zgrat | 747abbc9dd92fa2162a0eee074374963938357f40e1b2de464e613fe3c03e5a9

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11-05-2024 07:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0d6496f71fd24be93348c354faf7dfa6.exe
Size

1.6MB
MD5

0d6496f71fd24be93348c354faf7dfa6
SHA1

47f195a3996d4e3bd051d54e879d1ae68d2ed9a0
SHA256

747abbc9dd92fa2162a0eee074374963938357f40e1b2de464e613fe3c03e5a9
SHA512

0d755fb0bea2edf4a92a013a06ce3274f05f1d8fc01a25de320a2f566ec8055922e8fa0f34196c1263292ab45455e4b612f467757a0e211ba2edc066090b6a7c
SSDEEP

49152:TGJ95iN4KodXZCQRBHt268KDDljKrTrv:iJ9Z3dXLrHt2nYDKX

Score

10^/10

zgrat execution persistence rat

Malware Config

Signatures

Detect ZGRat V1 2 IoCs

resource	yara_rule
behavioral2/memory/1616-1-0x0000000000C20000-0x0000000000DCC000-memory.dmp	family_zgrat_v1
behavioral2/files/0x0007000000023267-23.dat	family_zgrat_v1

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\System.exe\""	0d6496f71fd24be93348c354faf7dfa6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\System.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\SppExtComObj.exe\""	0d6496f71fd24be93348c354faf7dfa6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\System.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\SppExtComObj.exe\", \"C:\\Recovery\\WindowsRE\\explorer.exe\""	0d6496f71fd24be93348c354faf7dfa6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\System.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\SppExtComObj.exe\", \"C:\\Recovery\\WindowsRE\\explorer.exe\", \"C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\StartMenuExperienceHost.exe\""	0d6496f71fd24be93348c354faf7dfa6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\System.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\SppExtComObj.exe\", \"C:\\Recovery\\WindowsRE\\explorer.exe\", \"C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\msedge.exe\""	0d6496f71fd24be93348c354faf7dfa6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\System.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\SppExtComObj.exe\", \"C:\\Recovery\\WindowsRE\\explorer.exe\", \"C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\msedge.exe\", \"C:\\Users\\Admin\\AppData\\Local\\Temp\\0d6496f71fd24be93348c354faf7dfa6.exe\""	0d6496f71fd24be93348c354faf7dfa6.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3256	1124	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4184	1124	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1200	1124	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2284	1124	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3772	1124	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3760	1124	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3900	1124	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3392	1124	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1376	1124	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2156	1124	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3984	1124	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3308	1124	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3332	1124	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1928	1124	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3096	1124	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3148	1124	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2204	1124	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4340	1124	schtasks.exe	91

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4400	powershell.exe
4672	powershell.exe
1484	powershell.exe
4912	powershell.exe
5012	powershell.exe
2008	powershell.exe

Checks computer location settings 2 TTPs 14 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	StartMenuExperienceHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	StartMenuExperienceHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	StartMenuExperienceHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	StartMenuExperienceHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	0d6496f71fd24be93348c354faf7dfa6.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	StartMenuExperienceHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	StartMenuExperienceHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	StartMenuExperienceHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	StartMenuExperienceHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	StartMenuExperienceHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	StartMenuExperienceHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	StartMenuExperienceHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	StartMenuExperienceHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	StartMenuExperienceHost.exe

Executes dropped EXE 14 IoCs

pid	Process
1516	StartMenuExperienceHost.exe
1644	StartMenuExperienceHost.exe
4912	StartMenuExperienceHost.exe
3824	msedge.exe
2596	StartMenuExperienceHost.exe
400	StartMenuExperienceHost.exe
800	StartMenuExperienceHost.exe
4464	StartMenuExperienceHost.exe
4424	StartMenuExperienceHost.exe
3176	StartMenuExperienceHost.exe
4460	StartMenuExperienceHost.exe
2440	StartMenuExperienceHost.exe
2752	StartMenuExperienceHost.exe
4692	StartMenuExperienceHost.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Program Files (x86)\\Windows Mail\\System.exe\""	0d6496f71fd24be93348c354faf7dfa6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Program Files (x86)\\Windows Multimedia Platform\\SppExtComObj.exe\""	0d6496f71fd24be93348c354faf7dfa6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Recovery\\WindowsRE\\explorer.exe\""	0d6496f71fd24be93348c354faf7dfa6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\StartMenuExperienceHost.exe\""	0d6496f71fd24be93348c354faf7dfa6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\0d6496f71fd24be93348c354faf7dfa6 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\0d6496f71fd24be93348c354faf7dfa6.exe\""	0d6496f71fd24be93348c354faf7dfa6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\0d6496f71fd24be93348c354faf7dfa6 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\0d6496f71fd24be93348c354faf7dfa6.exe\""	0d6496f71fd24be93348c354faf7dfa6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Program Files (x86)\\Windows Mail\\System.exe\""	0d6496f71fd24be93348c354faf7dfa6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Program Files (x86)\\Windows Multimedia Platform\\SppExtComObj.exe\""	0d6496f71fd24be93348c354faf7dfa6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Recovery\\WindowsRE\\explorer.exe\""	0d6496f71fd24be93348c354faf7dfa6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\StartMenuExperienceHost.exe\""	0d6496f71fd24be93348c354faf7dfa6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msedge = "\"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\msedge.exe\""	0d6496f71fd24be93348c354faf7dfa6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msedge = "\"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\msedge.exe\""	0d6496f71fd24be93348c354faf7dfa6.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\_iyiwy.exe	csc.exe
File created	\??\c:\Windows\System32\CSC9F3F7EB18EDD401D876017D0368E5E70.TMP	csc.exe

Drops file in Program Files directory 11 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\msedge.exe	0d6496f71fd24be93348c354faf7dfa6.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\55b276f4edf653	0d6496f71fd24be93348c354faf7dfa6.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\SppExtComObj.exe	0d6496f71fd24be93348c354faf7dfa6.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\e1ef82546f0b02	0d6496f71fd24be93348c354faf7dfa6.exe
File created	C:\Program Files (x86)\Windows Mail\27d1bcfc3c54e0	0d6496f71fd24be93348c354faf7dfa6.exe
File created	\??\c:\Program Files (x86)\Microsoft\Edge\Application\CSCF8AA3DACC7974BACA0987477A49A29BE.TMP	csc.exe
File opened for modification	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\msedge.exe	0d6496f71fd24be93348c354faf7dfa6.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\61a52ddc9dd915	0d6496f71fd24be93348c354faf7dfa6.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe	0d6496f71fd24be93348c354faf7dfa6.exe
File created	C:\Program Files (x86)\Windows Mail\System.exe	0d6496f71fd24be93348c354faf7dfa6.exe
File created	\??\c:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	csc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1200	schtasks.exe
3392	schtasks.exe
3308	schtasks.exe
4184	schtasks.exe
3772	schtasks.exe
3760	schtasks.exe
4340	schtasks.exe
1376	schtasks.exe
3332	schtasks.exe
3096	schtasks.exe
3148	schtasks.exe
2204	schtasks.exe
3256	schtasks.exe
2284	schtasks.exe
3900	schtasks.exe
2156	schtasks.exe
3984	schtasks.exe
1928	schtasks.exe

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	0d6496f71fd24be93348c354faf7dfa6.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	StartMenuExperienceHost.exe

Runs ping.exe 1 TTPs 4 IoCs

Remote System Discovery

T1018

pid	Process
3808	PING.EXE
4900	PING.EXE
536	PING.EXE
848	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
2008	powershell.exe
2008	powershell.exe
5012	powershell.exe
5012	powershell.exe
1484	powershell.exe
1484	powershell.exe
4912	powershell.exe
4912	powershell.exe
4672	powershell.exe
4672	powershell.exe
4400	powershell.exe
4400	powershell.exe
2008	powershell.exe
4672	powershell.exe
5012	powershell.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	1616	0d6496f71fd24be93348c354faf7dfa6.exe
Token: SeDebugPrivilege	2008	powershell.exe
Token: SeDebugPrivilege	5012	powershell.exe
Token: SeDebugPrivilege	1484	powershell.exe
Token: SeDebugPrivilege	4672	powershell.exe
Token: SeDebugPrivilege	4912	powershell.exe
Token: SeDebugPrivilege	4400	powershell.exe
Token: SeDebugPrivilege	1516	StartMenuExperienceHost.exe
Token: SeDebugPrivilege	1644	StartMenuExperienceHost.exe
Token: SeDebugPrivilege	4912	StartMenuExperienceHost.exe
Token: SeDebugPrivilege	2596	StartMenuExperienceHost.exe
Token: SeDebugPrivilege	400	StartMenuExperienceHost.exe
Token: SeDebugPrivilege	800	StartMenuExperienceHost.exe
Token: SeDebugPrivilege	4464	StartMenuExperienceHost.exe
Token: SeDebugPrivilege	4424	StartMenuExperienceHost.exe
Token: SeDebugPrivilege	3176	StartMenuExperienceHost.exe
Token: SeDebugPrivilege	4460	StartMenuExperienceHost.exe
Token: SeDebugPrivilege	2440	StartMenuExperienceHost.exe
Token: SeDebugPrivilege	2752	StartMenuExperienceHost.exe
Token: SeDebugPrivilege	4692	StartMenuExperienceHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1616 wrote to memory of 4124	1616	0d6496f71fd24be93348c354faf7dfa6.exe	95
PID 1616 wrote to memory of 4124	1616	0d6496f71fd24be93348c354faf7dfa6.exe	95
PID 4124 wrote to memory of 1400	4124	csc.exe	100
PID 4124 wrote to memory of 1400	4124	csc.exe	100
PID 1616 wrote to memory of 3740	1616	0d6496f71fd24be93348c354faf7dfa6.exe	101
PID 1616 wrote to memory of 3740	1616	0d6496f71fd24be93348c354faf7dfa6.exe	101
PID 3740 wrote to memory of 2560	3740	csc.exe	103
PID 3740 wrote to memory of 2560	3740	csc.exe	103
PID 1616 wrote to memory of 4400	1616	0d6496f71fd24be93348c354faf7dfa6.exe	119
PID 1616 wrote to memory of 4400	1616	0d6496f71fd24be93348c354faf7dfa6.exe	119
PID 1616 wrote to memory of 2008	1616	0d6496f71fd24be93348c354faf7dfa6.exe	120
PID 1616 wrote to memory of 2008	1616	0d6496f71fd24be93348c354faf7dfa6.exe	120
PID 1616 wrote to memory of 4672	1616	0d6496f71fd24be93348c354faf7dfa6.exe	121
PID 1616 wrote to memory of 4672	1616	0d6496f71fd24be93348c354faf7dfa6.exe	121
PID 1616 wrote to memory of 5012	1616	0d6496f71fd24be93348c354faf7dfa6.exe	123
PID 1616 wrote to memory of 5012	1616	0d6496f71fd24be93348c354faf7dfa6.exe	123
PID 1616 wrote to memory of 1484	1616	0d6496f71fd24be93348c354faf7dfa6.exe	124
PID 1616 wrote to memory of 1484	1616	0d6496f71fd24be93348c354faf7dfa6.exe	124
PID 1616 wrote to memory of 4912	1616	0d6496f71fd24be93348c354faf7dfa6.exe	127
PID 1616 wrote to memory of 4912	1616	0d6496f71fd24be93348c354faf7dfa6.exe	127
PID 1616 wrote to memory of 3232	1616	0d6496f71fd24be93348c354faf7dfa6.exe	132
PID 1616 wrote to memory of 3232	1616	0d6496f71fd24be93348c354faf7dfa6.exe	132
PID 3232 wrote to memory of 4396	3232	cmd.exe	134
PID 3232 wrote to memory of 4396	3232	cmd.exe	134
PID 3232 wrote to memory of 3204	3232	cmd.exe	137
PID 3232 wrote to memory of 3204	3232	cmd.exe	137
PID 3232 wrote to memory of 1516	3232	cmd.exe	138
PID 3232 wrote to memory of 1516	3232	cmd.exe	138
PID 1516 wrote to memory of 824	1516	StartMenuExperienceHost.exe	139
PID 1516 wrote to memory of 824	1516	StartMenuExperienceHost.exe	139
PID 824 wrote to memory of 2432	824	cmd.exe	141
PID 824 wrote to memory of 2432	824	cmd.exe	141
PID 824 wrote to memory of 1704	824	cmd.exe	142
PID 824 wrote to memory of 1704	824	cmd.exe	142
PID 824 wrote to memory of 1644	824	cmd.exe	144
PID 824 wrote to memory of 1644	824	cmd.exe	144
PID 1644 wrote to memory of 1392	1644	StartMenuExperienceHost.exe	145
PID 1644 wrote to memory of 1392	1644	StartMenuExperienceHost.exe	145
PID 1392 wrote to memory of 3192	1392	cmd.exe	147
PID 1392 wrote to memory of 3192	1392	cmd.exe	147
PID 1392 wrote to memory of 4564	1392	cmd.exe	148
PID 1392 wrote to memory of 4564	1392	cmd.exe	148
PID 1392 wrote to memory of 4912	1392	cmd.exe	149
PID 1392 wrote to memory of 4912	1392	cmd.exe	149
PID 4912 wrote to memory of 2488	4912	StartMenuExperienceHost.exe	150
PID 4912 wrote to memory of 2488	4912	StartMenuExperienceHost.exe	150
PID 2488 wrote to memory of 4632	2488	cmd.exe	152
PID 2488 wrote to memory of 4632	2488	cmd.exe	152
PID 2488 wrote to memory of 536	2488	cmd.exe	153
PID 2488 wrote to memory of 536	2488	cmd.exe	153
PID 2488 wrote to memory of 2596	2488	cmd.exe	155
PID 2488 wrote to memory of 2596	2488	cmd.exe	155
PID 2596 wrote to memory of 5092	2596	StartMenuExperienceHost.exe	156
PID 2596 wrote to memory of 5092	2596	StartMenuExperienceHost.exe	156
PID 5092 wrote to memory of 2304	5092	cmd.exe	158
PID 5092 wrote to memory of 2304	5092	cmd.exe	158
PID 5092 wrote to memory of 848	5092	cmd.exe	159
PID 5092 wrote to memory of 848	5092	cmd.exe	159
PID 5092 wrote to memory of 400	5092	cmd.exe	160
PID 5092 wrote to memory of 400	5092	cmd.exe	160
PID 400 wrote to memory of 5068	400	StartMenuExperienceHost.exe	161
PID 400 wrote to memory of 5068	400	StartMenuExperienceHost.exe	161
PID 5068 wrote to memory of 2120	5068	cmd.exe	163
PID 5068 wrote to memory of 2120	5068	cmd.exe	163

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\0d6496f71fd24be93348c354faf7dfa6.exe
"C:\Users\Admin\AppData\Local\Temp\0d6496f71fd24be93348c354faf7dfa6.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1616
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4psogkzy\4psogkzy.cmdline"
  2⤵
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:4124
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2E2F.tmp" "c:\Program Files (x86)\Microsoft\Edge\Application\CSCF8AA3DACC7974BACA0987477A49A29BE.TMP"
    3⤵
    PID:1400
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4s5fgzft\4s5fgzft.cmdline"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:3740
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3042.tmp" "c:\Windows\System32\CSC9F3F7EB18EDD401D876017D0368E5E70.TMP"
    3⤵
    PID:2560
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Mail\System.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4400
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Multimedia Platform\SppExtComObj.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2008
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\explorer.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4672
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5012
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\msedge.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1484
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\0d6496f71fd24be93348c354faf7dfa6.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4912
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\M7bMjtNPYm.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3232
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:4396
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:3204
- - C:\Program Files\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe
    "C:\Program Files\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1516
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\sOnG1wexym.bat"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:824
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:2432
    - - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        5⤵
        
        PID:1704
    - - C:\Program Files\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe
        
        "C:\Program Files\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1644
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\kJRy2Wx8TR.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1392
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:3192
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:4564
        
        C:\Program Files\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe
        
        "C:\Program Files\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4912
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5CZTOTC2vN.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:2488
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        9⤵
        
        PID:4632
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        9⤵
        Runs ping.exe
        
        PID:536
        
        C:\Program Files\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe
        
        "C:\Program Files\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2596
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\gbxaZFyaug.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:5092
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        11⤵
        
        PID:2304
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        11⤵
        Runs ping.exe
        
        PID:848
        
        C:\Program Files\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe
        
        "C:\Program Files\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe"
        11⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:400
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\j5cqYlxHIW.bat"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:5068
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        13⤵
        
        PID:2120
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:1532
        
        C:\Program Files\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe
        
        "C:\Program Files\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe"
        13⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:800
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\O4lRoaYFUn.bat"
        14⤵
        
        PID:2484
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        15⤵
        
        PID:1644
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:2440
        
        C:\Program Files\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe
        
        "C:\Program Files\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe"
        15⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4464
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GzP9pAsQzT.bat"
        16⤵
        
        PID:3516
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        17⤵
        
        PID:2240
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:3476
        
        C:\Program Files\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe
        
        "C:\Program Files\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe"
        17⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4424
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ItcmNmazXC.bat"
        18⤵
        
        PID:2960
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        19⤵
        
        PID:640
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:3348
        
        C:\Program Files\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe
        
        "C:\Program Files\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe"
        19⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3176
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\usSWzSdfMb.bat"
        20⤵
        
        PID:3472
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        21⤵
        
        PID:4004
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        21⤵
        Runs ping.exe
        
        PID:3808
        
        C:\Program Files\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe
        
        "C:\Program Files\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe"
        21⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4460
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\usSWzSdfMb.bat"
        22⤵
        
        PID:3828
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        23⤵
        
        PID:4124
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        23⤵
        Runs ping.exe
        
        PID:4900
        
        C:\Program Files\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe
        
        "C:\Program Files\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe"
        23⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2440
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tI0tYXMWWV.bat"
        24⤵
        
        PID:336
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        25⤵
        
        PID:4312
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:1496
        
        C:\Program Files\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe
        
        "C:\Program Files\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe"
        25⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2752
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\FlZ1LPsZoY.bat"
        26⤵
        
        PID:1812
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        27⤵
        
        PID:3672
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        27⤵
        
        PID:4212
        
        C:\Program Files\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe
        
        "C:\Program Files\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe"
        27⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4692
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\RKW7EBQnZE.bat"
        28⤵
        
        PID:1852
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        29⤵
        
        PID:1388
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        29⤵
        
        PID:2724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Mail\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Mail\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\msedge.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedge" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\msedge.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\msedge.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "0d6496f71fd24be93348c354faf7dfa60" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\AppData\Local\Temp\0d6496f71fd24be93348c354faf7dfa6.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "0d6496f71fd24be93348c354faf7dfa6" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\0d6496f71fd24be93348c354faf7dfa6.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "0d6496f71fd24be93348c354faf7dfa60" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\AppData\Local\Temp\0d6496f71fd24be93348c354faf7dfa6.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4340

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3700 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:8
1⤵
- Executes dropped EXE
PID:3824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Filesize
4KB

MD5
78539497603566c40e21d970b650b13d

SHA1
aa2a44e8946ab5310225bfc762a398cd99f18fb5

SHA256
0a04420fca4d6acfa297d5e08c2bc6a1063a423003f649c2fc732b414748b038

SHA512
5b3633ba01bff743a7a0f3af9f1b0871d53ad7b47b0e176230162a4aae4034df9068e37e9a9268c1de2d5c2514a7b26534ae7f163c5ac8b61ba90554f19916c9

Download Submit
C:\Program Files (x86)\Windows Mail\System.exe

Filesize
1.6MB

MD5
0d6496f71fd24be93348c354faf7dfa6

SHA1
47f195a3996d4e3bd051d54e879d1ae68d2ed9a0

SHA256
747abbc9dd92fa2162a0eee074374963938357f40e1b2de464e613fe3c03e5a9

SHA512
0d755fb0bea2edf4a92a013a06ce3274f05f1d8fc01a25de320a2f566ec8055922e8fa0f34196c1263292ab45455e4b612f467757a0e211ba2edc066090b6a7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\StartMenuExperienceHost.exe.log

Filesize
1KB

MD5
11aa02596ceccef38b448c52a899f470

SHA1
6da94dc9579e969d39d5e65c066af3a5251e39b4

SHA256
e778ec777a79a1a9c9a3b605ab9681558395d2f3ef46f6c34dca1e00dcd771fd

SHA512
5de4fd51ae76cce8de25c5257ee873a71668acdf407bc3351410f9f840a9b074099d4c018657d2cc8f33273e6fd03e4365165e4834ba12c052d735212bf5d0d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
0e3b2fb1305afa355fb0585c068cdbbd

SHA1
b4e9457bfdc38337f64e3b2606aa34861aa6b4ed

SHA256
43a303fed06d5928800280cb0bf716790d9f886c87f26faf9fbdfa59b55e9c0d

SHA512
6a754dbb33c549ace5f71e169511422284f688c9df1c1e5fac8a633feac24312ba39fa4c682bdc9fe1d1162e2a3bd6190013652e567909417579db4b8791554d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
22fbec4acba323d04079a263526cef3c

SHA1
eb8dd0042c6a3f20087a7d2391eaf48121f98740

SHA256
020e5d769893724f075e10b01c59bf2424214cefe6aafbab6f44bc700f525c40

SHA512
fb61d737de8cbed6b7d8b5a35911c46ef26a2927a52ed7add9d594cf19dcab1b9978b61912c6f3fe4f29228f4454fb022fb2e167788c727dc6503c1fcd42159e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
17fbfbe3f04595e251287a6bfcdc35de

SHA1
b576aabfd5e6d5799d487011506ed1ae70688987

SHA256
2e61ae727ca01496c9418a65777d6d7e05a85cbdb6b3a19516857442e5bd2da0

SHA512
449c68512d90a17f598e9dacfd6230e6e97bc6bfaaf2b06f3b91b370ece92e2322b81ee3721e288880fa1f05470156e519256e3f03d786c3b28a39788f5e0ad6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e8ce785f8ccc6d202d56fefc59764945

SHA1
ca032c62ddc5e0f26d84eff9895eb87f14e15960

SHA256
d85c19fc6b9d25e2168a2cc50ff38bd226fbf4f02aa7ac038a5f319522d2ffa4

SHA512
66460aec4afee582556270f8ee6048d130a090f1c12a2632ed71a99a4073e9931e9e1cc286e32debffb95a90bd955f0f0d6ec891b1c5cd2f0aae41eb6d25832f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
62623d22bd9e037191765d5083ce16a3

SHA1
4a07da6872672f715a4780513d95ed8ddeefd259

SHA256
95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010

SHA512
9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

Download Submit
C:\Users\Admin\AppData\Local\Temp\5CZTOTC2vN.bat

Filesize
203B

MD5
e8ab8e300d5c1d8ce4e23b30207c61d0

SHA1
7f84d3ded6e42c3caada16e680c92671d814f5b8

SHA256
50ccdf2d4fcd9ea5336982228ba8e39c2efb8bb5ccfd720a246227fc8fa46e9b

SHA512
05fd6384cedec762d67c50e1e98117bbf686f62f1435181d22072b25f65ed51a4bf0b80ca22dd31f1296cf6519c9bb453f312f0540e3ad742d5e3d83d7dccd38

Download Submit
C:\Users\Admin\AppData\Local\Temp\FlZ1LPsZoY.bat

Filesize
251B

MD5
0dbec08f21c37781ec1a7300ae00d9f0

SHA1
c3fe5c93746f3e556b9e1e1ec5c7e061c45c3381

SHA256
aa8617a8206c56f06d10c1156a59fbb32a27f4557ac43e5f048cd64ce3c826ed

SHA512
8de4662ff2db585b07d3c5c3c000fb8ee8768af6f1ed2ec69c1562f700288e62a8ed7fad858d873c58cf9b205638b2039818d3e918b6d3b2ffdd7723618592f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\GzP9pAsQzT.bat

Filesize
251B

MD5
20c3f0a3eeb42bdf79c6c278d0fb08e9

SHA1
8f852dac2c6499a886b09147178d931559a1eb9e

SHA256
71d0133ab82198ba1c016e3e117d323985e3c8acd286a66d5eea3256308ed200

SHA512
dd989e82f697e039c8179ca20ba02f5035785261e318ed709bc927bfe51851c656a987000fa9023945e7c53cf4be7587b289e7099d7f5e4cf01435ccb8e4e22a

Download Submit
C:\Users\Admin\AppData\Local\Temp\ItcmNmazXC.bat

Filesize
251B

MD5
9269e16170eae2a9a7d885d4e20926fe

SHA1
9d0a9b988e4750daf67f377a022ab6b4b5b2f29d

SHA256
1b58bc03cb24938da034f128892d9bc9d7056f14757734703dc3a036ea263ced

SHA512
7bb99ca555e2a45842e1218350aa0a91ff71f04da45788d66bf46f56afff246df4b9f42a1cedbeb793f1089e06fbad4ce99b7f813fdda24efbb3ac386e16e384

Download Submit
C:\Users\Admin\AppData\Local\Temp\M7bMjtNPYm.bat

Filesize
251B

MD5
cbb22b8d02a05e539bfae7198f762d5b

SHA1
0cb984b62783204f6eae3a6d1984a0e814ebd238

SHA256
f1152bff9004d837875305dbc1b88f02e08d06bc7d4782d995e1ef4cb8f9bbbd

SHA512
7b79262277acb55e032b57ce59ed02ce2bc6d90581a72e350f9c65a5937f5124c7b78e9c1757d729ae624cd73e4bd89a69993c923cba6ffd87feb57f628dfff4

Download Submit
C:\Users\Admin\AppData\Local\Temp\O4lRoaYFUn.bat

Filesize
251B

MD5
1ee8fa9776b5ddec2a1ac3abbaa0932a

SHA1
cb9052f9c7a311e26993d7a79d5c026ce46de49b

SHA256
57049e19181e0e9e0084b4705f8c4d1aadabe8a5d9f5df679dcb138e2a7f75d1

SHA512
8633811f1ad6df6e02b1627ec968ba8472dff2752bbca55fa9042b6398c91f2b7b6c51533be1ed112a81e39a029a632f06372d511c3903a024bd157453d92ebe

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES2E2F.tmp

Filesize
1KB

MD5
7a7906140989d6d5f2dc3de978ba89ad

SHA1
3258d3f5c9e05d4876d1793c668e037438dfd947

SHA256
f01490fe7528e7750c0aa9c971500e2efca3bf3d7491e65a3e522ece982dcf23

SHA512
435a3cddf2729f9614fe523ac1f177f624d2a8a8acf8c63afdf752e48cbc222787766c18be000602fe3294e2273698b3acb7954e4c18efb05287d886f06d29fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES3042.tmp

Filesize
1KB

MD5
a58a7eeb8824df9fa94aba7973cae87b

SHA1
a072776b1b53f97dcbef122b763e7e7f48860715

SHA256
e92cab7727badc2c32d7183717e5856350bbed40a78afd1d2f54acdfacc8a5c5

SHA512
2977ac7324434425bd1a1632df36a0eff391de51b9672ccd60a489470c3772c0010dc7b5afb692b2d5e314377ab8374727adc535ac02a84ae263f5ee71261f6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RKW7EBQnZE.bat

Filesize
251B

MD5
24d296cc8b00e9909906dbe136d6da1c

SHA1
2a6a5585df2b428383777e9a99ef90d15c6b66db

SHA256
d80723b8e6cb6440cc7249c2f78cfa6107a9d59c0ecabb3e3a110853e9be683f

SHA512
e829a29738e529d05e9e732762f21cb5a266e196355b269db2d8dd3505100bd48ffa1a420ddf548607d19276026ccd854ea73036c4c161fae5b9aec0f498f964

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_t0tlr1yi.oox.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\gbxaZFyaug.bat

Filesize
203B

MD5
0957b61b108dfeaf694a77552129e936

SHA1
d5a5a4f22f43f3dae540766631bcedfa0b408825

SHA256
35794b58065f5b49aaf8f5ec4fc434c6cef31f748971f4773e75a48119449359

SHA512
3d32af9155b515e35ffbf591d0f2f15f64dd6f7f073029f2d37ca54a0017be7ce5df963f9b583990972fd2163736a9d9e55fa2e796ff37eca2d4c31bcd571afa

Download Submit
C:\Users\Admin\AppData\Local\Temp\j5cqYlxHIW.bat

Filesize
251B

MD5
a752cfb9ad673e0d92acedd37967b5ef

SHA1
f0a28cf737791b8fdc6a22ca54e7d5e6a42a2d30

SHA256
c2378d059b55a257bd9939a4d47ac2a58a58efdf8cd2fb3065e6885f16a0aa87

SHA512
d583ede3d9b1e0551b1c9d773581521be1226da4419ed63ad397476e53f1e665f2bf646aaa8b3afd6615f151817083d1f591cf530670cb16cf1596d2f617b024

Download Submit
C:\Users\Admin\AppData\Local\Temp\kJRy2Wx8TR.bat

Filesize
251B

MD5
4259f03fcaef8db95af6cb810b656260

SHA1
9e2e692ffa869c717145064ae1b9f0f79867b59f

SHA256
46be2049dce10a2428b9a4b46f409d1662f31cf00cac7006fc7ed53c66577516

SHA512
6f92560fb22fdea9070b4e3a84564c5091e9f14b3f0b1b0c0ce1952e2a9b8b576338878ecc4ac7b7ba8d46418b5823bb44afc29c23cd29bc9e5ab0345261f130

Download Submit
C:\Users\Admin\AppData\Local\Temp\sOnG1wexym.bat

Filesize
251B

MD5
8143739cc6528f958d3181d669f9ca70

SHA1
24ced432ae52f719063fd12843e78d826ba2764d

SHA256
b0c2e408b16ae76cd4dca49920986f65e966c0d7be57ab1ad15aa8f511f702f4

SHA512
8bb1c79e3c62a740eca310dfcf1ef314c98e1438846cce66e8f05c9add8b197efc13be96413b7b1ba70f2f6b902c22913c0121bf59d174963cff533a703fca50

Download Submit
C:\Users\Admin\AppData\Local\Temp\tI0tYXMWWV.bat

Filesize
251B

MD5
aee788dae186033c586ec4ba60fc12cf

SHA1
cd82f71a18c46a1c46e3dce65253aa7ac0f6f884

SHA256
174bd69a25b63c40ee3a392ea861d0200aabe3bc7fa0970c2d9508f45e4f4687

SHA512
142830d61c2bd651f68249d10be96ce3932ee0b81bc52076707ae7abafb1c764ab9d3ddf9638e2c7b6705844f95f027db417eb51becedb28811ff035439400dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\usSWzSdfMb.bat

Filesize
203B

MD5
96b2ef9a4c97568aba9e75cbb65a0396

SHA1
d879753e744c7917437a6bf0a502cff3e5937411

SHA256
f0a0e98e2cb6ad7a4617b9c57258dcca241a958ef9a2c3af6b8708ae925965a5

SHA512
56533ec10742ad55fcb7e12f55d79d50c6f34e0117f54cf8f76b35bd39f77c9c247b08f501a4e07356f21d87f1c2a6f0a0df9483dfc1a9754008b41fef1ba4f4

Download Submit
\??\c:\Program Files (x86)\Microsoft\Edge\Application\CSCF8AA3DACC7974BACA0987477A49A29BE.TMP

Filesize
1KB

MD5
b5189fb271be514bec128e0d0809c04e

SHA1
5dd625d27ed30fca234ec097ad66f6c13a7edcbe

SHA256
e1984ba1e3ff8b071f7a320a6f1f18e1d5f4f337d31dc30d5bdfb021df39060f

SHA512
f0fcb8f97279579beb59f58ea89527ee0d86a64c9de28300f14460bec6c32dda72f0e6466573b6654a1e992421d6fe81ae7cce50f27059f54cf9fdca6953602e

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\4psogkzy\4psogkzy.0.cs

Filesize
408B

MD5
ac92854579607c9ef7dfc26202851a04

SHA1
4ebd20149fef4529fae2a2da3397dac4eb54fa43

SHA256
45a9bbbb8e0efddb92262cc178f85710c1a1353a4b199bc96cd55f8d06544303

SHA512
7e7d0004bcc3ef9642356df47c5a4c24e13896f042c70fbdcafe786be2c4d29fd5e62dd8e7fc7f7011ff0afd0bc86b6e4864ec09ac917121726fc9b99cb1501c

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\4psogkzy\4psogkzy.cmdline

Filesize
265B

MD5
31ae918cb7ad3b93490042653d3648dd

SHA1
861ad469bbd38d05196c845aa880dab015f619de

SHA256
17c397f7f602895000ed742ebe90eb7e93f09631fa72e9907cae2b2743151523

SHA512
a2230c487375e0e82bcab15e7e4296b066501ed7d2b9da1372fd1fa6389b2bbe7a5989aafe381ede192ca8b1016008762e7c7f1a0b19d35457a05a745ff1fc5e

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\4s5fgzft\4s5fgzft.0.cs

Filesize
378B

MD5
f7fd8f0868adde1335f3dad238ec2dbf

SHA1
07e618c2ad6e799881745c3bd9033889de7c1c96

SHA256
0d2ac6defcd279de0514015d3f152919087fc2d6369f0f5decd22303f77a5aaf

SHA512
4349d224b90244cd52ad9590b928155866bbf2580f9e7d8e211c5586689687d87ed39b05fa1822ebf6d937154bebf3606d06365e15ceb71402e4b831d8b7fa48

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\4s5fgzft\4s5fgzft.cmdline

Filesize
235B

MD5
ec6be3e7dd9089797561697455796554

SHA1
81d66d8575f70b8877abbb698bf67bc3146f4cc6

SHA256
891611e5496e8c9bef31443ff16dc406bde6fdac74e7315e16aaeeef70b752ed

SHA512
6502b2e4fd0577ae39c6c1fe40afb99dd0f5c14771cb7abb1f0f47eee641f9a913773a42d3d6516a3135c91eee86346d17cc99e7660ea16262d3bd4d97ca902b

Download Submit
\??\c:\Windows\System32\CSC9F3F7EB18EDD401D876017D0368E5E70.TMP

Filesize
1KB

MD5
188249e3f31caa0264351fc374794895

SHA1
323a707d1a37ac8cbae6d6e502cc850f69ae2e15

SHA256
1bf68148c555d0e84720c497dcf3ad708da300ee7472df12c9307a3acd4abde1

SHA512
28a0d97e83b6b6d10c0114166e8f23845663a34c8f262aa5a31ffb885abe232badb6f95bba99b8688559cac81f8ff93c3609ac363d8903d35f535d7c5e1e02d5

Download Submit
memory/1616-8-0x00007FFD3FDC0000-0x00007FFD40881000-memory.dmp

Filesize
10.8MB

Download
memory/1616-3-0x00007FFD3FDC0000-0x00007FFD40881000-memory.dmp

Filesize
10.8MB

Download
memory/1616-12-0x00007FFD3FDC0000-0x00007FFD40881000-memory.dmp

Filesize
10.8MB

Download
memory/1616-9-0x00007FFD3FDC0000-0x00007FFD40881000-memory.dmp

Filesize
10.8MB

Download
memory/1616-14-0x00007FFD3FDC0000-0x00007FFD40881000-memory.dmp

Filesize
10.8MB

Download
memory/1616-7-0x00007FFD3FDC0000-0x00007FFD40881000-memory.dmp

Filesize
10.8MB

Download
memory/1616-0-0x00007FFD3FDC3000-0x00007FFD3FDC5000-memory.dmp

Filesize
8KB

Download
memory/1616-6-0x00000000015E0000-0x00000000015EE000-memory.dmp

Filesize
56KB

Download
memory/1616-4-0x00007FFD3FDC0000-0x00007FFD40881000-memory.dmp

Filesize
10.8MB

Download
memory/1616-11-0x0000000001630000-0x000000000163C000-memory.dmp

Filesize
48KB

Download
memory/1616-110-0x00007FFD3FDC0000-0x00007FFD40881000-memory.dmp

Filesize
10.8MB

Download
memory/1616-1-0x0000000000C20000-0x0000000000DCC000-memory.dmp

Filesize
1.7MB

Download
memory/1616-2-0x00007FFD3FDC0000-0x00007FFD40881000-memory.dmp

Filesize
10.8MB

Download
memory/2440-215-0x000000001BC90000-0x000000001BDFA000-memory.dmp

Filesize
1.4MB

Download
memory/2752-224-0x000000001B990000-0x000000001BAFA000-memory.dmp

Filesize
1.4MB

Download
memory/4460-206-0x000000001BA30000-0x000000001BB9A000-memory.dmp

Filesize
1.4MB

Download
memory/4692-233-0x000000001C420000-0x000000001C58A000-memory.dmp

Filesize
1.4MB

Download
memory/5012-88-0x0000026277140000-0x0000026277162000-memory.dmp

Filesize
136KB

Download