dcrat | a87d18df4d58e31acb40b03e05c9de4a507991b1d4f3ba8cc22b599671fbf43a

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
15/01/2024, 05:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
154bc4130ed9dc590f44a77f3c843336.exe
Size 3.1MB
Sample240115-fx5btsaaep
SHA256 a87d18df4d58e31acb40b03e05c9de4a507991b1d4f3ba8cc22b599671fbf43a
MD5 154bc4130ed9dc590f44a77f3c843336
SHA1 af6a213ad6ce7289e517eb6c5e8f401de16e4e1c
SHA512 a9e68df4a8a5dd8101e3125636ee0408471c801910360055cb6a70102486ca6497511286734792e3475956c7b2cbd37b969699c7c60d55e97175dd45c682afd5
SSDEEP 49152:e+Vfco13ZYKVjVQq/ykNLZDQJ/7W4l1YKP7WTeSpRxWi2eFVXuSqYBG9Tw:eNo1hQqKWLZkI4l1Yd6zyVXjqZT
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat evasion infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 27 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2584	2844	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2612	2844	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2748	2844	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3064	2844	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2596	2844	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1968	2844	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2860	2844	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2756	2844	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2916	2844	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1664	2844	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1196	2844	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1056	2844	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2012	2844	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2476	2844	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2028	2844	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2556	2844	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	556	2844	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1908	2844	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1984	2844	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	320	2844	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	108	2844	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1624	2844	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1328	2844	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1860	2844	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1060	2844	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1308	2844	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2264	2844	schtasks.exe	28

UAC bypass 3 TTPs 30 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	154bc4130ed9dc590f44a77f3c843336.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	154bc4130ed9dc590f44a77f3c843336.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	154bc4130ed9dc590f44a77f3c843336.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe

DCRat payload 8 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/1648-0-0x0000000000C20000-0x0000000000F42000-memory.dmp	dcrat
behavioral1/files/0x0006000000014f08-38.dat	dcrat
behavioral1/files/0x00060000000162d1-76.dat	dcrat
behavioral1/files/0x00090000000142b3-115.dat	dcrat
behavioral1/files/0x0008000000014b87-127.dat	dcrat
behavioral1/files/0x000700000001549c-151.dat	dcrat
behavioral1/files/0x000d0000000122c2-272.dat	dcrat
behavioral1/files/0x000d0000000122c2-271.dat	dcrat

Executes dropped EXE 9 IoCs

pid	Process
948	Idle.exe
2608	Idle.exe
1220	Idle.exe
2036	Idle.exe
1576	Idle.exe
748	Idle.exe
1628	Idle.exe
980	Idle.exe
3044	Idle.exe

Checks whether UAC is enabled 1 TTPs 20 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	154bc4130ed9dc590f44a77f3c843336.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Idle.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	154bc4130ed9dc590f44a77f3c843336.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Idle.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Idle.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Idle.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Idle.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com
17	ip-api.com
30	ip-api.com

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Mail\fr-FR\cc11b995f2a76d	154bc4130ed9dc590f44a77f3c843336.exe
File created	C:\Program Files\Uninstall Information\lsm.exe	154bc4130ed9dc590f44a77f3c843336.exe
File opened for modification	C:\Program Files\Uninstall Information\lsm.exe	154bc4130ed9dc590f44a77f3c843336.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\spoolsv.exe	154bc4130ed9dc590f44a77f3c843336.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\RCX52F6.tmp	154bc4130ed9dc590f44a77f3c843336.exe
File opened for modification	C:\Program Files\Uninstall Information\RCX5D89.tmp	154bc4130ed9dc590f44a77f3c843336.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\spoolsv.exe	154bc4130ed9dc590f44a77f3c843336.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\RCX5307.tmp	154bc4130ed9dc590f44a77f3c843336.exe
File opened for modification	C:\Program Files\Windows Mail\fr-FR\RCX5819.tmp	154bc4130ed9dc590f44a77f3c843336.exe
File opened for modification	C:\Program Files\Windows Mail\fr-FR\RCX5897.tmp	154bc4130ed9dc590f44a77f3c843336.exe
File opened for modification	C:\Program Files\Windows Mail\fr-FR\winlogon.exe	154bc4130ed9dc590f44a77f3c843336.exe
File opened for modification	C:\Program Files\Uninstall Information\RCX5DB9.tmp	154bc4130ed9dc590f44a77f3c843336.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\f3b6ecef712a24	154bc4130ed9dc590f44a77f3c843336.exe
File created	C:\Program Files\Windows Mail\fr-FR\winlogon.exe	154bc4130ed9dc590f44a77f3c843336.exe
File created	C:\Program Files\Uninstall Information\101b941d020240	154bc4130ed9dc590f44a77f3c843336.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\ShellNew\services.exe	154bc4130ed9dc590f44a77f3c843336.exe
File created	C:\Windows\ShellNew\c5b4cb5e9653cc	154bc4130ed9dc590f44a77f3c843336.exe
File opened for modification	C:\Windows\ShellNew\RCX5ABA.tmp	154bc4130ed9dc590f44a77f3c843336.exe
File opened for modification	C:\Windows\ShellNew\RCX5B57.tmp	154bc4130ed9dc590f44a77f3c843336.exe
File opened for modification	C:\Windows\ShellNew\services.exe	154bc4130ed9dc590f44a77f3c843336.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 27 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2748	schtasks.exe
2916	schtasks.exe
1624	schtasks.exe
1328	schtasks.exe
3064	schtasks.exe
1664	schtasks.exe
2028	schtasks.exe
1908	schtasks.exe
2584	schtasks.exe
2860	schtasks.exe
2264	schtasks.exe
2596	schtasks.exe
2556	schtasks.exe
1984	schtasks.exe
1968	schtasks.exe
2012	schtasks.exe
1860	schtasks.exe
1308	schtasks.exe
2612	schtasks.exe
2476	schtasks.exe
1060	schtasks.exe
2756	schtasks.exe
1196	schtasks.exe
1056	schtasks.exe
556	schtasks.exe
320	schtasks.exe
108	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1648	154bc4130ed9dc590f44a77f3c843336.exe
1648	154bc4130ed9dc590f44a77f3c843336.exe
1648	154bc4130ed9dc590f44a77f3c843336.exe
1648	154bc4130ed9dc590f44a77f3c843336.exe
1648	154bc4130ed9dc590f44a77f3c843336.exe
1648	154bc4130ed9dc590f44a77f3c843336.exe
1648	154bc4130ed9dc590f44a77f3c843336.exe
1648	154bc4130ed9dc590f44a77f3c843336.exe
1648	154bc4130ed9dc590f44a77f3c843336.exe
1648	154bc4130ed9dc590f44a77f3c843336.exe
1648	154bc4130ed9dc590f44a77f3c843336.exe
1648	154bc4130ed9dc590f44a77f3c843336.exe
1648	154bc4130ed9dc590f44a77f3c843336.exe
1648	154bc4130ed9dc590f44a77f3c843336.exe
1648	154bc4130ed9dc590f44a77f3c843336.exe
1648	154bc4130ed9dc590f44a77f3c843336.exe
1648	154bc4130ed9dc590f44a77f3c843336.exe
1648	154bc4130ed9dc590f44a77f3c843336.exe
1648	154bc4130ed9dc590f44a77f3c843336.exe
1648	154bc4130ed9dc590f44a77f3c843336.exe
1648	154bc4130ed9dc590f44a77f3c843336.exe
1648	154bc4130ed9dc590f44a77f3c843336.exe
1648	154bc4130ed9dc590f44a77f3c843336.exe
1648	154bc4130ed9dc590f44a77f3c843336.exe
1648	154bc4130ed9dc590f44a77f3c843336.exe
1648	154bc4130ed9dc590f44a77f3c843336.exe
1648	154bc4130ed9dc590f44a77f3c843336.exe
1648	154bc4130ed9dc590f44a77f3c843336.exe
1648	154bc4130ed9dc590f44a77f3c843336.exe
1648	154bc4130ed9dc590f44a77f3c843336.exe
1648	154bc4130ed9dc590f44a77f3c843336.exe
1648	154bc4130ed9dc590f44a77f3c843336.exe
1648	154bc4130ed9dc590f44a77f3c843336.exe
1648	154bc4130ed9dc590f44a77f3c843336.exe
2280	powershell.exe
984	powershell.exe
1076	powershell.exe
1500	powershell.exe
3040	powershell.exe
2544	powershell.exe
2944	powershell.exe
2032	powershell.exe
876	powershell.exe
3012	powershell.exe
948	Idle.exe
948	Idle.exe
948	Idle.exe
948	Idle.exe
948	Idle.exe
948	Idle.exe
948	Idle.exe
948	Idle.exe
948	Idle.exe
948	Idle.exe
948	Idle.exe
948	Idle.exe
948	Idle.exe
948	Idle.exe
948	Idle.exe
948	Idle.exe
948	Idle.exe
948	Idle.exe
948	Idle.exe
948	Idle.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	1648	154bc4130ed9dc590f44a77f3c843336.exe
Token: SeDebugPrivilege	2280	powershell.exe
Token: SeDebugPrivilege	984	powershell.exe
Token: SeDebugPrivilege	1076	powershell.exe
Token: SeDebugPrivilege	1500	powershell.exe
Token: SeDebugPrivilege	3040	powershell.exe
Token: SeDebugPrivilege	2544	powershell.exe
Token: SeDebugPrivilege	2944	powershell.exe
Token: SeDebugPrivilege	2032	powershell.exe
Token: SeDebugPrivilege	876	powershell.exe
Token: SeDebugPrivilege	3012	powershell.exe
Token: SeDebugPrivilege	948	Idle.exe
Token: SeDebugPrivilege	2608	Idle.exe
Token: SeDebugPrivilege	1220	Idle.exe
Token: SeDebugPrivilege	2036	Idle.exe
Token: SeDebugPrivilege	1576	Idle.exe
Token: SeDebugPrivilege	748	Idle.exe
Token: SeDebugPrivilege	1628	Idle.exe
Token: SeDebugPrivilege	980	Idle.exe
Token: SeDebugPrivilege	3044	Idle.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 2280	1648	154bc4130ed9dc590f44a77f3c843336.exe	75
PID 1648 wrote to memory of 2280	1648	154bc4130ed9dc590f44a77f3c843336.exe	75
PID 1648 wrote to memory of 2280	1648	154bc4130ed9dc590f44a77f3c843336.exe	75
PID 1648 wrote to memory of 2544	1648	154bc4130ed9dc590f44a77f3c843336.exe	74
PID 1648 wrote to memory of 2544	1648	154bc4130ed9dc590f44a77f3c843336.exe	74
PID 1648 wrote to memory of 2544	1648	154bc4130ed9dc590f44a77f3c843336.exe	74
PID 1648 wrote to memory of 2032	1648	154bc4130ed9dc590f44a77f3c843336.exe	72
PID 1648 wrote to memory of 2032	1648	154bc4130ed9dc590f44a77f3c843336.exe	72
PID 1648 wrote to memory of 2032	1648	154bc4130ed9dc590f44a77f3c843336.exe	72
PID 1648 wrote to memory of 984	1648	154bc4130ed9dc590f44a77f3c843336.exe	71
PID 1648 wrote to memory of 984	1648	154bc4130ed9dc590f44a77f3c843336.exe	71
PID 1648 wrote to memory of 984	1648	154bc4130ed9dc590f44a77f3c843336.exe	71
PID 1648 wrote to memory of 1500	1648	154bc4130ed9dc590f44a77f3c843336.exe	70
PID 1648 wrote to memory of 1500	1648	154bc4130ed9dc590f44a77f3c843336.exe	70
PID 1648 wrote to memory of 1500	1648	154bc4130ed9dc590f44a77f3c843336.exe	70
PID 1648 wrote to memory of 876	1648	154bc4130ed9dc590f44a77f3c843336.exe	69
PID 1648 wrote to memory of 876	1648	154bc4130ed9dc590f44a77f3c843336.exe	69
PID 1648 wrote to memory of 876	1648	154bc4130ed9dc590f44a77f3c843336.exe	69
PID 1648 wrote to memory of 2944	1648	154bc4130ed9dc590f44a77f3c843336.exe	68
PID 1648 wrote to memory of 2944	1648	154bc4130ed9dc590f44a77f3c843336.exe	68
PID 1648 wrote to memory of 2944	1648	154bc4130ed9dc590f44a77f3c843336.exe	68
PID 1648 wrote to memory of 1076	1648	154bc4130ed9dc590f44a77f3c843336.exe	67
PID 1648 wrote to memory of 1076	1648	154bc4130ed9dc590f44a77f3c843336.exe	67
PID 1648 wrote to memory of 1076	1648	154bc4130ed9dc590f44a77f3c843336.exe	67
PID 1648 wrote to memory of 3012	1648	154bc4130ed9dc590f44a77f3c843336.exe	66
PID 1648 wrote to memory of 3012	1648	154bc4130ed9dc590f44a77f3c843336.exe	66
PID 1648 wrote to memory of 3012	1648	154bc4130ed9dc590f44a77f3c843336.exe	66
PID 1648 wrote to memory of 3040	1648	154bc4130ed9dc590f44a77f3c843336.exe	65
PID 1648 wrote to memory of 3040	1648	154bc4130ed9dc590f44a77f3c843336.exe	65
PID 1648 wrote to memory of 3040	1648	154bc4130ed9dc590f44a77f3c843336.exe	65
PID 1648 wrote to memory of 2792	1648	154bc4130ed9dc590f44a77f3c843336.exe	76
PID 1648 wrote to memory of 2792	1648	154bc4130ed9dc590f44a77f3c843336.exe	76
PID 1648 wrote to memory of 2792	1648	154bc4130ed9dc590f44a77f3c843336.exe	76
PID 2792 wrote to memory of 2584	2792	cmd.exe	78
PID 2792 wrote to memory of 2584	2792	cmd.exe	78
PID 2792 wrote to memory of 2584	2792	cmd.exe	78
PID 2792 wrote to memory of 948	2792	cmd.exe	79
PID 2792 wrote to memory of 948	2792	cmd.exe	79
PID 2792 wrote to memory of 948	2792	cmd.exe	79
PID 948 wrote to memory of 2468	948	Idle.exe	80
PID 948 wrote to memory of 2468	948	Idle.exe	80
PID 948 wrote to memory of 2468	948	Idle.exe	80
PID 948 wrote to memory of 2972	948	Idle.exe	81
PID 948 wrote to memory of 2972	948	Idle.exe	81
PID 948 wrote to memory of 2972	948	Idle.exe	81
PID 2468 wrote to memory of 2608	2468	WScript.exe	82
PID 2468 wrote to memory of 2608	2468	WScript.exe	82
PID 2468 wrote to memory of 2608	2468	WScript.exe	82
PID 2608 wrote to memory of 1636	2608	Idle.exe	83
PID 2608 wrote to memory of 1636	2608	Idle.exe	83
PID 2608 wrote to memory of 1636	2608	Idle.exe	83
PID 2608 wrote to memory of 2324	2608	Idle.exe	84
PID 2608 wrote to memory of 2324	2608	Idle.exe	84
PID 2608 wrote to memory of 2324	2608	Idle.exe	84
PID 1636 wrote to memory of 1220	1636	WScript.exe	87
PID 1636 wrote to memory of 1220	1636	WScript.exe	87
PID 1636 wrote to memory of 1220	1636	WScript.exe	87
PID 1220 wrote to memory of 2576	1220	Idle.exe	88
PID 1220 wrote to memory of 2576	1220	Idle.exe	88
PID 1220 wrote to memory of 2576	1220	Idle.exe	88
PID 1220 wrote to memory of 3036	1220	Idle.exe	89
PID 1220 wrote to memory of 3036	1220	Idle.exe	89
PID 1220 wrote to memory of 3036	1220	Idle.exe	89
PID 2576 wrote to memory of 2036	2576	WScript.exe	90

System policy modification 1 TTPs 30 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	154bc4130ed9dc590f44a77f3c843336.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	154bc4130ed9dc590f44a77f3c843336.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	154bc4130ed9dc590f44a77f3c843336.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\154bc4130ed9dc590f44a77f3c843336.exe
"C:\Users\Admin\AppData\Local\Temp\154bc4130ed9dc590f44a77f3c843336.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1648
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Downloads\taskhost.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3040
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\179d7a82-9b9c-11ee-95b5-e6b52eba4e86\lsm.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3012
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Uninstall Information\lsm.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1076
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ShellNew\services.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2944
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Mail\fr-FR\winlogon.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:876
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\179d7a82-9b9c-11ee-95b5-e6b52eba4e86\lsass.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1500
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Reference Assemblies\Microsoft\spoolsv.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:984
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Desktop\lsm.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2032
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\Idle.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2544
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\154bc4130ed9dc590f44a77f3c843336.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2280
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\kjrv1PTF5B.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2792
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:2584
- - C:\Users\Default User\Idle.exe
    "C:\Users\Default User\Idle.exe"
    3⤵
    - UAC bypass
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:948
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\81121eb4-5fd7-4f88-bd27-71aa4cd28a91.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2468
    - - C:\Users\Default User\Idle.exe
        
        "C:\Users\Default User\Idle.exe"
        5⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2608
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5ce3cd35-967e-4198-ae93-5d64500ce636.vbs"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1636
        
        C:\Users\Default User\Idle.exe
        
        "C:\Users\Default User\Idle.exe"
        7⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1220
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c483ede7-3ae1-4186-adb2-79f1611dd06a.vbs"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:2576
        
        C:\Users\Default User\Idle.exe
        
        "C:\Users\Default User\Idle.exe"
        9⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2036
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2fa91584-16d6-4e66-820d-bbc9d854291c.vbs"
        10⤵
        
        PID:2584
        
        C:\Users\Default User\Idle.exe
        
        "C:\Users\Default User\Idle.exe"
        11⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1576
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e2ced20b-6844-4915-840c-bf76d6f5c319.vbs"
        12⤵
        
        PID:2172
        
        C:\Users\Default User\Idle.exe
        
        "C:\Users\Default User\Idle.exe"
        13⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:748
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c370dac7-48a4-4ea1-84f4-5f7799f0a04d.vbs"
        14⤵
        
        PID:1908
        
        C:\Users\Default User\Idle.exe
        
        "C:\Users\Default User\Idle.exe"
        15⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1628
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2a15c4ac-3eff-42d9-b5bf-0015836e20ba.vbs"
        16⤵
        
        PID:2312
        
        C:\Users\Default User\Idle.exe
        
        "C:\Users\Default User\Idle.exe"
        17⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:980
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a7a9315f-9fd7-40d1-a349-bd793a209327.vbs"
        18⤵
        
        PID:1100
        
        C:\Users\Default User\Idle.exe
        
        "C:\Users\Default User\Idle.exe"
        19⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3044
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\301681ab-4491-4c2d-966e-86f19146db33.vbs"
        20⤵
        
        PID:1184
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d753d0e3-1917-475d-8893-a61203275008.vbs"
        20⤵
        
        PID:1084
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1df91854-8339-4824-a811-20df9be7ea25.vbs"
        18⤵
        
        PID:2000
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9284f257-a233-451a-af29-59580619c79a.vbs"
        16⤵
        
        PID:2948
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\547d3bbd-199e-4cfd-b28c-daa102611b37.vbs"
        14⤵
        
        PID:2728
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e38f476e-d4dd-4058-9342-f0109fdbbb6a.vbs"
        12⤵
        
        PID:2380
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\62ded68b-3208-45e4-96a6-6161d4bb4333.vbs"
        10⤵
        
        PID:1432
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b39db24c-f243-48de-bb71-9a2b46ab47a1.vbs"
        8⤵
        
        PID:3036
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f5e0e85f-b59e-44c3-a2e8-4fd8363ae101.vbs"
        6⤵
        
        PID:2324
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\622263cd-bca2-41e8-bc47-3e5dce3c0525.vbs"
      4⤵
      PID:2972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Default User\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Desktop\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Users\Default\Desktop\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 7 /tr "'C:\Users\Default\Desktop\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Recovery\179d7a82-9b9c-11ee-95b5-e6b52eba4e86\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\179d7a82-9b9c-11ee-95b5-e6b52eba4e86\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Recovery\179d7a82-9b9c-11ee-95b5-e6b52eba4e86\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Mail\fr-FR\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\fr-FR\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Mail\fr-FR\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Windows\ShellNew\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\ShellNew\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Windows\ShellNew\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 14 /tr "'C:\Program Files\Uninstall Information\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 10 /tr "'C:\Program Files\Uninstall Information\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 9 /tr "'C:\Recovery\179d7a82-9b9c-11ee-95b5-e6b52eba4e86\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Recovery\179d7a82-9b9c-11ee-95b5-e6b52eba4e86\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 13 /tr "'C:\Recovery\179d7a82-9b9c-11ee-95b5-e6b52eba4e86\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 5 /tr "'C:\Users\Public\Downloads\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Users\Public\Downloads\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 14 /tr "'C:\Users\Public\Downloads\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

winlogon.exe

Path C:\Program Files\Windows Mail\fr-FR\winlogon.exe
Size 3.1MB
SHA256 a87d18df4d58e31acb40b03e05c9de4a507991b1d4f3ba8cc22b599671fbf43a
MD5 154bc4130ed9dc590f44a77f3c843336
SHA1 af6a213ad6ce7289e517eb6c5e8f401de16e4e1c
SHA512 a9e68df4a8a5dd8101e3125636ee0408471c801910360055cb6a70102486ca6497511286734792e3475956c7b2cbd37b969699c7c60d55e97175dd45c682afd5
SSDEEP 49152:e+Vfco13ZYKVjVQq/ykNLZDQJ/7W4l1YKP7WTeSpRxWi2eFVXuSqYBG9Tw:eNo1hQqKWLZkI4l1Yd6zyVXjqZT
MD5 SHA1 SHA512 SSDEEP

Submit Download

winlogon.exe

Path C:\Program Files\Windows Mail\fr-FR\winlogon.exe
Size 3.1MB
SHA256 53bc25ad19a6a80fa26dcb7fcb07d20880aeb7d91696614f48cba17516aeff9e
MD5 0fd06beb89b55996eebec122cfd10ce0
SHA1 243d4073d33d0cf65dca51c93e8c2ad8176d39b4
SHA512 5af8c1841f81680b9d26aeee3ce922f2f8641c827309ae77719bfcc0e419b8cea974cc2131cd21478a9ad2590b1097af4e8b405b0239dab82048a8d6e901167f
SSDEEP 49152:C+Vfco13ZYKVjVQq/ykNLZDQJ/7W4l1YKP7WTeSpRxWi2eFVXuSqYBG9Tw:CNo1hQqKWLZkI4l1Yd6zyVXjqZT
MD5 SHA1 SHA512 SSDEEP

Submit Download

lsm.exe

Path C:\Recovery\179d7a82-9b9c-11ee-95b5-e6b52eba4e86\lsm.exe
Size 3.1MB
SHA256 d963ddc32cd250d2902039af447c9f05f6d3e14fa11a2fc34b4b978dd77ee0ac
MD5 1467a590838ec5517f28778ead021c42
SHA1 5970c92f2ada74c6dd3705c92a5884d52e3d86bb
SHA512 a22873b4747d3927192c82c805165583a6f57b136990a3138d10f45fc6d0cccd3bc344327db8162051114cd253e93f6df12d33fd3571c550ccdda41561247834
SSDEEP 49152:i+Vfco13ZYKVjVQq/ykNLZDQJ/7W4l1YKP7WTeSpRxWi2eFVXuSqYBG9Tw:iNo1hQqKWLZkI4l1Yd6zyVXjqZT
MD5 SHA1 SHA512 SSDEEP

Submit Download

2a15c4ac-3eff-42d9-b5bf-0015836e20ba.vbs

Path C:\Users\Admin\AppData\Local\Temp\2a15c4ac-3eff-42d9-b5bf-0015836e20ba.vbs
Size 706B
SHA256 11e91f94bd4e5ef18060c681b530b0ad719d56ce7768b4c998e46e0112fe4bef
MD5 1fe5a4ebfd4d20dbfbd4e0734d248e8a
SHA1 6404d58e295226e7f967cfacfb75078f8ecda52f
SHA512 41891d036c9e3d4d78d8bdc2fec09893ad707c5e3476664d2ccbb64afaed923e0df912594a7ed332fab0b11935a95d9f465d5ee8c803b34392beb68867f5a4ba
MD5 SHA1 SHA512

Submit Download

2fa91584-16d6-4e66-820d-bbc9d854291c.vbs

Path C:\Users\Admin\AppData\Local\Temp\2fa91584-16d6-4e66-820d-bbc9d854291c.vbs
Size 706B
SHA256 40ba1f75826a2d3172ca5ea77b73560da9640b4522b8ccd4acfd435ed989d754
MD5 f5ad4da42e86e2c0a6f8501ece72fcbc
SHA1 c9b436fbfbf80999d377a616bbe2355bd319e711
SHA512 3e0fdf530732a2c9d5e0c6391ccb0fad2ebc856340cd8e73c73f57cc9e749d4a9b4289b1a814563fa5a6dee0daabff2cfb3fca51a9345df6c34d435d3595d39e
MD5 SHA1 SHA512

Submit Download

301681ab-4491-4c2d-966e-86f19146db33.vbs

Path C:\Users\Admin\AppData\Local\Temp\301681ab-4491-4c2d-966e-86f19146db33.vbs
Size 706B
SHA256 9ffce7b43e57e530411609b7fb32fa97eecf7aa49282042c4630564d5480b1e2
MD5 3a89600c570ffe9b4b3c0a314cd184cb
SHA1 076b905fae11f674618ad656daadba1d0ba89c7d
SHA512 10618636d2497acba50439a7c1b060bd908943750b7d02736637a5f9fb59ed6cddcbe74eed1456220cb020d94ca539c649d2863f496b0b738bf0992023be5957
MD5 SHA1 SHA512

Submit Download

5ce3cd35-967e-4198-ae93-5d64500ce636.vbs

Path C:\Users\Admin\AppData\Local\Temp\5ce3cd35-967e-4198-ae93-5d64500ce636.vbs
Size 706B
SHA256 da909978ade90936e4f33bc1c6867cae0f4d22169714a81a47f2638d4ab35bcb
MD5 92d6a1e614d4bd25c388821bdf2839f3
SHA1 0d42642eb7efd4817d8a542bba134af457c12be7
SHA512 feaf87ac368661328de40923c799706db54b406d7f6ef169fe0a9af9ebab636ff26e03570f89b8cad41679b9f9bfaef93554e5365081d4dae6d061436e491f82
MD5 SHA1 SHA512

Submit Download

622263cd-bca2-41e8-bc47-3e5dce3c0525.vbs

Path C:\Users\Admin\AppData\Local\Temp\622263cd-bca2-41e8-bc47-3e5dce3c0525.vbs
Size 482B
SHA256 9c002aac94d98e45cac8617adf140a3478f7073bae0410f718c0fe4c42186774
MD5 4eda58bb0958d0b7a6a2e7d425fb0b79
SHA1 02cce2e241db3cb1ab61706e72c4d38fcae35581
SHA512 03ed9c0947e3d8b1dff9a0d78266e584cb7026f5d1ecd5631174a3d1aefb4d6c5502e668d7ce78c1245dc1352914b40e43c3cabb86cc7b892ab7590df08f0c93
MD5 SHA1 SHA512

Submit Download

81121eb4-5fd7-4f88-bd27-71aa4cd28a91.vbs

Path C:\Users\Admin\AppData\Local\Temp\81121eb4-5fd7-4f88-bd27-71aa4cd28a91.vbs
Size 705B
SHA256 04ca2157d3f3b6f65101b1ddd22697e043c59c372ee4c1feabb70ff65a322c51
MD5 f401b995a160362cbb985940be644287
SHA1 95cb6c681287e1dbc95cd5d9070a65933d64c013
SHA512 435e5c23eb841b2ce512dd8a8900b738916cb125a6be7bc4be285ef8c45e79ec84a6c37349e48aeaad8890eb5958a13ca4908b53c1bbeaf190eb6e880a49fb4c
MD5 SHA1 SHA512

Submit Download

a7a9315f-9fd7-40d1-a349-bd793a209327.vbs

Path C:\Users\Admin\AppData\Local\Temp\a7a9315f-9fd7-40d1-a349-bd793a209327.vbs
Size 705B
SHA256 82f1653f8511d694701e572180bbd74f5e93c35a516c5622a32faedac89e3c8d
MD5 13d2f3e311424cc0fe5353dd1f1bd917
SHA1 6d4406acb1d44e74a73530fcd65546234b89e875
SHA512 70a26dd5c3a2df033b77a6a81361cdbc32d18559986b9323e3567affa5a6da9b23e7847106a741dff4bce4bdb7b14cb1a24c63a28827b85cec53b8e9817ecc29
MD5 SHA1 SHA512

Submit Download

c370dac7-48a4-4ea1-84f4-5f7799f0a04d.vbs

Path C:\Users\Admin\AppData\Local\Temp\c370dac7-48a4-4ea1-84f4-5f7799f0a04d.vbs
Size 705B
SHA256 a8a43099fb1dda79abb3293778371305fc421c2126ec76a4d30f06bb26b8a5a8
MD5 20c113208922c63e4dfde683aa360b91
SHA1 e8bbd2618fa641da79da035d6c9fdae08e6e298f
SHA512 d8d7a72e7af4163ac282b0966c2f893a4bb525643c8b16202f1f9925e80dcce781613fd40f1528e7cc7a9479d03228f9027c9de7c1dabe5c25cea966dd396a94
MD5 SHA1 SHA512

Submit Download

c483ede7-3ae1-4186-adb2-79f1611dd06a.vbs

Path C:\Users\Admin\AppData\Local\Temp\c483ede7-3ae1-4186-adb2-79f1611dd06a.vbs
Size 706B
SHA256 b4548f15ec2500733579cfb01061ebadbf79f4dad32dec304bd7f6cee2882f1c
MD5 3397267442ce126eb9a5eaabe7f2a3ec
SHA1 82cfc0827fa26ce5c6f6da1b4a7c2d78270959d3
SHA512 53a70700b761cde06dc6b43f503c4c384426da11e3ab71ce3bcad99a50a282315f68a8f07f49460921e9fe487f282c8651dd26790c15d06c046de0e78197cee3
MD5 SHA1 SHA512

Submit Download

e2ced20b-6844-4915-840c-bf76d6f5c319.vbs

Path C:\Users\Admin\AppData\Local\Temp\e2ced20b-6844-4915-840c-bf76d6f5c319.vbs
Size 706B
SHA256 cf0f079e674a726e375dbc53a44f578db4a6ddd74c9e396139272a8cf1ed6f4a
MD5 3129715e368be26cf8904ab3adae705a
SHA1 616675ef5c5df40a4577321c40473a1b2452d05f
SHA512 84db1f6fb0e0d848007de829d96c2dac4259d40ef62817489d7c0cd607ddc8016d0d4c5132b973097b1a3e55e3fef93d398c9de4e3d955ed472c487d8c2659ac
MD5 SHA1 SHA512

Submit Download

kjrv1PTF5B.bat

Path C:\Users\Admin\AppData\Local\Temp\kjrv1PTF5B.bat
Size 195B
SHA256 c1d5d3a293f96d8c6a2eeef6ab7469c8756c2a5f077743736366c356c0c559f5
MD5 0812c3b16f9c3cb4706a0b088792c925
SHA1 22b31cb3a13d285a4f102b12a6d2b74ecdc19656
SHA512 ddf33bae4fbfc6e1b05acea4d44cfb5c82f5f7b0b536e6e7e971daef10be05887071380a15ae83e0dd66d64973bd0870e7e003ced99cb5be33a1e0fcb04e9baa
MD5 SHA1 SHA512

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 7KB
SHA256 65f23e2eb671173b4ab17fac5e2dde66110477bc5c7819ba4098157dddbf3cc0
MD5 577aa10560364f1b80b379459dcb8774
SHA1 e8cc1c86ccc20960b8e3890f9c186f2477b08e67
SHA512 99b4dcc9fde0bf822c6f8bd43208eb7fc6ca92979decda1d0a807b3f308780670f391a52c557ca22c41ec048141424ded6aaff76d985da2c98ce0788faf0eafa
SSDEEP 96:UjlbKC9M8unqvsqvJCwozjlbKC9M8unqvsEHyqvJCworZaL/QH+z71XXlUVa:4lbX6Uo/lbX6AHnorZybz71Xt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Idle.exe

Path C:\Users\Default User\Idle.exe
Size 1.0MB
SHA256 a3c239de8228b6de0e1c0f4500cdceba6ee0285af4c666b70657259c895363f0
MD5 9b1dec1953d27255d5ed842139480b41
SHA1 57abfcd64ef28bb708737cff70a3a506ea33ff44
SHA512 a2a29c8740ac4c672cbe74f03549452dc9f9be23de45d9f2274d99b2927f49e2e351ebac70e4cf880c5026bca7ddc59d3867bd0c57d74128f02b4ed5cb3dccaa
SSDEEP 24576:eEDPVfaSD+6rYDwB3ZRSKdod1FQDjv93TpGq/yyHd0r2LZDXA5:e+Vfco13ZYKVjVQq/ykNLZDQ5
MD5 SHA1 SHA512 SSDEEP

Submit Download

RCX5057.tmp

Path C:\Users\Default\Desktop\RCX5057.tmp
Size 3.1MB
SHA256 f0ada6afee8cee1e56f0e3fa5c91deca725018f316e16447b01e60d4c807591a
MD5 750d760532b9853891a6815ce887d4fc
SHA1 0ded4a70e3f60bce485d2ff070a1b05e1cf5c629
SHA512 5ce2fc59d42387d17d3aaf5d50f79312712c8e7dce40d8e06d71888a2ad211e9298572d7d82102bcf6183098e1101c0e742d0a3ffc441dc2c32030d1c55b819b
SSDEEP 49152:++Vfco13ZYKVjVQq/ykNLZDQJ/7W4l1YKP7WTeSpRxWi2eFVXuSqYBG9Tw:+No1hQqKWLZkI4l1Yd6zyVXjqZT
MD5 SHA1 SHA512 SSDEEP

Submit Download

Idle.exe

Path C:\Users\Default\Idle.exe
Size 1016KB
SHA256 b9a3f2e9317c4557524898434dc7e6852c257e3ae4679df031ba0cf2c869b4ec
MD5 c21266c5009eabb0aec549060fad9791
SHA1 3ef0163aa2f1fdb6bdfac72e8d8271569c99bf80
SHA512 1b4a8d42e633bcafdd2c858ae8ec972d61b6b05cae38882dab4c0d6f57e9ec588c6b85d4e3f9f54fdd8c689c8f3852fb7ebbb39d861e553db4f25f182d4ed82f
SSDEEP 24576:eEDPVfaSD+6rYDwB3ZRSKdod1FQDjv93TpGq/yyHd0r2LZDj:e+Vfco13ZYKVjVQq/ykNLZDj
MD5 SHA1 SHA512 SSDEEP

Submit Download

services.exe

Path C:\Windows\ShellNew\services.exe
Size 3.1MB
SHA256 6ed78749bd38bb7d673df31353a2e577dacfd73104e2c6ff231e08eacff49445
MD5 ffee7d2d77c82f3ade196f326a15d9ae
SHA1 d6fb8ea5f7ec971a24140e5178953a5eff1fde15
SHA512 fd53e67c87bffd7a59ab528e88da279cc06546c3657d23c23147a5e3976e85d5b873e1b494c4089a58f18032e7856c2295ee98cee512cd2d4a36bfb4d4c5026a
SSDEEP 49152:C+Vfco13ZYKVjVQq/ykNLZDQJ/7W4l1YKP7WTeSpRxWi2eFVXuSqYBG9Tw:CNo1hQqKWLZkI4l1Yd6zyVXjqZT
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/876-243-0x00000000027E0000-0x0000000002860000-memory.dmp

Download

memory/876-242-0x000007FEEC590000-0x000007FEECF2D000-memory.dmp

Download

memory/984-180-0x000000001B340000-0x000000001B622000-memory.dmp

Download

memory/984-228-0x000000000294B000-0x00000000029B2000-memory.dmp

Download

memory/984-223-0x0000000002944000-0x0000000002947000-memory.dmp

Download

memory/984-224-0x000007FEEC590000-0x000007FEECF2D000-memory.dmp

Download

memory/1076-226-0x000007FEEC590000-0x000007FEECF2D000-memory.dmp

Download

memory/1076-229-0x0000000002804000-0x0000000002807000-memory.dmp

Download

memory/1076-230-0x000000000280B000-0x0000000002872000-memory.dmp

Download

memory/1500-236-0x0000000002930000-0x00000000029B0000-memory.dmp

Download

memory/1500-234-0x0000000002930000-0x00000000029B0000-memory.dmp

Download

memory/1500-237-0x000007FEEC590000-0x000007FEECF2D000-memory.dmp

Download

memory/1648-126-0x000000001B160000-0x000000001B1E0000-memory.dmp

Download

memory/1648-1-0x000007FEF5730000-0x000007FEF611C000-memory.dmp

Download

memory/1648-28-0x000000001AD80000-0x000000001AD8A000-memory.dmp

Download

memory/1648-29-0x000000001AD90000-0x000000001AD9C000-memory.dmp

Download

memory/1648-44-0x000000001B160000-0x000000001B1E0000-memory.dmp

Download

memory/1648-55-0x000000001B160000-0x000000001B1E0000-memory.dmp

Download

memory/1648-70-0x000000001B160000-0x000000001B1E0000-memory.dmp

Download

memory/1648-91-0x000000001B160000-0x000000001B1E0000-memory.dmp

Download

memory/1648-109-0x000000001B160000-0x000000001B1E0000-memory.dmp

Download

memory/1648-26-0x000000001AD60000-0x000000001AD6C000-memory.dmp

Download

memory/1648-144-0x000007FEF5730000-0x000007FEF611C000-memory.dmp

Download

memory/1648-145-0x000000001B160000-0x000000001B1E0000-memory.dmp

Download

memory/1648-163-0x000000001B160000-0x000000001B1E0000-memory.dmp

Download

memory/1648-164-0x000000001B160000-0x000000001B1E0000-memory.dmp

Download

memory/1648-25-0x000000001B160000-0x000000001B1E0000-memory.dmp

Download

memory/1648-23-0x000000001AD40000-0x000000001AD48000-memory.dmp

Download

memory/1648-0-0x0000000000C20000-0x0000000000F42000-memory.dmp

Download

memory/1648-24-0x000000001AD50000-0x000000001AD5E000-memory.dmp

Download

memory/1648-179-0x000007FEF5730000-0x000007FEF611C000-memory.dmp

Download

memory/1648-21-0x000000001A940000-0x000000001A94A000-memory.dmp

Download

memory/1648-22-0x000000001A960000-0x000000001A96E000-memory.dmp

Download

memory/1648-10-0x0000000002370000-0x000000000237A000-memory.dmp

Download

memory/1648-20-0x000000001A950000-0x000000001A958000-memory.dmp

Download

memory/1648-19-0x000000001A930000-0x000000001A93C000-memory.dmp

Download

memory/1648-27-0x000000001AD70000-0x000000001AD78000-memory.dmp

Download

memory/1648-2-0x000000001B160000-0x000000001B1E0000-memory.dmp

Download

memory/1648-18-0x000000001A920000-0x000000001A92C000-memory.dmp

Download

memory/1648-17-0x00000000024C0000-0x00000000024C8000-memory.dmp

Download

memory/1648-16-0x00000000024B0000-0x00000000024BC000-memory.dmp

Download

memory/1648-3-0x00000000002D0000-0x00000000002DE000-memory.dmp

Download

memory/1648-4-0x00000000002E0000-0x00000000002EE000-memory.dmp

Download

memory/1648-15-0x00000000024A0000-0x00000000024AC000-memory.dmp

Download

memory/1648-5-0x0000000000520000-0x000000000053C000-memory.dmp

Download

memory/1648-14-0x0000000002390000-0x00000000023A2000-memory.dmp

Download

memory/1648-6-0x0000000000A50000-0x0000000000A60000-memory.dmp

Download

memory/1648-7-0x0000000000A60000-0x0000000000A76000-memory.dmp

Download

memory/1648-8-0x0000000000A80000-0x0000000000A88000-memory.dmp

Download

memory/1648-9-0x0000000002350000-0x0000000002358000-memory.dmp

Download

memory/1648-13-0x0000000002380000-0x000000000238C000-memory.dmp

Download

memory/1648-12-0x0000000002360000-0x000000000236C000-memory.dmp

Download

memory/1648-11-0x000000001A8D0000-0x000000001A926000-memory.dmp

Download

memory/2280-231-0x000007FEEC590000-0x000007FEECF2D000-memory.dmp

Download

memory/2280-227-0x00000000025E0000-0x0000000002660000-memory.dmp

Download

memory/2280-233-0x00000000025E0000-0x0000000002660000-memory.dmp

Download

memory/2280-235-0x00000000025E0000-0x0000000002660000-memory.dmp

Download

memory/2280-232-0x00000000025E0000-0x0000000002660000-memory.dmp

Download

memory/2280-225-0x000007FEEC590000-0x000007FEECF2D000-memory.dmp

Download

memory/2280-181-0x0000000002460000-0x0000000002468000-memory.dmp

Download

memory/2944-239-0x0000000002620000-0x00000000026A0000-memory.dmp

Download

memory/2944-238-0x000007FEEC590000-0x000007FEECF2D000-memory.dmp

Download

memory/3012-241-0x000007FEEC590000-0x000007FEECF2D000-memory.dmp

Download

memory/3012-240-0x0000000002900000-0x0000000002980000-memory.dmp

Download