colibri | 7400236c0f5f5fec04649ae26fe2999174eb2dd73fe0e93f54adef12d8d70a1a

Analysis

max time kernel
118s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-10-2024 02:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7400236c0f5f5fec04649ae26fe2999174eb2dd73fe0e93f54adef12d8d70a1aN.exe
Size

4.9MB
MD5

2b748156c46b12dda0fe68199c2853f0
SHA1

11dc51c0fa65751c1a4747055700c6b54a91e845
SHA256

7400236c0f5f5fec04649ae26fe2999174eb2dd73fe0e93f54adef12d8d70a1a
SHA512

ab8a8c46da9e12024d0d4d5582fb2dc8af12e70db6f1a4c7e33ce34ed988efacac06e93a1ad05d12175eb2d450b71b4c2fa5363fa26e3099c9017a852b902fc5
SSDEEP

49152:rl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:

Score

10^/10

colibri dcrat build1 discovery evasion execution infostealer loader rat trojan

Malware Config

Extracted

Family

colibri

Version

1.2.0

Botnet

Build1

http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php

http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php

rc4.plain

Signatures

Colibri Loader
A loader sold as MaaS first seen in August 2021.
loader colibri
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 33 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4796	3248	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1944	3248	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3728	3248	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2428	3248	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	936	3248	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3832	3248	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2244	3248	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2832	3248	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2608	3248	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2756	3248	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1044	3248	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2556	3248	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1956	3248	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1408	3248	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1444	3248	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1748	3248	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4308	3248	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1652	3248	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1364	3248	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4436	3248	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	756	3248	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4976	3248	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4236	3248	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	772	3248	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2292	3248	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1368	3248	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4048	3248	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2524	3248	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3160	3248	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4676	3248	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1048	3248	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3708	3248	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3716	3248	schtasks.exe	86

UAC bypass 3 TTPs 36 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	7400236c0f5f5fec04649ae26fe2999174eb2dd73fe0e93f54adef12d8d70a1aN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	7400236c0f5f5fec04649ae26fe2999174eb2dd73fe0e93f54adef12d8d70a1aN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	7400236c0f5f5fec04649ae26fe2999174eb2dd73fe0e93f54adef12d8d70a1aN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/116-3-0x000000001BBD0000-0x000000001BCFE000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1836	powershell.exe
2896	powershell.exe
1944	powershell.exe
2732	powershell.exe
4656	powershell.exe
264	powershell.exe
3976	powershell.exe
1464	powershell.exe
2664	powershell.exe
2064	powershell.exe
3380	powershell.exe

Checks computer location settings 2 TTPs 12 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	7400236c0f5f5fec04649ae26fe2999174eb2dd73fe0e93f54adef12d8d70a1aN.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	dllhost.exe

Executes dropped EXE 37 IoCs

pid	Process
4892	tmp9F6F.tmp.exe
1052	tmp9F6F.tmp.exe
4132	tmp9F6F.tmp.exe
1684	dllhost.exe
1624	tmpC4B7.tmp.exe
4132	tmpC4B7.tmp.exe
4472	dllhost.exe
2020	tmpE3A9.tmp.exe
2912	tmpE3A9.tmp.exe
2896	dllhost.exe
2196	dllhost.exe
3600	tmp2EBC.tmp.exe
768	tmp2EBC.tmp.exe
224	dllhost.exe
2484	tmp5DEA.tmp.exe
2576	tmp5DEA.tmp.exe
3460	dllhost.exe
2844	tmp8CF9.tmp.exe
3872	tmp8CF9.tmp.exe
3748	dllhost.exe
1220	tmpBD31.tmp.exe
3680	tmpBD31.tmp.exe
2808	dllhost.exe
1332	tmpECDC.tmp.exe
1456	tmpECDC.tmp.exe
2556	tmpECDC.tmp.exe
1872	dllhost.exe
2504	tmp97C.tmp.exe
5072	tmp97C.tmp.exe
1816	dllhost.exe
1036	tmp2438.tmp.exe
3680	tmp2438.tmp.exe
4656	tmp2438.tmp.exe
3588	tmp2438.tmp.exe
1364	dllhost.exe
1848	tmp527B.tmp.exe
1616	tmp527B.tmp.exe

Checks whether UAC is enabled 1 TTPs 24 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	7400236c0f5f5fec04649ae26fe2999174eb2dd73fe0e93f54adef12d8d70a1aN.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	7400236c0f5f5fec04649ae26fe2999174eb2dd73fe0e93f54adef12d8d70a1aN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe

Suspicious use of SetThreadContext 11 IoCs

description	pid	Process	procid_target
PID 1052 set thread context of 4132	1052	tmp9F6F.tmp.exe	123
PID 1624 set thread context of 4132	1624	tmpC4B7.tmp.exe	154
PID 2020 set thread context of 2912	2020	tmpE3A9.tmp.exe	164
PID 3600 set thread context of 768	3600	tmp2EBC.tmp.exe	181
PID 2484 set thread context of 2576	2484	tmp5DEA.tmp.exe	190
PID 2844 set thread context of 3872	2844	tmp8CF9.tmp.exe	200
PID 1220 set thread context of 3680	1220	tmpBD31.tmp.exe	209
PID 1456 set thread context of 2556	1456	tmpECDC.tmp.exe	219
PID 2504 set thread context of 5072	2504	tmp97C.tmp.exe	228
PID 4656 set thread context of 3588	4656	tmp2438.tmp.exe	239
PID 1848 set thread context of 1616	1848	tmp527B.tmp.exe	248

Drops file in Program Files directory 20 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\smss.exe	7400236c0f5f5fec04649ae26fe2999174eb2dd73fe0e93f54adef12d8d70a1aN.exe
File opened for modification	C:\Program Files\Internet Explorer\ja-JP\RCXA1B3.tmp	7400236c0f5f5fec04649ae26fe2999174eb2dd73fe0e93f54adef12d8d70a1aN.exe
File opened for modification	C:\Program Files (x86)\Windows NT\Accessories\RCXACF3.tmp	7400236c0f5f5fec04649ae26fe2999174eb2dd73fe0e93f54adef12d8d70a1aN.exe
File opened for modification	C:\Program Files (x86)\Windows NT\Accessories\7400236c0f5f5fec04649ae26fe2999174eb2dd73fe0e93f54adef12d8d70a1aN.exe	7400236c0f5f5fec04649ae26fe2999174eb2dd73fe0e93f54adef12d8d70a1aN.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\RCXAA72.tmp	7400236c0f5f5fec04649ae26fe2999174eb2dd73fe0e93f54adef12d8d70a1aN.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Configuration\Registration\RCXB189.tmp	7400236c0f5f5fec04649ae26fe2999174eb2dd73fe0e93f54adef12d8d70a1aN.exe
File created	C:\Program Files\Internet Explorer\ja-JP\886983d96e3d3e	7400236c0f5f5fec04649ae26fe2999174eb2dd73fe0e93f54adef12d8d70a1aN.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\38384e6a620884	7400236c0f5f5fec04649ae26fe2999174eb2dd73fe0e93f54adef12d8d70a1aN.exe
File created	C:\Program Files\WindowsPowerShell\Configuration\Registration\5940a34987c991	7400236c0f5f5fec04649ae26fe2999174eb2dd73fe0e93f54adef12d8d70a1aN.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\SearchApp.exe	7400236c0f5f5fec04649ae26fe2999174eb2dd73fe0e93f54adef12d8d70a1aN.exe
File created	C:\Program Files\Internet Explorer\ja-JP\csrss.exe	7400236c0f5f5fec04649ae26fe2999174eb2dd73fe0e93f54adef12d8d70a1aN.exe
File created	C:\Program Files\Common Files\microsoft shared\69ddcba757bf72	7400236c0f5f5fec04649ae26fe2999174eb2dd73fe0e93f54adef12d8d70a1aN.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\0c42a807f39806	7400236c0f5f5fec04649ae26fe2999174eb2dd73fe0e93f54adef12d8d70a1aN.exe
File created	C:\Program Files\WindowsPowerShell\Configuration\Registration\dllhost.exe	7400236c0f5f5fec04649ae26fe2999174eb2dd73fe0e93f54adef12d8d70a1aN.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\smss.exe	7400236c0f5f5fec04649ae26fe2999174eb2dd73fe0e93f54adef12d8d70a1aN.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Configuration\Registration\dllhost.exe	7400236c0f5f5fec04649ae26fe2999174eb2dd73fe0e93f54adef12d8d70a1aN.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\SearchApp.exe	7400236c0f5f5fec04649ae26fe2999174eb2dd73fe0e93f54adef12d8d70a1aN.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\7400236c0f5f5fec04649ae26fe2999174eb2dd73fe0e93f54adef12d8d70a1aN.exe	7400236c0f5f5fec04649ae26fe2999174eb2dd73fe0e93f54adef12d8d70a1aN.exe
File opened for modification	C:\Program Files\Internet Explorer\ja-JP\csrss.exe	7400236c0f5f5fec04649ae26fe2999174eb2dd73fe0e93f54adef12d8d70a1aN.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\RCXA3C8.tmp	7400236c0f5f5fec04649ae26fe2999174eb2dd73fe0e93f54adef12d8d70a1aN.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp9F6F.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpC4B7.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp5DEA.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp97C.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpE3A9.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp8CF9.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpECDC.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpECDC.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp2EBC.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp2438.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp527B.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp9F6F.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpBD31.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp2438.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp2438.tmp.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	dllhost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 33 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2756	schtasks.exe
1368	schtasks.exe
3832	schtasks.exe
2244	schtasks.exe
2832	schtasks.exe
1408	schtasks.exe
1364	schtasks.exe
772	schtasks.exe
2428	schtasks.exe
2608	schtasks.exe
4436	schtasks.exe
4676	schtasks.exe
2556	schtasks.exe
1956	schtasks.exe
2524	schtasks.exe
1048	schtasks.exe
4796	schtasks.exe
3728	schtasks.exe
4308	schtasks.exe
1652	schtasks.exe
4976	schtasks.exe
4236	schtasks.exe
1044	schtasks.exe
3708	schtasks.exe
1944	schtasks.exe
1444	schtasks.exe
1748	schtasks.exe
3716	schtasks.exe
936	schtasks.exe
756	schtasks.exe
2292	schtasks.exe
4048	schtasks.exe
3160	schtasks.exe

Suspicious behavior: EnumeratesProcesses 52 IoCs

pid	Process
116	7400236c0f5f5fec04649ae26fe2999174eb2dd73fe0e93f54adef12d8d70a1aN.exe
116	7400236c0f5f5fec04649ae26fe2999174eb2dd73fe0e93f54adef12d8d70a1aN.exe
116	7400236c0f5f5fec04649ae26fe2999174eb2dd73fe0e93f54adef12d8d70a1aN.exe
116	7400236c0f5f5fec04649ae26fe2999174eb2dd73fe0e93f54adef12d8d70a1aN.exe
116	7400236c0f5f5fec04649ae26fe2999174eb2dd73fe0e93f54adef12d8d70a1aN.exe
116	7400236c0f5f5fec04649ae26fe2999174eb2dd73fe0e93f54adef12d8d70a1aN.exe
116	7400236c0f5f5fec04649ae26fe2999174eb2dd73fe0e93f54adef12d8d70a1aN.exe
1836	powershell.exe
1836	powershell.exe
1836	powershell.exe
3976	powershell.exe
3976	powershell.exe
1944	powershell.exe
1944	powershell.exe
2064	powershell.exe
2064	powershell.exe
1464	powershell.exe
1464	powershell.exe
2896	powershell.exe
2896	powershell.exe
4656	powershell.exe
4656	powershell.exe
2664	powershell.exe
2664	powershell.exe
2732	powershell.exe
2732	powershell.exe
3380	powershell.exe
3380	powershell.exe
264	powershell.exe
264	powershell.exe
1944	powershell.exe
2064	powershell.exe
3976	powershell.exe
2896	powershell.exe
2732	powershell.exe
4656	powershell.exe
1464	powershell.exe
2664	powershell.exe
3380	powershell.exe
264	powershell.exe
1684	dllhost.exe
1684	dllhost.exe
4472	dllhost.exe
2896	dllhost.exe
2196	dllhost.exe
224	dllhost.exe
3460	dllhost.exe
3748	dllhost.exe
2808	dllhost.exe
1872	dllhost.exe
1816	dllhost.exe
1364	dllhost.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	116	7400236c0f5f5fec04649ae26fe2999174eb2dd73fe0e93f54adef12d8d70a1aN.exe
Token: SeDebugPrivilege	1836	powershell.exe
Token: SeDebugPrivilege	3976	powershell.exe
Token: SeDebugPrivilege	1944	powershell.exe
Token: SeDebugPrivilege	2064	powershell.exe
Token: SeDebugPrivilege	1464	powershell.exe
Token: SeDebugPrivilege	2896	powershell.exe
Token: SeDebugPrivilege	4656	powershell.exe
Token: SeDebugPrivilege	2664	powershell.exe
Token: SeDebugPrivilege	3380	powershell.exe
Token: SeDebugPrivilege	2732	powershell.exe
Token: SeDebugPrivilege	264	powershell.exe
Token: SeDebugPrivilege	1684	dllhost.exe
Token: SeDebugPrivilege	4472	dllhost.exe
Token: SeDebugPrivilege	2896	dllhost.exe
Token: SeDebugPrivilege	2196	dllhost.exe
Token: SeDebugPrivilege	224	dllhost.exe
Token: SeDebugPrivilege	3460	dllhost.exe
Token: SeDebugPrivilege	3748	dllhost.exe
Token: SeDebugPrivilege	2808	dllhost.exe
Token: SeDebugPrivilege	1872	dllhost.exe
Token: SeDebugPrivilege	1816	dllhost.exe
Token: SeDebugPrivilege	1364	dllhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 116 wrote to memory of 4892	116	7400236c0f5f5fec04649ae26fe2999174eb2dd73fe0e93f54adef12d8d70a1aN.exe	120
PID 116 wrote to memory of 4892	116	7400236c0f5f5fec04649ae26fe2999174eb2dd73fe0e93f54adef12d8d70a1aN.exe	120
PID 116 wrote to memory of 4892	116	7400236c0f5f5fec04649ae26fe2999174eb2dd73fe0e93f54adef12d8d70a1aN.exe	120
PID 4892 wrote to memory of 1052	4892	tmp9F6F.tmp.exe	122
PID 4892 wrote to memory of 1052	4892	tmp9F6F.tmp.exe	122
PID 4892 wrote to memory of 1052	4892	tmp9F6F.tmp.exe	122
PID 1052 wrote to memory of 4132	1052	tmp9F6F.tmp.exe	123
PID 1052 wrote to memory of 4132	1052	tmp9F6F.tmp.exe	123
PID 1052 wrote to memory of 4132	1052	tmp9F6F.tmp.exe	123
PID 1052 wrote to memory of 4132	1052	tmp9F6F.tmp.exe	123
PID 1052 wrote to memory of 4132	1052	tmp9F6F.tmp.exe	123
PID 1052 wrote to memory of 4132	1052	tmp9F6F.tmp.exe	123
PID 1052 wrote to memory of 4132	1052	tmp9F6F.tmp.exe	123
PID 116 wrote to memory of 264	116	7400236c0f5f5fec04649ae26fe2999174eb2dd73fe0e93f54adef12d8d70a1aN.exe	126
PID 116 wrote to memory of 264	116	7400236c0f5f5fec04649ae26fe2999174eb2dd73fe0e93f54adef12d8d70a1aN.exe	126
PID 116 wrote to memory of 3976	116	7400236c0f5f5fec04649ae26fe2999174eb2dd73fe0e93f54adef12d8d70a1aN.exe	127
PID 116 wrote to memory of 3976	116	7400236c0f5f5fec04649ae26fe2999174eb2dd73fe0e93f54adef12d8d70a1aN.exe	127
PID 116 wrote to memory of 1836	116	7400236c0f5f5fec04649ae26fe2999174eb2dd73fe0e93f54adef12d8d70a1aN.exe	128
PID 116 wrote to memory of 1836	116	7400236c0f5f5fec04649ae26fe2999174eb2dd73fe0e93f54adef12d8d70a1aN.exe	128
PID 116 wrote to memory of 1464	116	7400236c0f5f5fec04649ae26fe2999174eb2dd73fe0e93f54adef12d8d70a1aN.exe	129
PID 116 wrote to memory of 1464	116	7400236c0f5f5fec04649ae26fe2999174eb2dd73fe0e93f54adef12d8d70a1aN.exe	129
PID 116 wrote to memory of 2664	116	7400236c0f5f5fec04649ae26fe2999174eb2dd73fe0e93f54adef12d8d70a1aN.exe	130
PID 116 wrote to memory of 2664	116	7400236c0f5f5fec04649ae26fe2999174eb2dd73fe0e93f54adef12d8d70a1aN.exe	130
PID 116 wrote to memory of 2064	116	7400236c0f5f5fec04649ae26fe2999174eb2dd73fe0e93f54adef12d8d70a1aN.exe	131
PID 116 wrote to memory of 2064	116	7400236c0f5f5fec04649ae26fe2999174eb2dd73fe0e93f54adef12d8d70a1aN.exe	131
PID 116 wrote to memory of 2896	116	7400236c0f5f5fec04649ae26fe2999174eb2dd73fe0e93f54adef12d8d70a1aN.exe	132
PID 116 wrote to memory of 2896	116	7400236c0f5f5fec04649ae26fe2999174eb2dd73fe0e93f54adef12d8d70a1aN.exe	132
PID 116 wrote to memory of 4656	116	7400236c0f5f5fec04649ae26fe2999174eb2dd73fe0e93f54adef12d8d70a1aN.exe	133
PID 116 wrote to memory of 4656	116	7400236c0f5f5fec04649ae26fe2999174eb2dd73fe0e93f54adef12d8d70a1aN.exe	133
PID 116 wrote to memory of 2732	116	7400236c0f5f5fec04649ae26fe2999174eb2dd73fe0e93f54adef12d8d70a1aN.exe	134
PID 116 wrote to memory of 2732	116	7400236c0f5f5fec04649ae26fe2999174eb2dd73fe0e93f54adef12d8d70a1aN.exe	134
PID 116 wrote to memory of 1944	116	7400236c0f5f5fec04649ae26fe2999174eb2dd73fe0e93f54adef12d8d70a1aN.exe	136
PID 116 wrote to memory of 1944	116	7400236c0f5f5fec04649ae26fe2999174eb2dd73fe0e93f54adef12d8d70a1aN.exe	136
PID 116 wrote to memory of 3380	116	7400236c0f5f5fec04649ae26fe2999174eb2dd73fe0e93f54adef12d8d70a1aN.exe	137
PID 116 wrote to memory of 3380	116	7400236c0f5f5fec04649ae26fe2999174eb2dd73fe0e93f54adef12d8d70a1aN.exe	137
PID 116 wrote to memory of 1684	116	7400236c0f5f5fec04649ae26fe2999174eb2dd73fe0e93f54adef12d8d70a1aN.exe	148
PID 116 wrote to memory of 1684	116	7400236c0f5f5fec04649ae26fe2999174eb2dd73fe0e93f54adef12d8d70a1aN.exe	148
PID 1684 wrote to memory of 3348	1684	dllhost.exe	150
PID 1684 wrote to memory of 3348	1684	dllhost.exe	150
PID 1684 wrote to memory of 4916	1684	dllhost.exe	151
PID 1684 wrote to memory of 4916	1684	dllhost.exe	151
PID 1684 wrote to memory of 1624	1684	dllhost.exe	152
PID 1684 wrote to memory of 1624	1684	dllhost.exe	152
PID 1684 wrote to memory of 1624	1684	dllhost.exe	152
PID 1624 wrote to memory of 4132	1624	tmpC4B7.tmp.exe	154
PID 1624 wrote to memory of 4132	1624	tmpC4B7.tmp.exe	154
PID 1624 wrote to memory of 4132	1624	tmpC4B7.tmp.exe	154
PID 1624 wrote to memory of 4132	1624	tmpC4B7.tmp.exe	154
PID 1624 wrote to memory of 4132	1624	tmpC4B7.tmp.exe	154
PID 1624 wrote to memory of 4132	1624	tmpC4B7.tmp.exe	154
PID 1624 wrote to memory of 4132	1624	tmpC4B7.tmp.exe	154
PID 3348 wrote to memory of 4472	3348	WScript.exe	157
PID 3348 wrote to memory of 4472	3348	WScript.exe	157
PID 4472 wrote to memory of 4436	4472	dllhost.exe	159
PID 4472 wrote to memory of 4436	4472	dllhost.exe	159
PID 4472 wrote to memory of 4924	4472	dllhost.exe	160
PID 4472 wrote to memory of 4924	4472	dllhost.exe	160
PID 4472 wrote to memory of 2020	4472	dllhost.exe	162
PID 4472 wrote to memory of 2020	4472	dllhost.exe	162
PID 4472 wrote to memory of 2020	4472	dllhost.exe	162
PID 2020 wrote to memory of 2912	2020	tmpE3A9.tmp.exe	164
PID 2020 wrote to memory of 2912	2020	tmpE3A9.tmp.exe	164
PID 2020 wrote to memory of 2912	2020	tmpE3A9.tmp.exe	164
PID 2020 wrote to memory of 2912	2020	tmpE3A9.tmp.exe	164

System policy modification 1 TTPs 36 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	7400236c0f5f5fec04649ae26fe2999174eb2dd73fe0e93f54adef12d8d70a1aN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	7400236c0f5f5fec04649ae26fe2999174eb2dd73fe0e93f54adef12d8d70a1aN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	7400236c0f5f5fec04649ae26fe2999174eb2dd73fe0e93f54adef12d8d70a1aN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\7400236c0f5f5fec04649ae26fe2999174eb2dd73fe0e93f54adef12d8d70a1aN.exe
"C:\Users\Admin\AppData\Local\Temp\7400236c0f5f5fec04649ae26fe2999174eb2dd73fe0e93f54adef12d8d70a1aN.exe"
1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:116
- C:\Users\Admin\AppData\Local\Temp\tmp9F6F.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp9F6F.tmp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4892
- - C:\Users\Admin\AppData\Local\Temp\tmp9F6F.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp9F6F.tmp.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1052
  - - C:\Users\Admin\AppData\Local\Temp\tmp9F6F.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp9F6F.tmp.exe"
      4⤵
      Executes dropped EXE
      PID:4132
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:264
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3976
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1836
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1464
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2664
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2064
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2896
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4656
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2732
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1944
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3380
- C:\Program Files\WindowsPowerShell\Configuration\Registration\dllhost.exe
  "C:\Program Files\WindowsPowerShell\Configuration\Registration\dllhost.exe"
  2⤵
  - UAC bypass
  - Checks computer location settings
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1684
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c9ed7852-0d88-4193-a098-e74d4e8408b3.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3348
  - - C:\Program Files\WindowsPowerShell\Configuration\Registration\dllhost.exe
      "C:\Program Files\WindowsPowerShell\Configuration\Registration\dllhost.exe"
      4⤵
      UAC bypass
      Checks computer location settings
      Executes dropped EXE
      Checks whether UAC is enabled
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:4472
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f4be6219-7e56-49a1-8834-1c5c712053c9.vbs"
        5⤵
        
        PID:4436
      - C:\Program Files\WindowsPowerShell\Configuration\Registration\dllhost.exe
        
        "C:\Program Files\WindowsPowerShell\Configuration\Registration\dllhost.exe"
        6⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2896
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\991e2ae5-bc48-444e-9dc0-8e50355c4bb3.vbs"
        7⤵
        
        PID:3456
        
        C:\Program Files\WindowsPowerShell\Configuration\Registration\dllhost.exe
        
        "C:\Program Files\WindowsPowerShell\Configuration\Registration\dllhost.exe"
        8⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2196
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b6ec1477-2ffa-4d66-bd73-e5f6fbf4eb31.vbs"
        9⤵
        
        PID:4708
        
        C:\Program Files\WindowsPowerShell\Configuration\Registration\dllhost.exe
        
        "C:\Program Files\WindowsPowerShell\Configuration\Registration\dllhost.exe"
        10⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:224
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\164a123c-7aa7-479e-8ab7-cf11dd8a1fdf.vbs"
        11⤵
        
        PID:2616
        
        C:\Program Files\WindowsPowerShell\Configuration\Registration\dllhost.exe
        
        "C:\Program Files\WindowsPowerShell\Configuration\Registration\dllhost.exe"
        12⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3460
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\55ee1e3b-8bc8-42dc-bc0d-e14bac0a1b58.vbs"
        13⤵
        
        PID:3012
        
        C:\Program Files\WindowsPowerShell\Configuration\Registration\dllhost.exe
        
        "C:\Program Files\WindowsPowerShell\Configuration\Registration\dllhost.exe"
        14⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3748
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\64f1f48a-d226-47bf-8603-c0d6472a68e7.vbs"
        15⤵
        
        PID:4136
        
        C:\Program Files\WindowsPowerShell\Configuration\Registration\dllhost.exe
        
        "C:\Program Files\WindowsPowerShell\Configuration\Registration\dllhost.exe"
        16⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2808
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5b60d511-9236-4125-87d8-8d785abd2d54.vbs"
        17⤵
        
        PID:392
        
        C:\Program Files\WindowsPowerShell\Configuration\Registration\dllhost.exe
        
        "C:\Program Files\WindowsPowerShell\Configuration\Registration\dllhost.exe"
        18⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1872
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b5164030-cc93-4b61-aab0-78b522b346e9.vbs"
        19⤵
        
        PID:1732
        
        C:\Program Files\WindowsPowerShell\Configuration\Registration\dllhost.exe
        
        "C:\Program Files\WindowsPowerShell\Configuration\Registration\dllhost.exe"
        20⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1816
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\46470343-315e-4723-857a-f02ae48ad5c7.vbs"
        21⤵
        
        PID:4780
        
        C:\Program Files\WindowsPowerShell\Configuration\Registration\dllhost.exe
        
        "C:\Program Files\WindowsPowerShell\Configuration\Registration\dllhost.exe"
        22⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1364
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0e0494cc-0764-4a34-b111-e9953c51b5d9.vbs"
        23⤵
        
        PID:1908
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3ba4b016-f4ed-482d-9fbe-7ab82b9f7047.vbs"
        23⤵
        
        PID:324
        
        C:\Users\Admin\AppData\Local\Temp\tmp527B.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp527B.tmp.exe"
        23⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1848
        
        C:\Users\Admin\AppData\Local\Temp\tmp527B.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp527B.tmp.exe"
        24⤵
        Executes dropped EXE
        
        PID:1616
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\67b22f1a-27b4-4662-8088-6fbfb1af4319.vbs"
        21⤵
        
        PID:2008
        
        C:\Users\Admin\AppData\Local\Temp\tmp2438.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp2438.tmp.exe"
        21⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1036
        
        C:\Users\Admin\AppData\Local\Temp\tmp2438.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp2438.tmp.exe"
        22⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3680
        
        C:\Users\Admin\AppData\Local\Temp\tmp2438.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp2438.tmp.exe"
        23⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4656
        
        C:\Users\Admin\AppData\Local\Temp\tmp2438.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp2438.tmp.exe"
        24⤵
        Executes dropped EXE
        
        PID:3588
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e28eed04-aebf-43c5-8057-588a49d03c62.vbs"
        19⤵
        
        PID:1768
        
        C:\Users\Admin\AppData\Local\Temp\tmp97C.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp97C.tmp.exe"
        19⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2504
        
        C:\Users\Admin\AppData\Local\Temp\tmp97C.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp97C.tmp.exe"
        20⤵
        Executes dropped EXE
        
        PID:5072
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2229eaf2-dd2c-43f9-87a8-71e674d2d085.vbs"
        17⤵
        
        PID:3816
        
        C:\Users\Admin\AppData\Local\Temp\tmpECDC.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpECDC.tmp.exe"
        17⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1332
        
        C:\Users\Admin\AppData\Local\Temp\tmpECDC.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpECDC.tmp.exe"
        18⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1456
        
        C:\Users\Admin\AppData\Local\Temp\tmpECDC.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpECDC.tmp.exe"
        19⤵
        Executes dropped EXE
        
        PID:2556
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\778c954e-ffa1-4987-ad50-b8782706d305.vbs"
        15⤵
        
        PID:3352
        
        C:\Users\Admin\AppData\Local\Temp\tmpBD31.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpBD31.tmp.exe"
        15⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1220
        
        C:\Users\Admin\AppData\Local\Temp\tmpBD31.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpBD31.tmp.exe"
        16⤵
        Executes dropped EXE
        
        PID:3680
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\aec7b0ba-d6b1-40a0-90ee-520f0c20ef99.vbs"
        13⤵
        
        PID:1460
        
        C:\Users\Admin\AppData\Local\Temp\tmp8CF9.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp8CF9.tmp.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2844
        
        C:\Users\Admin\AppData\Local\Temp\tmp8CF9.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp8CF9.tmp.exe"
        14⤵
        Executes dropped EXE
        
        PID:3872
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ce5a2c7f-f705-4f21-8d5d-54f7d449c0cd.vbs"
        11⤵
        
        PID:1492
        
        C:\Users\Admin\AppData\Local\Temp\tmp5DEA.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp5DEA.tmp.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2484
        
        C:\Users\Admin\AppData\Local\Temp\tmp5DEA.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp5DEA.tmp.exe"
        12⤵
        Executes dropped EXE
        
        PID:2576
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\02d2c619-66ba-460d-9238-bee7fe3355ea.vbs"
        9⤵
        
        PID:1292
        
        C:\Users\Admin\AppData\Local\Temp\tmp2EBC.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp2EBC.tmp.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3600
        
        C:\Users\Admin\AppData\Local\Temp\tmp2EBC.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp2EBC.tmp.exe"
        10⤵
        Executes dropped EXE
        
        PID:768
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5668203e-cb33-443b-8fda-69fd025541d5.vbs"
        7⤵
        
        PID:1936
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b2d9a6af-a077-4439-b049-29e3eec19dd3.vbs"
        5⤵
        
        PID:4924
    - - C:\Users\Admin\AppData\Local\Temp\tmpE3A9.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpE3A9.tmp.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2020
      - C:\Users\Admin\AppData\Local\Temp\tmpE3A9.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpE3A9.tmp.exe"
        6⤵
        Executes dropped EXE
        
        PID:2912
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1b173d1c-94a0-4551-b59e-6f2a93ca977a.vbs"
    3⤵
    PID:4916
- - C:\Users\Admin\AppData\Local\Temp\tmpC4B7.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmpC4B7.tmp.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1624
  - - C:\Users\Admin\AppData\Local\Temp\tmpC4B7.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmpC4B7.tmp.exe"
      4⤵
      Executes dropped EXE
      PID:4132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Users\Default\Saved Games\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default\Saved Games\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Saved Games\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\Start Menu\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\All Users\Start Menu\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\Start Menu\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Pictures\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Public\Pictures\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Pictures\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Program Files\Internet Explorer\ja-JP\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\ja-JP\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Program Files\Internet Explorer\ja-JP\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Admin\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Users\Default\NetHood\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default\NetHood\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Users\Default\NetHood\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Program Files\Common Files\microsoft shared\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\Common Files\microsoft shared\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Program Files\Common Files\microsoft shared\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "7400236c0f5f5fec04649ae26fe2999174eb2dd73fe0e93f54adef12d8d70a1aN7" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows NT\Accessories\7400236c0f5f5fec04649ae26fe2999174eb2dd73fe0e93f54adef12d8d70a1aN.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "7400236c0f5f5fec04649ae26fe2999174eb2dd73fe0e93f54adef12d8d70a1aN" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\Accessories\7400236c0f5f5fec04649ae26fe2999174eb2dd73fe0e93f54adef12d8d70a1aN.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "7400236c0f5f5fec04649ae26fe2999174eb2dd73fe0e93f54adef12d8d70a1aN7" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows NT\Accessories\7400236c0f5f5fec04649ae26fe2999174eb2dd73fe0e93f54adef12d8d70a1aN.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 7 /tr "'C:\Users\Default\NetHood\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Users\Default\NetHood\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 11 /tr "'C:\Users\Default\NetHood\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Program Files\WindowsPowerShell\Configuration\Registration\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\Configuration\Registration\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Program Files\WindowsPowerShell\Configuration\Registration\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Windows Sidebar\Gadgets\SearchApp.exe

Filesize
4.9MB

MD5
2b748156c46b12dda0fe68199c2853f0

SHA1
11dc51c0fa65751c1a4747055700c6b54a91e845

SHA256
7400236c0f5f5fec04649ae26fe2999174eb2dd73fe0e93f54adef12d8d70a1a

SHA512
ab8a8c46da9e12024d0d4d5582fb2dc8af12e70db6f1a4c7e33ce34ed988efacac06e93a1ad05d12175eb2d450b71b4c2fa5363fa26e3099c9017a852b902fc5

Download Submit
C:\Program Files\WindowsPowerShell\Configuration\Registration\RCXB189.tmp

Filesize
4.9MB

MD5
8eff90bf357bb09ea717ef045f87f566

SHA1
cef3d6ff3204ae97b85a3077db03640612df4393

SHA256
2d776528299ab2af55f286bd85a00b9227a2d5b82151c8392bedb1b04be0fba5

SHA512
126eb64a8e5635468e9ca8a770c1d6cd26a755e30cdbc3a8476ec6ab29741b84bc86cc4ce531e08800ea598e138d3f99d038773b63d4b18c0335329d46d0bd3a

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\dllhost.exe

Filesize
4.9MB

MD5
ca4df14b1af7917a515a7aef648f6797

SHA1
87676354f8f5a0fc6cfb65bfc97bc8a06b416e99

SHA256
0daa360a7376b2ad2e0011c3f2a6ff071a46e088b2805176d2e86bfed552f5db

SHA512
62d680ced42fb07dedbed140500f2b340774d1cf5fed3f5fc6f6bed9f097525dbf9470120620ed284015e6940606031d566b7843e1a326f5ac88b794bff369fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\dllhost.exe.log

Filesize
1KB

MD5
4a667f150a4d1d02f53a9f24d89d53d1

SHA1
306e125c9edce66f28fdb63e6c4ca5c9ad6e8c97

SHA256
414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd

SHA512
4edd8e73ce03488a6d92750a782cd4042fbb54a5b3f8d8ba3ea227fda0653c2cd84f0c5d64976c7cdc1f518a2fdc8ff10e2a015ec7acf3cd01b0d62bc98542d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
a43e653ffb5ab07940f4bdd9cc8fade4

SHA1
af43d04e3427f111b22dc891c5c7ee8a10ac4123

SHA256
c4c53abb13e99475aebfbe9fec7a8fead81c14c80d9dcc2b81375304f3a683fe

SHA512
62a97e95e1f19a8d4302847110dae44f469877eed6aa8ea22345c6eb25ee220e7d310fa0b7ec5df42356815421c0af7c46a0f1fee8933cc446641800eda6cd1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
05626d543357a7b9aab66738323d7ac6

SHA1
8a0366530637b0f977af59dde44fae4df8906f0f

SHA256
352265151df8fcc298bbbde14c4ddff51683a9a43416ce1987511ee7a27fa433

SHA512
11222b457bce9d25eca8b7f4768c5706ad117960d122bf049f94158725187fbaea86f38b3910402043f5a565dcc5faca535366880c0bd92f58a799931a32401d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
59d97011e091004eaffb9816aa0b9abd

SHA1
1602a56b01dd4b7c577ca27d3117e4bcc1aa657b

SHA256
18f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d

SHA512
d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
815f9e54d2e55a6cd87a044f75fdba0c

SHA1
9e2c91b5d015a2f96539227ed0a5d83cf26f6c08

SHA256
ec7d07723ca9c032e3662c0a316318065854ed4dc54106a5214278cbd148e75f

SHA512
9198d94b9d3ef35693881e3dc3e1c7f4b42d98f23a27f58cec67309628504de6940f0ac58bff1de2923b9d1b2dd11be82ea98bad9419d2e22f610df01c7401a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\164a123c-7aa7-479e-8ab7-cf11dd8a1fdf.vbs

Filesize
748B

MD5
a38e5626f46d38625ff51978b0c4d262

SHA1
3bd22a6892056fac24e738021a27cda2e3052b3b

SHA256
2eacc854c6a56c227a40400fb049d89ed7fb849b8a232f233b6019a33824ae99

SHA512
0cf9de9fde668610d0ada3c5e94807a08cb02e4da241d8e6d761685903704dbfd2d68bf54b63d2151a315d668acbf846e70bb94432af82342b17eafabf575cdf

Download Submit
C:\Users\Admin\AppData\Local\Temp\1b173d1c-94a0-4551-b59e-6f2a93ca977a.vbs

Filesize
525B

MD5
f1fd22a23bd3a5f1b53d4d5cfcea7049

SHA1
83377b7674ae5ca6cf590a7d16de9ebf2d795c22

SHA256
a567f36b5c60e6cf665e3dbe2d671f0a0370b04407293dd17d55b0c398cfe21f

SHA512
bade073b84c57bae7d03e89706a7becde1a19f4d3ccd9c445e2cdfdf99087c6173639b4c73985679c48aa2767de3b747065fa03ed733f52fefaef26fb0029554

Download Submit
C:\Users\Admin\AppData\Local\Temp\55ee1e3b-8bc8-42dc-bc0d-e14bac0a1b58.vbs

Filesize
749B

MD5
498da83a6303b10d88bcc5e2e52c96ec

SHA1
cbf278df9e85caf6f02e35faabfe3bbd1b8e8b11

SHA256
d18b0ba7b606b449b43dacaba188806ff00b51fd95c1537ffca5ba84763606bd

SHA512
cd02f0447d5082c4d21aaffaac92ca5da6e9a35d42f657eb13d0ea0774d722b9f3ea9d6262fff7977aabbea1d06b6072afdefb5dccb66ca1820e7c5147c78488

Download Submit
C:\Users\Admin\AppData\Local\Temp\64f1f48a-d226-47bf-8603-c0d6472a68e7.vbs

Filesize
749B

MD5
3d3039cdcbe17bfe37da87be56cdbb72

SHA1
def43f0b4944417979191d33195b5d05f155d88a

SHA256
b44ce28176bc082191ec438a290f95d169e0ffe7673dbbe9cc22522d4b10bad7

SHA512
46d633c7a4cbcef88665c007a9e1d1ce13836627da327858737dfb1b6b5148a068f57088ef38f9537914ea573082686763012331cfd674c5f6893e74597b2001

Download Submit
C:\Users\Admin\AppData\Local\Temp\991e2ae5-bc48-444e-9dc0-8e50355c4bb3.vbs

Filesize
749B

MD5
71bdddb8973341fa396b7c044e945883

SHA1
1775755d2ac9eb5bbe825843b57586540959cbc0

SHA256
626a599100d73caba1e0356faa101c805ca3e96d0907f21390a91bc2912a5df9

SHA512
8b8bd519eb6c530dcf93a85e78b00a82a51430599338f619b89383ff730928d139c2e9eba708d1f48e3fe5b63e654dbf7c47959dfb651d8c0929cb1f85ca96c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_a325tezg.0dh.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\b6ec1477-2ffa-4d66-bd73-e5f6fbf4eb31.vbs

Filesize
749B

MD5
194aa5b435053484e7d0e5a341339db4

SHA1
e1e84231f1bd0d0ed6eedf4745a20e6077dd9099

SHA256
8f9a0f7855634587809a91d8e91d5014c3ea3047d79521d0eb4c10ef8db07fef

SHA512
403b8809a18d142cd23c99329ad7bb0dc63e75bbcfb9fcc63bddf17f80714d9f460b5e8a89bd1d6110de1727ca8e0456c5d41014c2b52fc80ad965047a3fff49

Download Submit
C:\Users\Admin\AppData\Local\Temp\c9ed7852-0d88-4193-a098-e74d4e8408b3.vbs

Filesize
749B

MD5
86f4cf202ec49ab5409ae3160d6b4415

SHA1
5d2968e5803584318dddf359a2d9eb51cf8d60ef

SHA256
5ebf8ee2f03601c7ff70d5aa686be85ecd26bc4c48b88141ad1ffdb0659dbdec

SHA512
539ceaf5cb73b577333c9ecc7aa0bc7077e3abdb1c63b2b0c518efd7d7e9cb94e51cf535b6324edb35d899786c223d12956bcd4c41b9a4da63dadc04e7d6563c

Download Submit
C:\Users\Admin\AppData\Local\Temp\f4be6219-7e56-49a1-8834-1c5c712053c9.vbs

Filesize
749B

MD5
1b051c9f1ad638bdc68c3a66ed66712e

SHA1
1ddc23115f872a4e30777f8692e8c79ae1d424c1

SHA256
c77f52b9a93a5f9e013f0015c8d133505bc73e3fd7080cefeca401b44d669b9e

SHA512
857bb0239be0ed39f8c212bb3e46197b89bfc7b0de193c026f1c502af78dad3b0eef340ee489b61743f97206e434aa1bd6e56a777f715055e84fcc022efea42f

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp9F6F.tmp.exe

Filesize
75KB

MD5
e0a68b98992c1699876f818a22b5b907

SHA1
d41e8ad8ba51217eb0340f8f69629ccb474484d0

SHA256
2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

SHA512
856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

Download Submit
memory/116-16-0x000000001C440000-0x000000001C448000-memory.dmp

Filesize
32KB

Download
memory/116-14-0x000000001C3D0000-0x000000001C3DE000-memory.dmp

Filesize
56KB

Download
memory/116-7-0x000000001BB90000-0x000000001BBA0000-memory.dmp

Filesize
64KB

Download
memory/116-8-0x000000001BBA0000-0x000000001BBB6000-memory.dmp

Filesize
88KB

Download
memory/116-4-0x000000001BB60000-0x000000001BB7C000-memory.dmp

Filesize
112KB

Download
memory/116-18-0x000000001C460000-0x000000001C46C000-memory.dmp

Filesize
48KB

Download
memory/116-9-0x000000001C390000-0x000000001C3A0000-memory.dmp

Filesize
64KB

Download
memory/116-3-0x000000001BBD0000-0x000000001BCFE000-memory.dmp

Filesize
1.2MB

Download
memory/116-259-0x00007FFA80EB3000-0x00007FFA80EB5000-memory.dmp

Filesize
8KB

Download
memory/116-271-0x00007FFA80EB0000-0x00007FFA81971000-memory.dmp

Filesize
10.8MB

Download
memory/116-10-0x000000001C3A0000-0x000000001C3AA000-memory.dmp

Filesize
40KB

Download
memory/116-0-0x00007FFA80EB3000-0x00007FFA80EB5000-memory.dmp

Filesize
8KB

Download
memory/116-2-0x00007FFA80EB0000-0x00007FFA81971000-memory.dmp

Filesize
10.8MB

Download
memory/116-17-0x000000001C450000-0x000000001C458000-memory.dmp

Filesize
32KB

Download
memory/116-6-0x0000000003070000-0x0000000003078000-memory.dmp

Filesize
32KB

Download
memory/116-13-0x000000001C3C0000-0x000000001C3CA000-memory.dmp

Filesize
40KB

Download
memory/116-5-0x000000001C3E0000-0x000000001C430000-memory.dmp

Filesize
320KB

Download
memory/116-1-0x00000000009C0000-0x0000000000EB4000-memory.dmp

Filesize
5.0MB

Download
memory/116-15-0x000000001C430000-0x000000001C43E000-memory.dmp

Filesize
56KB

Download
memory/116-12-0x000000001C960000-0x000000001CE88000-memory.dmp

Filesize
5.2MB

Download
memory/116-11-0x000000001C3B0000-0x000000001C3C2000-memory.dmp

Filesize
72KB

Download
memory/1684-272-0x0000000003370000-0x0000000003382000-memory.dmp

Filesize
72KB

Download
memory/1836-165-0x000002DC44650000-0x000002DC44672000-memory.dmp

Filesize
136KB

Download
memory/4132-76-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download