colibri | 9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9

Analysis

max time kernel
120s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
30/09/2024, 03:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
Size 4.9MB
Sample240930-eg3bvs1emf
SHA256 9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9
MD5 1104e32eb6157e6798d194f9a6d29e90
SHA1 178fca5fa8a5b0977c812bd58bd8912393f33591
SHA512 184de1c9150cea1ead9be483b46d80a6053d81760884ed935b7a9ef657c3286034a78b55ade810f5da9817e78516140356d401cbc68ba442ee13fabd44d9a35f
SSDEEP 49152:jl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

colibri dcrat build1 discovery evasion execution infostealer loader rat trojan

Malware Config

Extracted

Family

colibri

Version

1.2.0

Botnet

Build1

http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php
http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php

rc4.plain

Signatures

Colibri Loader
A loader sold as MaaS first seen in August 2021.
loader colibri
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 33 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3848	4056	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3992	4056	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4488	4056	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3956	4056	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2912	4056	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3748	4056	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3428	4056	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2652	4056	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2672	4056	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1440	4056	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1652	4056	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1336	4056	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4860	4056	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4504	4056	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	428	4056	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4232	4056	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5072	4056	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4784	4056	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2280	4056	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2576	4056	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2144	4056	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4212	4056	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2888	4056	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4880	4056	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4804	4056	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4704	4056	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2196	4056	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1108	4056	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1736	4056	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3700	4056	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2688	4056	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4308	4056	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1928	4056	schtasks.exe	81

UAC bypass 3 TTPs 36 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/1204-3-0x000000001B640000-0x000000001B76E000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
400	powershell.exe
2616	powershell.exe
2952	powershell.exe
644	powershell.exe
2708	powershell.exe
212	powershell.exe
2468	powershell.exe
1388	powershell.exe
1200	powershell.exe
1048	powershell.exe
3264	powershell.exe

Checks computer location settings 2 TTPs 12 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	sysmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	sysmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	sysmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	sysmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	sysmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	sysmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	sysmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	sysmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	sysmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	sysmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	sysmon.exe

Executes dropped EXE 31 IoCs

pid	Process
4352	tmpB605.tmp.exe
2580	tmpB605.tmp.exe
2080	sysmon.exe
3016	tmpDC18.tmp.exe
4960	tmpDC18.tmp.exe
4524	sysmon.exe
1424	tmp1037.tmp.exe
4704	tmp1037.tmp.exe
4596	tmp1037.tmp.exe
2488	sysmon.exe
1388	tmp4050.tmp.exe
4004	tmp4050.tmp.exe
1444	sysmon.exe
2080	sysmon.exe
4708	sysmon.exe
2872	tmpA97A.tmp.exe
3496	tmpA97A.tmp.exe
3304	sysmon.exe
1764	sysmon.exe
4400	tmpE318.tmp.exe
4860	tmpE318.tmp.exe
5064	tmpE318.tmp.exe
1640	sysmon.exe
5056	tmp134F.tmp.exe
4292	tmp134F.tmp.exe
2552	sysmon.exe
3952	tmp2F63.tmp.exe
1016	tmp2F63.tmp.exe
3960	sysmon.exe
2796	tmp5F3D.tmp.exe
960	tmp5F3D.tmp.exe

Checks whether UAC is enabled 1 TTPs 24 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sysmon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sysmon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sysmon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sysmon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sysmon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sysmon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sysmon.exe

Suspicious use of SetThreadContext 9 IoCs

description	pid	Process	procid_target
PID 4352 set thread context of 2580	4352	tmpB605.tmp.exe	118
PID 3016 set thread context of 4960	3016	tmpDC18.tmp.exe	149
PID 4704 set thread context of 4596	4704	tmp1037.tmp.exe	159
PID 1388 set thread context of 4004	1388	tmp4050.tmp.exe	167
PID 2872 set thread context of 3496	2872	tmpA97A.tmp.exe	179
PID 4860 set thread context of 5064	4860	tmpE318.tmp.exe	189
PID 5056 set thread context of 4292	5056	tmp134F.tmp.exe	195
PID 3952 set thread context of 1016	3952	tmp2F63.tmp.exe	201
PID 2796 set thread context of 960	2796	tmp5F3D.tmp.exe	207

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Temp\csrss.exe	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
File created	C:\Program Files (x86)\Microsoft\Temp\886983d96e3d3e	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Temp\RCXC85D.tmp	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Temp\csrss.exe	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe

Drops file in Windows directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\IME\sysmon.exe	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
File created	C:\Windows\DigitalLocker\en-US\dllhost.exe	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
File created	C:\Windows\tracing\6cb0b6c459d5d3	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
File created	C:\Windows\PLA\Templates\MusNotification.exe	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
File opened for modification	C:\Windows\tracing\RCXB952.tmp	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
File opened for modification	C:\Windows\PLA\Templates\MusNotification.exe	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
File created	C:\Windows\tracing\dwm.exe	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
File created	C:\Windows\PLA\Templates\aa97147c4c782d	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
File opened for modification	C:\Windows\tracing\dwm.exe	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
File created	C:\Windows\IME\sysmon.exe	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
File created	C:\Windows\Migration\WTR\MusNotification.exe	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
File created	C:\Windows\Migration\WTR\aa97147c4c782d	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
File created	C:\Windows\Provisioning\Autopilot\RuntimeBroker.exe	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
File created	C:\Windows\Provisioning\Autopilot\9e8d7a4ca61bd9	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
File opened for modification	C:\Windows\IME\RCXB1DC.tmp	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
File opened for modification	C:\Windows\DigitalLocker\en-US\dllhost.exe	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
File opened for modification	C:\Windows\Migration\WTR\RCXB73E.tmp	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
File opened for modification	C:\Windows\Migration\WTR\MusNotification.exe	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
File opened for modification	C:\Windows\PLA\Templates\RCXBF9F.tmp	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
File opened for modification	C:\Windows\Provisioning\Autopilot\RCXC435.tmp	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
File created	C:\Windows\IME\121e5b5079f7c0	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
File created	C:\Windows\DigitalLocker\en-US\5940a34987c991	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
File opened for modification	C:\Windows\DigitalLocker\en-US\RCXB4BB.tmp	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
File opened for modification	C:\Windows\Provisioning\Autopilot\RuntimeBroker.exe	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpE318.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp134F.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp5F3D.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpB605.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp1037.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp1037.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpE318.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpDC18.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp4050.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpA97A.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp2F63.tmp.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings	sysmon.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings	sysmon.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings	sysmon.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings	sysmon.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings	sysmon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings	sysmon.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings	sysmon.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings	sysmon.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings	sysmon.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings	sysmon.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings	sysmon.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 33 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4880	schtasks.exe
4308	schtasks.exe
3992	schtasks.exe
1336	schtasks.exe
4860	schtasks.exe
4232	schtasks.exe
1736	schtasks.exe
1928	schtasks.exe
3956	schtasks.exe
2912	schtasks.exe
1440	schtasks.exe
1108	schtasks.exe
2688	schtasks.exe
3848	schtasks.exe
2280	schtasks.exe
2196	schtasks.exe
4212	schtasks.exe
4704	schtasks.exe
3428	schtasks.exe
2672	schtasks.exe
5072	schtasks.exe
428	schtasks.exe
2888	schtasks.exe
4804	schtasks.exe
4488	schtasks.exe
1652	schtasks.exe
2144	schtasks.exe
3748	schtasks.exe
2652	schtasks.exe
2576	schtasks.exe
4504	schtasks.exe
4784	schtasks.exe
3700	schtasks.exe

Suspicious behavior: EnumeratesProcesses 50 IoCs

pid	Process
1204	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
1204	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
1204	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
1204	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
1204	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
1048	powershell.exe
1048	powershell.exe
212	powershell.exe
212	powershell.exe
3264	powershell.exe
3264	powershell.exe
2708	powershell.exe
2708	powershell.exe
400	powershell.exe
400	powershell.exe
1388	powershell.exe
1388	powershell.exe
644	powershell.exe
644	powershell.exe
2468	powershell.exe
2468	powershell.exe
2952	powershell.exe
2952	powershell.exe
1200	powershell.exe
1200	powershell.exe
2616	powershell.exe
2616	powershell.exe
212	powershell.exe
1048	powershell.exe
644	powershell.exe
2468	powershell.exe
2708	powershell.exe
3264	powershell.exe
400	powershell.exe
2952	powershell.exe
1200	powershell.exe
1388	powershell.exe
2616	powershell.exe
2080	sysmon.exe
2080	sysmon.exe
4524	sysmon.exe
2488	sysmon.exe
1444	sysmon.exe
2080	sysmon.exe
4708	sysmon.exe
3304	sysmon.exe
1764	sysmon.exe
1640	sysmon.exe
2552	sysmon.exe
3960	sysmon.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	1204	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
Token: SeDebugPrivilege	1048	powershell.exe
Token: SeDebugPrivilege	212	powershell.exe
Token: SeDebugPrivilege	3264	powershell.exe
Token: SeDebugPrivilege	2708	powershell.exe
Token: SeDebugPrivilege	400	powershell.exe
Token: SeDebugPrivilege	1388	powershell.exe
Token: SeDebugPrivilege	644	powershell.exe
Token: SeDebugPrivilege	2468	powershell.exe
Token: SeDebugPrivilege	2952	powershell.exe
Token: SeDebugPrivilege	1200	powershell.exe
Token: SeDebugPrivilege	2616	powershell.exe
Token: SeDebugPrivilege	2080	sysmon.exe
Token: SeDebugPrivilege	4524	sysmon.exe
Token: SeDebugPrivilege	2488	sysmon.exe
Token: SeDebugPrivilege	1444	sysmon.exe
Token: SeDebugPrivilege	2080	sysmon.exe
Token: SeDebugPrivilege	4708	sysmon.exe
Token: SeDebugPrivilege	3304	sysmon.exe
Token: SeDebugPrivilege	1764	sysmon.exe
Token: SeDebugPrivilege	1640	sysmon.exe
Token: SeDebugPrivilege	2552	sysmon.exe
Token: SeDebugPrivilege	3960	sysmon.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 4352	1204	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe	116
PID 1204 wrote to memory of 4352	1204	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe	116
PID 1204 wrote to memory of 4352	1204	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe	116
PID 4352 wrote to memory of 2580	4352	tmpB605.tmp.exe	118
PID 4352 wrote to memory of 2580	4352	tmpB605.tmp.exe	118
PID 4352 wrote to memory of 2580	4352	tmpB605.tmp.exe	118
PID 4352 wrote to memory of 2580	4352	tmpB605.tmp.exe	118
PID 4352 wrote to memory of 2580	4352	tmpB605.tmp.exe	118
PID 4352 wrote to memory of 2580	4352	tmpB605.tmp.exe	118
PID 4352 wrote to memory of 2580	4352	tmpB605.tmp.exe	118
PID 1204 wrote to memory of 2952	1204	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe	119
PID 1204 wrote to memory of 2952	1204	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe	119
PID 1204 wrote to memory of 2616	1204	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe	120
PID 1204 wrote to memory of 2616	1204	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe	120
PID 1204 wrote to memory of 400	1204	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe	121
PID 1204 wrote to memory of 400	1204	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe	121
PID 1204 wrote to memory of 1388	1204	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe	122
PID 1204 wrote to memory of 1388	1204	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe	122
PID 1204 wrote to memory of 2468	1204	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe	123
PID 1204 wrote to memory of 2468	1204	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe	123
PID 1204 wrote to memory of 212	1204	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe	124
PID 1204 wrote to memory of 212	1204	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe	124
PID 1204 wrote to memory of 3264	1204	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe	125
PID 1204 wrote to memory of 3264	1204	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe	125
PID 1204 wrote to memory of 1048	1204	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe	126
PID 1204 wrote to memory of 1048	1204	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe	126
PID 1204 wrote to memory of 2708	1204	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe	127
PID 1204 wrote to memory of 2708	1204	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe	127
PID 1204 wrote to memory of 644	1204	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe	128
PID 1204 wrote to memory of 644	1204	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe	128
PID 1204 wrote to memory of 1200	1204	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe	129
PID 1204 wrote to memory of 1200	1204	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe	129
PID 1204 wrote to memory of 2080	1204	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe	141
PID 1204 wrote to memory of 2080	1204	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe	141
PID 2080 wrote to memory of 2808	2080	sysmon.exe	144
PID 2080 wrote to memory of 2808	2080	sysmon.exe	144
PID 2080 wrote to memory of 2756	2080	sysmon.exe	145
PID 2080 wrote to memory of 2756	2080	sysmon.exe	145
PID 2080 wrote to memory of 3016	2080	sysmon.exe	147
PID 2080 wrote to memory of 3016	2080	sysmon.exe	147
PID 2080 wrote to memory of 3016	2080	sysmon.exe	147
PID 3016 wrote to memory of 4960	3016	tmpDC18.tmp.exe	149
PID 3016 wrote to memory of 4960	3016	tmpDC18.tmp.exe	149
PID 3016 wrote to memory of 4960	3016	tmpDC18.tmp.exe	149
PID 3016 wrote to memory of 4960	3016	tmpDC18.tmp.exe	149
PID 3016 wrote to memory of 4960	3016	tmpDC18.tmp.exe	149
PID 3016 wrote to memory of 4960	3016	tmpDC18.tmp.exe	149
PID 3016 wrote to memory of 4960	3016	tmpDC18.tmp.exe	149
PID 2808 wrote to memory of 4524	2808	WScript.exe	153
PID 2808 wrote to memory of 4524	2808	WScript.exe	153
PID 4524 wrote to memory of 3336	4524	sysmon.exe	154
PID 4524 wrote to memory of 3336	4524	sysmon.exe	154
PID 4524 wrote to memory of 4396	4524	sysmon.exe	155
PID 4524 wrote to memory of 4396	4524	sysmon.exe	155
PID 4524 wrote to memory of 1424	4524	sysmon.exe	156
PID 4524 wrote to memory of 1424	4524	sysmon.exe	156
PID 4524 wrote to memory of 1424	4524	sysmon.exe	156
PID 1424 wrote to memory of 4704	1424	tmp1037.tmp.exe	158
PID 1424 wrote to memory of 4704	1424	tmp1037.tmp.exe	158
PID 1424 wrote to memory of 4704	1424	tmp1037.tmp.exe	158
PID 4704 wrote to memory of 4596	4704	tmp1037.tmp.exe	159
PID 4704 wrote to memory of 4596	4704	tmp1037.tmp.exe	159
PID 4704 wrote to memory of 4596	4704	tmp1037.tmp.exe	159
PID 4704 wrote to memory of 4596	4704	tmp1037.tmp.exe	159

System policy modification 1 TTPs 36 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
"C:\Users\Admin\AppData\Local\Temp\9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe"
1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1204
- C:\Users\Admin\AppData\Local\Temp\tmpB605.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmpB605.tmp.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4352
- - C:\Users\Admin\AppData\Local\Temp\tmpB605.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmpB605.tmp.exe"
    3⤵
    - Executes dropped EXE
    PID:2580
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2952
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2616
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:400
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1388
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2468
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:212
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3264
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1048
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2708
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:644
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1200
- C:\Windows\IME\sysmon.exe
  "C:\Windows\IME\sysmon.exe"
  2⤵
  - UAC bypass
  - Checks computer location settings
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2080
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\43e61ae1-8712-4538-b4a7-c6d0f5d0345b.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2808
  - - C:\Windows\IME\sysmon.exe
      C:\Windows\IME\sysmon.exe
      4⤵
      UAC bypass
      Checks computer location settings
      Executes dropped EXE
      Checks whether UAC is enabled
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:4524
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\91cd27ae-c0ec-4292-9ebe-2a3ae8af110b.vbs"
        5⤵
        
        PID:3336
      - C:\Windows\IME\sysmon.exe
        
        C:\Windows\IME\sysmon.exe
        6⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2488
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\96e80458-baed-442f-9511-c25a845280ce.vbs"
        7⤵
        
        PID:3840
        
        C:\Windows\IME\sysmon.exe
        
        C:\Windows\IME\sysmon.exe
        8⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1444
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bafb4d80-221d-493e-b06d-7827c9d81fef.vbs"
        9⤵
        
        PID:4280
        
        C:\Windows\IME\sysmon.exe
        
        C:\Windows\IME\sysmon.exe
        10⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2080
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cec7005a-5f8b-4a7c-b079-f8b8720bcbae.vbs"
        11⤵
        
        PID:888
        
        C:\Windows\IME\sysmon.exe
        
        C:\Windows\IME\sysmon.exe
        12⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4708
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\029a167c-4c40-4378-930d-541a17a51e7e.vbs"
        13⤵
        
        PID:4980
        
        C:\Windows\IME\sysmon.exe
        
        C:\Windows\IME\sysmon.exe
        14⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3304
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f0f7a4b8-0da4-476a-9ec5-ad1650157759.vbs"
        15⤵
        
        PID:3580
        
        C:\Windows\IME\sysmon.exe
        
        C:\Windows\IME\sysmon.exe
        16⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1764
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\27603b95-a42a-4050-8234-af0325cd627b.vbs"
        17⤵
        
        PID:672
        
        C:\Windows\IME\sysmon.exe
        
        C:\Windows\IME\sysmon.exe
        18⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1640
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f83c358d-878c-4207-9122-10e3c9f4c837.vbs"
        19⤵
        
        PID:4388
        
        C:\Windows\IME\sysmon.exe
        
        C:\Windows\IME\sysmon.exe
        20⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2552
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8de96652-c388-47e4-81a3-a29529c4d7a2.vbs"
        21⤵
        
        PID:4532
        
        C:\Windows\IME\sysmon.exe
        
        C:\Windows\IME\sysmon.exe
        22⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3960
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3a00f1be-6474-43c2-81b1-e43728a08bd4.vbs"
        23⤵
        
        PID:4688
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a253deb0-5fd7-440a-9df4-5d40a1fd611c.vbs"
        23⤵
        
        PID:1928
        
        C:\Users\Admin\AppData\Local\Temp\tmp5F3D.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp5F3D.tmp.exe"
        23⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2796
        
        C:\Users\Admin\AppData\Local\Temp\tmp5F3D.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp5F3D.tmp.exe"
        24⤵
        Executes dropped EXE
        
        PID:960
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2f0a7144-067d-4467-8634-c91212465789.vbs"
        21⤵
        
        PID:4744
        
        C:\Users\Admin\AppData\Local\Temp\tmp2F63.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp2F63.tmp.exe"
        21⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3952
        
        C:\Users\Admin\AppData\Local\Temp\tmp2F63.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp2F63.tmp.exe"
        22⤵
        Executes dropped EXE
        
        PID:1016
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\308fb137-0d19-4fc3-b906-1b93af03cb34.vbs"
        19⤵
        
        PID:3992
        
        C:\Users\Admin\AppData\Local\Temp\tmp134F.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp134F.tmp.exe"
        19⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:5056
        
        C:\Users\Admin\AppData\Local\Temp\tmp134F.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp134F.tmp.exe"
        20⤵
        Executes dropped EXE
        
        PID:4292
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\00d8fdc8-8681-451a-86d3-40434c848ba0.vbs"
        17⤵
        
        PID:1468
        
        C:\Users\Admin\AppData\Local\Temp\tmpE318.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpE318.tmp.exe"
        17⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4400
        
        C:\Users\Admin\AppData\Local\Temp\tmpE318.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpE318.tmp.exe"
        18⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4860
        
        C:\Users\Admin\AppData\Local\Temp\tmpE318.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpE318.tmp.exe"
        19⤵
        Executes dropped EXE
        
        PID:5064
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\45ab0c79-75e2-4a69-85aa-08a89a8c77c7.vbs"
        15⤵
        
        PID:368
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f9d0e762-f4a0-4807-8a6a-1cbb96ad8a50.vbs"
        13⤵
        
        PID:212
        
        C:\Users\Admin\AppData\Local\Temp\tmpA97A.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpA97A.tmp.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2872
        
        C:\Users\Admin\AppData\Local\Temp\tmpA97A.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpA97A.tmp.exe"
        14⤵
        Executes dropped EXE
        
        PID:3496
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f592f505-46f6-441d-952a-83bcb5a1aa05.vbs"
        11⤵
        
        PID:1108
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f39608bc-b5da-40a2-9b13-c70f8921470d.vbs"
        9⤵
        
        PID:4224
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fbbc87e6-8590-45c1-87e7-b5d7de4a1422.vbs"
        7⤵
        
        PID:4520
        
        C:\Users\Admin\AppData\Local\Temp\tmp4050.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp4050.tmp.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1388
        
        C:\Users\Admin\AppData\Local\Temp\tmp4050.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp4050.tmp.exe"
        8⤵
        Executes dropped EXE
        
        PID:4004
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fdafffdf-4fa3-494e-8c62-9fd73b0ac84b.vbs"
        5⤵
        
        PID:4396
    - - C:\Users\Admin\AppData\Local\Temp\tmp1037.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp1037.tmp.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1424
      - C:\Users\Admin\AppData\Local\Temp\tmp1037.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp1037.tmp.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4704
        
        C:\Users\Admin\AppData\Local\Temp\tmp1037.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp1037.tmp.exe"
        7⤵
        Executes dropped EXE
        
        PID:4596
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\70a43cf7-cd7e-4576-94aa-4e4b86395068.vbs"
    3⤵
    PID:2756
- - C:\Users\Admin\AppData\Local\Temp\tmpDC18.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmpDC18.tmp.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3016
  - - C:\Users\Admin\AppData\Local\Temp\tmpDC18.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmpDC18.tmp.exe"
      4⤵
      Executes dropped EXE
      PID:4960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 9 /tr "'C:\Windows\IME\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Windows\IME\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 7 /tr "'C:\Windows\IME\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Windows\DigitalLocker\en-US\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\DigitalLocker\en-US\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Windows\DigitalLocker\en-US\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MusNotificationM" /sc MINUTE /mo 5 /tr "'C:\Windows\Migration\WTR\MusNotification.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MusNotification" /sc ONLOGON /tr "'C:\Windows\Migration\WTR\MusNotification.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MusNotificationM" /sc MINUTE /mo 8 /tr "'C:\Windows\Migration\WTR\MusNotification.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Windows\tracing\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\tracing\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Windows\tracing\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\All Users\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Default User\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MusNotificationM" /sc MINUTE /mo 7 /tr "'C:\Windows\PLA\Templates\MusNotification.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MusNotification" /sc ONLOGON /tr "'C:\Windows\PLA\Templates\MusNotification.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MusNotificationM" /sc MINUTE /mo 5 /tr "'C:\Windows\PLA\Templates\MusNotification.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Windows\Provisioning\Autopilot\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\Provisioning\Autopilot\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Windows\Provisioning\Autopilot\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N9" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N" /sc ONLOGON /tr "'C:\Users\Default User\9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N9" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft\Temp\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\Temp\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft\Temp\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

csrss.exe

Path C:\Program Files (x86)\Microsoft\Temp\csrss.exe
Size 4.9MB
SHA256 e527bc9fef2107153ef5a076bd36c6e91ec82e3654b062935d00360525d0dfa3
MD5 8b6ba4db18f730ad24a6aa57a2a467d0
SHA1 a6a9be5fa9d50a735f491c0ec819dac8ddefeeee
SHA512 6124984ccc72f90d6d44ecde7ce1e76057a570cdd63ed1e1fd21426fef004a7ceb8e04d691ad9c51438df606cff1de19eb476f5ac0a36673a16369be05be0d98
SSDEEP 49152:jl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorer.exe

Path C:\ProgramData\explorer.exe
Size 4.9MB
SHA256 9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9
MD5 1104e32eb6157e6798d194f9a6d29e90
SHA1 178fca5fa8a5b0977c812bd58bd8912393f33591
SHA512 184de1c9150cea1ead9be483b46d80a6053d81760884ed935b7a9ef657c3286034a78b55ade810f5da9817e78516140356d401cbc68ba442ee13fabd44d9a35f
SSDEEP 49152:jl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
MD5 SHA1 SHA512

Submit Download

sysmon.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\sysmon.exe.log
Size 1KB
SHA256 414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd
MD5 4a667f150a4d1d02f53a9f24d89d53d1
SHA1 306e125c9edce66f28fdb63e6c4ca5c9ad6e8c97
SHA512 4edd8e73ce03488a6d92750a782cd4042fbb54a5b3f8d8ba3ea227fda0653c2cd84f0c5d64976c7cdc1f518a2fdc8ff10e2a015ec7acf3cd01b0d62bc98542d8
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010
MD5 62623d22bd9e037191765d5083ce16a3
SHA1 4a07da6872672f715a4780513d95ed8ddeefd259
SHA512 9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
MD5 cadef9abd087803c630df65264a6c81c
SHA1 babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA512 7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f
MD5 e243a38635ff9a06c87c2a61a2200656
SHA1 ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc
SHA512 4418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6
MD5 bd5940f08d0be56e65e5f2aaf47c538e
SHA1 d7e31b87866e5e383ab5499da64aba50f03e8443
SHA512 c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406
MD5 SHA1 SHA512

Submit Download

029a167c-4c40-4378-930d-541a17a51e7e.vbs

Path C:\Users\Admin\AppData\Local\Temp\029a167c-4c40-4378-930d-541a17a51e7e.vbs
Size 701B
SHA256 c3a436b077c3d49a3e0783e7fc390e688c0e22ba236969e62de2770e839b0f3c
MD5 86cdc5ac45354437af449b55493ce2d4
SHA1 eefa944fbc01230f2f7f4516ed01294775c805d8
SHA512 2598d395cb792ed413fc5fa07541f381aeaeea14e05f2d1dbb1224de705ac7435cda582fdb6b03b5628a6190ac3ba1b2724387f8cda73aa41e9c6c254d29dddd
MD5 SHA1 SHA512

Submit Download

27603b95-a42a-4050-8234-af0325cd627b.vbs

Path C:\Users\Admin\AppData\Local\Temp\27603b95-a42a-4050-8234-af0325cd627b.vbs
Size 701B
SHA256 c5a5cb9ee2876483f2d5f849d0f5c2aea01bafe75942370129a871b3ba040aef
MD5 4827778508abb4145ec4410346a0c2e6
SHA1 a8116ef41c16dc1535658c4a2f9809db16775d7f
SHA512 b30f4bc935100cf3ae06baecbabb8317cc0fa664c570e1858ec064331526eee3fa2f31da25907a4971379d0dfc6bf23a744980c995b656092b0dc094bd4fc1a3
MD5 SHA1 SHA512

Submit Download

43e61ae1-8712-4538-b4a7-c6d0f5d0345b.vbs

Path C:\Users\Admin\AppData\Local\Temp\43e61ae1-8712-4538-b4a7-c6d0f5d0345b.vbs
Size 701B
SHA256 fb8e475a0f2997be6617c24c0a17aa61f3eea9dd2123def0e08e2d9930da03f9
MD5 64d01d37de9a31d66ce690a6a5c5ed15
SHA1 1c90bf63a38e85866bea6ad879e17e6e310d037a
SHA512 5f096e57a865b026484d63755ad28a2272944aa918b8ae60d603832156c1e0f834816376debdf2b5c111940337a316d295ab71a2746a9edccc047fa87fca45f7
MD5 SHA1 SHA512

Submit Download

70a43cf7-cd7e-4576-94aa-4e4b86395068.vbs

Path C:\Users\Admin\AppData\Local\Temp\70a43cf7-cd7e-4576-94aa-4e4b86395068.vbs
Size 477B
SHA256 4d06a06aac98067d74760ea26881d2ac50a5ab6a9950e6b102492600fc11941b
MD5 bf8ef3c454cb532c6c64de3655ae514a
SHA1 aee97266336e027aec953e3c80876544ade9337d
SHA512 667812ddd1b14156dac726ab083452b8e1efdf7afa869be6e57f5312a061e5e0c2c13093a5ded858473ca5c1be3b4012fcad68843feee1851ac1380e7cc7b6b5
MD5 SHA1 SHA512

Submit Download

91cd27ae-c0ec-4292-9ebe-2a3ae8af110b.vbs

Path C:\Users\Admin\AppData\Local\Temp\91cd27ae-c0ec-4292-9ebe-2a3ae8af110b.vbs
Size 701B
SHA256 6ca6d9438af483d591bed91bc23535eba32d75ce8406be634ff385c84d806705
MD5 f6ba67b125224c863b55e5f3d768c23c
SHA1 64e3e858f74ca994545bb97090ce0ea2eca210e7
SHA512 3a9533a5e8fa6cb672adb5b58023fa4bb8b669e415ec8b31a76ec4e8a3023794872680aae68f459e5bdae4e5124fbd01db8c996c1746c0afe638818f609389bb
MD5 SHA1 SHA512

Submit Download

96e80458-baed-442f-9511-c25a845280ce.vbs

Path C:\Users\Admin\AppData\Local\Temp\96e80458-baed-442f-9511-c25a845280ce.vbs
Size 701B
SHA256 3a9e56b46b808ef144a8e71ff5821af0c07747d7c565ddba99e5286478de7c59
MD5 5dc8a4ac8e65c7fa86e418643f2e81ce
SHA1 fa3604fd64c68417981f86e8f1c3fdc2294325c9
SHA512 d5a8f3b25c06f385b84c2554a07f7beedfc8ed678a154f9be34f01be9e1a6a884e010c54a4f489fd74577e3919334af41a5a4db8302238e84f54a10d1b17a0ae
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_jk204ccg.ai3.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jk204ccg.ai3.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

bafb4d80-221d-493e-b06d-7827c9d81fef.vbs

Path C:\Users\Admin\AppData\Local\Temp\bafb4d80-221d-493e-b06d-7827c9d81fef.vbs
Size 701B
SHA256 0a74d6d0ccdb3d2d6fdcf33804eaaea94c956b44a83c5792988237534ae7d054
MD5 3468e6342f544d4e982e3ff5c3195f67
SHA1 76a8feec8085c3478f14a46aaebd20b2fd715863
SHA512 f1de1782b6dd0702c4a32f6f82607120522d91d06916bbf87554cda9312539556739e3c00c03d0d25f6c1ef83b71b64d3d4fdb488ae0dd425fc7371726be8e0e
MD5 SHA1 SHA512

Submit Download

f0f7a4b8-0da4-476a-9ec5-ad1650157759.vbs

Path C:\Users\Admin\AppData\Local\Temp\f0f7a4b8-0da4-476a-9ec5-ad1650157759.vbs
Size 701B
SHA256 50e701e30be343ca0a8147a68015ce328a49ffd5340df586bc8f318fba5a6956
MD5 63ca1f2eac9f272f86b1b2bc178775e5
SHA1 c31f0c298c7e221c084dd014f38f0f07fd4311ad
SHA512 23489c2c09f8569e292075917733c22924b5ea793a2d42c89f149a929395d5670564d7bae48ef4b8220d1edab4303ac8ca1d8d797e7a235ecef6223f96a4dd9c
MD5 SHA1 SHA512

Submit Download

tmpB605.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmpB605.tmp.exe
Size 75KB
SHA256 2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f
MD5 e0a68b98992c1699876f818a22b5b907
SHA1 d41e8ad8ba51217eb0340f8f69629ccb474484d0
SHA512 856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2
SSDEEP 768:mdU/rTZZAG7lad6fEW1PRLqHxVR/LfXGCCMzgAprfLJh0AiyqjXJwr:mdU/rT9oTWbw/LvfHh0AliXJwr
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1048-183-0x00000218B35E0000-0x00000218B3602000-memory.dmp

Download

memory/1204-15-0x000000001B5B0000-0x000000001B5BE000-memory.dmp

Download

memory/1204-11-0x000000001B520000-0x000000001B532000-memory.dmp

Download

memory/1204-1-0x0000000000290000-0x0000000000784000-memory.dmp

Download

memory/1204-17-0x000000001B5D0000-0x000000001B5D8000-memory.dmp

Download

memory/1204-16-0x000000001B5C0000-0x000000001B5C8000-memory.dmp

Download

memory/1204-13-0x000000001B530000-0x000000001B53A000-memory.dmp

Download

memory/1204-260-0x00007FF9FEBA3000-0x00007FF9FEBA5000-memory.dmp

Download

memory/1204-290-0x00007FF9FEBA0000-0x00007FF9FF661000-memory.dmp

Download

memory/1204-14-0x000000001B540000-0x000000001B54E000-memory.dmp

Download

memory/1204-10-0x000000001B510000-0x000000001B51A000-memory.dmp

Download

memory/1204-0-0x00007FF9FEBA3000-0x00007FF9FEBA5000-memory.dmp

Download

memory/1204-12-0x000000001C2A0000-0x000000001C7C8000-memory.dmp

Download

memory/1204-18-0x000000001B5E0000-0x000000001B5EC000-memory.dmp

Download

memory/1204-9-0x000000001B500000-0x000000001B510000-memory.dmp

Download

memory/1204-8-0x000000001B4E0000-0x000000001B4F6000-memory.dmp

Download

memory/1204-6-0x00000000010A0000-0x00000000010A8000-memory.dmp

Download

memory/1204-7-0x000000001B4D0000-0x000000001B4E0000-memory.dmp

Download

memory/1204-5-0x000000001B560000-0x000000001B5B0000-memory.dmp

Download

memory/1204-4-0x0000000001080000-0x000000000109C000-memory.dmp

Download

memory/1204-3-0x000000001B640000-0x000000001B76E000-memory.dmp

Download

memory/1204-2-0x00007FF9FEBA0000-0x00007FF9FF661000-memory.dmp

Download

memory/2580-66-0x0000000000400000-0x0000000000407000-memory.dmp

Download