Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
27-04-2024 22:15
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://roexec.lol/
Resource
win10-20240404-en
General
-
Target
https://roexec.lol/
Malware Config
Signatures
-
Drops file in Windows directory 7 IoCs
Processes:
MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exetaskmgr.exedescription ioc process File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdge.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\4183903823\2290032291.pri taskmgr.exe File created C:\Windows\rescache\_merged\1601268389\715946058.pri taskmgr.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri taskmgr.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Processes:
browser_broker.exeMicrosoftEdgeCP.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe -
Modifies registry class 64 IoCs
Processes:
MicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exetaskmgr.exebrowser_broker.exeMicrosoftEdgeCP.exedescription ioc process Set value (data) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\FileNames\en-US = "en-US.1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\NextUpdateDate = "421037720" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$vBulletin 3 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\Certificates MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings taskmgr.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\PersistedStorageItemTable\System browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\MrtCache MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$vBulletin 4 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\Certificates MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\PersistedStorageItemTable\System\{191BE7F2-1413-4C78-BFC6-6A08C5E5401 = "\\\\?\\Volume{38FC2686-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\TempState\\Downloads\\Loader.zip" browser_broker.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "268435456" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content\CachePrefix MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = a37db676f098da01 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\Certificates MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History\CacheLimit = "1" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 5f1c9691f098da01 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\CTLs MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = 0100000012f853498c7e455a04979ae26f49ce2d723e8a1e603b8118a1b08bbce70c4ef71ac451fc773a960f6a034a68fa431130b216e07ab31cba005b17 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "395205405" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\DisallowDefaultBrowserPrompt = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\CRLs MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CacheLimit = "1" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$blogger MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Extensible Cache MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\OneTimeCleanup = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content\CacheLimit = "256000" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\Rating Prompt Shown = "0" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\IsSignedIn = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BingPageData MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\ACGPolicyState = "8" MicrosoftEdgeCP.exe -
NTFS ADS 1 IoCs
Processes:
browser_broker.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\Loader.zip.2zbj3pi.partial:Zone.Identifier browser_broker.exe -
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
NOTEPAD.EXEpid process 4436 NOTEPAD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exetaskmgr.exepowershell.exepid process 360 powershell.exe 360 powershell.exe 360 powershell.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 360 powershell.exe 360 powershell.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 4960 powershell.exe 4960 powershell.exe 4960 powershell.exe 4960 powershell.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe -
Suspicious behavior: MapViewOfSection 4 IoCs
Processes:
MicrosoftEdgeCP.exepid process 4472 MicrosoftEdgeCP.exe 4472 MicrosoftEdgeCP.exe 4472 MicrosoftEdgeCP.exe 4472 MicrosoftEdgeCP.exe -
Suspicious use of AdjustPrivilegeToken 30 IoCs
Processes:
MicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdge.exepowershell.exetaskmgr.exesvchost.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 2004 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 2004 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 2004 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 2004 MicrosoftEdgeCP.exe Token: SeShutdownPrivilege 1332 MicrosoftEdgeCP.exe Token: SeCreatePagefilePrivilege 1332 MicrosoftEdgeCP.exe Token: SeShutdownPrivilege 1332 MicrosoftEdgeCP.exe Token: SeCreatePagefilePrivilege 1332 MicrosoftEdgeCP.exe Token: SeShutdownPrivilege 1332 MicrosoftEdgeCP.exe Token: SeCreatePagefilePrivilege 1332 MicrosoftEdgeCP.exe Token: SeShutdownPrivilege 1332 MicrosoftEdgeCP.exe Token: SeCreatePagefilePrivilege 1332 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 2168 MicrosoftEdge.exe Token: SeDebugPrivilege 2168 MicrosoftEdge.exe Token: SeDebugPrivilege 360 powershell.exe Token: SeDebugPrivilege 3492 taskmgr.exe Token: SeSystemProfilePrivilege 3492 taskmgr.exe Token: SeCreateGlobalPrivilege 3492 taskmgr.exe Token: SeBackupPrivilege 1792 svchost.exe Token: SeRestorePrivilege 1792 svchost.exe Token: SeSecurityPrivilege 1792 svchost.exe Token: SeTakeOwnershipPrivilege 1792 svchost.exe Token: 35 1792 svchost.exe Token: SeDebugPrivilege 4960 powershell.exe Token: SeDebugPrivilege 2360 powershell.exe Token: SeBackupPrivilege 1792 svchost.exe Token: SeRestorePrivilege 1792 svchost.exe Token: SeSecurityPrivilege 1792 svchost.exe Token: SeTakeOwnershipPrivilege 1792 svchost.exe Token: 35 1792 svchost.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
NOTEPAD.EXEtaskmgr.exepid process 4436 NOTEPAD.EXE 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
taskmgr.exepid process 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exepid process 2168 MicrosoftEdge.exe 4472 MicrosoftEdgeCP.exe 2004 MicrosoftEdgeCP.exe 4472 MicrosoftEdgeCP.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
MicrosoftEdgeCP.execmd.execmd.execmd.exedescription pid process target process PID 4472 wrote to memory of 1332 4472 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 4472 wrote to memory of 1332 4472 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 4472 wrote to memory of 1332 4472 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 4472 wrote to memory of 1332 4472 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 4472 wrote to memory of 1332 4472 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 4472 wrote to memory of 1332 4472 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 4472 wrote to memory of 1332 4472 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 4472 wrote to memory of 1332 4472 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 4472 wrote to memory of 1332 4472 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 4472 wrote to memory of 1332 4472 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 4364 wrote to memory of 3756 4364 cmd.exe cmd.exe PID 4364 wrote to memory of 3756 4364 cmd.exe cmd.exe PID 4364 wrote to memory of 360 4364 cmd.exe powershell.exe PID 4364 wrote to memory of 360 4364 cmd.exe powershell.exe PID 3200 wrote to memory of 2588 3200 cmd.exe cmd.exe PID 3200 wrote to memory of 2588 3200 cmd.exe cmd.exe PID 3200 wrote to memory of 4960 3200 cmd.exe powershell.exe PID 3200 wrote to memory of 4960 3200 cmd.exe powershell.exe PID 656 wrote to memory of 3648 656 cmd.exe cmd.exe PID 656 wrote to memory of 3648 656 cmd.exe cmd.exe PID 656 wrote to memory of 2360 656 cmd.exe powershell.exe PID 656 wrote to memory of 2360 656 cmd.exe powershell.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\LaunchWinApp.exe"C:\Windows\system32\LaunchWinApp.exe" "https://roexec.lol/"1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- NTFS ADS
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\System32\NOTEPAD.EXE"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Loader.bat1⤵
- Opens file in notepad (likely ransom note)
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Desktop\Loader.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Invoke-Expression $env:VbLHakvKOm; "2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ep bypass -noprofile -windowstyle hidden2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SDRSVC1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Desktop\Loader.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Invoke-Expression $env:VbLHakvKOm; "2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ep bypass -noprofile -windowstyle hidden2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Desktop\Loader.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Invoke-Expression $env:VbLHakvKOm; "2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ep bypass -noprofile -windowstyle hidden2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157Filesize
4KB
MD51bfe591a4fe3d91b03cdf26eaacd8f89
SHA1719c37c320f518ac168c86723724891950911cea
SHA2569cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8
SHA51202f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
3KB
MD5b35c81b90185530c116e245b74fa2a7b
SHA19ec3db80d69bc51a822eeb1ebc8df8eab4fd7b6a
SHA256d4bbe07ea9e4148a6cbc18a722daa292595d0244b409a6d1900405b822daa4f2
SHA512f99b7a101e2954e5b303823b4ecacd01a392c9121d6564585d18876de8bf8897e50f223a2b661b16d45df15d2cdf1b2aa35e1dc6148e54d9fc9e6d7602ca9e7e
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ZDIGHWMN\edgecompatviewlist[1].xmlFilesize
74KB
MD5d4fc49dc14f63895d997fa4940f24378
SHA13efb1437a7c5e46034147cbbc8db017c69d02c31
SHA256853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1
SHA512cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
2KB
MD57b0cd7d30694f60c01aebc428ff43226
SHA1fecdc3f83f729cd8b6053c506aa27d92db1f21da
SHA256262aa0bb8ef97414457f0d164d0614a8edec814a370496d8d2994997b887f588
SHA512a0afd3b2965d217932dd5974269c1c7b2eafd15fee20c3e98ee15ab90ecd128107f43b64c042fcc5541f207f9eb859bbf16b18bb61bae4d96ef223b96a2bf865
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
2KB
MD5def2f140bf5d2a15ce19046bf195ffa8
SHA1595c463e9686926991834c11913b1d8fd0366a97
SHA256dc0ae4b2d3026ed953184ab9cfa86823c22b98853a60886ae3308939c2e294b2
SHA5124cdbeb3959dd305e4ab91d7ac899ade87874a9ca24271e7aeefc7bd82eea3c4a5a1ad29d217b0294902a0f34ffb2ef47db2f6594c729fa5544c61745e5a0f2c6
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\VQDZGNRD\suggestions[1].en-USFilesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\Loader.zip.2zbj3pi.partialFilesize
10.7MB
MD59707cda1159f673820ca1f4418c30b7f
SHA1f422d9bc5b0e87dd71ace4dce22a2f60fabe8db9
SHA25663ad1c61c2a15acb8bcfbb41e787cc5b82b925bb8acc6ebf8e5aa08ce056cafa
SHA5127afe416209d8c965ef767dd8239ebf1ed4d1dc00b84d4eba08c5cb04ba4ba511f8666ff683d1a824ee15b3b6cb4f1a4bdbe27353950bfaa3249e7d7d42fe4b44
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\01Y5O1AP\Loader[1].zipFilesize
15KB
MD54cc3ace51a0a2098f30d6318de38383b
SHA1f7d9afe8cf1e4794f3de7df9c7c293b6de02cec9
SHA256b611ca337046103c24c096bd8474cd271144a6a16354d778ee2867e16aec7cda
SHA512dee00bfd45337d32350409c2c1d5e766f8e8ccde5449e1db4e5bd4bbcba6e816920c6e22e372caa431c94bc72ddf3d99d4b830e8a1dbf035029077b51cdefe3a
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_eq3z4jvp.cni.ps1Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
memory/360-302-0x00007FF7F1AC0000-0x00007FF7F1B30000-memory.dmpFilesize
448KB
-
memory/360-276-0x00007FFF69C40000-0x00007FFF69CEE000-memory.dmpFilesize
696KB
-
memory/360-272-0x000001ABF15D0000-0x000001ABF20BC000-memory.dmpFilesize
10.9MB
-
memory/360-270-0x000001ABF0B20000-0x000001ABF15CC000-memory.dmpFilesize
10.7MB
-
memory/360-230-0x000001ABB83B0000-0x000001ABB8426000-memory.dmpFilesize
472KB
-
memory/360-219-0x000001ABB7F60000-0x000001ABB7F9C000-memory.dmpFilesize
240KB
-
memory/360-192-0x000001ABB7DB0000-0x000001ABB7DD2000-memory.dmpFilesize
136KB
-
memory/360-275-0x00007FFF6B550000-0x00007FFF6B72B000-memory.dmpFilesize
1.9MB
-
memory/1332-92-0x0000025159260000-0x0000025159262000-memory.dmpFilesize
8KB
-
memory/1332-88-0x0000025159220000-0x0000025159222000-memory.dmpFilesize
8KB
-
memory/1332-94-0x0000025159280000-0x0000025159282000-memory.dmpFilesize
8KB
-
memory/1332-86-0x00000251590C0000-0x00000251590C2000-memory.dmpFilesize
8KB
-
memory/1332-90-0x0000025159240000-0x0000025159242000-memory.dmpFilesize
8KB
-
memory/1332-78-0x0000025158EB0000-0x0000025158EB2000-memory.dmpFilesize
8KB
-
memory/1332-76-0x0000025158E90000-0x0000025158E93000-memory.dmpFilesize
12KB
-
memory/1332-80-0x0000025158ED0000-0x0000025158ED2000-memory.dmpFilesize
8KB
-
memory/1332-58-0x0000025148510000-0x0000025148610000-memory.dmpFilesize
1024KB
-
memory/1332-82-0x0000025158EF0000-0x0000025158EF2000-memory.dmpFilesize
8KB
-
memory/1332-84-0x00000251590B0000-0x00000251590B2000-memory.dmpFilesize
8KB
-
memory/2004-44-0x0000021BFC000000-0x0000021BFC100000-memory.dmpFilesize
1024KB
-
memory/2168-144-0x000001C4C5D80000-0x000001C4C5D81000-memory.dmpFilesize
4KB
-
memory/2168-16-0x000001C4BF620000-0x000001C4BF630000-memory.dmpFilesize
64KB
-
memory/2168-143-0x000001C4C5D50000-0x000001C4C5D51000-memory.dmpFilesize
4KB
-
memory/2168-35-0x000001C4BCBF0000-0x000001C4BCBF2000-memory.dmpFilesize
8KB
-
memory/2168-0-0x000001C4BF520000-0x000001C4BF530000-memory.dmpFilesize
64KB
-
memory/2360-440-0x00007FFF69C40000-0x00007FFF69CEE000-memory.dmpFilesize
696KB
-
memory/2360-439-0x00007FFF6B550000-0x00007FFF6B72B000-memory.dmpFilesize
1.9MB
-
memory/2360-466-0x00007FF7F1AC0000-0x00007FF7F1B30000-memory.dmpFilesize
448KB
-
memory/4960-359-0x00007FFF69C40000-0x00007FFF69CEE000-memory.dmpFilesize
696KB
-
memory/4960-358-0x00007FFF6B550000-0x00007FFF6B72B000-memory.dmpFilesize
1.9MB
-
memory/4960-392-0x00007FF7F1AC0000-0x00007FF7F1B30000-memory.dmpFilesize
448KB