colibri | 6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
01-11-2024 09:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
Size

4.9MB
MD5

325d72ca61c441e5eda24a533fb9771e
SHA1

f54eccb4118598ac4e51c6318ec91e5780ae4687
SHA256

6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3
SHA512

d2d17feefd6cf6a28425ca5204ed1ce17475f7657cc73487a7ddc2edea470edb2f2e79b60c29944257f08033073c3e89cf4f11cf97b90d7bf812e9cea143df6c
SSDEEP

49152:jl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:

Score

10^/10

colibri dcrat build1 discovery evasion execution infostealer loader rat trojan

Malware Config

Extracted

Family

colibri

Version

1.2.0

Botnet

Build1

http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php

http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php

rc4.plain

Signatures

Colibri Loader
A loader sold as MaaS first seen in August 2021.
loader colibri
Colibri family
colibri

DcRat 64 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		1848	schtasks.exe
		5028	schtasks.exe
		4472	schtasks.exe
		1256	schtasks.exe
File created	C:\Windows\es-ES\c5b4cb5e9653cc		6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
File created	C:\Program Files (x86)\Internet Explorer\c5b4cb5e9653cc		6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
		1880	schtasks.exe
		3048	schtasks.exe
		3696	schtasks.exe
		4776	schtasks.exe
		2080	schtasks.exe
		4940	schtasks.exe
		1808	schtasks.exe
		2040	schtasks.exe
		4052	schtasks.exe
File created	C:\Program Files (x86)\MSBuild\56085415360792		6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
		2748	schtasks.exe
		3044	schtasks.exe
		3984	schtasks.exe
		4504	schtasks.exe
		1656	schtasks.exe
		2620	schtasks.exe
		2964	schtasks.exe
		1456	schtasks.exe
		1384	schtasks.exe
		5008	schtasks.exe
		5072	schtasks.exe
File created	C:\Windows\Logs\HomeGroup\9e8d7a4ca61bd9		6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
		3820	schtasks.exe
		3908	schtasks.exe
		640	schtasks.exe
		1444	schtasks.exe
		2272	schtasks.exe
		4916	schtasks.exe
		4596	schtasks.exe
		2992	schtasks.exe
		3200	schtasks.exe
		4524	schtasks.exe
		3720	schtasks.exe
		2956	schtasks.exe
		3908	schtasks.exe
		3984	schtasks.exe
File created	C:\Windows\Performance\38384e6a620884		6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
		3688	schtasks.exe
File created	C:\Windows\schemas\7a0fd90576e088		6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
		1940	schtasks.exe
		1192	schtasks.exe
		4068	schtasks.exe
		4952	schtasks.exe
		2992	schtasks.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\de-DE\55b276f4edf653		6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
		4040	schtasks.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\6203df4a6bafc7		6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
		1500	schtasks.exe
		544	schtasks.exe
		4936	schtasks.exe
		3980	schtasks.exe
		4288	schtasks.exe
		1752	schtasks.exe
		1968	schtasks.exe
		2824	schtasks.exe
		2272	schtasks.exe
		1696	schtasks.exe
		4944	schtasks.exe

Dcrat family
dcrat

Process spawned unexpected child process 64 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	116	2932	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2748	2932	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2992	2932	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3908	2932	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2772	2932	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4952	2932	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4924	2932	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1192	2932	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1384	2932	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2964	2932	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	544	2932	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3984	2932	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2080	2932	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	112	2932	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2388	2932	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4040	2932	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1880	2932	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1764	2932	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1456	2932	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1652	2932	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1968	2932	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2824	2932	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	780	2932	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2272	2932	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4356	2932	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1684	2932	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4776	2932	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1500	2932	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3688	2932	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4576	2932	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2040	2932	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3200	2932	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4916	2932	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4596	2932	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3984	2932	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2272	2932	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4524	2932	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3720	2932	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4940	2932	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3048	2932	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5008	2932	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1848	2932	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3044	2932	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1808	2932	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2992	2932	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1696	2932	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3696	2932	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4944	2932	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2956	2932	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3980	2932	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4288	2932	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3820	2932	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4504	2932	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1752	2932	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5028	2932	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3908	2932	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4472	2932	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1256	2932	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4780	2932	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4576	2932	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1656	2932	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1940	2932	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1192	2932	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4936	2932	schtasks.exe	84

UAC bypass 3 TTPs 48 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/4272-2-0x000000001B7C0000-0x000000001B8EE000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 22 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3668	powershell.exe
4936	powershell.exe
4088	powershell.exe
1584	powershell.exe
1500	powershell.exe
3012	powershell.exe
4580	powershell.exe
3044	powershell.exe
3640	powershell.exe
3052	powershell.exe
2028	powershell.exe
4960	powershell.exe
1628	powershell.exe
1048	powershell.exe
2444	powershell.exe
1668	powershell.exe
4540	powershell.exe
3748	powershell.exe
724	powershell.exe
1484	powershell.exe
2040	powershell.exe
2648	powershell.exe

Checks computer location settings 2 TTPs 15 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	WmiPrvSE.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	WmiPrvSE.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	WmiPrvSE.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	WmiPrvSE.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	WmiPrvSE.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	WmiPrvSE.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	WmiPrvSE.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	WmiPrvSE.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	WmiPrvSE.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	WmiPrvSE.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	WmiPrvSE.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	WmiPrvSE.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	WmiPrvSE.exe

Executes dropped EXE 35 IoCs

pid	Process
3340	tmpADF4.tmp.exe
940	tmpADF4.tmp.exe
1052	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
2812	tmpE9B4.tmp.exe
540	tmpE9B4.tmp.exe
1344	WmiPrvSE.exe
1936	WmiPrvSE.exe
1216	WmiPrvSE.exe
1476	WmiPrvSE.exe
1456	tmp7589.tmp.exe
2676	tmp7589.tmp.exe
1764	WmiPrvSE.exe
3524	tmpA851.tmp.exe
844	tmpA851.tmp.exe
4868	WmiPrvSE.exe
1696	WmiPrvSE.exe
2960	tmpE6C1.tmp.exe
1172	tmpE6C1.tmp.exe
2080	WmiPrvSE.exe
1660	tmp44C.tmp.exe
1744	tmp44C.tmp.exe
2160	WmiPrvSE.exe
2996	tmp3762.tmp.exe
2952	tmp3762.tmp.exe
1656	WmiPrvSE.exe
4440	tmp698E.tmp.exe
2464	tmp698E.tmp.exe
4952	WmiPrvSE.exe
2144	tmp9C75.tmp.exe
4556	tmp9C75.tmp.exe
4128	WmiPrvSE.exe
3828	WmiPrvSE.exe
540	tmpD78A.tmp.exe
4280	tmpD78A.tmp.exe
4764	WmiPrvSE.exe

Checks whether UAC is enabled 1 TTPs 32 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	WmiPrvSE.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	WmiPrvSE.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	WmiPrvSE.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	WmiPrvSE.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	WmiPrvSE.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	WmiPrvSE.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	WmiPrvSE.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\System32\Keywords\backgroundTaskHost.exe	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
File created	C:\Windows\System32\Keywords\eddb19405b7ce1	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
File opened for modification	C:\Windows\System32\Keywords\backgroundTaskHost.exe	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe

Suspicious use of SetThreadContext 10 IoCs

description	pid	Process	procid_target
PID 3340 set thread context of 940	3340	tmpADF4.tmp.exe	120
PID 2812 set thread context of 540	2812	tmpE9B4.tmp.exe	197
PID 1456 set thread context of 2676	1456	tmp7589.tmp.exe	237
PID 3524 set thread context of 844	3524	tmpA851.tmp.exe	243
PID 2960 set thread context of 1172	2960	tmpE6C1.tmp.exe	253
PID 1660 set thread context of 1744	1660	tmp44C.tmp.exe	259
PID 2996 set thread context of 2952	2996	tmp3762.tmp.exe	267
PID 4440 set thread context of 2464	4440	tmp698E.tmp.exe	279
PID 2144 set thread context of 4556	2144	tmp9C75.tmp.exe	285
PID 540 set thread context of 4280	540	tmpD78A.tmp.exe	297

Drops file in Program Files directory 42 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\dllhost.exe	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
File created	C:\Program Files\Windows Sidebar\SearchApp.exe	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\MoUsoCoreWorker.exe	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
File created	C:\Program Files\Windows Security\BrowserCore\en-US\lsass.exe	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\1f93f77a7f4778	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
File created	C:\Program Files (x86)\Internet Explorer\services.exe	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
File created	C:\Program Files (x86)\MSBuild\56085415360792	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\dllhost.exe	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_2019.716.2316.0_neutral_~_8wekyb3d8bbwe\dwm.exe	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\6203df4a6bafc7	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\services.exe	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ja-JP\dllhost.exe	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
File opened for modification	C:\Program Files\Windows Sidebar\SearchApp.exe	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
File opened for modification	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\MoUsoCoreWorker.exe	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\lsass.exe	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
File created	C:\Program Files (x86)\Internet Explorer\c5b4cb5e9653cc	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
File opened for modification	C:\Program Files (x86)\MSBuild\RCXC2FD.tmp	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\5940a34987c991	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\de-DE\RCXBA10.tmp	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\de-DE\StartMenuExperienceHost.exe	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
File opened for modification	C:\Program Files\7-Zip\Lang\RCXC0E9.tmp	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
File opened for modification	C:\Program Files\7-Zip\Lang\unsecapp.exe	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\de-DE\StartMenuExperienceHost.exe	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
File created	C:\Program Files\7-Zip\Lang\unsecapp.exe	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
File created	C:\Program Files (x86)\MSBuild\wininit.exe	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\lsass.exe	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
File created	C:\Program Files (x86)\Common Files\System\System.exe	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
File created	C:\Program Files (x86)\Common Files\System\27d1bcfc3c54e0	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
File created	C:\Program Files (x86)\Internet Explorer\ja-JP\dllhost.exe	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
File created	C:\Program Files\Windows Security\BrowserCore\en-US\6203df4a6bafc7	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\System.exe	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
File created	C:\Program Files\7-Zip\Lang\29c1c3cc0f7685	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\774473ae650f00	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
File created	C:\Program Files\Windows Sidebar\38384e6a620884	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
File created	C:\Program Files (x86)\Internet Explorer\ja-JP\5940a34987c991	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
File opened for modification	C:\Program Files\Windows Security\BrowserCore\en-US\lsass.exe	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\RCXB180.tmp	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\RCXB3A4.tmp	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
File opened for modification	C:\Program Files (x86)\MSBuild\wininit.exe	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\de-DE\55b276f4edf653	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe

Drops file in Windows directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Performance\SearchApp.exe	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
File created	C:\Windows\Performance\38384e6a620884	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
File created	C:\Windows\es-ES\c5b4cb5e9653cc	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
File opened for modification	C:\Windows\Logs\HomeGroup\RCXB5B8.tmp	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
File opened for modification	C:\Windows\schemas\RCXBE58.tmp	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
File opened for modification	C:\Windows\schemas\explorer.exe	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
File created	C:\Windows\Performance\SearchApp.exe	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
File created	C:\Windows\Logs\HomeGroup\RuntimeBroker.exe	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
File created	C:\Windows\es-ES\services.exe	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
File created	C:\Windows\schemas\explorer.exe	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
File opened for modification	C:\Windows\Performance\RCXAF4D.tmp	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
File opened for modification	C:\Windows\es-ES\services.exe	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
File created	C:\Windows\rescache\Registry.exe	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
File created	C:\Windows\Logs\HomeGroup\9e8d7a4ca61bd9	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
File opened for modification	C:\Windows\Logs\HomeGroup\RuntimeBroker.exe	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
File opened for modification	C:\Windows\es-ES\RCXBC34.tmp	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
File created	C:\Windows\schemas\7a0fd90576e088	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpE9B4.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp7589.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpA851.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp44C.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp3762.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpADF4.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpE6C1.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp698E.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp9C75.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpD78A.tmp.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	WmiPrvSE.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	WmiPrvSE.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	WmiPrvSE.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	WmiPrvSE.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	WmiPrvSE.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	WmiPrvSE.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	WmiPrvSE.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	WmiPrvSE.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	WmiPrvSE.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	WmiPrvSE.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	WmiPrvSE.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	WmiPrvSE.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	WmiPrvSE.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1652	schtasks.exe
3696	schtasks.exe
640	schtasks.exe
116	schtasks.exe
2992	schtasks.exe
3984	schtasks.exe
4040	schtasks.exe
2748	schtasks.exe
1456	schtasks.exe
4504	schtasks.exe
4068	schtasks.exe
4052	schtasks.exe
544	schtasks.exe
1764	schtasks.exe
780	schtasks.exe
1696	schtasks.exe
1940	schtasks.exe
1684	schtasks.exe
3688	schtasks.exe
4916	schtasks.exe
1848	schtasks.exe
2080	schtasks.exe
4576	schtasks.exe
4596	schtasks.exe
4952	schtasks.exe
2040	schtasks.exe
4308	schtasks.exe
5028	schtasks.exe
4472	schtasks.exe
1444	schtasks.exe
4288	schtasks.exe
1656	schtasks.exe
1192	schtasks.exe
2824	schtasks.exe
3720	schtasks.exe
5008	schtasks.exe
2956	schtasks.exe
2992	schtasks.exe
4132	schtasks.exe
1192	schtasks.exe
1384	schtasks.exe
2388	schtasks.exe
1500	schtasks.exe
2964	schtasks.exe
112	schtasks.exe
4524	schtasks.exe
3048	schtasks.exe
1256	schtasks.exe
4576	schtasks.exe
3908	schtasks.exe
2772	schtasks.exe
1880	schtasks.exe
3200	schtasks.exe
1968	schtasks.exe
3980	schtasks.exe
4780	schtasks.exe
4936	schtasks.exe
4944	schtasks.exe
3820	schtasks.exe
5072	schtasks.exe
3908	schtasks.exe
2620	schtasks.exe
2272	schtasks.exe
4356	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4272	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
724	powershell.exe
724	powershell.exe
3044	powershell.exe
3044	powershell.exe
1628	powershell.exe
1628	powershell.exe
4936	powershell.exe
4936	powershell.exe
1668	powershell.exe
1668	powershell.exe
3668	powershell.exe
3668	powershell.exe
4960	powershell.exe
4960	powershell.exe
3640	powershell.exe
3640	powershell.exe
2028	powershell.exe
2028	powershell.exe
4540	powershell.exe
4540	powershell.exe
3748	powershell.exe
3748	powershell.exe
4540	powershell.exe
724	powershell.exe
3044	powershell.exe
1628	powershell.exe
3668	powershell.exe
4960	powershell.exe
3640	powershell.exe
2028	powershell.exe
4936	powershell.exe
1668	powershell.exe
3748	powershell.exe
1052	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
1052	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
1052	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
1052	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
1052	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
1052	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
1052	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
1052	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
1052	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
1052	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
1052	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
1052	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
1052	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
1052	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
1052	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
3012	powershell.exe
3012	powershell.exe
4580	powershell.exe
4580	powershell.exe
2444	powershell.exe
2444	powershell.exe
1584	powershell.exe
1584	powershell.exe
4088	powershell.exe
4088	powershell.exe
1500	powershell.exe
1500	powershell.exe
2648	powershell.exe
2648	powershell.exe
3052	powershell.exe

Suspicious use of AdjustPrivilegeToken 38 IoCs

description	pid	Process
Token: SeDebugPrivilege	4272	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
Token: SeDebugPrivilege	724	powershell.exe
Token: SeDebugPrivilege	3044	powershell.exe
Token: SeDebugPrivilege	4960	powershell.exe
Token: SeDebugPrivilege	1628	powershell.exe
Token: SeDebugPrivilege	4936	powershell.exe
Token: SeDebugPrivilege	1668	powershell.exe
Token: SeDebugPrivilege	3668	powershell.exe
Token: SeDebugPrivilege	4540	powershell.exe
Token: SeDebugPrivilege	2028	powershell.exe
Token: SeDebugPrivilege	3640	powershell.exe
Token: SeDebugPrivilege	3748	powershell.exe
Token: SeDebugPrivilege	1052	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
Token: SeDebugPrivilege	3012	powershell.exe
Token: SeDebugPrivilege	4580	powershell.exe
Token: SeDebugPrivilege	2444	powershell.exe
Token: SeDebugPrivilege	1584	powershell.exe
Token: SeDebugPrivilege	4088	powershell.exe
Token: SeDebugPrivilege	1500	powershell.exe
Token: SeDebugPrivilege	2648	powershell.exe
Token: SeDebugPrivilege	3052	powershell.exe
Token: SeDebugPrivilege	1484	powershell.exe
Token: SeDebugPrivilege	1048	powershell.exe
Token: SeDebugPrivilege	2040	powershell.exe
Token: SeDebugPrivilege	1344	WmiPrvSE.exe
Token: SeDebugPrivilege	1936	WmiPrvSE.exe
Token: SeDebugPrivilege	1216	WmiPrvSE.exe
Token: SeDebugPrivilege	1476	WmiPrvSE.exe
Token: SeDebugPrivilege	1764	WmiPrvSE.exe
Token: SeDebugPrivilege	4868	WmiPrvSE.exe
Token: SeDebugPrivilege	1696	WmiPrvSE.exe
Token: SeDebugPrivilege	2080	WmiPrvSE.exe
Token: SeDebugPrivilege	2160	WmiPrvSE.exe
Token: SeDebugPrivilege	1656	WmiPrvSE.exe
Token: SeDebugPrivilege	4952	WmiPrvSE.exe
Token: SeDebugPrivilege	4128	WmiPrvSE.exe
Token: SeDebugPrivilege	3828	WmiPrvSE.exe
Token: SeDebugPrivilege	4764	WmiPrvSE.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4272 wrote to memory of 3340	4272	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	117
PID 4272 wrote to memory of 3340	4272	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	117
PID 4272 wrote to memory of 3340	4272	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	117
PID 3340 wrote to memory of 940	3340	tmpADF4.tmp.exe	120
PID 3340 wrote to memory of 940	3340	tmpADF4.tmp.exe	120
PID 3340 wrote to memory of 940	3340	tmpADF4.tmp.exe	120
PID 3340 wrote to memory of 940	3340	tmpADF4.tmp.exe	120
PID 3340 wrote to memory of 940	3340	tmpADF4.tmp.exe	120
PID 3340 wrote to memory of 940	3340	tmpADF4.tmp.exe	120
PID 3340 wrote to memory of 940	3340	tmpADF4.tmp.exe	120
PID 4272 wrote to memory of 3044	4272	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	125
PID 4272 wrote to memory of 3044	4272	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	125
PID 4272 wrote to memory of 3668	4272	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	126
PID 4272 wrote to memory of 3668	4272	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	126
PID 4272 wrote to memory of 3640	4272	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	127
PID 4272 wrote to memory of 3640	4272	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	127
PID 4272 wrote to memory of 724	4272	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	128
PID 4272 wrote to memory of 724	4272	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	128
PID 4272 wrote to memory of 3748	4272	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	129
PID 4272 wrote to memory of 3748	4272	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	129
PID 4272 wrote to memory of 4936	4272	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	130
PID 4272 wrote to memory of 4936	4272	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	130
PID 4272 wrote to memory of 4540	4272	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	131
PID 4272 wrote to memory of 4540	4272	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	131
PID 4272 wrote to memory of 1628	4272	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	132
PID 4272 wrote to memory of 1628	4272	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	132
PID 4272 wrote to memory of 4960	4272	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	133
PID 4272 wrote to memory of 4960	4272	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	133
PID 4272 wrote to memory of 2028	4272	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	134
PID 4272 wrote to memory of 2028	4272	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	134
PID 4272 wrote to memory of 1668	4272	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	135
PID 4272 wrote to memory of 1668	4272	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	135
PID 4272 wrote to memory of 4864	4272	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	147
PID 4272 wrote to memory of 4864	4272	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	147
PID 4864 wrote to memory of 4272	4864	cmd.exe	149
PID 4864 wrote to memory of 4272	4864	cmd.exe	149
PID 4864 wrote to memory of 1052	4864	cmd.exe	152
PID 4864 wrote to memory of 1052	4864	cmd.exe	152
PID 1052 wrote to memory of 2812	1052	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	195
PID 1052 wrote to memory of 2812	1052	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	195
PID 1052 wrote to memory of 2812	1052	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	195
PID 2812 wrote to memory of 540	2812	tmpE9B4.tmp.exe	197
PID 2812 wrote to memory of 540	2812	tmpE9B4.tmp.exe	197
PID 2812 wrote to memory of 540	2812	tmpE9B4.tmp.exe	197
PID 2812 wrote to memory of 540	2812	tmpE9B4.tmp.exe	197
PID 2812 wrote to memory of 540	2812	tmpE9B4.tmp.exe	197
PID 2812 wrote to memory of 540	2812	tmpE9B4.tmp.exe	197
PID 2812 wrote to memory of 540	2812	tmpE9B4.tmp.exe	197
PID 1052 wrote to memory of 4088	1052	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	198
PID 1052 wrote to memory of 4088	1052	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	198
PID 1052 wrote to memory of 4580	1052	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	199
PID 1052 wrote to memory of 4580	1052	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	199
PID 1052 wrote to memory of 2648	1052	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	200
PID 1052 wrote to memory of 2648	1052	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	200
PID 1052 wrote to memory of 3012	1052	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	202
PID 1052 wrote to memory of 3012	1052	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	202
PID 1052 wrote to memory of 2444	1052	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	203
PID 1052 wrote to memory of 2444	1052	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	203
PID 1052 wrote to memory of 3052	1052	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	205
PID 1052 wrote to memory of 3052	1052	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	205
PID 1052 wrote to memory of 2040	1052	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	206
PID 1052 wrote to memory of 2040	1052	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	206
PID 1052 wrote to memory of 1500	1052	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	207
PID 1052 wrote to memory of 1500	1052	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	207

System policy modification 1 TTPs 48 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WmiPrvSE.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
"C:\Users\Admin\AppData\Local\Temp\6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe"
1⤵
- DcRat
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4272
- C:\Users\Admin\AppData\Local\Temp\tmpADF4.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmpADF4.tmp.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3340
- - C:\Users\Admin\AppData\Local\Temp\tmpADF4.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmpADF4.tmp.exe"
    3⤵
    - Executes dropped EXE
    PID:940
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3044
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3668
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3640
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:724
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3748
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4936
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4540
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1628
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4960
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2028
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1668
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\XIUWxWaE8g.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4864
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:4272
- - C:\Users\Admin\AppData\Local\Temp\6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
    "C:\Users\Admin\AppData\Local\Temp\6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe"
    3⤵
    - UAC bypass
    - Checks computer location settings
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:1052
  - - C:\Users\Admin\AppData\Local\Temp\tmpE9B4.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmpE9B4.tmp.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2812
    - - C:\Users\Admin\AppData\Local\Temp\tmpE9B4.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpE9B4.tmp.exe"
        5⤵
        Executes dropped EXE
        
        PID:540
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4088
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4580
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2648
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3012
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2444
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3052
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:2040
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1500
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:1484
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:1048
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1584
  - - C:\Recovery\WindowsRE\WmiPrvSE.exe
      "C:\Recovery\WindowsRE\WmiPrvSE.exe"
      4⤵
      UAC bypass
      Checks computer location settings
      Executes dropped EXE
      Checks whether UAC is enabled
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      System policy modification
      PID:1344
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b203baf2-a607-4281-bd14-d3b12f237b60.vbs"
        5⤵
        
        PID:4052
      - C:\Recovery\WindowsRE\WmiPrvSE.exe
        
        C:\Recovery\WindowsRE\WmiPrvSE.exe
        6⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1936
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\985b38bd-fa6f-4f44-9ffd-9ff8df327804.vbs"
        7⤵
        
        PID:2752
        
        C:\Recovery\WindowsRE\WmiPrvSE.exe
        
        C:\Recovery\WindowsRE\WmiPrvSE.exe
        8⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1216
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2922ece8-3339-48ed-b9fc-f7df309af580.vbs"
        9⤵
        
        PID:4436
        
        C:\Recovery\WindowsRE\WmiPrvSE.exe
        
        C:\Recovery\WindowsRE\WmiPrvSE.exe
        10⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1476
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\494feb1a-182f-4a2b-81aa-493f659a8a77.vbs"
        11⤵
        
        PID:4912
        
        C:\Recovery\WindowsRE\WmiPrvSE.exe
        
        C:\Recovery\WindowsRE\WmiPrvSE.exe
        12⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1764
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\782156bf-90b7-4c76-a8f2-d28919f15168.vbs"
        13⤵
        
        PID:1088
        
        C:\Recovery\WindowsRE\WmiPrvSE.exe
        
        C:\Recovery\WindowsRE\WmiPrvSE.exe
        14⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4868
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1cd99ac4-9b90-468d-827e-d147fd18f21c.vbs"
        15⤵
        
        PID:4124
        
        C:\Recovery\WindowsRE\WmiPrvSE.exe
        
        C:\Recovery\WindowsRE\WmiPrvSE.exe
        16⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1696
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\128144b9-8332-4170-b42d-f28b41a78928.vbs"
        17⤵
        
        PID:4316
        
        C:\Recovery\WindowsRE\WmiPrvSE.exe
        
        C:\Recovery\WindowsRE\WmiPrvSE.exe
        18⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2080
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6296d3f1-f400-49db-a618-054120a088a9.vbs"
        19⤵
        
        PID:1544
        
        C:\Recovery\WindowsRE\WmiPrvSE.exe
        
        C:\Recovery\WindowsRE\WmiPrvSE.exe
        20⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2160
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8f5745aa-baf2-4db2-98c4-4b0421b97afc.vbs"
        21⤵
        
        PID:3980
        
        C:\Recovery\WindowsRE\WmiPrvSE.exe
        
        C:\Recovery\WindowsRE\WmiPrvSE.exe
        22⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1656
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e080e0c9-491b-4093-84d4-5c6cb5edc6f2.vbs"
        23⤵
        
        PID:3464
        
        C:\Recovery\WindowsRE\WmiPrvSE.exe
        
        C:\Recovery\WindowsRE\WmiPrvSE.exe
        24⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4952
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4d560ae0-2448-46b0-91e3-2a0f628e521f.vbs"
        25⤵
        
        PID:4600
        
        C:\Recovery\WindowsRE\WmiPrvSE.exe
        
        C:\Recovery\WindowsRE\WmiPrvSE.exe
        26⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4128
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\21269aa5-6096-4704-a742-273fe074b6fa.vbs"
        27⤵
        
        PID:452
        
        C:\Recovery\WindowsRE\WmiPrvSE.exe
        
        C:\Recovery\WindowsRE\WmiPrvSE.exe
        28⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3828
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8bd8cae3-9ba0-4a40-93b1-c7f5172463a9.vbs"
        29⤵
        
        PID:428
        
        C:\Recovery\WindowsRE\WmiPrvSE.exe
        
        C:\Recovery\WindowsRE\WmiPrvSE.exe
        30⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4764
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c744c36a-5998-4416-9818-474b1ed6b4ba.vbs"
        29⤵
        
        PID:3012
        
        C:\Users\Admin\AppData\Local\Temp\tmpD78A.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpD78A.tmp.exe"
        29⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:540
        
        C:\Users\Admin\AppData\Local\Temp\tmpD78A.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpD78A.tmp.exe"
        30⤵
        Executes dropped EXE
        
        PID:4280
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6593b6d9-47e3-45fd-a289-0ce46b259c01.vbs"
        27⤵
        
        PID:4592
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c32c18fb-1ff8-45e0-a3f2-65e8ca584561.vbs"
        25⤵
        
        PID:1936
        
        C:\Users\Admin\AppData\Local\Temp\tmp9C75.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp9C75.tmp.exe"
        25⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2144
        
        C:\Users\Admin\AppData\Local\Temp\tmp9C75.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp9C75.tmp.exe"
        26⤵
        Executes dropped EXE
        
        PID:4556
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d4e77010-37bc-4597-b544-b35467388eaf.vbs"
        23⤵
        
        PID:3468
        
        C:\Users\Admin\AppData\Local\Temp\tmp698E.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp698E.tmp.exe"
        23⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4440
        
        C:\Users\Admin\AppData\Local\Temp\tmp698E.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp698E.tmp.exe"
        24⤵
        Executes dropped EXE
        
        PID:2464
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cc3cca88-9621-4572-b7d6-2dc30783f2d6.vbs"
        21⤵
        
        PID:4356
        
        C:\Users\Admin\AppData\Local\Temp\tmp3762.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp3762.tmp.exe"
        21⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2996
        
        C:\Users\Admin\AppData\Local\Temp\tmp3762.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp3762.tmp.exe"
        22⤵
        Executes dropped EXE
        
        PID:2952
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e0ba0ae1-6888-43e5-a4a7-a71fe337dfbe.vbs"
        19⤵
        
        PID:2420
        
        C:\Users\Admin\AppData\Local\Temp\tmp44C.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp44C.tmp.exe"
        19⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1660
        
        C:\Users\Admin\AppData\Local\Temp\tmp44C.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp44C.tmp.exe"
        20⤵
        Executes dropped EXE
        
        PID:1744
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5771f715-c5a0-46ea-a725-e834b781d3cd.vbs"
        17⤵
        
        PID:1584
        
        C:\Users\Admin\AppData\Local\Temp\tmpE6C1.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpE6C1.tmp.exe"
        17⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2960
        
        C:\Users\Admin\AppData\Local\Temp\tmpE6C1.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpE6C1.tmp.exe"
        18⤵
        Executes dropped EXE
        
        PID:1172
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\64877e2e-9ef8-4135-ac3e-3d5b72081893.vbs"
        15⤵
        
        PID:628
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\791f6e2e-c1e4-4b73-859d-80d577d31321.vbs"
        13⤵
        
        PID:1988
        
        C:\Users\Admin\AppData\Local\Temp\tmpA851.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpA851.tmp.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3524
        
        C:\Users\Admin\AppData\Local\Temp\tmpA851.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpA851.tmp.exe"
        14⤵
        Executes dropped EXE
        
        PID:844
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b1001dfe-acb5-4ffd-9aae-3382aef6a414.vbs"
        11⤵
        
        PID:4752
        
        C:\Users\Admin\AppData\Local\Temp\tmp7589.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp7589.tmp.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1456
        
        C:\Users\Admin\AppData\Local\Temp\tmp7589.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp7589.tmp.exe"
        12⤵
        Executes dropped EXE
        
        PID:2676
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\abacf5a9-77db-4130-95c1-eaabfed56748.vbs"
        9⤵
        
        PID:1752
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fc33843e-bfdc-4ef4-a21b-f722ff28048c.vbs"
        7⤵
        
        PID:1920
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f1f19f93-eac9-447a-80c0-3a82e5f82ba9.vbs"
        5⤵
        
        PID:2032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 11 /tr "'C:\Windows\Performance\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Windows\Performance\SearchApp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 12 /tr "'C:\Windows\Performance\SearchApp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\lsass.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Internet Explorer\services.exe'" /f
1⤵
- Process spawned unexpected child process
PID:4924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Internet Explorer\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Windows\Logs\HomeGroup\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\Logs\HomeGroup\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Windows\Logs\HomeGroup\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\winlogon.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Default User\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Photo Viewer\de-DE\StartMenuExperienceHost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\de-DE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Photo Viewer\de-DE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Windows\es-ES\services.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\es-ES\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Windows\es-ES\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Windows\schemas\explorer.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\schemas\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Windows\schemas\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 6 /tr "'C:\Program Files\7-Zip\Lang\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 6 /tr "'C:\Program Files\7-Zip\Lang\unsecapp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:4776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\MSBuild\wininit.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\MSBuild\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\dllhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb36" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:3984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb36" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:2272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Common Files\System\System.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\System\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Common Files\System\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:4940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Sidebar\SearchApp.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\SearchApp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Sidebar\SearchApp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Internet Explorer\ja-JP\dllhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:3044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\ja-JP\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:1808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Internet Explorer\ja-JP\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 9 /tr "'C:\Users\Public\SearchApp.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Users\Public\SearchApp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 10 /tr "'C:\Users\Public\SearchApp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:1752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 14 /tr "'C:\Windows\System32\Keywords\backgroundTaskHost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Windows\System32\Keywords\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 12 /tr "'C:\Windows\System32\Keywords\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\services.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\WmiPrvSE.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MoUsoCoreWorkerM" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\MoUsoCoreWorker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MoUsoCoreWorker" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\MoUsoCoreWorker.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:4308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MoUsoCoreWorkerM" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\MoUsoCoreWorker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:2620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\lsass.exe'" /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:4068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:4052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\lsass.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:4132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:5072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:1444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe.log

Filesize
1KB

MD5
bbb951a34b516b66451218a3ec3b0ae1

SHA1
7393835a2476ae655916e0a9687eeaba3ee876e9

SHA256
eb70c64ae99d14ac2588b7a84854fbf3c420532d7fe4dfd49c7b5a70c869943a

SHA512
63bcbfcf8e7421c66855c487c31b2991a989bdea0c1edd4c40066b52fa3eb3d9d37db1cd21b8eb4f33dd5870cc20532c8f485eab9c0b4f6b0793a35c077f2d6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\WmiPrvSE.exe.log

Filesize
1KB

MD5
4a667f150a4d1d02f53a9f24d89d53d1

SHA1
306e125c9edce66f28fdb63e6c4ca5c9ad6e8c97

SHA256
414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd

SHA512
4edd8e73ce03488a6d92750a782cd4042fbb54a5b3f8d8ba3ea227fda0653c2cd84f0c5d64976c7cdc1f518a2fdc8ff10e2a015ec7acf3cd01b0d62bc98542d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
588e5b3406537204588ef39f4c84259f

SHA1
c6056b8139c0796cc6272b7b71fca2085f62b785

SHA256
3b7e7c56deb0f16483d67e60a42a5f0a58ee557790fe0f312d036e4ecc31f7f0

SHA512
f85ea8f8f0c3ea56840a84f42a188f125c13cea8b23f86ddcce8eb28758e816dd6d871154dfe63d250ef369b153f72c587a7a8bccd0a2728b7bc922dd7436e96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
aaaac7c68d2b7997ed502c26fd9f65c2

SHA1
7c5a3731300d672bf53c43e2f9e951c745f7fbdf

SHA256
8724dc2c3c8e8f17aeefae44a23741b1ea3b43c490fbc52fd61575ffe1cd82bb

SHA512
c526febd9430413b48bed976edd9a795793ad1f06c8ff4f6b768b4ad63f4d2f06b9da72d4fcfa7cb9530a64e2dc3554f5ad97fd0ab60129701d175f2724ef1ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
2d45daa9e9acea96d8a2cadfd38aeb47

SHA1
a1d49dfe3b7ff32a914f4e5c6fca696878d7227c

SHA256
96341c1835589a0a0075c7cae08feb06a96c1a125fdbc650effc39b8ae36fbf5

SHA512
b6228fa8931b8a5bb5fba99ff706bb77aa21cfc03248c5d208c24e2a141c8cb79b4988eadf985441fa9d02e9525589ab69335315d604994a33ec92fe640731f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
a1008cfb29cdc25b4180c736ec404335

SHA1
39760fbcc8c1a64e856e98d61ce194d39b727438

SHA256
0eb4209b0f8c0dce02580b4d3ec5692d33be08b1a61858aad0413116afc95558

SHA512
00c2cde1601217c28fd71c2daefb21c7fcfeeee7e6badcd1b7f353f4e6df7817f5c4665148a1468b10ea31547642b999e3db5914d6e5f0cb1123243fd9ef213f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
b1a1d8b05525b7b0c5babfd80488c1f2

SHA1
c85bbd6b7d0143676916c20fd52720499c2bb5c6

SHA256
adad192fc86c2f939fd3f70cb9ad323139a4e100f7c90b4454e2c53bdbc9b705

SHA512
346c6513c1373bab58439e37d3f75de1c5c587d7eb27076cf696e885a027b3b38d70b585839d1a2e7f2270cdcf0dac8c1fdff799f3b1158242ae9e3364c2a06e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
b7189719e6df2c3dfc76197ec3f31f7a

SHA1
effd91412deadc87cc10ef76cdecc1e0b54b6d41

SHA256
1c72fa37d078b92c7e900b2e3d17c43c34d936a696a8ddf6c519f4a80308b892

SHA512
2df1f1d45844da7ffb17cdfb411f223e9c614c00f5cf7eb5ba92bf7ba174875af2a515371208286c95c0479c934ae2c6a83dfc0b54380be89db1eddd19faf978

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6019bc03fe1dc3367a67c76d08b55399

SHA1
3d0b6d4d99b6b8e49829a3992072c3d9df7ad672

SHA256
7f88db7b83b11cd8ea233efc3a1498635b68771482658255750df564a065f7d0

SHA512
6b5409780a23e977b0bbe463e351f1d474539100aeaa01b0b7fe72aa6dbfb3c0fec64fe9db65b63d188a279b65eae7f31ef0b6880c67ada9ab175da419f595eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
205f6010c033eefc37d63d8ce846bce4

SHA1
417b1aabb447765a2aa149529a1f4f52ded194ea

SHA256
993dbee9fb487dbdff56c09a1df360ea68b583bd8b28b2c315ec9d92639f3697

SHA512
c6bbd60c82ffbc3297d1d355ab3c6692de97da0b3bdd60ea4aacec6d27d360341cefa11a4411d7b8877d54d1177b48f4dc003e2a391031cc1a304b177689bfaf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
9f0b3bbfa39f2566ed59f5e594ad3848

SHA1
c9901f5d073fe6c85a4d5a52be4be6d050a7aa5c

SHA256
f4201e88a34d8a1958b81081136d6acd2edc2ae13561ad8e88c49443b76d7592

SHA512
f2590698ad5d615d68f041f8030f10469a3aeb52600303a55d6b09cb4945c673c770427abb07fa8c63725062f9efea0f7edf6da3174d3a2c08f268d51d2f75b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3c625954a51c4bbd8141206b00f6fc0a

SHA1
4128cb2f9d2984844e303e2e330e448334e5c273

SHA256
952515feb4929cfad2435c679a5fad19242e938e8a7c97afebb1f3d996bd3ec4

SHA512
3f7c4ea0551de5b6237ca13419413e6e73e85632e9bb09b5354d6310b5969f9c3a2dc27142e75e8572c2c65b2bc7615269fad27dcea2f91c389b6758e2630517

Download Submit
C:\Users\Admin\AppData\Local\Temp\1cd99ac4-9b90-468d-827e-d147fd18f21c.vbs

Filesize
710B

MD5
d43df4e7a3d3e3ca9ef1e6559adb4a88

SHA1
13792ebb047fa3a93ed7108d9e468b9c14b73ce8

SHA256
18e18e9e07ed837862633cf66d36ed7011238f69bfd6be3d1b09cad2159adf2d

SHA512
021eaef22b6913029421b62466fdbc2d4fbf878fa57aa82987fc3ba8f26f1aae3193c82919d55bbcd8e78c062de2c6cdf10e8ef88a9181f5105d6657f244de98

Download Submit
C:\Users\Admin\AppData\Local\Temp\2922ece8-3339-48ed-b9fc-f7df309af580.vbs

Filesize
710B

MD5
eba416c30e9252e3cdd15e4c2a6046f4

SHA1
84809bba59f11cd890a0844cdd2a7e396e471013

SHA256
7548c1a3ff6c242e5adec34e10f80029b1179c02088000a7920695ede932d6e3

SHA512
3b20b2dcff37efbe93d0a3969342f189aa031705cc21b9e97ece05a76db913d297615984d713535481e68ffe5c8cb76d06373ec65278103a12fd2c6603c03803

Download Submit
C:\Users\Admin\AppData\Local\Temp\494feb1a-182f-4a2b-81aa-493f659a8a77.vbs

Filesize
710B

MD5
2ff659ce628e7fdba8858522ac870d7e

SHA1
e84c84cc9abf92464913ab28889852e4019e4307

SHA256
7ec23b9415c9a901af1229fa5915eb114af8f6391b47aacc90953cb55235b5ae

SHA512
462ba1da6c45b61654fccfb7825faf7f7ca68547b621c50ae9fc80adecb1861ffc7ede68add3e42cd7997ddccabfefc100c8aeed118782daa638f1c4d42380a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\782156bf-90b7-4c76-a8f2-d28919f15168.vbs

Filesize
710B

MD5
6c0e868f64fbba578578dfff6a27a2e4

SHA1
475cb1c057367e891790efb361b68ec2bd518be0

SHA256
84d4a8114bfc27032ff72bf3342e622d19daaeb1ad88e9f4adc3f5f51373b2eb

SHA512
c332dc52b0f9005bcf63251c60b0fca687e83a1e93901528024f1f0368d81d76751c05fa133dbc92642cc72c7d6b5480bc7d29e3b328bca41d503c725517c517

Download Submit
C:\Users\Admin\AppData\Local\Temp\985b38bd-fa6f-4f44-9ffd-9ff8df327804.vbs

Filesize
710B

MD5
d6e9e36251260902f8807ca6bae665a4

SHA1
12b5a9931ba2e2e87510fcb22b31952cf9091cf2

SHA256
822db98f9679cecec9dceb41af63755604823183d85fffb60e669c4f26edfefb

SHA512
03c160f185228bf75b793b2b897939f661e97c159ace97b5d033386a88c39fed8158c85ef1322b85ad7aec42829cab6f8a10f21917f76aee5e901dea0212736c

Download Submit
C:\Users\Admin\AppData\Local\Temp\XIUWxWaE8g.bat

Filesize
267B

MD5
1a5fec5b53b48f706ad1597cfc79a093

SHA1
ea6dc61579483e85a1f0d62ecb6ab5a27c2d2d59

SHA256
54276781517282d97fb781c352f2e93d7154740a69c2f6fa26fa3bde716de110

SHA512
77ca992681ca83d281d2013773aa208b0c9972fcae3a50a25d4337bcc05f01550a95be2afb68cddb65f4ae0be72d107b30f32b5412782878eec18360fd08ea36

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4zijkiha.2gf.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\b203baf2-a607-4281-bd14-d3b12f237b60.vbs

Filesize
710B

MD5
96d944de60e79a423ddd5f12b498afe7

SHA1
6d8be45b2037c3da83cb91228b54c5281226f856

SHA256
72d78a99662359fcf82a1b5e9e997d1bd3c0b7e8789f0816a4c2ddae271c7a36

SHA512
66e1510f6b35664d214f58593044801497d82c9dcd4b9bb06db69e4f8f44f8800a3fcf18c25fabe22db22891fbe78157b6baf7e1eee858b1a2ef515e0d79d874

Download Submit
C:\Users\Admin\AppData\Local\Temp\f1f19f93-eac9-447a-80c0-3a82e5f82ba9.vbs

Filesize
486B

MD5
a854cab890d27903785f591c63767369

SHA1
d2fd738222a9f89f700aca11bfb0ad6b14b62a83

SHA256
4010fafd936913e3fbc1714017358aa4012b4429ef125bec770037ca1a85f15f

SHA512
83346dc4708248200b98d498d09a2d5551bd97a32591ab8458109951e4e3ebc9d44059ecb4ba1892fcf58bee92289cf488e03f9798558510d64921b78353aed1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpADF4.tmp.exe

Filesize
75KB

MD5
e0a68b98992c1699876f818a22b5b907

SHA1
d41e8ad8ba51217eb0340f8f69629ccb474484d0

SHA256
2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

SHA512
856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

Download Submit
C:\Users\Default\winlogon.exe

Filesize
4.9MB

MD5
325d72ca61c441e5eda24a533fb9771e

SHA1
f54eccb4118598ac4e51c6318ec91e5780ae4687

SHA256
6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3

SHA512
d2d17feefd6cf6a28425ca5204ed1ce17475f7657cc73487a7ddc2edea470edb2f2e79b60c29944257f08033073c3e89cf4f11cf97b90d7bf812e9cea143df6c

Download Submit
memory/940-58-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/1052-254-0x000000001BE60000-0x000000001BE72000-memory.dmp

Filesize
72KB

Download
memory/1764-559-0x000000001BB30000-0x000000001BB42000-memory.dmp

Filesize
72KB

Download
memory/3044-139-0x000001B9AB680000-0x000001B9AB6A2000-memory.dmp

Filesize
136KB

Download
memory/4272-7-0x0000000001070000-0x0000000001080000-memory.dmp

Filesize
64KB

Download
memory/4272-10-0x000000001B5D0000-0x000000001B5DA000-memory.dmp

Filesize
40KB

Download
memory/4272-8-0x0000000001080000-0x0000000001096000-memory.dmp

Filesize
88KB

Download
memory/4272-6-0x0000000001050000-0x0000000001058000-memory.dmp

Filesize
32KB

Download
memory/4272-4-0x0000000001030000-0x000000000104C000-memory.dmp

Filesize
112KB

Download
memory/4272-3-0x00007FF802EA0000-0x00007FF803961000-memory.dmp

Filesize
10.8MB

Download
memory/4272-2-0x000000001B7C0000-0x000000001B8EE000-memory.dmp

Filesize
1.2MB

Download
memory/4272-0-0x00007FF802EA3000-0x00007FF802EA5000-memory.dmp

Filesize
8KB

Download
memory/4272-9-0x00000000029E0000-0x00000000029F0000-memory.dmp

Filesize
64KB

Download
memory/4272-127-0x00007FF802EA0000-0x00007FF803961000-memory.dmp

Filesize
10.8MB

Download
memory/4272-5-0x000000001B620000-0x000000001B670000-memory.dmp

Filesize
320KB

Download
memory/4272-15-0x000000001B610000-0x000000001B61E000-memory.dmp

Filesize
56KB

Download
memory/4272-14-0x000000001B600000-0x000000001B60E000-memory.dmp

Filesize
56KB

Download
memory/4272-1-0x0000000000350000-0x0000000000844000-memory.dmp

Filesize
5.0MB

Download
memory/4272-11-0x000000001B5E0000-0x000000001B5F2000-memory.dmp

Filesize
72KB

Download
memory/4272-16-0x000000001B670000-0x000000001B678000-memory.dmp

Filesize
32KB

Download
memory/4272-17-0x000000001B680000-0x000000001B688000-memory.dmp

Filesize
32KB

Download
memory/4272-12-0x000000001C420000-0x000000001C948000-memory.dmp

Filesize
5.2MB

Download
memory/4272-18-0x000000001B690000-0x000000001B69C000-memory.dmp

Filesize
48KB

Download
memory/4272-13-0x000000001B5F0000-0x000000001B5FA000-memory.dmp

Filesize
40KB

Download
memory/4764-699-0x000000001C0F0000-0x000000001C102000-memory.dmp

Filesize
72KB

Download
memory/4868-583-0x0000000002EA0000-0x0000000002EB2000-memory.dmp

Filesize
72KB

Download