Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
157s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
15/05/2021, 19:40
Static task
static1
Behavioral task
behavioral1
Sample
3839C4E0DC64B64D407F864221198B50.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
3839C4E0DC64B64D407F864221198B50.exe
Resource
win10v20210408
General
-
Target
3839C4E0DC64B64D407F864221198B50.exe
-
Size
3.6MB
-
MD5
3839c4e0dc64b64d407f864221198b50
-
SHA1
4f2417a99b0ef785376d88c3745c88a5a28eb196
-
SHA256
541ebfa6dd694728edd3cf536a13c739179edadcd880e7c28e074b60da1bcac8
-
SHA512
536473d9884d6e29e46dff43c89c70afba1d265b7b80076e4a6a1cb2dd0cbc898c6b577cf01130bcf9bc15a494ccfed7199f1e87c24392579d2913347074ae79
Malware Config
Extracted
redline
source1
199.195.251.96:43073
Extracted
smokeloader
2020
http://khaleelahmed.com/upload/
http://twvickiassociation.com/upload/
http://www20833.com/upload/
http://cocinasintonterias.com/upload/
http://masaofukunaga.com/upload/
http://gnckids.com/upload/
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 3 IoCs
resource yara_rule behavioral2/memory/4624-162-0x0000000000400000-0x000000000041C000-memory.dmp family_redline behavioral2/memory/4624-163-0x00000000004163CE-mapping.dmp family_redline behavioral2/memory/4232-169-0x0000000000850000-0x00000000008FE000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE 10 IoCs
pid Process 3672 jg2_2qua.exe 2804 Files.exe 3852 File.exe 1384 KRSetp.exe 4104 wf-game.exe 4160 agdsk.exe 4204 pzyh.exe 4232 pub2.exe 5308 jfiag3g_gg.exe 6004 jfiag3g_gg.exe -
resource yara_rule behavioral2/files/0x000200000001ab6a-242.dat upx behavioral2/files/0x000200000001ab6a-243.dat upx behavioral2/files/0x000800000001ab7c-252.dat upx behavioral2/files/0x000800000001ab7c-253.dat upx -
resource yara_rule behavioral2/files/0x000300000001ab25-117.dat vmprotect behavioral2/files/0x000300000001ab25-118.dat vmprotect behavioral2/memory/3672-124-0x0000000000400000-0x000000000060A000-memory.dmp vmprotect -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation 3839C4E0DC64B64D407F864221198B50.exe Key value queried \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation wf-game.exe Key value queried \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation Files.exe -
Loads dropped DLL 2 IoCs
pid Process 4576 rUNdlL32.eXe 4232 pub2.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\haleng = "C:\\Users\\Admin\\AppData\\Local\\Temp\\haleng.e" pzyh.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA jg2_2qua.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 15 ip-api.com -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\Tasks\Firefox Default Browser Agent 1AC4F97EE7A83A4A svchost.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3852 set thread context of 4624 3852 File.exe 91 PID 380 set thread context of 4772 380 svchost.exe 93 -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI pub2.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI pub2.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI pub2.exe -
Kills process with taskkill 1 IoCs
pid Process 5272 taskkill.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdge.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\"" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\ACGPolicyState = "8" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PageSetup MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\IsSignedIn = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\AllComplete = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\DatastoreSchemaVersion = "8" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1" MicrosoftEdge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{62FM2EJ3-714D-A09D-WM25-6QFJ226I1FER} rUNdlL32.eXe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Toolbar\WebBrowser MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3 MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 98e16373d249d701 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IntelliForms MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming\ChangeUnitGenerationNeeded = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 01000000472e7b74efefd4e5e1062daed8ad64003ff5adc6136bf1c08c25f91e18a2db416f28f77774a14bb86f1289d2974fa37184af9f0e567e3f8b4625 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Zoom MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListInPrivateBrowsingAllowed = "1" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = f0760d79d249d701 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DontShowMeThisDialogAgain MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 21e10975d249d701 MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\MigrationTime = 1d24df8b702cd701 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main MicrosoftEdge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{45AC2TN3-666M-M32E-TO40-1MIP137D5TOZ} svchost.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration MicrosoftEdge.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4576 rUNdlL32.eXe 4576 rUNdlL32.eXe 4232 pub2.exe 4232 pub2.exe 380 svchost.exe 380 svchost.exe 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 4232 pub2.exe 4412 MicrosoftEdgeCP.exe 4412 MicrosoftEdgeCP.exe 4412 MicrosoftEdgeCP.exe 4412 MicrosoftEdgeCP.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4088 MicrosoftEdge.exe Token: SeDebugPrivilege 4088 MicrosoftEdge.exe Token: SeDebugPrivilege 4088 MicrosoftEdge.exe Token: SeDebugPrivilege 4088 MicrosoftEdge.exe Token: SeCreateTokenPrivilege 4160 agdsk.exe Token: SeAssignPrimaryTokenPrivilege 4160 agdsk.exe Token: SeLockMemoryPrivilege 4160 agdsk.exe Token: SeIncreaseQuotaPrivilege 4160 agdsk.exe Token: SeMachineAccountPrivilege 4160 agdsk.exe Token: SeTcbPrivilege 4160 agdsk.exe Token: SeSecurityPrivilege 4160 agdsk.exe Token: SeTakeOwnershipPrivilege 4160 agdsk.exe Token: SeLoadDriverPrivilege 4160 agdsk.exe Token: SeSystemProfilePrivilege 4160 agdsk.exe Token: SeSystemtimePrivilege 4160 agdsk.exe Token: SeProfSingleProcessPrivilege 4160 agdsk.exe Token: SeIncBasePriorityPrivilege 4160 agdsk.exe Token: SeCreatePagefilePrivilege 4160 agdsk.exe Token: SeCreatePermanentPrivilege 4160 agdsk.exe Token: SeBackupPrivilege 4160 agdsk.exe Token: SeRestorePrivilege 4160 agdsk.exe Token: SeShutdownPrivilege 4160 agdsk.exe Token: SeDebugPrivilege 4160 agdsk.exe Token: SeAuditPrivilege 4160 agdsk.exe Token: SeSystemEnvironmentPrivilege 4160 agdsk.exe Token: SeChangeNotifyPrivilege 4160 agdsk.exe Token: SeRemoteShutdownPrivilege 4160 agdsk.exe Token: SeUndockPrivilege 4160 agdsk.exe Token: SeSyncAgentPrivilege 4160 agdsk.exe Token: SeEnableDelegationPrivilege 4160 agdsk.exe Token: SeManageVolumePrivilege 4160 agdsk.exe Token: SeImpersonatePrivilege 4160 agdsk.exe Token: SeCreateGlobalPrivilege 4160 agdsk.exe Token: 31 4160 agdsk.exe Token: 32 4160 agdsk.exe Token: 33 4160 agdsk.exe Token: 34 4160 agdsk.exe Token: 35 4160 agdsk.exe Token: SeDebugPrivilege 1384 KRSetp.exe Token: SeDebugPrivilege 3852 File.exe Token: SeDebugPrivilege 4576 rUNdlL32.eXe Token: SeDebugPrivilege 4576 rUNdlL32.eXe Token: SeDebugPrivilege 380 svchost.exe Token: SeDebugPrivilege 4576 rUNdlL32.eXe Token: SeDebugPrivilege 4576 rUNdlL32.eXe Token: SeDebugPrivilege 4576 rUNdlL32.eXe Token: SeDebugPrivilege 4576 rUNdlL32.eXe Token: SeDebugPrivilege 4576 rUNdlL32.eXe Token: SeDebugPrivilege 4576 rUNdlL32.eXe Token: SeDebugPrivilege 4576 rUNdlL32.eXe Token: SeDebugPrivilege 4576 rUNdlL32.eXe Token: SeDebugPrivilege 4576 rUNdlL32.eXe Token: SeDebugPrivilege 4576 rUNdlL32.eXe Token: SeDebugPrivilege 4492 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4492 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4492 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4492 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4576 rUNdlL32.eXe Token: SeShutdownPrivilege 2568 Process not Found Token: SeCreatePagefilePrivilege 2568 Process not Found Token: SeShutdownPrivilege 2568 Process not Found Token: SeCreatePagefilePrivilege 2568 Process not Found Token: SeShutdownPrivilege 2568 Process not Found Token: SeCreatePagefilePrivilege 2568 Process not Found -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2568 Process not Found 2568 Process not Found -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 2568 Process not Found 2568 Process not Found -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4088 MicrosoftEdge.exe 4412 MicrosoftEdgeCP.exe 4412 MicrosoftEdgeCP.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 2568 Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3164 wrote to memory of 3672 3164 3839C4E0DC64B64D407F864221198B50.exe 75 PID 3164 wrote to memory of 3672 3164 3839C4E0DC64B64D407F864221198B50.exe 75 PID 3164 wrote to memory of 3672 3164 3839C4E0DC64B64D407F864221198B50.exe 75 PID 3164 wrote to memory of 2804 3164 3839C4E0DC64B64D407F864221198B50.exe 77 PID 3164 wrote to memory of 2804 3164 3839C4E0DC64B64D407F864221198B50.exe 77 PID 3164 wrote to memory of 2804 3164 3839C4E0DC64B64D407F864221198B50.exe 77 PID 2804 wrote to memory of 3852 2804 Files.exe 78 PID 2804 wrote to memory of 3852 2804 Files.exe 78 PID 2804 wrote to memory of 3852 2804 Files.exe 78 PID 3164 wrote to memory of 1384 3164 3839C4E0DC64B64D407F864221198B50.exe 82 PID 3164 wrote to memory of 1384 3164 3839C4E0DC64B64D407F864221198B50.exe 82 PID 3164 wrote to memory of 4104 3164 3839C4E0DC64B64D407F864221198B50.exe 83 PID 3164 wrote to memory of 4104 3164 3839C4E0DC64B64D407F864221198B50.exe 83 PID 3164 wrote to memory of 4104 3164 3839C4E0DC64B64D407F864221198B50.exe 83 PID 3164 wrote to memory of 4160 3164 3839C4E0DC64B64D407F864221198B50.exe 85 PID 3164 wrote to memory of 4160 3164 3839C4E0DC64B64D407F864221198B50.exe 85 PID 3164 wrote to memory of 4160 3164 3839C4E0DC64B64D407F864221198B50.exe 85 PID 3164 wrote to memory of 4204 3164 3839C4E0DC64B64D407F864221198B50.exe 86 PID 3164 wrote to memory of 4204 3164 3839C4E0DC64B64D407F864221198B50.exe 86 PID 3164 wrote to memory of 4204 3164 3839C4E0DC64B64D407F864221198B50.exe 86 PID 3164 wrote to memory of 4232 3164 3839C4E0DC64B64D407F864221198B50.exe 87 PID 3164 wrote to memory of 4232 3164 3839C4E0DC64B64D407F864221198B50.exe 87 PID 3164 wrote to memory of 4232 3164 3839C4E0DC64B64D407F864221198B50.exe 87 PID 4104 wrote to memory of 4576 4104 wf-game.exe 90 PID 4104 wrote to memory of 4576 4104 wf-game.exe 90 PID 4104 wrote to memory of 4576 4104 wf-game.exe 90 PID 3852 wrote to memory of 4624 3852 File.exe 91 PID 3852 wrote to memory of 4624 3852 File.exe 91 PID 3852 wrote to memory of 4624 3852 File.exe 91 PID 3852 wrote to memory of 4624 3852 File.exe 91 PID 3852 wrote to memory of 4624 3852 File.exe 91 PID 3852 wrote to memory of 4624 3852 File.exe 91 PID 3852 wrote to memory of 4624 3852 File.exe 91 PID 3852 wrote to memory of 4624 3852 File.exe 91 PID 4576 wrote to memory of 380 4576 rUNdlL32.eXe 69 PID 4576 wrote to memory of 2756 4576 rUNdlL32.eXe 57 PID 380 wrote to memory of 4772 380 svchost.exe 93 PID 380 wrote to memory of 4772 380 svchost.exe 93 PID 380 wrote to memory of 4772 380 svchost.exe 93 PID 4576 wrote to memory of 340 4576 rUNdlL32.eXe 44 PID 4576 wrote to memory of 2608 4576 rUNdlL32.eXe 51 PID 4576 wrote to memory of 2576 4576 rUNdlL32.eXe 47 PID 4576 wrote to memory of 1096 4576 rUNdlL32.eXe 12 PID 4576 wrote to memory of 68 4576 rUNdlL32.eXe 23 PID 4576 wrote to memory of 1428 4576 rUNdlL32.eXe 18 PID 4576 wrote to memory of 1908 4576 rUNdlL32.eXe 29 PID 4576 wrote to memory of 1180 4576 rUNdlL32.eXe 13 PID 4576 wrote to memory of 1376 4576 rUNdlL32.eXe 20 PID 4576 wrote to memory of 2852 4576 rUNdlL32.eXe 55 PID 4576 wrote to memory of 2836 4576 rUNdlL32.eXe 56 PID 4412 wrote to memory of 4292 4412 MicrosoftEdgeCP.exe 96 PID 4412 wrote to memory of 4292 4412 MicrosoftEdgeCP.exe 96 PID 4412 wrote to memory of 4292 4412 MicrosoftEdgeCP.exe 96 PID 4412 wrote to memory of 4696 4412 MicrosoftEdgeCP.exe 97 PID 4412 wrote to memory of 4696 4412 MicrosoftEdgeCP.exe 97 PID 4412 wrote to memory of 4696 4412 MicrosoftEdgeCP.exe 97 PID 4412 wrote to memory of 4696 4412 MicrosoftEdgeCP.exe 97 PID 4412 wrote to memory of 4696 4412 MicrosoftEdgeCP.exe 97 PID 4412 wrote to memory of 4696 4412 MicrosoftEdgeCP.exe 97 PID 4160 wrote to memory of 5220 4160 agdsk.exe 98 PID 4160 wrote to memory of 5220 4160 agdsk.exe 98 PID 4160 wrote to memory of 5220 4160 agdsk.exe 98 PID 4412 wrote to memory of 4292 4412 MicrosoftEdgeCP.exe 96 PID 4412 wrote to memory of 4292 4412 MicrosoftEdgeCP.exe 96
Processes
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ProfSvc1⤵PID:1096
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Themes1⤵PID:1180
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s SENS1⤵PID:1428
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s UserManager1⤵PID:1376
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Schedule1⤵
- Drops file in System32 directory
PID:68
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection1⤵PID:1908
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s gpsvc1⤵PID:340
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s LanmanServer1⤵PID:2576
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s IKEEXT1⤵PID:2608
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Winmgmt1⤵PID:2852
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s WpnService1⤵PID:2836
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Browser1⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\3839C4E0DC64B64D407F864221198B50.exe"C:\Users\Admin\AppData\Local\Temp\3839C4E0DC64B64D407F864221198B50.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\jg2_2qua.exe"C:\Users\Admin\AppData\Local\Temp\jg2_2qua.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
PID:3672
-
-
C:\Users\Admin\AppData\Local\Temp\Files.exe"C:\Users\Admin\AppData\Local\Temp\Files.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\File.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\File.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe4⤵PID:4624
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\KRSetp.exe"C:\Users\Admin\AppData\Local\Temp\KRSetp.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1384
-
-
C:\Users\Admin\AppData\Local\Temp\wf-game.exe"C:\Users\Admin\AppData\Local\Temp\wf-game.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Windows\SysWOW64\rUNdlL32.eXe"C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",install3⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4576
-
-
-
C:\Users\Admin\AppData\Local\Temp\agdsk.exe"C:\Users\Admin\AppData\Local\Temp\agdsk.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe3⤵PID:5220
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe4⤵
- Kills process with taskkill
PID:5272
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\pzyh.exe"C:\Users\Admin\AppData\Local\Temp\pzyh.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt3⤵
- Executes dropped EXE
PID:5308
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt3⤵
- Executes dropped EXE
PID:6004
-
-
-
C:\Users\Admin\AppData\Local\Temp\pub2.exe"C:\Users\Admin\AppData\Local\Temp\pub2.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4232
-
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s BITS1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:380 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService2⤵
- Modifies registry class
PID:4772
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4088
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
PID:2548
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4412
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4492
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:4648
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:5116
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:4292
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:4696