dcrat | 177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30f

Analysis

max time kernel
118s
max time network
125s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
17-09-2024 21:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
Size

4.9MB
MD5

950254b6989e56a5d93d3f38445e1c60
SHA1

4c6442eb7ddfdbb5d3fb34f53e50da45794cdaed
SHA256

177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30f
SHA512

261732dc34213730d2f747cf4868ed82227b9af8be44d4d28b155aaaf6608c9b88cd832db03000c92aa395fbb62a11c2915b8b12ff8f1754ad682e1178bdaa22
SSDEEP

49152:jl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:

Score

10^/10

dcrat evasion execution infostealer rat trojan

Malware Config

Signatures

DcRat 64 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		3004	schtasks.exe
		2040	schtasks.exe
		2256	schtasks.exe
		2696	schtasks.exe
		1588	schtasks.exe
		2096	schtasks.exe
		2884	schtasks.exe
		1428	schtasks.exe
		704	schtasks.exe
		1128	schtasks.exe
		1796	schtasks.exe
		2908	schtasks.exe
		2936	schtasks.exe
		2908	schtasks.exe
		1012	schtasks.exe
		2496	schtasks.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_32\24dbde2999530e		177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
		2544	schtasks.exe
		1764	schtasks.exe
		1772	schtasks.exe
		2376	schtasks.exe
		2404	schtasks.exe
		2956	schtasks.exe
		2060	schtasks.exe
		1528	schtasks.exe
		540	schtasks.exe
		2776	schtasks.exe
		2580	schtasks.exe
		2400	schtasks.exe
		1760	schtasks.exe
		2480	schtasks.exe
		1296	schtasks.exe
		2596	schtasks.exe
		2076	schtasks.exe
		552	schtasks.exe
		2840	schtasks.exe
		1988	schtasks.exe
		2668	schtasks.exe
		1724	schtasks.exe
		2504	schtasks.exe
File created	C:\Program Files\VideoLAN\101b941d020240		177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
		2820	schtasks.exe
		1488	schtasks.exe
		2488	schtasks.exe
		1952	schtasks.exe
		876	schtasks.exe
		2796	schtasks.exe
		2848	schtasks.exe
		2080	schtasks.exe
		2612	schtasks.exe
		2876	schtasks.exe
		3012	schtasks.exe
		3032	schtasks.exe
		1472	schtasks.exe
		3000	schtasks.exe
File created	C:\Program Files (x86)\Google\CrashReports\1805d82cfccfcc		177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
File created	C:\Program Files\Uninstall Information\cc11b995f2a76d		177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
		1044	schtasks.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\5940a34987c991		177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
		2176	schtasks.exe
		2628	schtasks.exe
		2004	schtasks.exe
		2304	schtasks.exe
		512	schtasks.exe

Process spawned unexpected child process 64 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2776	2720	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2796	2720	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2560	2720	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2908	2720	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2580	2720	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2696	2720	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2596	2720	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3032	2720	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	512	2720	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2504	2720	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	316	2720	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1296	2720	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2404	2720	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2820	2720	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2612	2720	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2848	2720	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3012	2720	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2496	2720	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2880	2720	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2876	2720	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2996	2720	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	704	2720	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1932	2720	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2956	2720	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1772	2720	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1128	2720	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1724	2720	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2076	2720	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1384	2720	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2060	2720	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	824	2720	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2376	2720	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	552	2720	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1100	2720	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1472	2720	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1796	2720	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1488	2720	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1588	2720	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3004	2720	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1528	2720	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3000	2720	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2936	2720	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2176	2720	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2488	2720	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2640	2720	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2840	2720	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2484	2720	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2384	2720	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1952	2720	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2908	2720	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2096	2720	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2628	2720	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2400	2720	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	876	2720	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2040	2720	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1044	2720	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2464	2720	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2004	2720	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1012	2720	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2080	2720	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2884	2720	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	540	2720	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2256	2720	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1760	2720	schtasks.exe	30

UAC bypass 3 TTPs 21 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/2124-3-0x000000001B430000-0x000000001B55E000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 24 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2944	powershell.exe
2276	powershell.exe
1968	powershell.exe
1884	powershell.exe
2300	powershell.exe
748	powershell.exe
972	powershell.exe
1076	powershell.exe
1480	powershell.exe
1640	powershell.exe
2208	powershell.exe
2308	powershell.exe
2348	powershell.exe
1652	powershell.exe
1188	powershell.exe
1736	powershell.exe
1040	powershell.exe
3048	powershell.exe
1192	powershell.exe
2872	powershell.exe
892	powershell.exe
636	powershell.exe
236	powershell.exe
2076	powershell.exe

Executes dropped EXE 6 IoCs

pid	Process
568	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
1876	winlogon.exe
2116	winlogon.exe
2588	winlogon.exe
1748	winlogon.exe
2752	winlogon.exe

Checks whether UAC is enabled 1 TTPs 14 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe

Drops file in Program Files directory 42 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Journal\Templates\audiodg.exe	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
File created	C:\Program Files\Microsoft Office\Office14\audiodg.exe	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
File created	C:\Program Files (x86)\Google\CrashReports\177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\RCXA48E.tmp	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
File opened for modification	C:\Program Files\VideoLAN\lsm.exe	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\dllhost.exe	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
File opened for modification	C:\Program Files\Windows Journal\Templates\RCX9D99.tmp	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
File opened for modification	C:\Program Files (x86)\Google\CrashReports\177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
File opened for modification	C:\Program Files\Uninstall Information\RCX9FDB.tmp	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\dllhost.exe	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\System.exe	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\RedistList\csrss.exe	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
File opened for modification	C:\Program Files\Windows Media Player\Network Sharing\spoolsv.exe	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
File created	C:\Program Files\Windows Journal\Templates\audiodg.exe	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
File created	C:\Program Files\Windows Journal\Templates\42af1c969fbb7b	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
File created	C:\Program Files\Uninstall Information\winlogon.exe	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
File created	C:\Program Files (x86)\Google\CrashReports\1805d82cfccfcc	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\WmiPrvSE.exe	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
File opened for modification	C:\Program Files\Microsoft Office\audiodg.exe	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
File created	C:\Program Files\Uninstall Information\cc11b995f2a76d	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
File created	C:\Program Files\VideoLAN\lsm.exe	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
File created	C:\Program Files\VideoLAN\101b941d020240	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
File opened for modification	C:\Program Files\Uninstall Information\winlogon.exe	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\audiodg.exe	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\1033\System.exe	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\csrss.exe	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
File created	C:\Program Files\Microsoft Office\Office14\42af1c969fbb7b	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\RCXAD0A.tmp	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
File created	C:\Program Files (x86)\Microsoft.NET\RedistList\csrss.exe	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
File created	C:\Program Files (x86)\Microsoft.NET\RedistList\886983d96e3d3e	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
File created	C:\Program Files\Windows Media Player\Network Sharing\f3b6ecef712a24	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\24dbde2999530e	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\WmiPrvSE.exe	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
File created	C:\Program Files\Microsoft Office\42af1c969fbb7b	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\27d1bcfc3c54e0	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
File created	C:\Program Files\Microsoft Office\audiodg.exe	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\5940a34987c991	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
File opened for modification	C:\Program Files (x86)\Google\CrashReports\RCXA8D4.tmp	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
File opened for modification	C:\Program Files\VideoLAN\RCXAAF7.tmp	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\csrss.exe	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\886983d96e3d3e	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
File created	C:\Program Files\Windows Media Player\Network Sharing\spoolsv.exe	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\assembly\NativeImages_v4.0.30319_32\WmiPrvSE.exe	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_32\24dbde2999530e	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
File opened for modification	C:\Windows\assembly\NativeImages_v4.0.30319_32\RCXAF9B.tmp	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
File opened for modification	C:\Windows\assembly\NativeImages_v4.0.30319_32\WmiPrvSE.exe	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
File created	C:\Windows\L2Schemas\lsm.exe	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
File opened for modification	C:\Windows\L2Schemas\lsm.exe	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
File created	C:\Windows\L2Schemas\101b941d020240	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1764	schtasks.exe
1988	schtasks.exe
1472	schtasks.exe
3004	schtasks.exe
1760	schtasks.exe
2400	schtasks.exe
2776	schtasks.exe
2908	schtasks.exe
2176	schtasks.exe
2488	schtasks.exe
2096	schtasks.exe
2596	schtasks.exe
2404	schtasks.exe
3012	schtasks.exe
2384	schtasks.exe
704	schtasks.exe
2496	schtasks.exe
1724	schtasks.exe
2640	schtasks.exe
2628	schtasks.exe
2076	schtasks.exe
1384	schtasks.exe
2376	schtasks.exe
1044	schtasks.exe
2876	schtasks.exe
1796	schtasks.exe
1588	schtasks.exe
876	schtasks.exe
2396	schtasks.exe
1428	schtasks.exe
1296	schtasks.exe
2880	schtasks.exe
552	schtasks.exe
2884	schtasks.exe
2908	schtasks.exe
2480	schtasks.exe
2996	schtasks.exe
1772	schtasks.exe
1128	schtasks.exe
2060	schtasks.exe
1012	schtasks.exe
316	schtasks.exe
2612	schtasks.exe
704	schtasks.exe
3000	schtasks.exe
2256	schtasks.exe
2544	schtasks.exe
2304	schtasks.exe
2668	schtasks.exe
2696	schtasks.exe
512	schtasks.exe
2820	schtasks.exe
1932	schtasks.exe
2600	schtasks.exe
2840	schtasks.exe
2560	schtasks.exe
3032	schtasks.exe
2848	schtasks.exe
824	schtasks.exe
1952	schtasks.exe
2464	schtasks.exe
540	schtasks.exe
2580	schtasks.exe
2956	schtasks.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
2124	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
2124	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
2124	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
1076	powershell.exe
236	powershell.exe
1640	powershell.exe
1040	powershell.exe
892	powershell.exe
2308	powershell.exe
1736	powershell.exe
2208	powershell.exe
2276	powershell.exe
2944	powershell.exe
636	powershell.exe
1480	powershell.exe
568	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
568	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
568	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
568	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
568	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
3048	powershell.exe
2300	powershell.exe
748	powershell.exe
1968	powershell.exe
1192	powershell.exe
1188	powershell.exe
2348	powershell.exe
2872	powershell.exe
2076	powershell.exe
1652	powershell.exe
1884	powershell.exe
972	powershell.exe
1876	winlogon.exe
2116	winlogon.exe
2588	winlogon.exe
1748	winlogon.exe
2752	winlogon.exe

Suspicious use of AdjustPrivilegeToken 31 IoCs

description	pid	Process
Token: SeDebugPrivilege	2124	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
Token: SeDebugPrivilege	1076	powershell.exe
Token: SeDebugPrivilege	236	powershell.exe
Token: SeDebugPrivilege	1640	powershell.exe
Token: SeDebugPrivilege	1040	powershell.exe
Token: SeDebugPrivilege	892	powershell.exe
Token: SeDebugPrivilege	2308	powershell.exe
Token: SeDebugPrivilege	1736	powershell.exe
Token: SeDebugPrivilege	2208	powershell.exe
Token: SeDebugPrivilege	2276	powershell.exe
Token: SeDebugPrivilege	2944	powershell.exe
Token: SeDebugPrivilege	636	powershell.exe
Token: SeDebugPrivilege	1480	powershell.exe
Token: SeDebugPrivilege	568	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
Token: SeDebugPrivilege	3048	powershell.exe
Token: SeDebugPrivilege	2300	powershell.exe
Token: SeDebugPrivilege	748	powershell.exe
Token: SeDebugPrivilege	1968	powershell.exe
Token: SeDebugPrivilege	1192	powershell.exe
Token: SeDebugPrivilege	1188	powershell.exe
Token: SeDebugPrivilege	2348	powershell.exe
Token: SeDebugPrivilege	2872	powershell.exe
Token: SeDebugPrivilege	2076	powershell.exe
Token: SeDebugPrivilege	1652	powershell.exe
Token: SeDebugPrivilege	1884	powershell.exe
Token: SeDebugPrivilege	972	powershell.exe
Token: SeDebugPrivilege	1876	winlogon.exe
Token: SeDebugPrivilege	2116	winlogon.exe
Token: SeDebugPrivilege	2588	winlogon.exe
Token: SeDebugPrivilege	1748	winlogon.exe
Token: SeDebugPrivilege	2752	winlogon.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 1076	2124	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe	58
PID 2124 wrote to memory of 1076	2124	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe	58
PID 2124 wrote to memory of 1076	2124	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe	58
PID 2124 wrote to memory of 1736	2124	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe	59
PID 2124 wrote to memory of 1736	2124	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe	59
PID 2124 wrote to memory of 1736	2124	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe	59
PID 2124 wrote to memory of 892	2124	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe	60
PID 2124 wrote to memory of 892	2124	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe	60
PID 2124 wrote to memory of 892	2124	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe	60
PID 2124 wrote to memory of 1040	2124	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe	61
PID 2124 wrote to memory of 1040	2124	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe	61
PID 2124 wrote to memory of 1040	2124	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe	61
PID 2124 wrote to memory of 636	2124	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe	64
PID 2124 wrote to memory of 636	2124	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe	64
PID 2124 wrote to memory of 636	2124	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe	64
PID 2124 wrote to memory of 1640	2124	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe	65
PID 2124 wrote to memory of 1640	2124	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe	65
PID 2124 wrote to memory of 1640	2124	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe	65
PID 2124 wrote to memory of 1480	2124	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe	66
PID 2124 wrote to memory of 1480	2124	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe	66
PID 2124 wrote to memory of 1480	2124	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe	66
PID 2124 wrote to memory of 2944	2124	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe	68
PID 2124 wrote to memory of 2944	2124	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe	68
PID 2124 wrote to memory of 2944	2124	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe	68
PID 2124 wrote to memory of 236	2124	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe	73
PID 2124 wrote to memory of 236	2124	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe	73
PID 2124 wrote to memory of 236	2124	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe	73
PID 2124 wrote to memory of 2276	2124	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe	74
PID 2124 wrote to memory of 2276	2124	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe	74
PID 2124 wrote to memory of 2276	2124	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe	74
PID 2124 wrote to memory of 2308	2124	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe	75
PID 2124 wrote to memory of 2308	2124	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe	75
PID 2124 wrote to memory of 2308	2124	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe	75
PID 2124 wrote to memory of 2208	2124	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe	76
PID 2124 wrote to memory of 2208	2124	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe	76
PID 2124 wrote to memory of 2208	2124	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe	76
PID 2124 wrote to memory of 568	2124	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe	82
PID 2124 wrote to memory of 568	2124	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe	82
PID 2124 wrote to memory of 568	2124	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe	82
PID 568 wrote to memory of 3048	568	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe	131
PID 568 wrote to memory of 3048	568	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe	131
PID 568 wrote to memory of 3048	568	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe	131
PID 568 wrote to memory of 1192	568	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe	133
PID 568 wrote to memory of 1192	568	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe	133
PID 568 wrote to memory of 1192	568	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe	133
PID 568 wrote to memory of 2300	568	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe	135
PID 568 wrote to memory of 2300	568	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe	135
PID 568 wrote to memory of 2300	568	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe	135
PID 568 wrote to memory of 2872	568	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe	136
PID 568 wrote to memory of 2872	568	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe	136
PID 568 wrote to memory of 2872	568	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe	136
PID 568 wrote to memory of 2348	568	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe	137
PID 568 wrote to memory of 2348	568	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe	137
PID 568 wrote to memory of 2348	568	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe	137
PID 568 wrote to memory of 1188	568	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe	138
PID 568 wrote to memory of 1188	568	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe	138
PID 568 wrote to memory of 1188	568	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe	138
PID 568 wrote to memory of 1968	568	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe	140
PID 568 wrote to memory of 1968	568	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe	140
PID 568 wrote to memory of 1968	568	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe	140
PID 568 wrote to memory of 1652	568	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe	141
PID 568 wrote to memory of 1652	568	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe	141
PID 568 wrote to memory of 1652	568	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe	141
PID 568 wrote to memory of 972	568	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe	143

System policy modification 1 TTPs 21 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
"C:\Users\Admin\AppData\Local\Temp\177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe"
1⤵
- DcRat
- UAC bypass
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2124
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1076
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1736
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:892
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1040
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:636
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1640
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1480
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2944
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:236
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2276
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2308
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2208
- C:\Users\Admin\AppData\Local\Temp\177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe
  "C:\Users\Admin\AppData\Local\Temp\177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:568
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3048
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1192
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2300
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2872
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2348
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1188
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1968
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1652
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:972
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1884
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2076
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:748
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BWw2qr2Xqb.bat"
    3⤵
    PID:1796
  - - C:\Windows\system32\w32tm.exe
      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
      4⤵
      PID:1460
  - - C:\Users\Default User\winlogon.exe
      "C:\Users\Default User\winlogon.exe"
      4⤵
      UAC bypass
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      System policy modification
      PID:1876
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\47bfebeb-e8f8-4427-85b9-2850bf94ca15.vbs"
        5⤵
        
        PID:916
      - C:\Users\Default User\winlogon.exe
        
        "C:\Users\Default User\winlogon.exe"
        6⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2116
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e804c63e-2b65-42ef-9dfb-80ff09fb85cd.vbs"
        7⤵
        
        PID:1524
        
        C:\Users\Default User\winlogon.exe
        
        "C:\Users\Default User\winlogon.exe"
        8⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2588
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d496ab57-0ee7-42f2-b9ac-fbb12c45bbf9.vbs"
        9⤵
        
        PID:1568
        
        C:\Users\Default User\winlogon.exe
        
        "C:\Users\Default User\winlogon.exe"
        10⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1748
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\207523ec-ad8d-4715-aa36-4b39f8089c75.vbs"
        11⤵
        
        PID:876
        
        C:\Users\Default User\winlogon.exe
        
        "C:\Users\Default User\winlogon.exe"
        12⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2752
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\05374f04-9cf4-4e2b-bd96-33708e60714d.vbs"
        13⤵
        
        PID:1988
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\21ea5e3f-608a-4a09-aa57-74c844cf893c.vbs"
        13⤵
        
        PID:1824
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c65824b4-496a-4698-a9af-2ae583cc3234.vbs"
        11⤵
        
        PID:2732
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a32935f5-055f-4388-b071-795df0ea956c.vbs"
        9⤵
        
        PID:2032
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\69ac7fcf-4e00-4729-9333-7726ba0a3924.vbs"
        7⤵
        
        PID:2892
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8c8b0f17-00ad-480c-b84a-73b896b93a45.vbs"
        5⤵
        
        PID:2324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Journal\Templates\audiodg.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Program Files\Windows Journal\Templates\audiodg.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:2796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Journal\Templates\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\Program Files\Uninstall Information\winlogon.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Program Files\Uninstall Information\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Recovery\53190a62-69f6-11ef-9f57-62cb582c238c\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\53190a62-69f6-11ef-9f57-62cb582c238c\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Recovery\53190a62-69f6-11ef-9f57-62cb582c238c\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 6 /tr "'C:\Program Files\Microsoft Office\Office14\audiodg.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:2504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\Office14\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 9 /tr "'C:\Program Files\Microsoft Office\Office14\audiodg.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN1" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Google\CrashReports\177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\CrashReports\177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN1" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Google\CrashReports\177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30fN.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 9 /tr "'C:\Program Files\VideoLAN\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\lsm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 13 /tr "'C:\Program Files\VideoLAN\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Program Files\Common Files\Microsoft Shared\OFFICE14\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Common Files\Microsoft Shared\OFFICE14\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Program Files\Common Files\Microsoft Shared\OFFICE14\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 14 /tr "'C:\Windows\assembly\NativeImages_v4.0.30319_32\WmiPrvSE.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Windows\assembly\NativeImages_v4.0.30319_32\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 13 /tr "'C:\Windows\assembly\NativeImages_v4.0.30319_32\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 10 /tr "'C:\Windows\L2Schemas\lsm.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Windows\L2Schemas\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 5 /tr "'C:\Windows\L2Schemas\lsm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\Recovery\53190a62-69f6-11ef-9f57-62cb582c238c\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\53190a62-69f6-11ef-9f57-62cb582c238c\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Recovery\53190a62-69f6-11ef-9f57-62cb582c238c\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
PID:1100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\winlogon.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:1488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Default User\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Common Files\microsoft shared\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:1528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\microsoft shared\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Common Files\microsoft shared\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:2936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:2484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Media Player\Network Sharing\spoolsv.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\Network Sharing\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Media Player\Network Sharing\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Videos\dwm.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\Public\Videos\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Videos\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\Start Menu\explorer.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:2040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\Admin\Start Menu\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\Start Menu\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\smss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:2004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:2080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Program Files\Microsoft Office\Office14\1033\System.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\Office14\1033\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Program Files\Microsoft Office\Office14\1033\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Recovery\53190a62-69f6-11ef-9f57-62cb582c238c\lsass.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\53190a62-69f6-11ef-9f57-62cb582c238c\lsass.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Recovery\53190a62-69f6-11ef-9f57-62cb582c238c\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:2544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Sidebar\Gadgets\WmiPrvSE.exe'" /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:1764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Gadgets\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:1988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Sidebar\Gadgets\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:2304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\System.exe'" /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:2480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:2668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:1428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 7 /tr "'C:\Program Files\Microsoft Office\audiodg.exe'" /f
1⤵
PID:1480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\audiodg.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 10 /tr "'C:\Program Files\Microsoft Office\audiodg.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\csrss.exe

Filesize
4.9MB

MD5
950254b6989e56a5d93d3f38445e1c60

SHA1
4c6442eb7ddfdbb5d3fb34f53e50da45794cdaed

SHA256
177b289140818d5260ee64ebacb5479e1e991a9f5cac38611b0beb6da393e30f

SHA512
261732dc34213730d2f747cf4868ed82227b9af8be44d4d28b155aaaf6608c9b88cd832db03000c92aa395fbb62a11c2915b8b12ff8f1754ad682e1178bdaa22

Download Submit
C:\Users\Admin\AppData\Local\Temp\05374f04-9cf4-4e2b-bd96-33708e60714d.vbs

Filesize
710B

MD5
d40d099a5e0d9e45e0ce60e5ff16aad3

SHA1
c1dc543792ecef7c6dcc24bf4ffc1768aa56d5cb

SHA256
47c6d6a2a5badcc79ce76c25c493476095d12a322a860cf43262956e867cdd55

SHA512
3c9b8c68c3f8d244b9fcf658fe5e0cc3e192f7052ace72afcb6d83ecc1575bb5d8635122b3df59fb6d87045392b53654a5257ec0607d0d322ab77099c7149bba

Download Submit
C:\Users\Admin\AppData\Local\Temp\207523ec-ad8d-4715-aa36-4b39f8089c75.vbs

Filesize
710B

MD5
2c4907d9a828b9a9eb2799b037b0acd5

SHA1
312ebb51f155f1fbd34410de8e13d4821ceea3b7

SHA256
49219c6fee7518a19ab700c04638b1f4021a2dfa116774cb9d757df54a869611

SHA512
b665ea98df69f7a78471a28793debf1e3802129a4fb171178cb04907876211a03334c18bb68d0b51836e6f0dde718d5452fed90694f7743da0457cb10dbce3ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\47bfebeb-e8f8-4427-85b9-2850bf94ca15.vbs

Filesize
710B

MD5
d2b16c5c5350101b1aaab3f7b91eecb3

SHA1
e06c3084a204b9959eb51f2dab1f23ede10959f4

SHA256
572bbee3c1e61c67c1b3fdaf7d42686de9e3c55a5eaf5f5e2da6a25ab19cac7f

SHA512
6ebd8f0e8f202f2eb44075ee09eb0bda4cf0ac7043ddd4d28333c1683edf0b37c44c918a65d4d69a42e829fc42b5ceb6f10b73240d098c21ff58bc4eef57696f

Download Submit
C:\Users\Admin\AppData\Local\Temp\8c8b0f17-00ad-480c-b84a-73b896b93a45.vbs

Filesize
486B

MD5
0c137ee95e5e8ede58d22e8ccecaca9c

SHA1
d1737ee98f3d0d52228a602958ba492e848c5cfb

SHA256
4ce7ef18d8e4348ab1566f590837de233ab0211a25d098e8f84490f7fc8cad6d

SHA512
80f417349e2eaecb27ed07b86f40dd52e8f9dc8f71a71d688ecc4750f9f4d559c878545c179a1909e37cf03fd762a31520fff5977583bf054dbc468135eb2f4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\BWw2qr2Xqb.bat

Filesize
199B

MD5
eda05cc997b9d990acc980112c8a800c

SHA1
93a027e6ba3cbd2dba05b74375d51849585ed522

SHA256
36b3194d418ccf472fcfbbe27eb21b5fc5ed03f325fea146302df918800eebb1

SHA512
2931355fa82538c5746e89998754c056fea25d8dfaf767bc85400d54f96522bde102c2db7377c539c848c18caf880e6764d23b8f530a028f1f84514a5a028057

Download Submit
C:\Users\Admin\AppData\Local\Temp\d496ab57-0ee7-42f2-b9ac-fbb12c45bbf9.vbs

Filesize
710B

MD5
ab734091fd652b54d81f31f48d5721a0

SHA1
bdc298338f823ca4037d5f72ded35fc6283852e2

SHA256
e31a48c85fc78910f6edfdef51cb6645b50cdd6e444ee37b09e9aa72e1658f3d

SHA512
42dc9bb15f54f694491056c57f292bf882117dd0eed6010e96249f5c9c8470d3c495a3140d7df49e2821d06dd993188e744eb269524dbd32c94afaf5b64e50a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\e804c63e-2b65-42ef-9dfb-80ff09fb85cd.vbs

Filesize
710B

MD5
52df7992112a9eb880b22b5e4305360c

SHA1
0be486e5e5b2dead9f9340bece569034337b16fe

SHA256
cba710ddf7eb6440c3222574e7459458179ae4a2c7871aeca65cbd2a96a65951

SHA512
11e6d118c194025a85fa2604e05000f37c73bd8a299e27b7c16f094eb7d4123f98fba77578e30f83aa6552dc31dc87dfd2732bb25998c0ec7c412ce2593a8bd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpC294.tmp.exe

Filesize
75KB

MD5
e0a68b98992c1699876f818a22b5b907

SHA1
d41e8ad8ba51217eb0340f8f69629ccb474484d0

SHA256
2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

SHA512
856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
13274f658625e06a130644cf097c3bfa

SHA1
413f20e26991aa68baada34487ba02d81262ecee

SHA256
d3a7d22b303cb4793a0b01b7fda78e360d709d814821769d7eff3db1441f88d6

SHA512
18d82484a6bc7448a079662e1e7ecc84d52b95b3111af3b6f3a5a349faa55e397e1264fb39d2cad2f926c4eb34855d53896e419f04f15686a65174191391b801

Download Submit
memory/568-171-0x000000001B3A0000-0x000000001B3B2000-memory.dmp

Filesize
72KB

Download
memory/1076-167-0x0000000002390000-0x0000000002398000-memory.dmp

Filesize
32KB

Download
memory/1748-345-0x0000000000F20000-0x0000000001414000-memory.dmp

Filesize
5.0MB

Download
memory/1876-301-0x0000000000F80000-0x0000000001474000-memory.dmp

Filesize
5.0MB

Download
memory/2116-315-0x00000000011A0000-0x0000000001694000-memory.dmp

Filesize
5.0MB

Download
memory/2124-165-0x000007FEF5FD0000-0x000007FEF69BC000-memory.dmp

Filesize
9.9MB

Download
memory/2124-6-0x0000000000BE0000-0x0000000000BF0000-memory.dmp

Filesize
64KB

Download
memory/2124-89-0x000007FEF5FD3000-0x000007FEF5FD4000-memory.dmp

Filesize
4KB

Download
memory/2124-103-0x000007FEF5FD0000-0x000007FEF69BC000-memory.dmp

Filesize
9.9MB

Download
memory/2124-13-0x00000000026E0000-0x00000000026EE000-memory.dmp

Filesize
56KB

Download
memory/2124-15-0x0000000002700000-0x0000000002708000-memory.dmp

Filesize
32KB

Download
memory/2124-2-0x000007FEF5FD0000-0x000007FEF69BC000-memory.dmp

Filesize
9.9MB

Download
memory/2124-12-0x0000000002550000-0x000000000255E000-memory.dmp

Filesize
56KB

Download
memory/2124-11-0x0000000002540000-0x000000000254A000-memory.dmp

Filesize
40KB

Download
memory/2124-10-0x0000000000C30000-0x0000000000C42000-memory.dmp

Filesize
72KB

Download
memory/2124-1-0x0000000000C40000-0x0000000001134000-memory.dmp

Filesize
5.0MB

Download
memory/2124-3-0x000000001B430000-0x000000001B55E000-memory.dmp

Filesize
1.2MB

Download
memory/2124-0-0x000007FEF5FD3000-0x000007FEF5FD4000-memory.dmp

Filesize
4KB

Download
memory/2124-8-0x0000000000C10000-0x0000000000C20000-memory.dmp

Filesize
64KB

Download
memory/2124-9-0x0000000000C20000-0x0000000000C2A000-memory.dmp

Filesize
40KB

Download
memory/2124-7-0x0000000000BF0000-0x0000000000C06000-memory.dmp

Filesize
88KB

Download
memory/2124-14-0x00000000026F0000-0x00000000026F8000-memory.dmp

Filesize
32KB

Download
memory/2124-16-0x0000000002710000-0x000000000271C000-memory.dmp

Filesize
48KB

Download
memory/2124-5-0x0000000000420000-0x0000000000428000-memory.dmp

Filesize
32KB

Download
memory/2124-4-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2308-166-0x000000001B410000-0x000000001B6F2000-memory.dmp

Filesize
2.9MB

Download
memory/2588-330-0x0000000000140000-0x0000000000634000-memory.dmp

Filesize
5.0MB

Download
memory/3048-251-0x000000001B420000-0x000000001B702000-memory.dmp

Filesize
2.9MB

Download
memory/3048-252-0x00000000025E0000-0x00000000025E8000-memory.dmp

Filesize
32KB

Download