Analysis
-
max time kernel
47s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
26-03-2024 18:37
Static task
static1
Behavioral task
behavioral1
Sample
dfd508ce328b9ec9a51ae057506df229.exe
Resource
win7-20240319-en
Behavioral task
behavioral2
Sample
dfd508ce328b9ec9a51ae057506df229.exe
Resource
win10v2004-20240226-en
General
-
Target
dfd508ce328b9ec9a51ae057506df229.exe
-
Size
496KB
-
MD5
dfd508ce328b9ec9a51ae057506df229
-
SHA1
60b38c0fc9eae02dd7be4735f981852eb6d51689
-
SHA256
3d529a586c44bdeb8526cfac2dbdc2167e0f64b22d3adbb0036470648f855319
-
SHA512
385db0988f4d54893f93bf7be789df771cc3d318b6b1ac793998ff526553e04c6b6f721b6c2c806c03cdcee19249dc32811473c0b8dd30c61dedcdc5abb9178f
-
SSDEEP
12288:+DCPENnBV5jaHBoFvZstQW012B04Ngjw5qu8jxTQlDrLOM:+EEZBV5jCoFvZsSWG2BdN+w2+O
Malware Config
Signatures
-
Modifies security service 2 TTPs 1 IoCs
Processes:
3men.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "3" 3men.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
j29oAE.exeraovuub.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" j29oAE.exe Set value (int) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" raovuub.exe -
Disables taskbar notifications via registry modification
-
Modifies Installed Components in the registry 2 TTPs 4 IoCs
Processes:
explorer.exeexplorer.exeexplorer.exeexplorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
j29oAE.exedfd508ce328b9ec9a51ae057506df229.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation j29oAE.exe Key value queried \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation dfd508ce328b9ec9a51ae057506df229.exe -
Executes dropped EXE 12 IoCs
Processes:
j29oAE.exeraovuub.exe2men.exe2men.exe2men.exe2men.exe2men.exe2men.exe3men.exe3men.exe3men.exeCFB.tmppid process 4520 j29oAE.exe 3220 raovuub.exe 3436 2men.exe 2864 2men.exe 960 2men.exe 952 2men.exe 2488 2men.exe 4860 2men.exe 2616 3men.exe 232 3men.exe 448 3men.exe 3556 CFB.tmp -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral2/memory/2864-47-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral2/memory/2864-51-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral2/memory/2864-50-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral2/memory/960-52-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/memory/960-56-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/memory/960-60-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/memory/960-59-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/memory/952-62-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral2/memory/2488-66-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral2/memory/952-65-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral2/memory/952-68-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral2/memory/2488-71-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral2/memory/2488-74-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral2/memory/2864-77-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral2/memory/2616-86-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/952-90-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral2/memory/2488-91-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral2/memory/2616-93-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/232-106-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/2616-162-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/2616-286-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/448-291-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/2616-298-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/2616-449-0x0000000000400000-0x000000000046A000-memory.dmp upx -
Adds Run key to start application 2 TTPs 39 IoCs
Processes:
raovuub.exe3men.exej29oAE.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\raovuub = "C:\\Users\\Admin\\raovuub.exe /a" raovuub.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\raovuub = "C:\\Users\\Admin\\raovuub.exe /N" raovuub.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\raovuub = "C:\\Users\\Admin\\raovuub.exe /i" raovuub.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\raovuub = "C:\\Users\\Admin\\raovuub.exe /h" raovuub.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\raovuub = "C:\\Users\\Admin\\raovuub.exe /T" raovuub.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\raovuub = "C:\\Users\\Admin\\raovuub.exe /s" raovuub.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\raovuub = "C:\\Users\\Admin\\raovuub.exe /D" raovuub.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\raovuub = "C:\\Users\\Admin\\raovuub.exe /E" raovuub.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\raovuub = "C:\\Users\\Admin\\raovuub.exe /J" raovuub.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\raovuub = "C:\\Users\\Admin\\raovuub.exe /x" raovuub.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\raovuub = "C:\\Users\\Admin\\raovuub.exe /z" raovuub.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\raovuub = "C:\\Users\\Admin\\raovuub.exe /O" raovuub.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\raovuub = "C:\\Users\\Admin\\raovuub.exe /Y" raovuub.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\raovuub = "C:\\Users\\Admin\\raovuub.exe /y" raovuub.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\raovuub = "C:\\Users\\Admin\\raovuub.exe /b" raovuub.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\D4A.exe = "C:\\Program Files (x86)\\LP\\5AD4\\D4A.exe" 3men.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\raovuub = "C:\\Users\\Admin\\raovuub.exe /t" raovuub.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\raovuub = "C:\\Users\\Admin\\raovuub.exe /c" raovuub.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\raovuub = "C:\\Users\\Admin\\raovuub.exe /j" raovuub.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\raovuub = "C:\\Users\\Admin\\raovuub.exe /U" raovuub.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\raovuub = "C:\\Users\\Admin\\raovuub.exe /R" raovuub.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\raovuub = "C:\\Users\\Admin\\raovuub.exe /q" raovuub.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\raovuub = "C:\\Users\\Admin\\raovuub.exe /e" raovuub.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\raovuub = "C:\\Users\\Admin\\raovuub.exe /m" j29oAE.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\raovuub = "C:\\Users\\Admin\\raovuub.exe /C" raovuub.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\raovuub = "C:\\Users\\Admin\\raovuub.exe /I" raovuub.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\raovuub = "C:\\Users\\Admin\\raovuub.exe /f" raovuub.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\raovuub = "C:\\Users\\Admin\\raovuub.exe /M" raovuub.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\raovuub = "C:\\Users\\Admin\\raovuub.exe /H" raovuub.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\raovuub = "C:\\Users\\Admin\\raovuub.exe /A" raovuub.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\raovuub = "C:\\Users\\Admin\\raovuub.exe /Z" raovuub.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\raovuub = "C:\\Users\\Admin\\raovuub.exe /P" raovuub.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\raovuub = "C:\\Users\\Admin\\raovuub.exe /w" raovuub.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\raovuub = "C:\\Users\\Admin\\raovuub.exe /K" raovuub.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\raovuub = "C:\\Users\\Admin\\raovuub.exe /S" raovuub.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\raovuub = "C:\\Users\\Admin\\raovuub.exe /B" raovuub.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\raovuub = "C:\\Users\\Admin\\raovuub.exe /g" raovuub.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\raovuub = "C:\\Users\\Admin\\raovuub.exe /L" raovuub.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\raovuub = "C:\\Users\\Admin\\raovuub.exe /G" raovuub.exe -
Enumerates connected drives 3 TTPs 8 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
explorer.exeexplorer.exeexplorer.exeexplorer.exedescription ioc process File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
2men.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 2men.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 2men.exe -
Suspicious use of SetThreadContext 5 IoCs
Processes:
2men.exedescription pid process target process PID 3436 set thread context of 2864 3436 2men.exe 2men.exe PID 3436 set thread context of 960 3436 2men.exe 2men.exe PID 3436 set thread context of 952 3436 2men.exe 2men.exe PID 3436 set thread context of 2488 3436 2men.exe 2men.exe PID 3436 set thread context of 4860 3436 2men.exe 2men.exe -
Drops file in Program Files directory 3 IoCs
Processes:
3men.exedescription ioc process File created C:\Program Files (x86)\LP\5AD4\D4A.exe 3men.exe File opened for modification C:\Program Files (x86)\LP\5AD4\D4A.exe 3men.exe File opened for modification C:\Program Files (x86)\LP\5AD4\CFB.tmp 3men.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2988 4860 WerFault.exe 2men.exe -
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
explorer.exeexplorer.exeexplorer.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName explorer.exe -
Enumerates processes with tasklist 1 TTPs 2 IoCs
Processes:
tasklist.exetasklist.exepid process 1292 tasklist.exe 2852 tasklist.exe -
Processes:
SearchApp.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe -
Modifies registry class 63 IoCs
Processes:
explorer.exeexplorer.exeSearchApp.exeexplorer.exeexplorer.exeStartMenuExperienceHost.exeStartMenuExperienceHost.exeStartMenuExperienceHost.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3045580317-3728985860-206385570-1000\{3420DD3E-6062-4D52-98E8-0C574B2FB171} explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "23" SearchApp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "56" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "23" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchApp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHos = 6801000088020000 explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Speech_OneCore\\Recognizers\\Tokens\\MS-1033-110-WINMO-DNN" SearchApp.exe Set value (data) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "152" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search SearchApp.exe Set value (data) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "56" SearchApp.exe Set value (data) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "185" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHos = 6801000088020000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\MuiCache SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3045580317-3728985860-206385570-1000\{82D13CBD-2C76-416B-B8C3-B7A426591CB6} explorer.exe Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search SearchApp.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3045580317-3728985860-206385570-1000\{6B661C5E-2658-4E07-B5CC-E464F907B885} explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3045580317-3728985860-206385570-1000\{3B4652BA-2BBC-415D-97CB-CF48B34ACFD7} explorer.exe Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchApp.exe Set value (data) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHos = 6801000088020000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
j29oAE.exe2men.exe2men.exeraovuub.exe3men.exepid process 4520 j29oAE.exe 4520 j29oAE.exe 4520 j29oAE.exe 4520 j29oAE.exe 960 2men.exe 960 2men.exe 952 2men.exe 952 2men.exe 3220 raovuub.exe 3220 raovuub.exe 3220 raovuub.exe 3220 raovuub.exe 3220 raovuub.exe 3220 raovuub.exe 960 2men.exe 960 2men.exe 3220 raovuub.exe 3220 raovuub.exe 952 2men.exe 952 2men.exe 3220 raovuub.exe 3220 raovuub.exe 3220 raovuub.exe 3220 raovuub.exe 3220 raovuub.exe 3220 raovuub.exe 960 2men.exe 960 2men.exe 3220 raovuub.exe 3220 raovuub.exe 960 2men.exe 960 2men.exe 960 2men.exe 960 2men.exe 3220 raovuub.exe 3220 raovuub.exe 2616 3men.exe 2616 3men.exe 2616 3men.exe 2616 3men.exe 2616 3men.exe 2616 3men.exe 2616 3men.exe 2616 3men.exe 2616 3men.exe 2616 3men.exe 2616 3men.exe 2616 3men.exe 3220 raovuub.exe 3220 raovuub.exe 3220 raovuub.exe 3220 raovuub.exe 960 2men.exe 960 2men.exe 960 2men.exe 960 2men.exe 3220 raovuub.exe 3220 raovuub.exe 960 2men.exe 960 2men.exe 3220 raovuub.exe 3220 raovuub.exe 3220 raovuub.exe 3220 raovuub.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
tasklist.exemsiexec.exetasklist.exeexplorer.exeexplorer.exedescription pid process Token: SeDebugPrivilege 1292 tasklist.exe Token: SeSecurityPrivilege 2856 msiexec.exe Token: SeDebugPrivilege 2852 tasklist.exe Token: SeShutdownPrivilege 4188 explorer.exe Token: SeCreatePagefilePrivilege 4188 explorer.exe Token: SeShutdownPrivilege 4188 explorer.exe Token: SeCreatePagefilePrivilege 4188 explorer.exe Token: SeShutdownPrivilege 4188 explorer.exe Token: SeCreatePagefilePrivilege 4188 explorer.exe Token: SeShutdownPrivilege 4188 explorer.exe Token: SeCreatePagefilePrivilege 4188 explorer.exe Token: SeShutdownPrivilege 4188 explorer.exe Token: SeCreatePagefilePrivilege 4188 explorer.exe Token: SeShutdownPrivilege 4188 explorer.exe Token: SeCreatePagefilePrivilege 4188 explorer.exe Token: SeShutdownPrivilege 4188 explorer.exe Token: SeCreatePagefilePrivilege 4188 explorer.exe Token: SeShutdownPrivilege 4188 explorer.exe Token: SeCreatePagefilePrivilege 4188 explorer.exe Token: SeShutdownPrivilege 4188 explorer.exe Token: SeCreatePagefilePrivilege 4188 explorer.exe Token: SeShutdownPrivilege 4188 explorer.exe Token: SeCreatePagefilePrivilege 4188 explorer.exe Token: SeShutdownPrivilege 4188 explorer.exe Token: SeCreatePagefilePrivilege 4188 explorer.exe Token: SeShutdownPrivilege 4188 explorer.exe Token: SeCreatePagefilePrivilege 4188 explorer.exe Token: SeShutdownPrivilege 4488 explorer.exe Token: SeCreatePagefilePrivilege 4488 explorer.exe Token: SeShutdownPrivilege 4488 explorer.exe Token: SeCreatePagefilePrivilege 4488 explorer.exe Token: SeShutdownPrivilege 4488 explorer.exe Token: SeCreatePagefilePrivilege 4488 explorer.exe Token: SeShutdownPrivilege 4488 explorer.exe Token: SeCreatePagefilePrivilege 4488 explorer.exe Token: SeShutdownPrivilege 4488 explorer.exe Token: SeCreatePagefilePrivilege 4488 explorer.exe Token: SeShutdownPrivilege 4488 explorer.exe Token: SeCreatePagefilePrivilege 4488 explorer.exe Token: SeShutdownPrivilege 4488 explorer.exe Token: SeCreatePagefilePrivilege 4488 explorer.exe Token: SeShutdownPrivilege 4488 explorer.exe Token: SeCreatePagefilePrivilege 4488 explorer.exe Token: SeShutdownPrivilege 4488 explorer.exe Token: SeCreatePagefilePrivilege 4488 explorer.exe Token: SeShutdownPrivilege 4488 explorer.exe Token: SeCreatePagefilePrivilege 4488 explorer.exe Token: SeShutdownPrivilege 4488 explorer.exe Token: SeCreatePagefilePrivilege 4488 explorer.exe Token: SeShutdownPrivilege 4488 explorer.exe Token: SeCreatePagefilePrivilege 4488 explorer.exe Token: SeShutdownPrivilege 4488 explorer.exe Token: SeCreatePagefilePrivilege 4488 explorer.exe Token: SeShutdownPrivilege 4488 explorer.exe Token: SeCreatePagefilePrivilege 4488 explorer.exe Token: SeShutdownPrivilege 4488 explorer.exe Token: SeCreatePagefilePrivilege 4488 explorer.exe Token: SeShutdownPrivilege 4488 explorer.exe Token: SeCreatePagefilePrivilege 4488 explorer.exe Token: SeShutdownPrivilege 4488 explorer.exe Token: SeCreatePagefilePrivilege 4488 explorer.exe Token: SeShutdownPrivilege 4488 explorer.exe Token: SeCreatePagefilePrivilege 4488 explorer.exe Token: SeShutdownPrivilege 4488 explorer.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
explorer.exeexplorer.exepid process 4188 explorer.exe 4188 explorer.exe 4188 explorer.exe 4188 explorer.exe 4188 explorer.exe 4188 explorer.exe 4188 explorer.exe 4188 explorer.exe 4188 explorer.exe 4188 explorer.exe 4188 explorer.exe 4188 explorer.exe 4188 explorer.exe 4188 explorer.exe 4188 explorer.exe 4188 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe -
Suspicious use of SendNotifyMessage 55 IoCs
Processes:
explorer.exeexplorer.exeexplorer.exeexplorer.exepid process 4188 explorer.exe 4188 explorer.exe 4188 explorer.exe 4188 explorer.exe 4188 explorer.exe 4188 explorer.exe 4188 explorer.exe 4188 explorer.exe 4188 explorer.exe 4188 explorer.exe 4188 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 5364 explorer.exe 5364 explorer.exe 5364 explorer.exe 5364 explorer.exe 5364 explorer.exe 5364 explorer.exe 5364 explorer.exe 5364 explorer.exe 5364 explorer.exe 5364 explorer.exe 5364 explorer.exe 5172 explorer.exe 5172 explorer.exe 5172 explorer.exe 5172 explorer.exe 5172 explorer.exe 5172 explorer.exe 5172 explorer.exe 5172 explorer.exe 5172 explorer.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
Processes:
dfd508ce328b9ec9a51ae057506df229.exej29oAE.exeraovuub.exe2men.exe2men.exe2men.exeStartMenuExperienceHost.exeStartMenuExperienceHost.exeSearchApp.exeStartMenuExperienceHost.exepid process 408 dfd508ce328b9ec9a51ae057506df229.exe 4520 j29oAE.exe 3220 raovuub.exe 3436 2men.exe 2864 2men.exe 2488 2men.exe 452 StartMenuExperienceHost.exe 1828 StartMenuExperienceHost.exe 3908 SearchApp.exe 5692 StartMenuExperienceHost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
dfd508ce328b9ec9a51ae057506df229.exej29oAE.execmd.exe2men.exeraovuub.execmd.exedescription pid process target process PID 408 wrote to memory of 4520 408 dfd508ce328b9ec9a51ae057506df229.exe j29oAE.exe PID 408 wrote to memory of 4520 408 dfd508ce328b9ec9a51ae057506df229.exe j29oAE.exe PID 408 wrote to memory of 4520 408 dfd508ce328b9ec9a51ae057506df229.exe j29oAE.exe PID 4520 wrote to memory of 3220 4520 j29oAE.exe raovuub.exe PID 4520 wrote to memory of 3220 4520 j29oAE.exe raovuub.exe PID 4520 wrote to memory of 3220 4520 j29oAE.exe raovuub.exe PID 4520 wrote to memory of 1996 4520 j29oAE.exe cmd.exe PID 4520 wrote to memory of 1996 4520 j29oAE.exe cmd.exe PID 4520 wrote to memory of 1996 4520 j29oAE.exe cmd.exe PID 1996 wrote to memory of 1292 1996 cmd.exe tasklist.exe PID 1996 wrote to memory of 1292 1996 cmd.exe tasklist.exe PID 1996 wrote to memory of 1292 1996 cmd.exe tasklist.exe PID 408 wrote to memory of 3436 408 dfd508ce328b9ec9a51ae057506df229.exe 2men.exe PID 408 wrote to memory of 3436 408 dfd508ce328b9ec9a51ae057506df229.exe 2men.exe PID 408 wrote to memory of 3436 408 dfd508ce328b9ec9a51ae057506df229.exe 2men.exe PID 3436 wrote to memory of 2864 3436 2men.exe 2men.exe PID 3436 wrote to memory of 2864 3436 2men.exe 2men.exe PID 3436 wrote to memory of 2864 3436 2men.exe 2men.exe PID 3436 wrote to memory of 2864 3436 2men.exe 2men.exe PID 3436 wrote to memory of 2864 3436 2men.exe 2men.exe PID 3436 wrote to memory of 2864 3436 2men.exe 2men.exe PID 3436 wrote to memory of 2864 3436 2men.exe 2men.exe PID 3436 wrote to memory of 2864 3436 2men.exe 2men.exe PID 3436 wrote to memory of 960 3436 2men.exe 2men.exe PID 3436 wrote to memory of 960 3436 2men.exe 2men.exe PID 3436 wrote to memory of 960 3436 2men.exe 2men.exe PID 3436 wrote to memory of 960 3436 2men.exe 2men.exe PID 3436 wrote to memory of 960 3436 2men.exe 2men.exe PID 3436 wrote to memory of 960 3436 2men.exe 2men.exe PID 3436 wrote to memory of 960 3436 2men.exe 2men.exe PID 3436 wrote to memory of 960 3436 2men.exe 2men.exe PID 3436 wrote to memory of 952 3436 2men.exe 2men.exe PID 3436 wrote to memory of 952 3436 2men.exe 2men.exe PID 3436 wrote to memory of 952 3436 2men.exe 2men.exe PID 3436 wrote to memory of 952 3436 2men.exe 2men.exe PID 3436 wrote to memory of 952 3436 2men.exe 2men.exe PID 3436 wrote to memory of 952 3436 2men.exe 2men.exe PID 3436 wrote to memory of 952 3436 2men.exe 2men.exe PID 3436 wrote to memory of 952 3436 2men.exe 2men.exe PID 3436 wrote to memory of 2488 3436 2men.exe 2men.exe PID 3436 wrote to memory of 2488 3436 2men.exe 2men.exe PID 3436 wrote to memory of 2488 3436 2men.exe 2men.exe PID 3436 wrote to memory of 2488 3436 2men.exe 2men.exe PID 3436 wrote to memory of 2488 3436 2men.exe 2men.exe PID 3436 wrote to memory of 2488 3436 2men.exe 2men.exe PID 3436 wrote to memory of 2488 3436 2men.exe 2men.exe PID 3436 wrote to memory of 2488 3436 2men.exe 2men.exe PID 3436 wrote to memory of 4860 3436 2men.exe 2men.exe PID 3436 wrote to memory of 4860 3436 2men.exe 2men.exe PID 3436 wrote to memory of 4860 3436 2men.exe 2men.exe PID 3436 wrote to memory of 4860 3436 2men.exe 2men.exe PID 3220 wrote to memory of 1292 3220 raovuub.exe tasklist.exe PID 3220 wrote to memory of 1292 3220 raovuub.exe tasklist.exe PID 408 wrote to memory of 2616 408 dfd508ce328b9ec9a51ae057506df229.exe 3men.exe PID 408 wrote to memory of 2616 408 dfd508ce328b9ec9a51ae057506df229.exe 3men.exe PID 408 wrote to memory of 2616 408 dfd508ce328b9ec9a51ae057506df229.exe 3men.exe PID 408 wrote to memory of 3172 408 dfd508ce328b9ec9a51ae057506df229.exe cmd.exe PID 408 wrote to memory of 3172 408 dfd508ce328b9ec9a51ae057506df229.exe cmd.exe PID 408 wrote to memory of 3172 408 dfd508ce328b9ec9a51ae057506df229.exe cmd.exe PID 3172 wrote to memory of 2852 3172 cmd.exe tasklist.exe PID 3172 wrote to memory of 2852 3172 cmd.exe tasklist.exe PID 3172 wrote to memory of 2852 3172 cmd.exe tasklist.exe PID 3220 wrote to memory of 2852 3220 raovuub.exe tasklist.exe PID 3220 wrote to memory of 2852 3220 raovuub.exe tasklist.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
3men.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer 3men.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1" 3men.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\dfd508ce328b9ec9a51ae057506df229.exe"C:\Users\Admin\AppData\Local\Temp\dfd508ce328b9ec9a51ae057506df229.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\j29oAE.exeC:\Users\Admin\j29oAE.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\raovuub.exe"C:\Users\Admin\raovuub.exe"3⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del j29oAE.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\2men.exeC:\Users\Admin\2men.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\2men.exe"C:\Users\Admin\2men.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\2men.exe"C:\Users\Admin\2men.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\2men.exe"C:\Users\Admin\2men.exe"3⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\2men.exe"C:\Users\Admin\2men.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\2men.exe"C:\Users\Admin\2men.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4860 -s 804⤵
- Program crash
-
C:\Users\Admin\3men.exeC:\Users\Admin\3men.exe2⤵
- Modifies security service
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- System policy modification
-
C:\Users\Admin\3men.exeC:\Users\Admin\3men.exe startC:\Users\Admin\AppData\Roaming\4C74B\1755A.exe%C:\Users\Admin\AppData\Roaming\4C74B3⤵
- Executes dropped EXE
-
C:\Users\Admin\3men.exeC:\Users\Admin\3men.exe startC:\Program Files (x86)\4B581\lvvm.exe%C:\Program Files (x86)\4B5813⤵
- Executes dropped EXE
-
C:\Program Files (x86)\LP\5AD4\CFB.tmp"C:\Program Files (x86)\LP\5AD4\CFB.tmp"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del dfd508ce328b9ec9a51ae057506df229.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4860 -ip 48601⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of SendNotifyMessage
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Modifies registry class
- Suspicious use of SendNotifyMessage
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Defense Evasion
Modify Registry
6Hide Artifacts
1Hidden Files and Directories
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\LP\5AD4\CFB.tmpFilesize
96KB
MD56b9ed8570a1857126c8bf99e0663926c
SHA194e08d8a0be09be35f37a9b17ec2130febfa2074
SHA256888e4e571a6f78ee81d94ab56bd033d413f9160f1089073176b03c91878aae2d
SHA51223211a1b71f1d05ad7f003231da826220ac4940e48071135cc3fba14708123fa0292e2e71c294a8086d8dc5f90dd32c4da3b41e6857c56f38cb325d78cb14880
-
C:\Users\Admin\2men.exeFilesize
132KB
MD5945a713b037b50442ec5d18d3dc0d55e
SHA12c8881b327a79fafcce27479b78f05487d93c802
SHA2562da470571a64bcdeb56f62c916ee2bffa87ccc6c028b7c8cb0132d09bceedd2f
SHA5120eab4bb5d04725cc20e463ae6959f71064674602f8ee7b3c9b2db75e928b9a0b1bdc94233dc261f6277d02e54a443b42a59b12aaebb8bbf243f0940344fbf385
-
C:\Users\Admin\3men.exeFilesize
271KB
MD50d668203e24463de2bf228f00443b7bc
SHA1eacff981d71f6648f6315e508bfd75e11683dba8
SHA256509d530e99839d7dbc8fccac163420d9dc455fb478fa57fdec1b7a2ef629d7bc
SHA5123251bb1341bd466e71468d72723bd5cf545dbd232327f343b44c51daae8755ed3caa02f74adbb0304912769346fa90dfa4c7036c211836e5650bdb06993ba803
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53Filesize
471B
MD5c8f4056acf8fe623a5c5d0900e7ec2e1
SHA192280060f3a3bba0c8b476604f3820bfda7bd8c1
SHA2564a18b2179c0b858a787056da6d6be51e3d474b33083f48fbd61fce93e1fcc6f8
SHA512b1c1b51b41e2d0608a65e2547da0f004bdf88866f28492898f49c61547f4c1fa5508a0067aee3460c93bfa5ec172c4999da0bc615b9d671742834485db64ace3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53Filesize
412B
MD513d0cc08fd79da88e64a1958a13fbf8c
SHA1b3c60d78c7045010fc69943fe2cf3a2706a8b673
SHA2560631d1e7c5152ef72bfe19d33a19bc099a12966893cd5e6aa2b4da90836578b8
SHA512d78482728051a8d431cb65979ae2f158e1b292c99c5f075b81bb1dacdfc4b34820cf901f8b9c031a999a98ee97bea1fe66744c6828a6c7333d521b27961d1752
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\N3A1GXDL\microsoft.windows[1].xmlFilesize
97B
MD52a048584ff1532f817c94dc91dcd1288
SHA1a8feaa50ff20598096757253f961ed62cc8e2569
SHA256ac0e9ccd0c2a91247d80d72c35930928c1da245701ca832072bd977c61d3901a
SHA512b6e50c342123202657e524ce15e02851da3b8573494e0ba98f7b70c6438fcbee100df4eac302d1dcbd3d3123bdf14a11d232c96d998c569431887317419c1d86
-
C:\Users\Admin\AppData\Roaming\4C74B\B581.C74Filesize
600B
MD584936b094c170e68906b73ba6b8479f1
SHA194f1b581ecbd06a7b467e3a96306a91f3afb8bab
SHA256f4c042c5e8c804a1fca441b98fa0b104939133defa420c1912cd178a019c9148
SHA512500f4a74ccb444e9a2fc6da8067028e871386d9d3cbf4631d63cf93e91484361a1f361b55419d7a750c68705da2e7aa8d117fef364301c4e54ca970990a7cdd0
-
C:\Users\Admin\AppData\Roaming\4C74B\B581.C74Filesize
996B
MD5a5d71d96d66ff7030b5b425cf15a48b6
SHA119e813578d95b6245b1ba70691e5762a46915372
SHA256d14e8d6ea8971a9cc0fe8ee714c8979404e019455bd5427afeba525a999090c7
SHA51229800348cfa172403ca6ec049df7bb75073cc3344a0be5a9200334c99d43c302cbbe000d91f7f45da703202441565992826771070a4dd72d78f393f8099c8f70
-
C:\Users\Admin\AppData\Roaming\4C74B\B581.C74Filesize
1KB
MD51fe1fa3106e8e15234b565792505ce4d
SHA134706a19198146eeaab624f10d1d073bbdd7c86d
SHA25670afd6953e673615b9fe305f275c3b9b339db48f7ee2dd41753adc75e2344e6d
SHA5126e99964cd71b39bf792fb3424fd60e5df1925c9bc8a86fa28f719ebabd91b5f40ce72fe9648999bbdda22e790f6ad879b626727f96400066b64e33cd22a9fc0f
-
C:\Users\Admin\j29oAE.exeFilesize
176KB
MD5c4a634088e095eab98183984bb7252d8
SHA1c205f2c1f8040c9205c6c06accd75c0396c59781
SHA256db345985313397a39cc2817134315c8db71ab4c48680e62c0358db406b0eff6a
SHA512b6a30f6d5cc30bee9b9d483629f16c80c5338360cec629f9ee2a3307b73b9743fd71396e408ac72008b84f4b8fded26002c910421853253b52b8b4d530df7a8e
-
C:\Users\Admin\raovuub.exeFilesize
176KB
MD56a7bef52dd3eb20153962a760725d073
SHA14f29647f68575330484b61857051b218d2be70b8
SHA25641365ff39bdcc04c493af47c5ff0c08653dc934b42bd7ffeaef7cac4c6a16051
SHA512b7ccf64e9f42e2e69c92f685f6dbbfbeb3536e94a7d556ec8a99de2772dfb5755f92dc1c84df147bb4362456d9da2e7be6bcf3d4d8c22c4dadb5dc93d88f306f
-
\??\PIPE\srvsvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/232-106-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/232-107-0x0000000000648000-0x0000000000668000-memory.dmpFilesize
128KB
-
memory/448-289-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/448-290-0x0000000000530000-0x0000000000630000-memory.dmpFilesize
1024KB
-
memory/448-291-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/952-65-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/952-68-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/952-62-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/952-90-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/960-59-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/960-60-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/960-56-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/960-52-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/2488-71-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/2488-91-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/2488-66-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/2488-74-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/2616-298-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/2616-286-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/2616-87-0x0000000000840000-0x0000000000940000-memory.dmpFilesize
1024KB
-
memory/2616-86-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/2616-93-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/2616-162-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/2616-449-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/2616-287-0x0000000000840000-0x0000000000940000-memory.dmpFilesize
1024KB
-
memory/2672-433-0x0000029AA8DD0000-0x0000029AA8DF0000-memory.dmpFilesize
128KB
-
memory/2672-431-0x0000029AA9020000-0x0000029AA9040000-memory.dmpFilesize
128KB
-
memory/2672-435-0x0000029AA93E0000-0x0000029AA9400000-memory.dmpFilesize
128KB
-
memory/2864-77-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/2864-50-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/2864-51-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/2864-47-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/3448-489-0x00000208D77D0000-0x00000208D77F0000-memory.dmpFilesize
128KB
-
memory/3556-452-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/3556-450-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/3556-451-0x00000000005E0000-0x00000000006E0000-memory.dmpFilesize
1024KB
-
memory/3908-310-0x000001CF39460000-0x000001CF39480000-memory.dmpFilesize
128KB
-
memory/3908-312-0x000001CF39A80000-0x000001CF39AA0000-memory.dmpFilesize
128KB
-
memory/3908-306-0x000001CF394A0000-0x000001CF394C0000-memory.dmpFilesize
128KB
-
memory/4488-299-0x0000000004120000-0x0000000004121000-memory.dmpFilesize
4KB
-
memory/5172-423-0x0000000004200000-0x0000000004201000-memory.dmpFilesize
4KB
-
memory/5368-482-0x0000000002C60000-0x0000000002C61000-memory.dmpFilesize
4KB
-
memory/5848-454-0x0000000003E90000-0x0000000003E91000-memory.dmpFilesize
4KB
-
memory/5864-462-0x00000222E8BE0000-0x00000222E8C00000-memory.dmpFilesize
128KB
-
memory/5864-465-0x00000222E8BA0000-0x00000222E8BC0000-memory.dmpFilesize
128KB
-
memory/5864-468-0x00000222E8FB0000-0x00000222E8FD0000-memory.dmpFilesize
128KB