redline | 51dcab7d0fcc6a5205a003c0f8e4664fa6cfe3fc497e5baed8669c32b258b473

Analysis

max time kernel
156s
max time network
146s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
22-10-2022 18:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

51dcab7d0fcc6a5205a003c0f8e4664fa6cfe3fc497e5baed8669c32b258b473.exe
Size

225KB
MD5

7667e8967387863076e5e34bceceda12
SHA1

93f4d0c73fca84b2e13478ee009c9a6d70dba3ca
SHA256

51dcab7d0fcc6a5205a003c0f8e4664fa6cfe3fc497e5baed8669c32b258b473
SHA512

421a2a04ca706e55429bc08a7dbaeaf8c45923e1df3cfa35b68f2290cb0107b10c625275b3717618562d7028f50f3787a66d37ed20feb3dea5893a18d2bd9782
SSDEEP

3072:YXqAWLDqEuTUA5OcgcOXV3Db5xqHP/Z6Dkg5A7TMQggOHXlH3K2:s3WLRi+CidaHP/ZGkn/MQgD3n

Score

10^/10

redline smokeloader google2 nam7 newe slovarikinstalls backdoor discovery evasion infostealer spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

nam7

103.89.90.61:34589

Attributes

auth_value
533c8fbdab4382453812c73ea2cee5b8

Extracted

Family

redline

Botnet

Google2

167.235.71.14:20469

Attributes

auth_value
fb274d9691235ba015830da570a13578

Extracted

Family

redline

Botnet

slovarikinstalls

78.153.144.3:2510

Attributes

auth_value
5f80b2ec82e3bd02a08a3a55d3180551

Extracted

Family

redline

Botnet

Newe

89.208.106.66:4691

Attributes

auth_value
e7141b98243e53ec71dadf6344aff038

Signatures

Detects Smokeloader packer 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1764-142-0x00000000001E0000-0x00000000001E9000-memory.dmp	family_smokeloader

Modifies security service 2 TTPs 5 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

reg.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo	reg.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 13 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4784-180-0x0000000000A50000-0x0000000000AAC000-memory.dmp	family_redline
behavioral1/memory/4808-179-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline
behavioral1/memory/4224-191-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline
behavioral1/memory/4808-188-0x0000000000422136-mapping.dmp	family_redline
behavioral1/memory/4788-202-0x0000000000930000-0x000000000098C000-memory.dmp	family_redline
behavioral1/memory/4224-206-0x00000000004221AE-mapping.dmp	family_redline
behavioral1/memory/4784-214-0x0000000000A50000-0x0000000000AAC000-memory.dmp	family_redline
behavioral1/memory/4788-232-0x0000000000930000-0x000000000098C000-memory.dmp	family_redline
behavioral1/memory/4836-245-0x0000000000422146-mapping.dmp	family_redline
behavioral1/memory/4644-262-0x0000000000210000-0x000000000026C000-memory.dmp	family_redline
behavioral1/memory/4836-364-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline
behavioral1/memory/424-437-0x0000000004B60000-0x0000000004B9E000-memory.dmp	family_redline
behavioral1/memory/424-496-0x00000000076D0000-0x000000000770C000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Downloads MZ/PE file

Executes dropped EXE 9 IoCs

Processes:

7976.exe7CE2.exe81F3.exe8CF1.exeA2EB.exetmp60E0.tmpqeixhgsnha4b.exetmp60E1.tmpsxvmvtd207y.exesvcupdater.exeWinUpdate.exe

pid	process
4784	7976.exe
4788	7CE2.exe
4644	81F3.exe
424	8CF1.exe
3924	A2EB.exe
1280	tmp60E0.tmpqeixhgsnha4b.exe
2552	tmp60E1.tmpsxvmvtd207y.exe
2204	svcupdater.exe
4040	WinUpdate.exe

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489
Deletes itself 1 IoCs

Processes:

pid process

3020
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

49 ip-api.com

pid	process
3020

flow	ioc
49	ip-api.com

Suspicious use of SetThreadContext 4 IoCs

Processes:

7976.exe7CE2.exe81F3.exeA2EB.exe

description	pid	process	target process
PID 4784 set thread context of 4808	4784	7976.exe	RegSvcs.exe
PID 4788 set thread context of 4224	4788	7CE2.exe	RegSvcs.exe
PID 4644 set thread context of 4836	4644	81F3.exe	RegSvcs.exe
PID 3924 set thread context of 4684	3924	A2EB.exe	vbc.exe

Drops file in Program Files directory 1 IoCs

Processes:

tmp60E0.tmpqeixhgsnha4b.exe

description ioc process

File created C:\Program Files\WindowsUpdateService\WindowsUpdate\WinUpdate.exe tmp60E0.tmpqeixhgsnha4b.exe

description	ioc	process
File created	C:\Program Files\WindowsUpdateService\WindowsUpdate\WinUpdate.exe	tmp60E0.tmpqeixhgsnha4b.exe

Drops file in Windows directory 3 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exe

description	ioc	process
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe

Launches sc.exe 5 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exe

pid process

4736 sc.exe
3956 sc.exe
4972 sc.exe
2200 sc.exe
4364 sc.exe

pid	process
4736	sc.exe
3956	sc.exe
4972	sc.exe
2200	sc.exe
4364	sc.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

51dcab7d0fcc6a5205a003c0f8e4664fa6cfe3fc497e5baed8669c32b258b473.exe

description	ioc	process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	51dcab7d0fcc6a5205a003c0f8e4664fa6cfe3fc497e5baed8669c32b258b473.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	51dcab7d0fcc6a5205a003c0f8e4664fa6cfe3fc497e5baed8669c32b258b473.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	51dcab7d0fcc6a5205a003c0f8e4664fa6cfe3fc497e5baed8669c32b258b473.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

vbc.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	vbc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	vbc.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4948 schtasks.exe

pid	process
4948	schtasks.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

Processes:

browser_broker.exeMicrosoftEdgeCP.exeMicrosoftEdge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe

Modifies data under HKEY_USERS 42 IoCs

Processes:

powershell.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\DetectPhoneNumberComplete = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PageSetup	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url4 = "https://login.live.com/"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\ManagerHistoryComplete = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\IsSignedIn = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B7216 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListInPrivateBrowsingAllowed = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\AllComplete = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\FirstRecoveryTime = 51e0d6d06eaed801	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\EnableNegotiate = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Toolbar\WebBrowser	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 0100000063e5062f9b3a29f8cdd609bbe42d01f113a5ff067fcb46c248b4d9e9ece557330a8de870a0e3041ac5fb74a94d5f270a5031576c72c7ab64c2e114e0d1fd7bc0c7657b60a8f9d0d6cbd902eb300233e31e44c7adfb54b2e42afc	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 67244e0152e6d801	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\MigrationTime = 51e0d6d06eaed801	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGLockdown	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGLockdown	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\AllComplete = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\OneTimeCleanup = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IntelliForms	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{A8A88C49-5EB2-4990-A1A2-08760 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = ea198ffb51e6d801	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\FlipAheadCompletedVersion = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\ImageStoreRandomFolder = "6d7bntr"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\Extension = "{32E07910-15FC-49C9-860A-EBD3B8B17F39}"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

51dcab7d0fcc6a5205a003c0f8e4664fa6cfe3fc497e5baed8669c32b258b473.exe

pid	process
1764	51dcab7d0fcc6a5205a003c0f8e4664fa6cfe3fc497e5baed8669c32b258b473.exe
1764	51dcab7d0fcc6a5205a003c0f8e4664fa6cfe3fc497e5baed8669c32b258b473.exe
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

3020

pid	process
3020

Suspicious behavior: MapViewOfSection 41 IoCs

Processes:

51dcab7d0fcc6a5205a003c0f8e4664fa6cfe3fc497e5baed8669c32b258b473.exeexplorer.exeexplorer.exeMicrosoftEdgeCP.exe

pid	process
1764	51dcab7d0fcc6a5205a003c0f8e4664fa6cfe3fc497e5baed8669c32b258b473.exe
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
2020	explorer.exe
2020	explorer.exe
496	explorer.exe
496	explorer.exe
496	explorer.exe
496	explorer.exe
2020	explorer.exe
2020	explorer.exe
496	explorer.exe
496	explorer.exe
2020	explorer.exe
2020	explorer.exe
496	explorer.exe
496	explorer.exe
2020	explorer.exe
2020	explorer.exe
496	explorer.exe
496	explorer.exe
2020	explorer.exe
2020	explorer.exe
1176	MicrosoftEdgeCP.exe
1176	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

8CF1.exevbc.exeRegSvcs.exeRegSvcs.exeRegSvcs.exeMicrosoftEdge.exetmp60E1.tmpsxvmvtd207y.exeMicrosoftEdgeCP.exesvcupdater.exepowershell.exeMicrosoftEdgeCP.exe

description	pid	process
Token: SeDebugPrivilege	424	8CF1.exe
Token: SeDebugPrivilege	4684	vbc.exe
Token: SeShutdownPrivilege	3020
Token: SeCreatePagefilePrivilege	3020
Token: SeShutdownPrivilege	3020
Token: SeCreatePagefilePrivilege	3020
Token: SeShutdownPrivilege	3020
Token: SeCreatePagefilePrivilege	3020
Token: SeShutdownPrivilege	3020
Token: SeCreatePagefilePrivilege	3020
Token: SeShutdownPrivilege	3020
Token: SeCreatePagefilePrivilege	3020
Token: SeShutdownPrivilege	3020
Token: SeCreatePagefilePrivilege	3020
Token: SeShutdownPrivilege	3020
Token: SeCreatePagefilePrivilege	3020
Token: SeShutdownPrivilege	3020
Token: SeCreatePagefilePrivilege	3020
Token: SeShutdownPrivilege	3020
Token: SeCreatePagefilePrivilege	3020
Token: SeDebugPrivilege	4836	RegSvcs.exe
Token: SeDebugPrivilege	4224	RegSvcs.exe
Token: SeShutdownPrivilege	3020
Token: SeCreatePagefilePrivilege	3020
Token: SeDebugPrivilege	4808	RegSvcs.exe
Token: SeShutdownPrivilege	3020
Token: SeCreatePagefilePrivilege	3020
Token: SeShutdownPrivilege	3020
Token: SeCreatePagefilePrivilege	3020
Token: SeTakeOwnershipPrivilege	3020
Token: SeRestorePrivilege	3020
Token: SeShutdownPrivilege	3020
Token: SeCreatePagefilePrivilege	3020
Token: SeDebugPrivilege	5100	MicrosoftEdge.exe
Token: SeDebugPrivilege	5100	MicrosoftEdge.exe
Token: SeDebugPrivilege	5100	MicrosoftEdge.exe
Token: SeDebugPrivilege	5100	MicrosoftEdge.exe
Token: SeShutdownPrivilege	3020
Token: SeCreatePagefilePrivilege	3020
Token: SeShutdownPrivilege	3020
Token: SeCreatePagefilePrivilege	3020
Token: SeShutdownPrivilege	3020
Token: SeCreatePagefilePrivilege	3020
Token: SeDebugPrivilege	2552	tmp60E1.tmpsxvmvtd207y.exe
Token: SeDebugPrivilege	4556	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4556	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2204	svcupdater.exe
Token: SeShutdownPrivilege	3020
Token: SeCreatePagefilePrivilege	3020
Token: SeShutdownPrivilege	3020
Token: SeCreatePagefilePrivilege	3020
Token: SeDebugPrivilege	3844	powershell.exe
Token: SeDebugPrivilege	3540	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3540	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3540	MicrosoftEdgeCP.exe
Token: SeShutdownPrivilege	3020
Token: SeCreatePagefilePrivilege	3020
Token: SeIncreaseQuotaPrivilege	3844	powershell.exe
Token: SeSecurityPrivilege	3844	powershell.exe
Token: SeTakeOwnershipPrivilege	3844	powershell.exe
Token: SeLoadDriverPrivilege	3844	powershell.exe
Token: SeSystemProfilePrivilege	3844	powershell.exe
Token: SeSystemtimePrivilege	3844	powershell.exe
Token: SeProfSingleProcessPrivilege	3844	powershell.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exe

pid process

3020
5100 MicrosoftEdge.exe
1176 MicrosoftEdgeCP.exe
1176 MicrosoftEdgeCP.exe

pid	process
3020
5100	MicrosoftEdge.exe
1176	MicrosoftEdgeCP.exe
1176	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

7976.exe7CE2.exe81F3.exeA2EB.exe

description	pid	process	target process
PID 3020 wrote to memory of 4784	3020		7976.exe
PID 3020 wrote to memory of 4784	3020		7976.exe
PID 3020 wrote to memory of 4784	3020		7976.exe
PID 3020 wrote to memory of 4788	3020		7CE2.exe
PID 3020 wrote to memory of 4788	3020		7CE2.exe
PID 3020 wrote to memory of 4788	3020		7CE2.exe
PID 3020 wrote to memory of 4644	3020		81F3.exe
PID 3020 wrote to memory of 4644	3020		81F3.exe
PID 3020 wrote to memory of 4644	3020		81F3.exe
PID 4784 wrote to memory of 4808	4784	7976.exe	RegSvcs.exe
PID 4784 wrote to memory of 4808	4784	7976.exe	RegSvcs.exe
PID 4784 wrote to memory of 4808	4784	7976.exe	RegSvcs.exe
PID 4784 wrote to memory of 4808	4784	7976.exe	RegSvcs.exe
PID 4784 wrote to memory of 4808	4784	7976.exe	RegSvcs.exe
PID 4788 wrote to memory of 4224	4788	7CE2.exe	RegSvcs.exe
PID 4788 wrote to memory of 4224	4788	7CE2.exe	RegSvcs.exe
PID 4788 wrote to memory of 4224	4788	7CE2.exe	RegSvcs.exe
PID 4788 wrote to memory of 4224	4788	7CE2.exe	RegSvcs.exe
PID 4788 wrote to memory of 4224	4788	7CE2.exe	RegSvcs.exe
PID 4644 wrote to memory of 4836	4644	81F3.exe	RegSvcs.exe
PID 4644 wrote to memory of 4836	4644	81F3.exe	RegSvcs.exe
PID 4644 wrote to memory of 4836	4644	81F3.exe	RegSvcs.exe
PID 4644 wrote to memory of 4836	4644	81F3.exe	RegSvcs.exe
PID 4644 wrote to memory of 4836	4644	81F3.exe	RegSvcs.exe
PID 3020 wrote to memory of 424	3020		8CF1.exe
PID 3020 wrote to memory of 424	3020		8CF1.exe
PID 3020 wrote to memory of 424	3020		8CF1.exe
PID 3020 wrote to memory of 3924	3020		A2EB.exe
PID 3020 wrote to memory of 3924	3020		A2EB.exe
PID 3020 wrote to memory of 3924	3020		A2EB.exe
PID 3020 wrote to memory of 4660	3020		explorer.exe
PID 3020 wrote to memory of 4660	3020		explorer.exe
PID 3020 wrote to memory of 4660	3020		explorer.exe
PID 3020 wrote to memory of 4660	3020		explorer.exe
PID 3924 wrote to memory of 4684	3924	A2EB.exe	vbc.exe
PID 3924 wrote to memory of 4684	3924	A2EB.exe	vbc.exe
PID 3924 wrote to memory of 4684	3924	A2EB.exe	vbc.exe
PID 3924 wrote to memory of 4684	3924	A2EB.exe	vbc.exe
PID 3924 wrote to memory of 4684	3924	A2EB.exe	vbc.exe
PID 3020 wrote to memory of 2020	3020		explorer.exe
PID 3020 wrote to memory of 2020	3020		explorer.exe
PID 3020 wrote to memory of 2020	3020		explorer.exe
PID 3020 wrote to memory of 816	3020		explorer.exe
PID 3020 wrote to memory of 816	3020		explorer.exe
PID 3020 wrote to memory of 816	3020		explorer.exe
PID 3020 wrote to memory of 816	3020		explorer.exe
PID 3020 wrote to memory of 496	3020		explorer.exe
PID 3020 wrote to memory of 496	3020		explorer.exe
PID 3020 wrote to memory of 496	3020		explorer.exe
PID 3020 wrote to memory of 1292	3020		explorer.exe
PID 3020 wrote to memory of 1292	3020		explorer.exe
PID 3020 wrote to memory of 1292	3020		explorer.exe
PID 3020 wrote to memory of 1292	3020		explorer.exe
PID 3020 wrote to memory of 2676	3020		explorer.exe
PID 3020 wrote to memory of 2676	3020		explorer.exe
PID 3020 wrote to memory of 2676	3020		explorer.exe
PID 3020 wrote to memory of 2676	3020		explorer.exe
PID 3020 wrote to memory of 4072	3020		explorer.exe
PID 3020 wrote to memory of 4072	3020		explorer.exe
PID 3020 wrote to memory of 4072	3020		explorer.exe
PID 3020 wrote to memory of 4072	3020		explorer.exe
PID 3020 wrote to memory of 3480	3020		explorer.exe
PID 3020 wrote to memory of 3480	3020		explorer.exe
PID 3020 wrote to memory of 3480	3020		explorer.exe

C:\Users\Admin\AppData\Local\Temp\51dcab7d0fcc6a5205a003c0f8e4664fa6cfe3fc497e5baed8669c32b258b473.exe
"C:\Users\Admin\AppData\Local\Temp\51dcab7d0fcc6a5205a003c0f8e4664fa6cfe3fc497e5baed8669c32b258b473.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1764

C:\Users\Admin\AppData\Local\Temp\7976.exe
C:\Users\Admin\AppData\Local\Temp\7976.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4784

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4808

C:\Users\Admin\AppData\Local\Temp\7CE2.exe
C:\Users\Admin\AppData\Local\Temp\7CE2.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4788

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4224

C:\Users\Admin\AppData\Local\Temp\81F3.exe
C:\Users\Admin\AppData\Local\Temp\81F3.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4644

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4836

C:\Users\Admin\AppData\Local\Temp\8CF1.exe
C:\Users\Admin\AppData\Local\Temp\8CF1.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:424

C:\Users\Admin\AppData\Local\Temp\A2EB.exe
C:\Users\Admin\AppData\Local\Temp\A2EB.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3924

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
2⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4684

C:\Users\Admin\AppData\Local\Temp\tmp60E0.tmpqeixhgsnha4b.exe
"C:\Users\Admin\AppData\Local\Temp\tmp60E0.tmpqeixhgsnha4b.exe"
3⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1280

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3844

C:\Windows\SYSTEM32\cmd.exe
cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
4⤵
PID:4244

C:\Windows\system32\sc.exe
sc stop UsoSvc
5⤵
- Launches sc.exe
PID:4972

C:\Windows\system32\sc.exe
sc stop WaaSMedicSvc
5⤵
- Launches sc.exe
PID:2200

C:\Windows\system32\sc.exe
sc stop wuauserv
5⤵
- Launches sc.exe
PID:4364

C:\Windows\system32\sc.exe
sc stop bits
5⤵
- Launches sc.exe
PID:4736

C:\Windows\system32\sc.exe
sc stop dosvc
5⤵
- Launches sc.exe
PID:3956

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
5⤵
PID:4948

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
5⤵
PID:828

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
5⤵
- Modifies security service
PID:776

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
5⤵
PID:2340

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
5⤵
PID:3416

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell <#pdhkkybc#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'WinUpdate' /tr '''C:\Program Files\WindowsUpdateService\WindowsUpdate\WinUpdate.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\WindowsUpdateService\WindowsUpdate\WinUpdate.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'WinUpdate' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "WinUpdate" /t REG_SZ /f /d 'C:\Program Files\WindowsUpdateService\WindowsUpdate\WinUpdate.exe' }
4⤵
PID:2324

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell <#ycbgwj#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "WinUpdate" } Else { "C:\Program Files\WindowsUpdateService\WindowsUpdate\WinUpdate.exe" }
4⤵
PID:4972

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /run /tn WinUpdate
5⤵
PID:3848

C:\Users\Admin\AppData\Local\Temp\tmp60E1.tmpsxvmvtd207y.exe
"C:\Users\Admin\AppData\Local\Temp\tmp60E1.tmpsxvmvtd207y.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2552

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" /C schtasks /create /tn \6aqmucowl1 /tr "C:\Users\Admin\AppData\Roaming\6aqmucowl1\svcupdater.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f
4⤵
PID:2500

C:\Windows\system32\schtasks.exe
schtasks /create /tn \6aqmucowl1 /tr "C:\Users\Admin\AppData\Roaming\6aqmucowl1\svcupdater.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f
5⤵
- Creates scheduled task(s)
PID:4948

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4660

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
- Suspicious behavior: MapViewOfSection
PID:2020

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:816

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
- Suspicious behavior: MapViewOfSection
PID:496

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1292

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2676

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4072

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:3480

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4248

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5100

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:4240

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:1176

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:5072

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4556

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:160

C:\Users\Admin\AppData\Roaming\6aqmucowl1\svcupdater.exe
C:\Users\Admin\AppData\Roaming\6aqmucowl1\svcupdater.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2204

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\d9d672cf690641f9ae5f2781c9cc50dd /t 4272 /p 5072
1⤵
PID:3952

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3540

C:\Program Files\WindowsUpdateService\WindowsUpdate\WinUpdate.exe
"C:\Program Files\WindowsUpdateService\WindowsUpdate\WinUpdate.exe"
1⤵
- Executes dropped EXE
PID:4040

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
2⤵
- Modifies data under HKEY_USERS
PID:316

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

T1064

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Impair Defenses

T1562

Scripting

T1064

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\WindowsUpdateService\WindowsUpdate\WinUpdate.exe
Filesize
8.5MB

MD5
a8cb08bfc1808532130fd2e5a7c4076b

SHA1
f1e4e14155225bc8dbc8503cd9a3a729a41fa9a3

SHA256
d4c6e9e50c1f1c4e0cf4371fbdd7bf4568f2388bfb37d6fcc058892782d293da

SHA512
59529c05dd8875c6e5f3686217414962390de6c0ea1fc9e2866b0a43c5c9138f7d552114374b87e3f43e1f4d314cc5a0a383fe39c1cfd680ad950cf126c97ec3

Download Submit
C:\Program Files\WindowsUpdateService\WindowsUpdate\WinUpdate.exe
Filesize
8.5MB

MD5
a8cb08bfc1808532130fd2e5a7c4076b

SHA1
f1e4e14155225bc8dbc8503cd9a3a729a41fa9a3

SHA256
d4c6e9e50c1f1c4e0cf4371fbdd7bf4568f2388bfb37d6fcc058892782d293da

SHA512
59529c05dd8875c6e5f3686217414962390de6c0ea1fc9e2866b0a43c5c9138f7d552114374b87e3f43e1f4d314cc5a0a383fe39c1cfd680ad950cf126c97ec3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
3KB

MD5
8592ba100a78835a6b94d5949e13dfc1

SHA1
63e901200ab9a57c7dd4c078d7f75dcd3b357020

SHA256
fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c

SHA512
87f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegSvcs.exe.log
Filesize
2KB

MD5
af9f1d78e75c81f74a552cca7cde5b94

SHA1
dab1097e77c27ba68ea304c21aea5db627d9a091

SHA256
a8e388a4a5160d4eaeca3a677fb84fb99c99c37363b0c6f4692ac20fe3af4c8e

SHA512
20ce7d249b86c12288dd814772f5edd649cf1cffe57e41e1bbf2cb4ad5d30abd3918448e556faa5dcd3c2dfac4565416f463499e5e840d52ae75f38b1e540aaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
e551db210fceab205836d8dd70619099

SHA1
b55d29cf1eb678f1662ad6497e02fcb9c68130f7

SHA256
efa03969a748cdf9e75e56b77779dc7a3e5205f1225b410e7228bd4296ada38b

SHA512
ec71ed766dc5d3b9ec157839bcf667141e901fb9dadc93eeec8166062021742da3ec15edb72359456c7fa460412dbf7edb5e1472b8fc753dc5d5ae4acb047882

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
b4a90fa69e6b3857a4626be8ef6b3e1d

SHA1
84f182a263ad730645cf95fa0f585d0cf5136f47

SHA256
722ddcfbc18ed21b6a2b7174b25731d054f2aec5430e6c4428feed9dec637ade

SHA512
d49c9abe1aee2b4b78d0c79784ce12673c00ee87b6397ebb666dd9db2fb9e769db6653f84b85d85511de432f98274da019b518056b9162656b00e1482d8ac440

Download Submit
C:\Users\Admin\AppData\Local\Temp\7976.exe
Filesize
355KB

MD5
de9cc8f0aca4cbab79ae9ed574ad9d79

SHA1
a1f8f805a2fcb1253fd006ac5710ef7cd77fbb8a

SHA256
c64cb4f10302ee642e3f4448366075af371219e7ca9743e97d6574ab222ff294

SHA512
6b913c8dc69790775daa47d08d54d17747c2fc76ff96ea61065dc7bea11960556cefed8ff366e9867db5c0633661665ed6eb099b48117018662aa1b03164f118

Download Submit
C:\Users\Admin\AppData\Local\Temp\7976.exe
Filesize
355KB

MD5
de9cc8f0aca4cbab79ae9ed574ad9d79

SHA1
a1f8f805a2fcb1253fd006ac5710ef7cd77fbb8a

SHA256
c64cb4f10302ee642e3f4448366075af371219e7ca9743e97d6574ab222ff294

SHA512
6b913c8dc69790775daa47d08d54d17747c2fc76ff96ea61065dc7bea11960556cefed8ff366e9867db5c0633661665ed6eb099b48117018662aa1b03164f118

Download Submit
C:\Users\Admin\AppData\Local\Temp\7CE2.exe
Filesize
355KB

MD5
7a25eee3fa668991ae69109ec2869215

SHA1
a88f1dc1487fad8e6a962b4d627d48aef427fd74

SHA256
a79e4053a5374ee515e6a83c1d43f1bd87829a24170ef343791a2d246fbe067c

SHA512
4780d946cb52d7f248321baab266a3101ab472a04d21055e9075a48864a80e24bde250508dfdf4b08daaee748dcab784aa307e0c24f4bd5cd8c1f546ac3bab5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7CE2.exe
Filesize
355KB

MD5
7a25eee3fa668991ae69109ec2869215

SHA1
a88f1dc1487fad8e6a962b4d627d48aef427fd74

SHA256
a79e4053a5374ee515e6a83c1d43f1bd87829a24170ef343791a2d246fbe067c

SHA512
4780d946cb52d7f248321baab266a3101ab472a04d21055e9075a48864a80e24bde250508dfdf4b08daaee748dcab784aa307e0c24f4bd5cd8c1f546ac3bab5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\81F3.exe
Filesize
355KB

MD5
7a300f675d38cc88faf96932a58048ee

SHA1
6331bc68fa7d08fde37d186ea5010368f4460462

SHA256
84ce0cd38735c91e76d0533db9b1ce4990a0e8f418e8a51018c1d5bda93948f0

SHA512
26fff6de8b38c5ef8d9a4c206af4d4752a2899204f74ff9d65e1bf6f607017acc83a475b7667d16a19b440541450482be3d50b8bd845889d35e799deb4a83d1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\81F3.exe
Filesize
355KB

MD5
7a300f675d38cc88faf96932a58048ee

SHA1
6331bc68fa7d08fde37d186ea5010368f4460462

SHA256
84ce0cd38735c91e76d0533db9b1ce4990a0e8f418e8a51018c1d5bda93948f0

SHA512
26fff6de8b38c5ef8d9a4c206af4d4752a2899204f74ff9d65e1bf6f607017acc83a475b7667d16a19b440541450482be3d50b8bd845889d35e799deb4a83d1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\8CF1.exe
Filesize
334KB

MD5
5ed2072ac4ef7e846934e83aa000517f

SHA1
ce849563eca61cb24853e5a70c4249667d07beb6

SHA256
96477c056dcbc3e63b38d34e7ffd6ffb6ba6ca769e4adf3d3db9d0bfd2913d77

SHA512
6150d1e7ce71804873022d5987b3173c6e53ab2c30dad763f8f5c5609db9578b3378cac32383323b03d18050a88a7ec97affbcaed0b3abbb5983fd0b9e06f27f

Download Submit
C:\Users\Admin\AppData\Local\Temp\8CF1.exe
Filesize
334KB

MD5
5ed2072ac4ef7e846934e83aa000517f

SHA1
ce849563eca61cb24853e5a70c4249667d07beb6

SHA256
96477c056dcbc3e63b38d34e7ffd6ffb6ba6ca769e4adf3d3db9d0bfd2913d77

SHA512
6150d1e7ce71804873022d5987b3173c6e53ab2c30dad763f8f5c5609db9578b3378cac32383323b03d18050a88a7ec97affbcaed0b3abbb5983fd0b9e06f27f

Download Submit
C:\Users\Admin\AppData\Local\Temp\A2EB.exe
Filesize
3.6MB

MD5
d2c9d7a9031f37f53dc751a5ab55faca

SHA1
81a9fc92bb5d525c20b3c22490154934f895af5e

SHA256
63111c4dc154915dc37a32820a08062fd1832d745e2f18df96ad55e1151d672d

SHA512
f0455d21904d408b0c69757fc1f8d960f89364755dcecc6c70db8cbe8856b5ab13a3d2bfbbb856e81699a73f6c2d397e9833c75cedb82a6729d0167141476aef

Download Submit
C:\Users\Admin\AppData\Local\Temp\A2EB.exe
Filesize
3.6MB

MD5
d2c9d7a9031f37f53dc751a5ab55faca

SHA1
81a9fc92bb5d525c20b3c22490154934f895af5e

SHA256
63111c4dc154915dc37a32820a08062fd1832d745e2f18df96ad55e1151d672d

SHA512
f0455d21904d408b0c69757fc1f8d960f89364755dcecc6c70db8cbe8856b5ab13a3d2bfbbb856e81699a73f6c2d397e9833c75cedb82a6729d0167141476aef

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp60E0.tmpqeixhgsnha4b.exe
Filesize
8.5MB

MD5
4b04fb35f2c4d70b84a004b0ff58a3f0

SHA1
5f78511de8b867931dfc4c35e131f7084d34324d

SHA256
9ae886b50fe3d445258bf1edeef0d7fbbd79e28df5831044e6f81769c353ca77

SHA512
142a9ae7733d541298c50224d408900f3175488eddae94e197431cf51436208c3f3898fee545d608acd9bc4056e2677b45e44d483685c4f4756e8dbf234c8848

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp60E0.tmpqeixhgsnha4b.exe
Filesize
8.5MB

MD5
4b04fb35f2c4d70b84a004b0ff58a3f0

SHA1
5f78511de8b867931dfc4c35e131f7084d34324d

SHA256
9ae886b50fe3d445258bf1edeef0d7fbbd79e28df5831044e6f81769c353ca77

SHA512
142a9ae7733d541298c50224d408900f3175488eddae94e197431cf51436208c3f3898fee545d608acd9bc4056e2677b45e44d483685c4f4756e8dbf234c8848

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp60E1.tmpsxvmvtd207y.exe
Filesize
15KB

MD5
350e3de1f003f18ecf81bbae7c9282f2

SHA1
1adbe7642794c39811c5a8b2035e5c71f478016d

SHA256
5fd05b12ea39141d570a44d142e5853db3a9c5981dcb7b24f3550a425b079616

SHA512
1f588b33557fc3d9fd413d344baf62917f1f11c647b38befa4d4ce3ba16db33e1bb8bb9570b3bb842f2f1c615dfacb4c6bc0c47c97f1b326a501236b62c01fac

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp60E1.tmpsxvmvtd207y.exe
Filesize
15KB

MD5
350e3de1f003f18ecf81bbae7c9282f2

SHA1
1adbe7642794c39811c5a8b2035e5c71f478016d

SHA256
5fd05b12ea39141d570a44d142e5853db3a9c5981dcb7b24f3550a425b079616

SHA512
1f588b33557fc3d9fd413d344baf62917f1f11c647b38befa4d4ce3ba16db33e1bb8bb9570b3bb842f2f1c615dfacb4c6bc0c47c97f1b326a501236b62c01fac

Download Submit
C:\Users\Admin\AppData\Roaming\6aqmucowl1\svcupdater.exe
Filesize
15KB

MD5
350e3de1f003f18ecf81bbae7c9282f2

SHA1
1adbe7642794c39811c5a8b2035e5c71f478016d

SHA256
5fd05b12ea39141d570a44d142e5853db3a9c5981dcb7b24f3550a425b079616

SHA512
1f588b33557fc3d9fd413d344baf62917f1f11c647b38befa4d4ce3ba16db33e1bb8bb9570b3bb842f2f1c615dfacb4c6bc0c47c97f1b326a501236b62c01fac

Download Submit
C:\Users\Admin\AppData\Roaming\6aqmucowl1\svcupdater.exe
Filesize
15KB

MD5
350e3de1f003f18ecf81bbae7c9282f2

SHA1
1adbe7642794c39811c5a8b2035e5c71f478016d

SHA256
5fd05b12ea39141d570a44d142e5853db3a9c5981dcb7b24f3550a425b079616

SHA512
1f588b33557fc3d9fd413d344baf62917f1f11c647b38befa4d4ce3ba16db33e1bb8bb9570b3bb842f2f1c615dfacb4c6bc0c47c97f1b326a501236b62c01fac

Download Submit
memory/316-1567-0x0000000000000000-mapping.dmp

Download
memory/424-889-0x0000000002C50000-0x0000000002CFE000-memory.dmp

Filesize
696KB

Download
memory/424-381-0x0000000002C50000-0x0000000002CFE000-memory.dmp

Filesize
696KB

Download
memory/424-987-0x0000000008B80000-0x0000000008BD0000-memory.dmp

Filesize
320KB

Download
memory/424-496-0x00000000076D0000-0x000000000770C000-memory.dmp

Filesize
240KB

Download
memory/424-986-0x00000000088D0000-0x0000000008946000-memory.dmp

Filesize
472KB

Download
memory/424-268-0x0000000000000000-mapping.dmp

Download
memory/424-989-0x0000000008E30000-0x0000000008FF2000-memory.dmp

Filesize
1.8MB

Download
memory/424-477-0x0000000007190000-0x000000000768E000-memory.dmp

Filesize
5.0MB

Download
memory/424-509-0x0000000007710000-0x00000000077A2000-memory.dmp

Filesize
584KB

Download
memory/424-427-0x0000000000400000-0x0000000002C42000-memory.dmp

Filesize
40.3MB

Download
memory/424-990-0x0000000009000000-0x000000000952C000-memory.dmp

Filesize
5.2MB

Download
memory/424-391-0x0000000002FA0000-0x0000000002FDE000-memory.dmp

Filesize
248KB

Download
memory/424-437-0x0000000004B60000-0x0000000004B9E000-memory.dmp

Filesize
248KB

Download
memory/496-951-0x0000000000D50000-0x0000000000D56000-memory.dmp

Filesize
24KB

Download
memory/496-512-0x0000000000D50000-0x0000000000D56000-memory.dmp

Filesize
24KB

Download
memory/496-517-0x0000000000D40000-0x0000000000D4C000-memory.dmp

Filesize
48KB

Download
memory/496-483-0x0000000000000000-mapping.dmp

Download
memory/776-1526-0x0000000000000000-mapping.dmp

Download
memory/816-444-0x0000000000000000-mapping.dmp

Download
memory/816-801-0x00000000006B0000-0x00000000006B5000-memory.dmp

Filesize
20KB

Download
memory/816-853-0x00000000006A0000-0x00000000006A9000-memory.dmp

Filesize
36KB

Download
memory/828-1523-0x0000000000000000-mapping.dmp

Download
memory/1176-1413-0x000002062B7D0000-0x000002062B7DF000-memory.dmp

Filesize
60KB

Download
memory/1176-1414-0x000002062BB70000-0x000002062BB7C000-memory.dmp

Filesize
48KB

Download
memory/1280-1431-0x0000000000000000-mapping.dmp

Download
memory/1280-1443-0x00007FF7E7FD0000-0x00007FF7E885B000-memory.dmp

Filesize
8.5MB

Download
memory/1292-516-0x0000000000000000-mapping.dmp

Download
memory/1292-893-0x00000000001A0000-0x00000000001C2000-memory.dmp

Filesize
136KB

Download
memory/1292-934-0x0000000000170000-0x0000000000197000-memory.dmp

Filesize
156KB

Download
memory/1292-1005-0x00000000001A0000-0x00000000001C2000-memory.dmp

Filesize
136KB

Download
memory/1764-137-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1764-151-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1764-143-0x0000000000400000-0x0000000002C26000-memory.dmp

Filesize
40.1MB

Download
memory/1764-142-0x00000000001E0000-0x00000000001E9000-memory.dmp

Filesize
36KB

Download
memory/1764-145-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1764-141-0x0000000002DC1000-0x0000000002DD7000-memory.dmp

Filesize
88KB

Download
memory/1764-146-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1764-147-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1764-140-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1764-148-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1764-139-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1764-138-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1764-154-0x0000000000400000-0x0000000002C26000-memory.dmp

Filesize
40.1MB

Download
memory/1764-136-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1764-135-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1764-134-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1764-149-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1764-150-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1764-133-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1764-144-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1764-152-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1764-117-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1764-132-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1764-131-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1764-130-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1764-129-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1764-128-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1764-127-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1764-126-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1764-125-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1764-124-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1764-123-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1764-122-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1764-153-0x0000000002DC1000-0x0000000002DD7000-memory.dmp

Filesize
88KB

Download
memory/1764-121-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1764-120-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1764-119-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1764-118-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/2020-408-0x0000000000000000-mapping.dmp

Download
memory/2020-932-0x0000000000E00000-0x0000000000E09000-memory.dmp

Filesize
36KB

Download
memory/2020-434-0x0000000000BF0000-0x0000000000BFF000-memory.dmp

Filesize
60KB

Download
memory/2020-474-0x0000000000E00000-0x0000000000E09000-memory.dmp

Filesize
36KB

Download
memory/2200-1509-0x0000000000000000-mapping.dmp

Download
memory/2324-1501-0x0000000000000000-mapping.dmp

Download
memory/2340-1527-0x0000000000000000-mapping.dmp

Download
memory/2500-1446-0x0000000000000000-mapping.dmp

Download
memory/2552-1441-0x00000000005F0000-0x00000000005FA000-memory.dmp

Filesize
40KB

Download
memory/2552-1438-0x0000000000000000-mapping.dmp

Download
memory/2676-938-0x00000000031E0000-0x00000000031E5000-memory.dmp

Filesize
20KB

Download
memory/2676-1011-0x00000000031E0000-0x00000000031E5000-memory.dmp

Filesize
20KB

Download
memory/2676-942-0x00000000031D0000-0x00000000031D9000-memory.dmp

Filesize
36KB

Download
memory/2676-553-0x0000000000000000-mapping.dmp

Download
memory/3416-1528-0x0000000000000000-mapping.dmp

Download
memory/3480-687-0x0000000000A40000-0x0000000000A47000-memory.dmp

Filesize
28KB

Download
memory/3480-633-0x0000000000000000-mapping.dmp

Download
memory/3480-988-0x0000000000A40000-0x0000000000A47000-memory.dmp

Filesize
28KB

Download
memory/3480-695-0x0000000000A30000-0x0000000000A3D000-memory.dmp

Filesize
52KB

Download
memory/3844-1459-0x0000000000000000-mapping.dmp

Download
memory/3848-1562-0x0000000000000000-mapping.dmp

Download
memory/3924-327-0x0000000000000000-mapping.dmp

Download
memory/3956-1515-0x0000000000000000-mapping.dmp

Download
memory/4072-1015-0x0000000000BE0000-0x0000000000BE6000-memory.dmp

Filesize
24KB

Download
memory/4072-952-0x0000000000BD0000-0x0000000000BDB000-memory.dmp

Filesize
44KB

Download
memory/4072-593-0x0000000000000000-mapping.dmp

Download
memory/4072-940-0x0000000000BE0000-0x0000000000BE6000-memory.dmp

Filesize
24KB

Download
memory/4224-206-0x00000000004221AE-mapping.dmp

Download
memory/4224-744-0x0000000005420000-0x000000000545E000-memory.dmp

Filesize
248KB

Download
memory/4224-191-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4244-1500-0x0000000000000000-mapping.dmp

Download
memory/4248-1021-0x0000000000770000-0x0000000000778000-memory.dmp

Filesize
32KB

Download
memory/4248-953-0x0000000000770000-0x0000000000778000-memory.dmp

Filesize
32KB

Download
memory/4248-673-0x0000000000000000-mapping.dmp

Download
memory/4248-954-0x0000000000760000-0x000000000076B000-memory.dmp

Filesize
44KB

Download
memory/4364-1511-0x0000000000000000-mapping.dmp

Download
memory/4556-1448-0x00000209F1B10000-0x00000209F1B69000-memory.dmp

Filesize
356KB

Download
memory/4644-262-0x0000000000210000-0x000000000026C000-memory.dmp

Filesize
368KB

Download
memory/4644-175-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/4644-173-0x0000000000000000-mapping.dmp

Download
memory/4644-178-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/4644-181-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/4644-176-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/4644-177-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/4644-183-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/4660-705-0x0000000000C90000-0x0000000000C97000-memory.dmp

Filesize
28KB

Download
memory/4660-371-0x0000000000000000-mapping.dmp

Download
memory/4660-757-0x0000000000C80000-0x0000000000C8B000-memory.dmp

Filesize
44KB

Download
memory/4684-562-0x0000000000500000-0x0000000000664000-memory.dmp

Filesize
1.4MB

Download
memory/4684-848-0x00000000090C0000-0x0000000009126000-memory.dmp

Filesize
408KB

Download
memory/4684-1229-0x0000000009800000-0x000000000980A000-memory.dmp

Filesize
40KB

Download
memory/4684-1230-0x0000000009810000-0x0000000009822000-memory.dmp

Filesize
72KB

Download
memory/4684-395-0x000000000065E52E-mapping.dmp

Download
memory/4736-1514-0x0000000000000000-mapping.dmp

Download
memory/4784-159-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/4784-190-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/4784-195-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/4784-193-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/4784-160-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/4784-161-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/4784-158-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/4784-214-0x0000000000A50000-0x0000000000AAC000-memory.dmp

Filesize
368KB

Download
memory/4784-162-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/4784-157-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/4784-155-0x0000000000000000-mapping.dmp

Download
memory/4784-180-0x0000000000A50000-0x0000000000AAC000-memory.dmp

Filesize
368KB

Download
memory/4788-167-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/4788-232-0x0000000000930000-0x000000000098C000-memory.dmp

Filesize
368KB

Download
memory/4788-171-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/4788-166-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/4788-170-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/4788-169-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/4788-168-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/4788-164-0x0000000000000000-mapping.dmp

Download
memory/4788-202-0x0000000000930000-0x000000000098C000-memory.dmp

Filesize
368KB

Download
memory/4808-192-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/4808-179-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4808-189-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/4808-188-0x0000000000422136-mapping.dmp

Download
memory/4836-667-0x0000000005460000-0x0000000005A66000-memory.dmp

Filesize
6.0MB

Download
memory/4836-680-0x0000000004FC0000-0x00000000050CA000-memory.dmp

Filesize
1.0MB

Download
memory/4836-783-0x00000000050D0000-0x000000000511B000-memory.dmp

Filesize
300KB

Download
memory/4836-716-0x0000000004EF0000-0x0000000004F02000-memory.dmp

Filesize
72KB

Download
memory/4836-245-0x0000000000422146-mapping.dmp

Download
memory/4836-364-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4948-1447-0x0000000000000000-mapping.dmp

Download
memory/4948-1518-0x0000000000000000-mapping.dmp

Download
memory/4972-1544-0x0000000000000000-mapping.dmp

Download
memory/4972-1506-0x0000000000000000-mapping.dmp

Download
memory/5072-1419-0x000001B382800000-0x000001B38280F000-memory.dmp

Filesize
60KB

Download
memory/5072-1417-0x000001B3827E0000-0x000001B3827EC000-memory.dmp

Filesize
48KB

Download