dcrat | 6d95012691b58c36574d4b1061b07e0a8340909664908e991fad91028777fdd1

Resubmissions

12-01-2023 20:01

230112-yrh6hsae52 10

07-01-2023 04:41

230107-fa3jqagb8t 10

07-01-2023 04:21

230107-eynj2acf87 10

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07-01-2023 04:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Size

3.8MB
MD5

0a0a64f3c4fa7d960be983aa0a7d0ce8
SHA1

b597c7397ecaff7c5c1aa27f5124fc7b8a94e643
SHA256

6d95012691b58c36574d4b1061b07e0a8340909664908e991fad91028777fdd1
SHA512

ef04e3eb8f2b10dae6845b97fa66086c3d02c5508adcd1923a93975c88f1ad0f80f984b563c36c4868276670b1dee9e11ae3c57faf7b0509118d121d920df7d4
SSDEEP

98304:F7b3a0t2TiPhx6Sp+ybfnDA4qo34n1oO:FH3Z8cp+gDZ4n1

Score

10^/10

dcrat evasion infostealer persistence rat trojan

Malware Config

Signatures

DcRat 49 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

Processes:

schtasks.exeschtasks.exeschtasks.exe0a0a64f3c4fa7d960be983aa0a7d0ce8.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
4496	schtasks.exe
5100	schtasks.exe
5088	schtasks.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
5096	schtasks.exe
4580	schtasks.exe
1660	schtasks.exe
220	schtasks.exe
3444	schtasks.exe
1924	schtasks.exe
476	schtasks.exe
808	schtasks.exe
4720	schtasks.exe
4252	schtasks.exe
1084	schtasks.exe
876	schtasks.exe
4620	schtasks.exe
2240	schtasks.exe
976	schtasks.exe
3544	schtasks.exe
3372	schtasks.exe
4500	schtasks.exe
1136	schtasks.exe
1112	schtasks.exe
4572	schtasks.exe
4856	schtasks.exe
1656	schtasks.exe
4224	schtasks.exe
4656	schtasks.exe
3268	schtasks.exe
4976	schtasks.exe
4612	schtasks.exe
3988	schtasks.exe
4204	schtasks.exe
1104	schtasks.exe
4752	schtasks.exe
1268	schtasks.exe
1872	schtasks.exe
4484	schtasks.exe
1492	schtasks.exe
4652	schtasks.exe
2252	schtasks.exe
4552	schtasks.exe
3336	schtasks.exe
3692	schtasks.exe
1948	schtasks.exe
4436	schtasks.exe
1776	schtasks.exe
748	schtasks.exe

Modifies WinLogon for persistence 2 TTPs 16 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

0a0a64f3c4fa7d960be983aa0a7d0ce8.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\wininit.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\WmiPrvSE.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\WmiPrvSE.exe\", \"C:\\Users\\Admin\\Recent\\taskhostw.exe\", \"C:\\Program Files\\Windows Sidebar\\Gadgets\\WmiPrvSE.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\WmiPrvSE.exe\", \"C:\\Users\\Admin\\Recent\\taskhostw.exe\", \"C:\\Program Files\\Windows Sidebar\\Gadgets\\WmiPrvSE.exe\", \"C:\\Windows\\SKB\\Registry.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\WmiPrvSE.exe\", \"C:\\Users\\Admin\\Recent\\taskhostw.exe\", \"C:\\Program Files\\Windows Sidebar\\Gadgets\\WmiPrvSE.exe\", \"C:\\Windows\\SKB\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\WmiPrvSE.exe\", \"C:\\Users\\Admin\\Recent\\taskhostw.exe\", \"C:\\Program Files\\Windows Sidebar\\Gadgets\\WmiPrvSE.exe\", \"C:\\Windows\\SKB\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Windows\\RemotePackages\\RemoteDesktops\\StartMenuExperienceHost.exe\", \"C:\\Windows\\INF\\.NETFramework\\040C\\System.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\WmiPrvSE.exe\", \"C:\\Users\\Admin\\Recent\\taskhostw.exe\", \"C:\\Program Files\\Windows Sidebar\\Gadgets\\WmiPrvSE.exe\", \"C:\\Windows\\SKB\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Windows\\RemotePackages\\RemoteDesktops\\StartMenuExperienceHost.exe\", \"C:\\Windows\\INF\\.NETFramework\\040C\\System.exe\", \"C:\\Windows\\Prefetch\\ReadyBoot\\upfc.exe\", \"C:\\odt\\RuntimeBroker.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\WmiPrvSE.exe\", \"C:\\Users\\Admin\\Recent\\taskhostw.exe\", \"C:\\Program Files\\Windows Sidebar\\Gadgets\\WmiPrvSE.exe\", \"C:\\Windows\\SKB\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Windows\\RemotePackages\\RemoteDesktops\\StartMenuExperienceHost.exe\", \"C:\\Windows\\INF\\.NETFramework\\040C\\System.exe\", \"C:\\Windows\\Prefetch\\ReadyBoot\\upfc.exe\", \"C:\\odt\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\services.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\RuntimeBroker.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\WmiPrvSE.exe\", \"C:\\Users\\Admin\\Recent\\taskhostw.exe\", \"C:\\Program Files\\Windows Sidebar\\Gadgets\\WmiPrvSE.exe\", \"C:\\Windows\\SKB\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Windows\\RemotePackages\\RemoteDesktops\\StartMenuExperienceHost.exe\", \"C:\\Windows\\INF\\.NETFramework\\040C\\System.exe\", \"C:\\Windows\\Prefetch\\ReadyBoot\\upfc.exe\", \"C:\\odt\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\services.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\RuntimeBroker.exe\", \"C:\\Users\\All Users\\Desktop\\services.exe\", \"C:\\Users\\Admin\\Application Data\\RuntimeBroker.exe\", \"C:\\Program Files\\Windows Photo Viewer\\en-US\\SppExtComObj.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\WmiPrvSE.exe\", \"C:\\Users\\Admin\\Recent\\taskhostw.exe\", \"C:\\Program Files\\Windows Sidebar\\Gadgets\\WmiPrvSE.exe\", \"C:\\Windows\\SKB\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Windows\\RemotePackages\\RemoteDesktops\\StartMenuExperienceHost.exe\", \"C:\\Windows\\INF\\.NETFramework\\040C\\System.exe\", \"C:\\Windows\\Prefetch\\ReadyBoot\\upfc.exe\", \"C:\\odt\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\services.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\RuntimeBroker.exe\", \"C:\\Users\\All Users\\Desktop\\services.exe\", \"C:\\Users\\Admin\\Application Data\\RuntimeBroker.exe\", \"C:\\Program Files\\Windows Photo Viewer\\en-US\\SppExtComObj.exe\", \"C:\\Users\\Admin\\System.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\WmiPrvSE.exe\", \"C:\\Users\\Admin\\Recent\\taskhostw.exe\", \"C:\\Program Files\\Windows Sidebar\\Gadgets\\WmiPrvSE.exe\", \"C:\\Windows\\SKB\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Windows\\RemotePackages\\RemoteDesktops\\StartMenuExperienceHost.exe\", \"C:\\Windows\\INF\\.NETFramework\\040C\\System.exe\", \"C:\\Windows\\Prefetch\\ReadyBoot\\upfc.exe\", \"C:\\odt\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\services.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\RuntimeBroker.exe\", \"C:\\Users\\All Users\\Desktop\\services.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\WmiPrvSE.exe\", \"C:\\Users\\Admin\\Recent\\taskhostw.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\WmiPrvSE.exe\", \"C:\\Users\\Admin\\Recent\\taskhostw.exe\", \"C:\\Program Files\\Windows Sidebar\\Gadgets\\WmiPrvSE.exe\", \"C:\\Windows\\SKB\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Windows\\RemotePackages\\RemoteDesktops\\StartMenuExperienceHost.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\WmiPrvSE.exe\", \"C:\\Users\\Admin\\Recent\\taskhostw.exe\", \"C:\\Program Files\\Windows Sidebar\\Gadgets\\WmiPrvSE.exe\", \"C:\\Windows\\SKB\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Windows\\RemotePackages\\RemoteDesktops\\StartMenuExperienceHost.exe\", \"C:\\Windows\\INF\\.NETFramework\\040C\\System.exe\", \"C:\\Windows\\Prefetch\\ReadyBoot\\upfc.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\WmiPrvSE.exe\", \"C:\\Users\\Admin\\Recent\\taskhostw.exe\", \"C:\\Program Files\\Windows Sidebar\\Gadgets\\WmiPrvSE.exe\", \"C:\\Windows\\SKB\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Windows\\RemotePackages\\RemoteDesktops\\StartMenuExperienceHost.exe\", \"C:\\Windows\\INF\\.NETFramework\\040C\\System.exe\", \"C:\\Windows\\Prefetch\\ReadyBoot\\upfc.exe\", \"C:\\odt\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\services.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\WmiPrvSE.exe\", \"C:\\Users\\Admin\\Recent\\taskhostw.exe\", \"C:\\Program Files\\Windows Sidebar\\Gadgets\\WmiPrvSE.exe\", \"C:\\Windows\\SKB\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Windows\\RemotePackages\\RemoteDesktops\\StartMenuExperienceHost.exe\", \"C:\\Windows\\INF\\.NETFramework\\040C\\System.exe\", \"C:\\Windows\\Prefetch\\ReadyBoot\\upfc.exe\", \"C:\\odt\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\services.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\RuntimeBroker.exe\", \"C:\\Users\\All Users\\Desktop\\services.exe\", \"C:\\Users\\Admin\\Application Data\\RuntimeBroker.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe

Process spawned unexpected child process 48 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4484	3340	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4620	3340	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4436	3340	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1656	3340	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4976	3340	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	808	3340	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5096	3340	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4720	3340	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1492	3340	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4652	3340	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4612	3340	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4580	3340	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1776	3340	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2252	3340	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4252	3340	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1660	3340	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4224	3340	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4552	3340	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1084	3340	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4656	3340	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4500	3340	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1136	3340	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1112	3340	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4572	3340	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3268	3340	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	876	3340	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4856	3340	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4752	3340	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2240	3340	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1268	3340	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	220	3340	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1872	3340	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3988	3340	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4496	3340	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5100	3340	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4204	3340	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5088	3340	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3336	3340	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	976	3340	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1924	3340	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	476	3340	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3692	3340	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3544	3340	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3372	3340	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3444	3340	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	748	3340	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1104	3340	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1948	3340	schtasks.exe

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

0a0a64f3c4fa7d960be983aa0a7d0ce8.exeservices.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	services.exe

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
behavioral2/memory/2248-132-0x0000000000CC0000-0x000000000108A000-memory.dmp	dcrat
C:\Users\All Users\Desktop\services.exe	dcrat
C:\Users\Public\Desktop\services.exe	dcrat
behavioral2/memory/5892-213-0x0000000000600000-0x00000000009CA000-memory.dmp	dcrat

Executes dropped EXE 1 IoCs

Processes:

services.exe

pid process

5892 services.exe

pid	process
5892	services.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

0a0a64f3c4fa7d960be983aa0a7d0ce8.exeservices.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	services.exe

Adds Run key to start application 2 TTPs 32 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

0a0a64f3c4fa7d960be983aa0a7d0ce8.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Recovery\\WindowsRE\\WmiPrvSE.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\odt\\RuntimeBroker.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Program Files\\Windows Photo Viewer\\en-US\\SppExtComObj.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Program Files\\Windows Photo Viewer\\en-US\\SppExtComObj.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Users\\Admin\\System.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Users\\Admin\\Recent\\taskhostw.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Windows\\SKB\\Registry.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Windows\\INF\\.NETFramework\\040C\\System.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\odt\\RuntimeBroker.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\RuntimeBroker.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Users\\All Users\\Desktop\\services.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Users\\Admin\\Recent\\taskhostw.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Windows\\RemotePackages\\RemoteDesktops\\StartMenuExperienceHost.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Windows\\INF\\.NETFramework\\040C\\System.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\upfc = "\"C:\\Windows\\Prefetch\\ReadyBoot\\upfc.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Program Files (x86)\\WindowsPowerShell\\services.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Program Files\\Windows Sidebar\\Gadgets\\WmiPrvSE.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Users\\Admin\\Application Data\\RuntimeBroker.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Users\\Admin\\System.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Windows\\SKB\\Registry.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Users\\Admin\\Application Data\\RuntimeBroker.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Recovery\\WindowsRE\\WmiPrvSE.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Program Files\\Windows Sidebar\\Gadgets\\WmiPrvSE.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Users\\All Users\\Desktop\\services.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Recovery\\WindowsRE\\wininit.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Recovery\\WindowsRE\\wininit.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\upfc = "\"C:\\Windows\\Prefetch\\ReadyBoot\\upfc.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Program Files (x86)\\WindowsPowerShell\\services.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\RuntimeBroker.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Windows\\RemotePackages\\RemoteDesktops\\StartMenuExperienceHost.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

services.exe0a0a64f3c4fa7d960be983aa0a7d0ce8.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

83 ipinfo.io
84 ipinfo.io

flow	ioc
83	ipinfo.io
84	ipinfo.io

Drops file in Program Files directory 20 IoCs

Processes:

0a0a64f3c4fa7d960be983aa0a7d0ce8.exe

description	ioc	process
File created	C:\Program Files\Windows Sidebar\Gadgets\24dbde2999530e	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\RuntimeBroker.exe	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\9e8d7a4ca61bd9	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RCX920C.tmp	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RCX9299.tmp	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\services.exe	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\RCXABCE.tmp	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\RuntimeBroker.exe	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\WmiPrvSE.exe	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\WmiPrvSE.exe	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\en-US\RCXB5A8.tmp	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\en-US\SppExtComObj.exe	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
File created	C:\Program Files\Windows Photo Viewer\en-US\SppExtComObj.exe	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
File created	C:\Program Files\Windows Photo Viewer\en-US\e1ef82546f0b02	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\RCXA8BE.tmp	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\RCXAC5B.tmp	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\en-US\RCXB51B.tmp	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
File created	C:\Program Files (x86)\WindowsPowerShell\services.exe	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
File created	C:\Program Files (x86)\WindowsPowerShell\c5b4cb5e9653cc	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\RCXA93C.tmp	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe

Drops file in Windows directory 20 IoCs

Processes:

0a0a64f3c4fa7d960be983aa0a7d0ce8.exe

description	ioc	process
File created	C:\Windows\RemotePackages\RemoteDesktops\StartMenuExperienceHost.exe	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
File created	C:\Windows\Prefetch\ReadyBoot\upfc.exe	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
File opened for modification	C:\Windows\INF\.NETFramework\040C\RCX9E77.tmp	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
File opened for modification	C:\Windows\SKB\Registry.exe	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
File opened for modification	C:\Windows\INF\.NETFramework\040C\System.exe	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
File created	C:\Windows\SKB\Registry.exe	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
File created	C:\Windows\SKB\ee2ad38f3d4382	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
File created	C:\Windows\RemotePackages\RemoteDesktops\55b276f4edf653	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
File created	C:\Windows\INF\.NETFramework\040C\27d1bcfc3c54e0	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
File opened for modification	C:\Windows\SKB\RCX95B8.tmp	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
File created	C:\Windows\INF\.NETFramework\040C\System.exe	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
File created	C:\Windows\Prefetch\ReadyBoot\ea1d8f6d871115	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
File opened for modification	C:\Windows\SKB\RCX952A.tmp	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
File opened for modification	C:\Windows\RemotePackages\RemoteDesktops\RCX9BE6.tmp	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
File opened for modification	C:\Windows\Prefetch\ReadyBoot\RCXA31E.tmp	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
File opened for modification	C:\Windows\RemotePackages\RemoteDesktops\RCX9B59.tmp	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
File opened for modification	C:\Windows\RemotePackages\RemoteDesktops\StartMenuExperienceHost.exe	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
File opened for modification	C:\Windows\INF\.NETFramework\040C\RCX9FE0.tmp	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
File opened for modification	C:\Windows\Prefetch\ReadyBoot\RCXA290.tmp	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
File opened for modification	C:\Windows\Prefetch\ReadyBoot\upfc.exe	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 48 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

pid	process
3988	schtasks.exe
5088	schtasks.exe
1924	schtasks.exe
3692	schtasks.exe
1492	schtasks.exe
220	schtasks.exe
1872	schtasks.exe
4552	schtasks.exe
4572	schtasks.exe
876	schtasks.exe
476	schtasks.exe
1104	schtasks.exe
4484	schtasks.exe
4436	schtasks.exe
4224	schtasks.exe
4252	schtasks.exe
3268	schtasks.exe
5100	schtasks.exe
1776	schtasks.exe
2240	schtasks.exe
4496	schtasks.exe
748	schtasks.exe
4620	schtasks.exe
808	schtasks.exe
5096	schtasks.exe
1656	schtasks.exe
2252	schtasks.exe
976	schtasks.exe
4856	schtasks.exe
3544	schtasks.exe
3444	schtasks.exe
1660	schtasks.exe
4656	schtasks.exe
1136	schtasks.exe
3372	schtasks.exe
1948	schtasks.exe
4500	schtasks.exe
1112	schtasks.exe
4752	schtasks.exe
4612	schtasks.exe
4580	schtasks.exe
1084	schtasks.exe
1268	schtasks.exe
4204	schtasks.exe
4976	schtasks.exe
4720	schtasks.exe
4652	schtasks.exe
3336	schtasks.exe

Modifies registry class 2 IoCs

Processes:

0a0a64f3c4fa7d960be983aa0a7d0ce8.exeservices.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	services.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

0a0a64f3c4fa7d960be983aa0a7d0ce8.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	process
2248	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
2248	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
2248	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
2248	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
2248	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
2248	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
2248	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
3796	powershell.exe
3796	powershell.exe
2640	powershell.exe
2640	powershell.exe
1676	powershell.exe
1676	powershell.exe
4528	powershell.exe
4528	powershell.exe
3848	powershell.exe
3848	powershell.exe
2864	powershell.exe
2864	powershell.exe
744	powershell.exe
744	powershell.exe
1276	powershell.exe
1276	powershell.exe
4624	powershell.exe
4624	powershell.exe
1132	powershell.exe
1132	powershell.exe
5012	powershell.exe
5012	powershell.exe
1564	powershell.exe
1564	powershell.exe
4484	powershell.exe
4484	powershell.exe
1120	powershell.exe
1120	powershell.exe
4680	powershell.exe
4680	powershell.exe
4432	powershell.exe
4432	powershell.exe
3184	powershell.exe
3184	powershell.exe
3796	powershell.exe
3796	powershell.exe
1676	powershell.exe
1676	powershell.exe
2640	powershell.exe
2640	powershell.exe
2864	powershell.exe
2864	powershell.exe
4528	powershell.exe
4528	powershell.exe
3848	powershell.exe
3848	powershell.exe
744	powershell.exe
744	powershell.exe
1276	powershell.exe
1276	powershell.exe
4624	powershell.exe
4624	powershell.exe
1132	powershell.exe
1132	powershell.exe
4484	powershell.exe
1564	powershell.exe
1564	powershell.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

Processes:

description	pid	process
Token: SeDebugPrivilege	2248	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Token: SeDebugPrivilege	3796	powershell.exe
Token: SeDebugPrivilege	2640	powershell.exe
Token: SeDebugPrivilege	1676	powershell.exe
Token: SeDebugPrivilege	4528	powershell.exe
Token: SeDebugPrivilege	3848	powershell.exe
Token: SeDebugPrivilege	2864	powershell.exe
Token: SeDebugPrivilege	744	powershell.exe
Token: SeDebugPrivilege	1276	powershell.exe
Token: SeDebugPrivilege	4624	powershell.exe
Token: SeDebugPrivilege	1132	powershell.exe
Token: SeDebugPrivilege	5012	powershell.exe
Token: SeDebugPrivilege	1564	powershell.exe
Token: SeDebugPrivilege	4484	powershell.exe
Token: SeDebugPrivilege	1120	powershell.exe
Token: SeDebugPrivilege	4680	powershell.exe
Token: SeDebugPrivilege	4432	powershell.exe
Token: SeDebugPrivilege	3184	powershell.exe
Token: SeDebugPrivilege	5892	services.exe
Token: SeBackupPrivilege	5200	vssvc.exe
Token: SeRestorePrivilege	5200	vssvc.exe
Token: SeAuditPrivilege	5200	vssvc.exe

Suspicious use of WriteProcessMemory 44 IoCs

Processes:

0a0a64f3c4fa7d960be983aa0a7d0ce8.execmd.exeservices.exe

description	pid	process	target process
PID 2248 wrote to memory of 3796	2248	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	powershell.exe
PID 2248 wrote to memory of 3796	2248	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	powershell.exe
PID 2248 wrote to memory of 1676	2248	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	powershell.exe
PID 2248 wrote to memory of 1676	2248	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	powershell.exe
PID 2248 wrote to memory of 2640	2248	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	powershell.exe
PID 2248 wrote to memory of 2640	2248	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	powershell.exe
PID 2248 wrote to memory of 2864	2248	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	powershell.exe
PID 2248 wrote to memory of 2864	2248	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	powershell.exe
PID 2248 wrote to memory of 4528	2248	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	powershell.exe
PID 2248 wrote to memory of 4528	2248	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	powershell.exe
PID 2248 wrote to memory of 3848	2248	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	powershell.exe
PID 2248 wrote to memory of 3848	2248	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	powershell.exe
PID 2248 wrote to memory of 744	2248	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	powershell.exe
PID 2248 wrote to memory of 744	2248	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	powershell.exe
PID 2248 wrote to memory of 1276	2248	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	powershell.exe
PID 2248 wrote to memory of 1276	2248	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	powershell.exe
PID 2248 wrote to memory of 4624	2248	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	powershell.exe
PID 2248 wrote to memory of 4624	2248	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	powershell.exe
PID 2248 wrote to memory of 1132	2248	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	powershell.exe
PID 2248 wrote to memory of 1132	2248	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	powershell.exe
PID 2248 wrote to memory of 1564	2248	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	powershell.exe
PID 2248 wrote to memory of 1564	2248	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	powershell.exe
PID 2248 wrote to memory of 4484	2248	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	powershell.exe
PID 2248 wrote to memory of 4484	2248	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	powershell.exe
PID 2248 wrote to memory of 5012	2248	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	powershell.exe
PID 2248 wrote to memory of 5012	2248	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	powershell.exe
PID 2248 wrote to memory of 1120	2248	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	powershell.exe
PID 2248 wrote to memory of 1120	2248	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	powershell.exe
PID 2248 wrote to memory of 4680	2248	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	powershell.exe
PID 2248 wrote to memory of 4680	2248	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	powershell.exe
PID 2248 wrote to memory of 4432	2248	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	powershell.exe
PID 2248 wrote to memory of 4432	2248	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	powershell.exe
PID 2248 wrote to memory of 3184	2248	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	powershell.exe
PID 2248 wrote to memory of 3184	2248	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	powershell.exe
PID 2248 wrote to memory of 4760	2248	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	cmd.exe
PID 2248 wrote to memory of 4760	2248	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	cmd.exe
PID 4760 wrote to memory of 5372	4760	cmd.exe	w32tm.exe
PID 4760 wrote to memory of 5372	4760	cmd.exe	w32tm.exe
PID 4760 wrote to memory of 5892	4760	cmd.exe	services.exe
PID 4760 wrote to memory of 5892	4760	cmd.exe	services.exe
PID 5892 wrote to memory of 3004	5892	services.exe	WScript.exe
PID 5892 wrote to memory of 3004	5892	services.exe	WScript.exe
PID 5892 wrote to memory of 996	5892	services.exe	WScript.exe
PID 5892 wrote to memory of 996	5892	services.exe	WScript.exe

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

Processes:

services.exe0a0a64f3c4fa7d960be983aa0a7d0ce8.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	services.exe

C:\Users\Admin\AppData\Local\Temp\0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
"C:\Users\Admin\AppData\Local\Temp\0a0a64f3c4fa7d960be983aa0a7d0ce8.exe"
1⤵
- DcRat
- Modifies WinLogon for persistence
- UAC bypass
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2248

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\0a0a64f3c4fa7d960be983aa0a7d0ce8.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3796

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\WmiPrvSE.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2640

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Recent\taskhostw.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2864

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Sidebar\Gadgets\WmiPrvSE.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4528

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\wininit.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1676

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\SKB\Registry.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3848

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\RuntimeBroker.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:744

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\INF\.NETFramework\040C\System.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4624

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Prefetch\ReadyBoot\upfc.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1132

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\WindowsPowerShell\services.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4484

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\WindowsPowerShell\Modules\RuntimeBroker.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5012

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\RuntimeBroker.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1564

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\RemotePackages\RemoteDesktops\StartMenuExperienceHost.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1276

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Desktop\services.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1120

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Application Data\RuntimeBroker.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4680

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Photo Viewer\en-US\SppExtComObj.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4432

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\System.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3184

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WAYFjljOjk.bat"
2⤵
- Suspicious use of WriteProcessMemory
PID:4760

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
3⤵
PID:5372

C:\Users\All Users\Desktop\services.exe
"C:\Users\All Users\Desktop\services.exe"
3⤵
- UAC bypass
- Executes dropped EXE
- Checks computer location settings
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5892

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9a7c8142-69f2-4599-8e4c-78a3187fccff.vbs"
4⤵
PID:3004

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5f96a65d-6056-4da4-89e7-0bbf7fbc86a2.vbs"
4⤵
PID:996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\WmiPrvSE.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\Recent\taskhostw.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Users\Admin\Recent\taskhostw.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\Recent\taskhostw.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Sidebar\Gadgets\WmiPrvSE.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Gadgets\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Sidebar\Gadgets\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 9 /tr "'C:\Windows\SKB\Registry.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Windows\SKB\Registry.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 6 /tr "'C:\Windows\SKB\Registry.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 10 /tr "'C:\Windows\RemotePackages\RemoteDesktops\StartMenuExperienceHost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Windows\RemotePackages\RemoteDesktops\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 11 /tr "'C:\Windows\RemotePackages\RemoteDesktops\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Windows\INF\.NETFramework\040C\System.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\INF\.NETFramework\040C\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Windows\INF\.NETFramework\040C\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 10 /tr "'C:\Windows\Prefetch\ReadyBoot\upfc.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Windows\Prefetch\ReadyBoot\upfc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 8 /tr "'C:\Windows\Prefetch\ReadyBoot\upfc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\odt\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\odt\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\odt\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\WindowsPowerShell\services.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\WindowsPowerShell\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Desktop\services.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Users\All Users\Desktop\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\Desktop\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\Application Data\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Admin\Application Data\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\Application Data\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Photo Viewer\en-US\SppExtComObj.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\en-US\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Photo Viewer\en-US\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\System.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Admin\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1948

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5200

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Winlogon Helper DLL

T1004

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Bypass User Account Control

T1088

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
ecceac16628651c18879d836acfcb062

SHA1
420502b3e5220a01586c59504e94aa1ee11982c9

SHA256
58238de09a8817ed9f894ed8e5bf06a897fd08e0b0bd77e508d37b2598edd2a9

SHA512
be3c7cb529cafb00f58790a6f8b35c4ff6db9f7f43a507d2218fd80cebc88413e46f71b1bc35b8afcc36b68f9409c946470d1e74a4fe225400eeb6f3f898f5b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
ecceac16628651c18879d836acfcb062

SHA1
420502b3e5220a01586c59504e94aa1ee11982c9

SHA256
58238de09a8817ed9f894ed8e5bf06a897fd08e0b0bd77e508d37b2598edd2a9

SHA512
be3c7cb529cafb00f58790a6f8b35c4ff6db9f7f43a507d2218fd80cebc88413e46f71b1bc35b8afcc36b68f9409c946470d1e74a4fe225400eeb6f3f898f5b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
e8ce785f8ccc6d202d56fefc59764945

SHA1
ca032c62ddc5e0f26d84eff9895eb87f14e15960

SHA256
d85c19fc6b9d25e2168a2cc50ff38bd226fbf4f02aa7ac038a5f319522d2ffa4

SHA512
66460aec4afee582556270f8ee6048d130a090f1c12a2632ed71a99a4073e9931e9e1cc286e32debffb95a90bd955f0f0d6ec891b1c5cd2f0aae41eb6d25832f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
aaaac7c68d2b7997ed502c26fd9f65c2

SHA1
7c5a3731300d672bf53c43e2f9e951c745f7fbdf

SHA256
8724dc2c3c8e8f17aeefae44a23741b1ea3b43c490fbc52fd61575ffe1cd82bb

SHA512
c526febd9430413b48bed976edd9a795793ad1f06c8ff4f6b768b4ad63f4d2f06b9da72d4fcfa7cb9530a64e2dc3554f5ad97fd0ab60129701d175f2724ef1ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
aaaac7c68d2b7997ed502c26fd9f65c2

SHA1
7c5a3731300d672bf53c43e2f9e951c745f7fbdf

SHA256
8724dc2c3c8e8f17aeefae44a23741b1ea3b43c490fbc52fd61575ffe1cd82bb

SHA512
c526febd9430413b48bed976edd9a795793ad1f06c8ff4f6b768b4ad63f4d2f06b9da72d4fcfa7cb9530a64e2dc3554f5ad97fd0ab60129701d175f2724ef1ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\5f96a65d-6056-4da4-89e7-0bbf7fbc86a2.vbs
Filesize
491B

MD5
ee64068297bbe93860db86af6d8ebae2

SHA1
1db06ef996a08531235e25204751dc6eb5b6d05e

SHA256
39ec08b47ad14d11c65749b2033a59ae2e31a2f1cc6b67f02bf02084e483e4d3

SHA512
1d8e01b9437ed3ed77ae82c15c84e00cf0c47e86899c5d2a86fa6b8597f4d457d273df772239371a379f178ee42779f67dc83af285b712147ac988e115553f8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\9a7c8142-69f2-4599-8e4c-78a3187fccff.vbs
Filesize
715B

MD5
18614fbb8ab9f52dc1bc6373c400c93c

SHA1
ec3e8d69312dbd39c8fa14642ac6fc73216c42d7

SHA256
98a4913c45cad021b41de91d8aa7361c17fd1604cc1505bd7f352b20555d7c14

SHA512
0c2a46d71ebb8432a71385dbe5c42e7d1a3a3b40e859f9e5954ae49321db4eb88acd84e2fefd364b2d5dd463888baa56cbbeae4a9f24e57153c7a87f2e1e9354

Download Submit
C:\Users\Admin\AppData\Local\Temp\WAYFjljOjk.bat
Filesize
204B

MD5
09bc6f236ebbf6d5b794ce788cd4ae7b

SHA1
dcadc226a0a84bca2ce3af19ffe8a6c94b53ff74

SHA256
a8992b7942c730a630ae4defff09aaaa3ea898028ccf66322f8b82d5d127b959

SHA512
0f78ae6f8de1758704fe8b7be5faeda2043f3f138d0b4ea250cf0c4cd76d5e29f3d6caa385e97281119f8d01c5a764c93b3607a6b815f4e798a0adb62cfd2145

Download Submit
C:\Users\All Users\Desktop\services.exe
Filesize
3.8MB

MD5
03b76d5b0761c7c9e09491a7aa8ac926

SHA1
0a328b78ea03445c401c7a2dced42c538baf2f6a

SHA256
31dffaee3196287c369a0e07ec35b9ecc95262ae9a4ef9c4b8a407312278a7ee

SHA512
3b8748d10f3981bc553b3b1a962cb33920a0a9a268b10c5c9638301ca22f44f3a0b9ce8490b68ee864c2347e65b6299aecaccda2df3cbc0e0f75d3584babc336

Download Submit
C:\Users\Public\Desktop\services.exe
Filesize
3.8MB

MD5
03b76d5b0761c7c9e09491a7aa8ac926

SHA1
0a328b78ea03445c401c7a2dced42c538baf2f6a

SHA256
31dffaee3196287c369a0e07ec35b9ecc95262ae9a4ef9c4b8a407312278a7ee

SHA512
3b8748d10f3981bc553b3b1a962cb33920a0a9a268b10c5c9638301ca22f44f3a0b9ce8490b68ee864c2347e65b6299aecaccda2df3cbc0e0f75d3584babc336

Download Submit
memory/744-162-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

Filesize
10.8MB

Download
memory/744-197-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

Filesize
10.8MB

Download
memory/744-143-0x0000000000000000-mapping.dmp

Download
memory/996-216-0x0000000000000000-mapping.dmp

Download
memory/1120-150-0x0000000000000000-mapping.dmp

Download
memory/1120-208-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

Filesize
10.8MB

Download
memory/1120-166-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

Filesize
10.8MB

Download
memory/1132-195-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

Filesize
10.8MB

Download
memory/1132-146-0x0000000000000000-mapping.dmp

Download
memory/1132-174-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

Filesize
10.8MB

Download
memory/1276-191-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

Filesize
10.8MB

Download
memory/1276-144-0x0000000000000000-mapping.dmp

Download
memory/1276-173-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

Filesize
10.8MB

Download
memory/1564-196-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

Filesize
10.8MB

Download
memory/1564-164-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

Filesize
10.8MB

Download
memory/1564-147-0x0000000000000000-mapping.dmp

Download
memory/1676-180-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

Filesize
10.8MB

Download
memory/1676-138-0x0000000000000000-mapping.dmp

Download
memory/1676-155-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

Filesize
10.8MB

Download
memory/2248-133-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

Filesize
10.8MB

Download
memory/2248-134-0x000000001BCA0000-0x000000001BCF0000-memory.dmp

Filesize
320KB

Download
memory/2248-136-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

Filesize
10.8MB

Download
memory/2248-135-0x000000001D960000-0x000000001DE88000-memory.dmp

Filesize
5.2MB

Download
memory/2248-161-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

Filesize
10.8MB

Download
memory/2248-132-0x0000000000CC0000-0x000000000108A000-memory.dmp

Filesize
3.8MB

Download
memory/2640-139-0x0000000000000000-mapping.dmp

Download
memory/2640-187-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

Filesize
10.8MB

Download
memory/2640-156-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

Filesize
10.8MB

Download
memory/2864-186-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

Filesize
10.8MB

Download
memory/2864-158-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

Filesize
10.8MB

Download
memory/2864-140-0x0000000000000000-mapping.dmp

Download
memory/3004-215-0x0000000000000000-mapping.dmp

Download
memory/3184-170-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

Filesize
10.8MB

Download
memory/3184-205-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

Filesize
10.8MB

Download
memory/3184-154-0x0000000000000000-mapping.dmp

Download
memory/3796-157-0x000001437D930000-0x000001437D952000-memory.dmp

Filesize
136KB

Download
memory/3796-176-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

Filesize
10.8MB

Download
memory/3796-152-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

Filesize
10.8MB

Download
memory/3796-137-0x0000000000000000-mapping.dmp

Download
memory/3848-172-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

Filesize
10.8MB

Download
memory/3848-142-0x0000000000000000-mapping.dmp

Download
memory/3848-185-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

Filesize
10.8MB

Download
memory/4432-169-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

Filesize
10.8MB

Download
memory/4432-203-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

Filesize
10.8MB

Download
memory/4432-153-0x0000000000000000-mapping.dmp

Download
memory/4484-199-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

Filesize
10.8MB

Download
memory/4484-175-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

Filesize
10.8MB

Download
memory/4484-148-0x0000000000000000-mapping.dmp

Download
memory/4528-184-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

Filesize
10.8MB

Download
memory/4528-160-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

Filesize
10.8MB

Download
memory/4528-141-0x0000000000000000-mapping.dmp

Download
memory/4624-192-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

Filesize
10.8MB

Download
memory/4624-145-0x0000000000000000-mapping.dmp

Download
memory/4624-163-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

Filesize
10.8MB

Download
memory/4680-167-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

Filesize
10.8MB

Download
memory/4680-209-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

Filesize
10.8MB

Download
memory/4680-151-0x0000000000000000-mapping.dmp

Download
memory/4760-159-0x0000000000000000-mapping.dmp

Download
memory/5012-149-0x0000000000000000-mapping.dmp

Download
memory/5012-165-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

Filesize
10.8MB

Download
memory/5012-204-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

Filesize
10.8MB

Download
memory/5372-171-0x0000000000000000-mapping.dmp

Download
memory/5892-213-0x0000000000600000-0x00000000009CA000-memory.dmp

Filesize
3.8MB

Download
memory/5892-214-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

Filesize
10.8MB

Download
memory/5892-210-0x0000000000000000-mapping.dmp

Download
memory/5892-219-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

Filesize
10.8MB

Download
memory/5892-220-0x000000001FAF0000-0x000000001FCB2000-memory.dmp

Filesize
1.8MB

Download