colibri | bb676a031583052274837784f3485223606d83d9bfbdfdea45628ac829b365e3

Analysis

max time kernel
119s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11-09-2024 01:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6a7c993e01ad5ed33ba8680de9539080N.exe
Size

4.9MB
MD5

6a7c993e01ad5ed33ba8680de9539080
SHA1

7ea79ce18d23cfe9d2519d89ec01183f7c375792
SHA256

bb676a031583052274837784f3485223606d83d9bfbdfdea45628ac829b365e3
SHA512

9a718c2912ffe013d669d9a9df5891d890ae88222ab2349515962b8bb03a2aa063674629adc1481a97bd3f1b9afd6410c918bf68db5003a89a6762e2fc684104
SSDEEP

49152:jl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:

Score

10^/10

colibri dcrat build1 discovery evasion execution infostealer loader rat trojan

Malware Config

Extracted

Family

colibri

Version

1.2.0

Botnet

Build1

http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php

http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php

rc4.plain

Signatures

Colibri Loader
A loader sold as MaaS first seen in August 2021.
loader colibri
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 48 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4888	1116	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4432	1116	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4012	1116	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2644	1116	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	820	1116	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2012	1116	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3084	1116	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1588	1116	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	868	1116	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2972	1116	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3884	1116	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2164	1116	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3220	1116	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3692	1116	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	628	1116	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4648	1116	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4556	1116	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	468	1116	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2212	1116	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1040	1116	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4936	1116	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	780	1116	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4488	1116	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1964	1116	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3592	1116	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2948	1116	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1528	1116	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4004	1116	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1220	1116	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1892	1116	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4664	1116	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1352	1116	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2408	1116	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4112	1116	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2812	1116	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1536	1116	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3636	1116	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1716	1116	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4480	1116	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1324	1116	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5112	1116	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4032	1116	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2348	1116	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1608	1116	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4784	1116	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2904	1116	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2940	1116	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1212	1116	schtasks.exe	86

UAC bypass 3 TTPs 27 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	6a7c993e01ad5ed33ba8680de9539080N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	6a7c993e01ad5ed33ba8680de9539080N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	6a7c993e01ad5ed33ba8680de9539080N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/3676-3-0x000000001C1A0000-0x000000001C2CE000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2076	powershell.exe
3452	powershell.exe
3640	powershell.exe
1704	powershell.exe
3980	powershell.exe
2164	powershell.exe
4964	powershell.exe
2124	powershell.exe
3792	powershell.exe
2756	powershell.exe
5004	powershell.exe

Checks computer location settings 2 TTPs 9 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	6a7c993e01ad5ed33ba8680de9539080N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe

Executes dropped EXE 32 IoCs

pid	Process
3448	tmp6D15.tmp.exe
2000	tmp6D15.tmp.exe
4972	RuntimeBroker.exe
3716	tmpB006.tmp.exe
5056	tmpB006.tmp.exe
1220	RuntimeBroker.exe
2412	tmpF54D.tmp.exe
3948	tmpF54D.tmp.exe
1380	RuntimeBroker.exe
2252	tmp273A.tmp.exe
3880	tmp273A.tmp.exe
5084	RuntimeBroker.exe
4972	tmp5A8F.tmp.exe
2904	tmp5A8F.tmp.exe
4664	RuntimeBroker.exe
4872	tmp8D08.tmp.exe
8	tmp8D08.tmp.exe
2372	RuntimeBroker.exe
1168	tmpBD31.tmp.exe
3500	tmpBD31.tmp.exe
2404	tmpBD31.tmp.exe
2468	tmpBD31.tmp.exe
3492	tmpBD31.tmp.exe
2112	tmpBD31.tmp.exe
4192	RuntimeBroker.exe
3180	tmpD9E0.tmp.exe
1984	tmpD9E0.tmp.exe
3372	RuntimeBroker.exe
2860	tmpF6FD.tmp.exe
3540	tmpF6FD.tmp.exe
3988	tmpF6FD.tmp.exe
2612	tmpF6FD.tmp.exe

Checks whether UAC is enabled 1 TTPs 18 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	6a7c993e01ad5ed33ba8680de9539080N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	6a7c993e01ad5ed33ba8680de9539080N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe

Suspicious use of SetThreadContext 9 IoCs

description	pid	Process	procid_target
PID 3448 set thread context of 2000	3448	tmp6D15.tmp.exe	137
PID 3716 set thread context of 5056	3716	tmpB006.tmp.exe	168
PID 2412 set thread context of 3948	2412	tmpF54D.tmp.exe	181
PID 2252 set thread context of 3880	2252	tmp273A.tmp.exe	187
PID 4972 set thread context of 2904	4972	tmp5A8F.tmp.exe	193
PID 4872 set thread context of 8	4872	tmp8D08.tmp.exe	199
PID 3492 set thread context of 2112	3492	tmpBD31.tmp.exe	209
PID 3180 set thread context of 1984	3180	tmpD9E0.tmp.exe	215
PID 3988 set thread context of 2612	3988	tmpF6FD.tmp.exe	223

Drops file in Program Files directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Photo Viewer\es-ES\RCX6DB2.tmp	6a7c993e01ad5ed33ba8680de9539080N.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\es-ES\services.exe	6a7c993e01ad5ed33ba8680de9539080N.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\wininit.exe	6a7c993e01ad5ed33ba8680de9539080N.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\Idle.exe	6a7c993e01ad5ed33ba8680de9539080N.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\skins\SearchApp.exe	6a7c993e01ad5ed33ba8680de9539080N.exe
File opened for modification	C:\Program Files\Windows NT\TableTextService\en-US\sihost.exe	6a7c993e01ad5ed33ba8680de9539080N.exe
File created	C:\Program Files\Windows NT\TableTextService\en-US\sihost.exe	6a7c993e01ad5ed33ba8680de9539080N.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\wininit.exe	6a7c993e01ad5ed33ba8680de9539080N.exe
File created	C:\Program Files\VideoLAN\VLC\skins\38384e6a620884	6a7c993e01ad5ed33ba8680de9539080N.exe
File created	C:\Program Files\Windows Security\BrowserCore\en-US\5940a34987c991	6a7c993e01ad5ed33ba8680de9539080N.exe
File created	C:\Program Files\Windows Photo Viewer\es-ES\services.exe	6a7c993e01ad5ed33ba8680de9539080N.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\cc11b995f2a76d	6a7c993e01ad5ed33ba8680de9539080N.exe
File created	C:\Program Files\VideoLAN\VLC\skins\SearchApp.exe	6a7c993e01ad5ed33ba8680de9539080N.exe
File created	C:\Program Files\Windows NT\TableTextService\en-US\66fc9ff0ee96c2	6a7c993e01ad5ed33ba8680de9539080N.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\RCX741E.tmp	6a7c993e01ad5ed33ba8680de9539080N.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\6ccacd8608530f	6a7c993e01ad5ed33ba8680de9539080N.exe
File created	C:\Program Files\Windows Photo Viewer\es-ES\c5b4cb5e9653cc	6a7c993e01ad5ed33ba8680de9539080N.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\Idle.exe	6a7c993e01ad5ed33ba8680de9539080N.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\skins\RCX8386.tmp	6a7c993e01ad5ed33ba8680de9539080N.exe
File created	C:\Program Files\Windows Security\BrowserCore\en-US\dllhost.exe	6a7c993e01ad5ed33ba8680de9539080N.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\winlogon.exe	6a7c993e01ad5ed33ba8680de9539080N.exe
File opened for modification	C:\Program Files\Windows NT\TableTextService\en-US\RCX6BAC.tmp	6a7c993e01ad5ed33ba8680de9539080N.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\RCX7C6F.tmp	6a7c993e01ad5ed33ba8680de9539080N.exe
File opened for modification	C:\Program Files\Windows Security\BrowserCore\en-US\dllhost.exe	6a7c993e01ad5ed33ba8680de9539080N.exe
File opened for modification	C:\Program Files\Windows Security\BrowserCore\en-US\RCX69A8.tmp	6a7c993e01ad5ed33ba8680de9539080N.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\winlogon.exe	6a7c993e01ad5ed33ba8680de9539080N.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\RCX8104.tmp	6a7c993e01ad5ed33ba8680de9539080N.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\56085415360792	6a7c993e01ad5ed33ba8680de9539080N.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\ja-JP\upfc.exe	6a7c993e01ad5ed33ba8680de9539080N.exe
File created	C:\Windows\ja-JP\ea1d8f6d871115	6a7c993e01ad5ed33ba8680de9539080N.exe
File created	C:\Windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\microsoft.system.package.metadata\spoolsv.exe	6a7c993e01ad5ed33ba8680de9539080N.exe
File created	C:\Windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\microsoft.system.package.metadata\f3b6ecef712a24	6a7c993e01ad5ed33ba8680de9539080N.exe
File opened for modification	C:\Windows\ja-JP\RCX71EA.tmp	6a7c993e01ad5ed33ba8680de9539080N.exe
File opened for modification	C:\Windows\ja-JP\upfc.exe	6a7c993e01ad5ed33ba8680de9539080N.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\microsoft.system.package.metadata\RCX7846.tmp	6a7c993e01ad5ed33ba8680de9539080N.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\microsoft.system.package.metadata\spoolsv.exe	6a7c993e01ad5ed33ba8680de9539080N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpBD31.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpBD31.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpBD31.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpB006.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp273A.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpBD31.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpF6FD.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpF6FD.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp5A8F.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp8D08.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpBD31.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpD9E0.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpF6FD.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp6D15.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpF54D.tmp.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings	6a7c993e01ad5ed33ba8680de9539080N.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings	RuntimeBroker.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 48 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3592	schtasks.exe
1528	schtasks.exe
1536	schtasks.exe
2644	schtasks.exe
3084	schtasks.exe
468	schtasks.exe
4936	schtasks.exe
4488	schtasks.exe
2948	schtasks.exe
1352	schtasks.exe
1324	schtasks.exe
5112	schtasks.exe
4032	schtasks.exe
4888	schtasks.exe
868	schtasks.exe
2212	schtasks.exe
4112	schtasks.exe
2812	schtasks.exe
4004	schtasks.exe
2408	schtasks.exe
4784	schtasks.exe
4432	schtasks.exe
1588	schtasks.exe
2348	schtasks.exe
3220	schtasks.exe
1040	schtasks.exe
1220	schtasks.exe
4012	schtasks.exe
820	schtasks.exe
2972	schtasks.exe
3884	schtasks.exe
2164	schtasks.exe
4664	schtasks.exe
2904	schtasks.exe
1212	schtasks.exe
2012	schtasks.exe
3692	schtasks.exe
4556	schtasks.exe
780	schtasks.exe
4480	schtasks.exe
1716	schtasks.exe
1608	schtasks.exe
2940	schtasks.exe
628	schtasks.exe
4648	schtasks.exe
1964	schtasks.exe
1892	schtasks.exe
3636	schtasks.exe

Suspicious behavior: EnumeratesProcesses 61 IoCs

pid	Process
3676	6a7c993e01ad5ed33ba8680de9539080N.exe
3676	6a7c993e01ad5ed33ba8680de9539080N.exe
3676	6a7c993e01ad5ed33ba8680de9539080N.exe
3676	6a7c993e01ad5ed33ba8680de9539080N.exe
3676	6a7c993e01ad5ed33ba8680de9539080N.exe
3676	6a7c993e01ad5ed33ba8680de9539080N.exe
3676	6a7c993e01ad5ed33ba8680de9539080N.exe
3676	6a7c993e01ad5ed33ba8680de9539080N.exe
3676	6a7c993e01ad5ed33ba8680de9539080N.exe
3676	6a7c993e01ad5ed33ba8680de9539080N.exe
3676	6a7c993e01ad5ed33ba8680de9539080N.exe
3676	6a7c993e01ad5ed33ba8680de9539080N.exe
3676	6a7c993e01ad5ed33ba8680de9539080N.exe
3676	6a7c993e01ad5ed33ba8680de9539080N.exe
3676	6a7c993e01ad5ed33ba8680de9539080N.exe
3676	6a7c993e01ad5ed33ba8680de9539080N.exe
3676	6a7c993e01ad5ed33ba8680de9539080N.exe
3676	6a7c993e01ad5ed33ba8680de9539080N.exe
3676	6a7c993e01ad5ed33ba8680de9539080N.exe
3676	6a7c993e01ad5ed33ba8680de9539080N.exe
5004	powershell.exe
5004	powershell.exe
3452	powershell.exe
3452	powershell.exe
2124	powershell.exe
2124	powershell.exe
2756	powershell.exe
2756	powershell.exe
1704	powershell.exe
1704	powershell.exe
2164	powershell.exe
2164	powershell.exe
3640	powershell.exe
3640	powershell.exe
2076	powershell.exe
2076	powershell.exe
3792	powershell.exe
3792	powershell.exe
3980	powershell.exe
3980	powershell.exe
4964	powershell.exe
4964	powershell.exe
3792	powershell.exe
2164	powershell.exe
1704	powershell.exe
5004	powershell.exe
4964	powershell.exe
2756	powershell.exe
3640	powershell.exe
3452	powershell.exe
2124	powershell.exe
2076	powershell.exe
3980	powershell.exe
4972	RuntimeBroker.exe
1220	RuntimeBroker.exe
1380	RuntimeBroker.exe
5084	RuntimeBroker.exe
4664	RuntimeBroker.exe
2372	RuntimeBroker.exe
4192	RuntimeBroker.exe
3372	RuntimeBroker.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	3676	6a7c993e01ad5ed33ba8680de9539080N.exe
Token: SeDebugPrivilege	5004	powershell.exe
Token: SeDebugPrivilege	3452	powershell.exe
Token: SeDebugPrivilege	2124	powershell.exe
Token: SeDebugPrivilege	2756	powershell.exe
Token: SeDebugPrivilege	1704	powershell.exe
Token: SeDebugPrivilege	4964	powershell.exe
Token: SeDebugPrivilege	2164	powershell.exe
Token: SeDebugPrivilege	3640	powershell.exe
Token: SeDebugPrivilege	3792	powershell.exe
Token: SeDebugPrivilege	2076	powershell.exe
Token: SeDebugPrivilege	3980	powershell.exe
Token: SeDebugPrivilege	4972	RuntimeBroker.exe
Token: SeDebugPrivilege	1220	RuntimeBroker.exe
Token: SeDebugPrivilege	1380	RuntimeBroker.exe
Token: SeDebugPrivilege	5084	RuntimeBroker.exe
Token: SeDebugPrivilege	4664	RuntimeBroker.exe
Token: SeDebugPrivilege	2372	RuntimeBroker.exe
Token: SeDebugPrivilege	4192	RuntimeBroker.exe
Token: SeDebugPrivilege	3372	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3676 wrote to memory of 3448	3676	6a7c993e01ad5ed33ba8680de9539080N.exe	135
PID 3676 wrote to memory of 3448	3676	6a7c993e01ad5ed33ba8680de9539080N.exe	135
PID 3676 wrote to memory of 3448	3676	6a7c993e01ad5ed33ba8680de9539080N.exe	135
PID 3448 wrote to memory of 2000	3448	tmp6D15.tmp.exe	137
PID 3448 wrote to memory of 2000	3448	tmp6D15.tmp.exe	137
PID 3448 wrote to memory of 2000	3448	tmp6D15.tmp.exe	137
PID 3448 wrote to memory of 2000	3448	tmp6D15.tmp.exe	137
PID 3448 wrote to memory of 2000	3448	tmp6D15.tmp.exe	137
PID 3448 wrote to memory of 2000	3448	tmp6D15.tmp.exe	137
PID 3448 wrote to memory of 2000	3448	tmp6D15.tmp.exe	137
PID 3676 wrote to memory of 2124	3676	6a7c993e01ad5ed33ba8680de9539080N.exe	138
PID 3676 wrote to memory of 2124	3676	6a7c993e01ad5ed33ba8680de9539080N.exe	138
PID 3676 wrote to memory of 5004	3676	6a7c993e01ad5ed33ba8680de9539080N.exe	139
PID 3676 wrote to memory of 5004	3676	6a7c993e01ad5ed33ba8680de9539080N.exe	139
PID 3676 wrote to memory of 3980	3676	6a7c993e01ad5ed33ba8680de9539080N.exe	140
PID 3676 wrote to memory of 3980	3676	6a7c993e01ad5ed33ba8680de9539080N.exe	140
PID 3676 wrote to memory of 3792	3676	6a7c993e01ad5ed33ba8680de9539080N.exe	141
PID 3676 wrote to memory of 3792	3676	6a7c993e01ad5ed33ba8680de9539080N.exe	141
PID 3676 wrote to memory of 1704	3676	6a7c993e01ad5ed33ba8680de9539080N.exe	142
PID 3676 wrote to memory of 1704	3676	6a7c993e01ad5ed33ba8680de9539080N.exe	142
PID 3676 wrote to memory of 2756	3676	6a7c993e01ad5ed33ba8680de9539080N.exe	143
PID 3676 wrote to memory of 2756	3676	6a7c993e01ad5ed33ba8680de9539080N.exe	143
PID 3676 wrote to memory of 3640	3676	6a7c993e01ad5ed33ba8680de9539080N.exe	144
PID 3676 wrote to memory of 3640	3676	6a7c993e01ad5ed33ba8680de9539080N.exe	144
PID 3676 wrote to memory of 3452	3676	6a7c993e01ad5ed33ba8680de9539080N.exe	145
PID 3676 wrote to memory of 3452	3676	6a7c993e01ad5ed33ba8680de9539080N.exe	145
PID 3676 wrote to memory of 2076	3676	6a7c993e01ad5ed33ba8680de9539080N.exe	146
PID 3676 wrote to memory of 2076	3676	6a7c993e01ad5ed33ba8680de9539080N.exe	146
PID 3676 wrote to memory of 4964	3676	6a7c993e01ad5ed33ba8680de9539080N.exe	147
PID 3676 wrote to memory of 4964	3676	6a7c993e01ad5ed33ba8680de9539080N.exe	147
PID 3676 wrote to memory of 2164	3676	6a7c993e01ad5ed33ba8680de9539080N.exe	148
PID 3676 wrote to memory of 2164	3676	6a7c993e01ad5ed33ba8680de9539080N.exe	148
PID 3676 wrote to memory of 468	3676	6a7c993e01ad5ed33ba8680de9539080N.exe	160
PID 3676 wrote to memory of 468	3676	6a7c993e01ad5ed33ba8680de9539080N.exe	160
PID 468 wrote to memory of 632	468	cmd.exe	162
PID 468 wrote to memory of 632	468	cmd.exe	162
PID 468 wrote to memory of 4972	468	cmd.exe	163
PID 468 wrote to memory of 4972	468	cmd.exe	163
PID 4972 wrote to memory of 4384	4972	RuntimeBroker.exe	164
PID 4972 wrote to memory of 4384	4972	RuntimeBroker.exe	164
PID 4972 wrote to memory of 1240	4972	RuntimeBroker.exe	165
PID 4972 wrote to memory of 1240	4972	RuntimeBroker.exe	165
PID 4972 wrote to memory of 3716	4972	RuntimeBroker.exe	166
PID 4972 wrote to memory of 3716	4972	RuntimeBroker.exe	166
PID 4972 wrote to memory of 3716	4972	RuntimeBroker.exe	166
PID 3716 wrote to memory of 5056	3716	tmpB006.tmp.exe	168
PID 3716 wrote to memory of 5056	3716	tmpB006.tmp.exe	168
PID 3716 wrote to memory of 5056	3716	tmpB006.tmp.exe	168
PID 3716 wrote to memory of 5056	3716	tmpB006.tmp.exe	168
PID 3716 wrote to memory of 5056	3716	tmpB006.tmp.exe	168
PID 3716 wrote to memory of 5056	3716	tmpB006.tmp.exe	168
PID 3716 wrote to memory of 5056	3716	tmpB006.tmp.exe	168
PID 4384 wrote to memory of 1220	4384	WScript.exe	176
PID 4384 wrote to memory of 1220	4384	WScript.exe	176
PID 1220 wrote to memory of 2404	1220	RuntimeBroker.exe	177
PID 1220 wrote to memory of 2404	1220	RuntimeBroker.exe	177
PID 1220 wrote to memory of 2416	1220	RuntimeBroker.exe	178
PID 1220 wrote to memory of 2416	1220	RuntimeBroker.exe	178
PID 1220 wrote to memory of 2412	1220	RuntimeBroker.exe	179
PID 1220 wrote to memory of 2412	1220	RuntimeBroker.exe	179
PID 1220 wrote to memory of 2412	1220	RuntimeBroker.exe	179
PID 2412 wrote to memory of 3948	2412	tmpF54D.tmp.exe	181
PID 2412 wrote to memory of 3948	2412	tmpF54D.tmp.exe	181
PID 2412 wrote to memory of 3948	2412	tmpF54D.tmp.exe	181

System policy modification 1 TTPs 27 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	6a7c993e01ad5ed33ba8680de9539080N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	6a7c993e01ad5ed33ba8680de9539080N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	6a7c993e01ad5ed33ba8680de9539080N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\6a7c993e01ad5ed33ba8680de9539080N.exe
"C:\Users\Admin\AppData\Local\Temp\6a7c993e01ad5ed33ba8680de9539080N.exe"
1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3676
- C:\Users\Admin\AppData\Local\Temp\tmp6D15.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp6D15.tmp.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3448
- - C:\Users\Admin\AppData\Local\Temp\tmp6D15.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp6D15.tmp.exe"
    3⤵
    - Executes dropped EXE
    PID:2000
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2124
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5004
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3980
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3792
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1704
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2756
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3640
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3452
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2076
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4964
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2164
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\EunsIO9tk2.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:468
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:632
- - C:\Recovery\WindowsRE\RuntimeBroker.exe
    "C:\Recovery\WindowsRE\RuntimeBroker.exe"
    3⤵
    - UAC bypass
    - Checks computer location settings
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:4972
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\39c9dd0c-ffd8-4b7e-85f8-9bd567741f19.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4384
    - - C:\Recovery\WindowsRE\RuntimeBroker.exe
        
        C:\Recovery\WindowsRE\RuntimeBroker.exe
        5⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1220
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\153c5105-570f-4806-b9fe-48929a3d4055.vbs"
        6⤵
        
        PID:2404
        
        C:\Recovery\WindowsRE\RuntimeBroker.exe
        
        C:\Recovery\WindowsRE\RuntimeBroker.exe
        7⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1380
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4c6aeb63-12d0-420f-8d44-717efcff2cd7.vbs"
        8⤵
        
        PID:5000
        
        C:\Recovery\WindowsRE\RuntimeBroker.exe
        
        C:\Recovery\WindowsRE\RuntimeBroker.exe
        9⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:5084
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f9697031-a7f4-4839-a8a9-4f9be7c21023.vbs"
        10⤵
        
        PID:2320
        
        C:\Recovery\WindowsRE\RuntimeBroker.exe
        
        C:\Recovery\WindowsRE\RuntimeBroker.exe
        11⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4664
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4aee6f56-64e6-4b8e-9fba-45f12ab3530e.vbs"
        12⤵
        
        PID:2024
        
        C:\Recovery\WindowsRE\RuntimeBroker.exe
        
        C:\Recovery\WindowsRE\RuntimeBroker.exe
        13⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2372
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8846e0af-cf53-4348-8368-83b0a8ac0ee6.vbs"
        14⤵
        
        PID:1856
        
        C:\Recovery\WindowsRE\RuntimeBroker.exe
        
        C:\Recovery\WindowsRE\RuntimeBroker.exe
        15⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4192
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fd34ef2d-96d9-4414-a38b-ca2a7f45510d.vbs"
        16⤵
        
        PID:2848
        
        C:\Recovery\WindowsRE\RuntimeBroker.exe
        
        C:\Recovery\WindowsRE\RuntimeBroker.exe
        17⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3372
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e706ad81-55c6-42bc-8420-f47eb921588b.vbs"
        18⤵
        
        PID:4348
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c0acaa9f-2cb3-4c0c-b039-84457296c739.vbs"
        18⤵
        
        PID:3488
        
        C:\Users\Admin\AppData\Local\Temp\tmpF6FD.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpF6FD.tmp.exe"
        18⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2860
        
        C:\Users\Admin\AppData\Local\Temp\tmpF6FD.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpF6FD.tmp.exe"
        19⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3540
        
        C:\Users\Admin\AppData\Local\Temp\tmpF6FD.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpF6FD.tmp.exe"
        20⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3988
        
        C:\Users\Admin\AppData\Local\Temp\tmpF6FD.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpF6FD.tmp.exe"
        21⤵
        Executes dropped EXE
        
        PID:2612
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1351ce50-bcca-40a6-b0e1-e020da2932b5.vbs"
        16⤵
        
        PID:5000
        
        C:\Users\Admin\AppData\Local\Temp\tmpD9E0.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpD9E0.tmp.exe"
        16⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3180
        
        C:\Users\Admin\AppData\Local\Temp\tmpD9E0.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpD9E0.tmp.exe"
        17⤵
        Executes dropped EXE
        
        PID:1984
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7e6ee337-0359-4804-9c52-65579340d68d.vbs"
        14⤵
        
        PID:5104
        
        C:\Users\Admin\AppData\Local\Temp\tmpBD31.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpBD31.tmp.exe"
        14⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1168
        
        C:\Users\Admin\AppData\Local\Temp\tmpBD31.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpBD31.tmp.exe"
        15⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3500
        
        C:\Users\Admin\AppData\Local\Temp\tmpBD31.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpBD31.tmp.exe"
        16⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2404
        
        C:\Users\Admin\AppData\Local\Temp\tmpBD31.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpBD31.tmp.exe"
        17⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2468
        
        C:\Users\Admin\AppData\Local\Temp\tmpBD31.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpBD31.tmp.exe"
        18⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3492
        
        C:\Users\Admin\AppData\Local\Temp\tmpBD31.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpBD31.tmp.exe"
        19⤵
        Executes dropped EXE
        
        PID:2112
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cd0d5ff2-da6e-4d4a-8eb3-3c99a125d399.vbs"
        12⤵
        
        PID:3948
        
        C:\Users\Admin\AppData\Local\Temp\tmp8D08.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp8D08.tmp.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4872
        
        C:\Users\Admin\AppData\Local\Temp\tmp8D08.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp8D08.tmp.exe"
        13⤵
        Executes dropped EXE
        
        PID:8
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\46a73e47-e62b-4265-891a-49e4f349498a.vbs"
        10⤵
        
        PID:840
        
        C:\Users\Admin\AppData\Local\Temp\tmp5A8F.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp5A8F.tmp.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4972
        
        C:\Users\Admin\AppData\Local\Temp\tmp5A8F.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp5A8F.tmp.exe"
        11⤵
        Executes dropped EXE
        
        PID:2904
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6815f126-45fc-44f1-8917-69e0d50d2496.vbs"
        8⤵
        
        PID:536
        
        C:\Users\Admin\AppData\Local\Temp\tmp273A.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp273A.tmp.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2252
        
        C:\Users\Admin\AppData\Local\Temp\tmp273A.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp273A.tmp.exe"
        9⤵
        Executes dropped EXE
        
        PID:3880
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fe89b81d-5bf4-41a1-b2c2-f36a0af31f1a.vbs"
        6⤵
        
        PID:2416
      - C:\Users\Admin\AppData\Local\Temp\tmpF54D.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpF54D.tmp.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2412
        
        C:\Users\Admin\AppData\Local\Temp\tmpF54D.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpF54D.tmp.exe"
        7⤵
        Executes dropped EXE
        
        PID:3948
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b2d823d6-84b0-4213-a25c-19f35b17dd5a.vbs"
      4⤵
      PID:1240
  - - C:\Users\Admin\AppData\Local\Temp\tmpB006.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmpB006.tmp.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3716
    - - C:\Users\Admin\AppData\Local\Temp\tmpB006.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpB006.tmp.exe"
        5⤵
        Executes dropped EXE
        
        PID:5056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows NT\TableTextService\en-US\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files\Windows NT\TableTextService\en-US\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows NT\TableTextService\en-US\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Photo Viewer\es-ES\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\es-ES\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Photo Viewer\es-ES\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 14 /tr "'C:\Windows\ja-JP\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Windows\ja-JP\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 12 /tr "'C:\Windows\ja-JP\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Program Files\Mozilla Firefox\uninstall\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\uninstall\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\Program Files\Mozilla Firefox\uninstall\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\microsoft.system.package.metadata\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\microsoft.system.package.metadata\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\microsoft.system.package.metadata\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Default User\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\Links\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Users\Admin\Links\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\Links\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 5 /tr "'C:\Program Files\VideoLAN\VLC\skins\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\skins\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 8 /tr "'C:\Program Files\VideoLAN\VLC\skins\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\OneDrive\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Admin\OneDrive\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\OneDrive\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Recovery\WindowsRE\RCX7632.tmp

Filesize
4.9MB

MD5
89e3a47430399071234a4c3b9d67dc58

SHA1
5f6e8d30983f571cbf72d5cc7081e2f8a3dd85a9

SHA256
427e6cdca181ddaedfabf19028520efb7acf8a59c0cc8f8f4f5a43448f3c07b6

SHA512
a77468c4be1f17d9f3d266f2bdf1d45aa0e1f3dc1aeefd268dc08f6e560e6ed087bc0e7fbc200740f2fb89fade37f30b10763dc9ef7ecfab945d2263f2d58544

Download Submit
C:\Recovery\WindowsRE\RuntimeBroker.exe

Filesize
4.9MB

MD5
886c9235f7a9008864d19fc44b77a636

SHA1
75ffaad418209b182f24fe917bc9ecc6e4f2b020

SHA256
719bb6469ee0a8ad406782dcc9cb6c6b4d50ba5a7e2577b6659ebc2d7a48d66c

SHA512
67124cb68e3d670dc3ee81650da577485e9afac3a87b285aaa8095dbb220581fc90cc887b4048967f2c73ce53ebf7aa32ab02bd5a91c30853e822c8921341a81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RuntimeBroker.exe.log

Filesize
1KB

MD5
4a667f150a4d1d02f53a9f24d89d53d1

SHA1
306e125c9edce66f28fdb63e6c4ca5c9ad6e8c97

SHA256
414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd

SHA512
4edd8e73ce03488a6d92750a782cd4042fbb54a5b3f8d8ba3ea227fda0653c2cd84f0c5d64976c7cdc1f518a2fdc8ff10e2a015ec7acf3cd01b0d62bc98542d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d3e9c29fe44e90aae6ed30ccf799ca8

SHA1
c7974ef72264bbdf13a2793ccf1aed11bc565dce

SHA256
2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

SHA512
60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
59d97011e091004eaffb9816aa0b9abd

SHA1
1602a56b01dd4b7c577ca27d3117e4bcc1aa657b

SHA256
18f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d

SHA512
d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
bd5940f08d0be56e65e5f2aaf47c538e

SHA1
d7e31b87866e5e383ab5499da64aba50f03e8443

SHA256
2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

SHA512
c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
a8e8360d573a4ff072dcc6f09d992c88

SHA1
3446774433ceaf0b400073914facab11b98b6807

SHA256
bf5e284e8f95122bf75ead61c7e2b40f55c96742b05330b5b1cb7915991df13b

SHA512
4ee5167643d82082f57c42616007ef9be57f43f9731921bdf7bca611a914724ad94072d3c8f5b130fa54129e5328ccdebf37ba74339c37deb53e79df5cdf0dbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\153c5105-570f-4806-b9fe-48929a3d4055.vbs

Filesize
715B

MD5
4299d7468ffb7acd0fc025cf3b095df3

SHA1
ce656cd5edfe2bc84c115e9e4f93eef848de36f5

SHA256
044f4cbf00e32c591e3383a94c81493b7a95921ed6837e8b99604849b698e744

SHA512
2447c136bb1e29f1b037f0f6c606446a5ed763523c58551d0c08f4f925fcf339fd9259509c770ef7b486b8f6a98320835f67e44099601ad32d23796e22669807

Download Submit
C:\Users\Admin\AppData\Local\Temp\39c9dd0c-ffd8-4b7e-85f8-9bd567741f19.vbs

Filesize
715B

MD5
40003205b168722d6d19e1920a6225ae

SHA1
0e8c6c2abadbb49a25dc74cd32f5ed36fba8d407

SHA256
54edddba34a4a7febec52d51ccf7b8e45fccefc4873dbbee609c62c40d42cc06

SHA512
c02fa9b057a135b7d1aef7b9f8e74049aea08f9899838f5f232d1ff56f3ea9f8d9008bd433653a184de9348e0ae634bba3c20aef4c83373ad08a04c185c7b399

Download Submit
C:\Users\Admin\AppData\Local\Temp\4aee6f56-64e6-4b8e-9fba-45f12ab3530e.vbs

Filesize
715B

MD5
e31cff40d495241449f513ce73e6449f

SHA1
555351ec4852c2bfe1e978bf7d3260e94cb1bb4e

SHA256
4bb11447e62eb86a82c85a7d5957a8f5c3c310af9198852500a99563e4789ecc

SHA512
1240a1a0a296acebab91a79020af4bfb4d1d56bfa98e691e117290369396ee2e69f7e4205de814d762c4d66d470f8c7400450e7ec13bfc0d702c0a856168eb2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\4c6aeb63-12d0-420f-8d44-717efcff2cd7.vbs

Filesize
715B

MD5
5609eb495d1e6bee01b499bfbaf9771d

SHA1
bac926cea6bdfe1a303e4a7a4b16ad2bcd10d007

SHA256
2295ccb7a90f08775eec75aecb5d81c94ffa4067d3e25eed30d89a3524642614

SHA512
84a66cbd2dc1253b630f28e1f55a417007294445241e68d3d340e86372bcdab9d0e7e78db594cdafcf3cddd002bf3dda77d83cab05100bd867dfd26496831cc1

Download Submit
C:\Users\Admin\AppData\Local\Temp\8846e0af-cf53-4348-8368-83b0a8ac0ee6.vbs

Filesize
715B

MD5
f152734e3d89511c8cca81b8e3e7a085

SHA1
859f8e49773c65aec4b51200189432c13f50e3fd

SHA256
e7b1a0351b5d9fb4f15ae074dbe00b0ae4731cf3d981e7a14f07463dc864abc4

SHA512
02a6d1084f938edc711ebc7b458f6a525f4162ce2630b4adebab822316acb5f084595ab32a8341106032038a52228e8acb68658cd961990e067648eb5ea631c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\EunsIO9tk2.bat

Filesize
204B

MD5
b4b068b58150b9651664f3e32d2cc1fc

SHA1
a3eadb035be21b5301cac283543c49bbb0f24921

SHA256
5d0343c1bf37d804a8a18503b73ba3b3e887b2110870f3916eefadffca7f60a0

SHA512
0533c56e4d87f53c95da23b81ef4ebff829087e640c51a951dde73001e78e3f0e975ec0deb7c6f6ef9e7e68d46c7b0c9ec6b69fad7be01085f01845cde347fd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5ang5ihu.qmr.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\b2d823d6-84b0-4213-a25c-19f35b17dd5a.vbs

Filesize
491B

MD5
f4812542e2f7ac82b3e2f0f15db1872f

SHA1
781bd503ed9643286076ef53436642e910b1923d

SHA256
ed47dd6131ef7a235fb77201bc600f9bcc0fa463f17a295d44037bcb4678e186

SHA512
ddaa6ed84b052bf45c68bf0268d7419e818f4ab2c6e96f3c5a18b046f5e9de3a0abb13252e9f17a194f2b89df9d9da54c233592a75e4b79fa0aca3d99d3d4020

Download Submit
C:\Users\Admin\AppData\Local\Temp\f9697031-a7f4-4839-a8a9-4f9be7c21023.vbs

Filesize
715B

MD5
06cd73e06153e0d066f75975d5a04a32

SHA1
b2c879f064a36e8e707d057be4c1b0d4c0ad618a

SHA256
0cd847b90123dd7a29115b820c19afc06329ff3b3f62c0086a53fd0f89e69bc7

SHA512
672fcb30c4474c4cd85d7c312afab40ec0ccb9a0741b4b93933344aa91f621eb02572a267a3da09dce13384a0fec2c01bede845a17f49ceab10d3d844f74e081

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp6D15.tmp.exe

Filesize
75KB

MD5
e0a68b98992c1699876f818a22b5b907

SHA1
d41e8ad8ba51217eb0340f8f69629ccb474484d0

SHA256
2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

SHA512
856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

Download Submit
C:\Windows\ja-JP\upfc.exe

Filesize
4.9MB

MD5
6a7c993e01ad5ed33ba8680de9539080

SHA1
7ea79ce18d23cfe9d2519d89ec01183f7c375792

SHA256
bb676a031583052274837784f3485223606d83d9bfbdfdea45628ac829b365e3

SHA512
9a718c2912ffe013d669d9a9df5891d890ae88222ab2349515962b8bb03a2aa063674629adc1481a97bd3f1b9afd6410c918bf68db5003a89a6762e2fc684104

Download Submit
memory/1704-192-0x00000173B5F30000-0x00000173B5F52000-memory.dmp

Filesize
136KB

Download
memory/2000-84-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/3676-13-0x000000001C940000-0x000000001C94A000-memory.dmp

Filesize
40KB

Download
memory/3676-0-0x00007FFD07613000-0x00007FFD07615000-memory.dmp

Filesize
8KB

Download
memory/3676-7-0x000000001C050000-0x000000001C060000-memory.dmp

Filesize
64KB

Download
memory/3676-11-0x000000001C930000-0x000000001C942000-memory.dmp

Filesize
72KB

Download
memory/3676-9-0x000000001C080000-0x000000001C090000-memory.dmp

Filesize
64KB

Download
memory/3676-4-0x000000001C020000-0x000000001C03C000-memory.dmp

Filesize
112KB

Download
memory/3676-16-0x000000001C970000-0x000000001C978000-memory.dmp

Filesize
32KB

Download
memory/3676-18-0x000000001C990000-0x000000001C99C000-memory.dmp

Filesize
48KB

Download
memory/3676-2-0x00007FFD07610000-0x00007FFD080D1000-memory.dmp

Filesize
10.8MB

Download
memory/3676-17-0x000000001C980000-0x000000001C988000-memory.dmp

Filesize
32KB

Download
memory/3676-6-0x000000001C040000-0x000000001C048000-memory.dmp

Filesize
32KB

Download
memory/3676-154-0x00007FFD07613000-0x00007FFD07615000-memory.dmp

Filesize
8KB

Download
memory/3676-14-0x000000001C950000-0x000000001C95E000-memory.dmp

Filesize
56KB

Download
memory/3676-15-0x000000001C960000-0x000000001C96E000-memory.dmp

Filesize
56KB

Download
memory/3676-5-0x000000001C8D0000-0x000000001C920000-memory.dmp

Filesize
320KB

Download
memory/3676-12-0x000000001CE70000-0x000000001D398000-memory.dmp

Filesize
5.2MB

Download
memory/3676-3-0x000000001C1A0000-0x000000001C2CE000-memory.dmp

Filesize
1.2MB

Download
memory/3676-1-0x0000000000EF0000-0x00000000013E4000-memory.dmp

Filesize
5.0MB

Download
memory/3676-10-0x000000001C920000-0x000000001C92A000-memory.dmp

Filesize
40KB

Download
memory/3676-177-0x00007FFD07610000-0x00007FFD080D1000-memory.dmp

Filesize
10.8MB

Download
memory/3676-8-0x000000001C060000-0x000000001C076000-memory.dmp

Filesize
88KB

Download
memory/3676-168-0x00007FFD07610000-0x00007FFD080D1000-memory.dmp

Filesize
10.8MB

Download
memory/4972-305-0x0000000000E30000-0x0000000001324000-memory.dmp

Filesize
5.0MB

Download