100-0x0000000000C80000-0x0000000000C95000-memory.dmpFilesize
84KB
-
memory/4928-226-0x0000000000C80000-0x0000000000C95000-memory.dmpFilesize
84KB
-
memory/5196-201-0x0000000000C80000-0x0000000000C95000-memory.dmpFilesize
84KB
-
memory/5196-189-0x0000000000C80000-0x0000000000C95000-memory.dmpFilesize
84KB
-
memory/5296-125-0x0000000000C80000-0x0000000000C95000-memory.dmpFilesize
84KB
-
memory/5296-113-0x0000000000C80000-0x0000000000C95000-memory.dmpFilesize
84KB
-
memory/5420-326-0x0000000000C80000-0x0000000000C95000-memory.dmpFilesize
84KB
-
memory/5420-335-0x0000000000C80000-0x0000000000C95000-memory.dmpFilesize
84KB
-
memory/5596-306-0x0000000000C80000-0x0000000000C95000-memory.dmpFilesize
84KB
-
memory/5904-61-0x0000000000C80000-0x0000000000C95000-memory.dmpFilesize
84KB
-
memory/6056-297-0x0000000000C80000-0x0000000000C95000-memory.dmpFilesize
84KB
-
memory/6056-288-0x0000000000C80000-0x0000000000C95000-memory.dmpFilesize
84KB
-
memory/6108-315-0x0000000000C80000-0x0000000000C95000-memory.dmpFilesize
84KB