dcrat | 7c2553e0b991923e0c4aa1410cf06cb686a455c5ea2867fc00778da787f8dc05

Analysis

max time kernel
149s
max time network
152s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
02-11-2024 23:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7c2553e0b991923e0c4aa1410cf06cb686a455c5ea2867fc00778da787f8dc05N.exe
Size

4.9MB
MD5

ae0ba9569cf7c10b38e333294ecd7e70
SHA1

ea845af8e5d2a2faee5881f904e79f6316e461dd
SHA256

7c2553e0b991923e0c4aa1410cf06cb686a455c5ea2867fc00778da787f8dc05
SHA512

b9959a49727c1867aeb71d71c9b26cbf0094bb6a310dec981f110d09d9b2aa3d33b9800ae6736cd66c51720ae76d0b6b5887e138377429f6aea6c142b247bd2d
SSDEEP

49152:bl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:

Score

10^/10

dcrat evasion execution infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 27 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2952	2868	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2880	2868	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2732	2868	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2760	2868	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3068	2868	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2748	2868	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2456	2868	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2724	2868	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2776	2868	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2376	2868	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2448	2868	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1344	2868	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2080	2868	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3036	2868	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1716	2868	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2976	2868	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1348	2868	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1584	2868	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2072	2868	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2540	2868	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1556	2868	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	432	2868	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	848	2868	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1688	2868	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2260	2868	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1304	2868	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1116	2868	schtasks.exe	30

UAC bypass 3 TTPs 36 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	7c2553e0b991923e0c4aa1410cf06cb686a455c5ea2867fc00778da787f8dc05N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	7c2553e0b991923e0c4aa1410cf06cb686a455c5ea2867fc00778da787f8dc05N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	7c2553e0b991923e0c4aa1410cf06cb686a455c5ea2867fc00778da787f8dc05N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/2116-3-0x000000001B250000-0x000000001B37E000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1700	powershell.exe
1372	powershell.exe
772	powershell.exe
2700	powershell.exe
700	powershell.exe
2252	powershell.exe
1980	powershell.exe
940	powershell.exe
1724	powershell.exe
796	powershell.exe
2688	powershell.exe
2416	powershell.exe

Executes dropped EXE 11 IoCs

pid	Process
1656	lsass.exe
1960	lsass.exe
756	lsass.exe
2184	lsass.exe
1660	lsass.exe
2452	lsass.exe
1672	lsass.exe
1692	lsass.exe
2392	lsass.exe
2584	lsass.exe
1432	lsass.exe

Checks whether UAC is enabled 1 TTPs 24 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	7c2553e0b991923e0c4aa1410cf06cb686a455c5ea2867fc00778da787f8dc05N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	7c2553e0b991923e0c4aa1410cf06cb686a455c5ea2867fc00778da787f8dc05N.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Games\Minesweeper\dwm.exe	7c2553e0b991923e0c4aa1410cf06cb686a455c5ea2867fc00778da787f8dc05N.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\6cb0b6c459d5d3	7c2553e0b991923e0c4aa1410cf06cb686a455c5ea2867fc00778da787f8dc05N.exe
File created	C:\Program Files\MSBuild\Microsoft\wininit.exe	7c2553e0b991923e0c4aa1410cf06cb686a455c5ea2867fc00778da787f8dc05N.exe
File created	C:\Program Files\MSBuild\Microsoft\56085415360792	7c2553e0b991923e0c4aa1410cf06cb686a455c5ea2867fc00778da787f8dc05N.exe
File opened for modification	C:\Program Files\Microsoft Games\Minesweeper\RCXB01.tmp	7c2553e0b991923e0c4aa1410cf06cb686a455c5ea2867fc00778da787f8dc05N.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\wininit.exe	7c2553e0b991923e0c4aa1410cf06cb686a455c5ea2867fc00778da787f8dc05N.exe
File created	C:\Program Files (x86)\Windows Defender\wininit.exe	7c2553e0b991923e0c4aa1410cf06cb686a455c5ea2867fc00778da787f8dc05N.exe
File created	C:\Program Files (x86)\Windows Defender\56085415360792	7c2553e0b991923e0c4aa1410cf06cb686a455c5ea2867fc00778da787f8dc05N.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\RCX498.tmp	7c2553e0b991923e0c4aa1410cf06cb686a455c5ea2867fc00778da787f8dc05N.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\wininit.exe	7c2553e0b991923e0c4aa1410cf06cb686a455c5ea2867fc00778da787f8dc05N.exe
File opened for modification	C:\Program Files\Microsoft Games\Minesweeper\dwm.exe	7c2553e0b991923e0c4aa1410cf06cb686a455c5ea2867fc00778da787f8dc05N.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\RCXFC4.tmp	7c2553e0b991923e0c4aa1410cf06cb686a455c5ea2867fc00778da787f8dc05N.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Installer\{90140000-006E-0409-0000-0000000FF1CE}\lsass.exe	7c2553e0b991923e0c4aa1410cf06cb686a455c5ea2867fc00778da787f8dc05N.exe
File created	C:\Windows\Installer\{90140000-006E-0409-0000-0000000FF1CE}\6203df4a6bafc7	7c2553e0b991923e0c4aa1410cf06cb686a455c5ea2867fc00778da787f8dc05N.exe
File opened for modification	C:\Windows\Installer\{90140000-006E-0409-0000-0000000FF1CE}\RCX8DE.tmp	7c2553e0b991923e0c4aa1410cf06cb686a455c5ea2867fc00778da787f8dc05N.exe
File opened for modification	C:\Windows\Installer\{90140000-006E-0409-0000-0000000FF1CE}\lsass.exe	7c2553e0b991923e0c4aa1410cf06cb686a455c5ea2867fc00778da787f8dc05N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 27 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2880	schtasks.exe
2976	schtasks.exe
1348	schtasks.exe
2072	schtasks.exe
432	schtasks.exe
2732	schtasks.exe
2448	schtasks.exe
1584	schtasks.exe
2260	schtasks.exe
2724	schtasks.exe
1344	schtasks.exe
2080	schtasks.exe
1688	schtasks.exe
3068	schtasks.exe
2748	schtasks.exe
2776	schtasks.exe
2376	schtasks.exe
848	schtasks.exe
2456	schtasks.exe
2540	schtasks.exe
1556	schtasks.exe
1116	schtasks.exe
2952	schtasks.exe
3036	schtasks.exe
1716	schtasks.exe
1304	schtasks.exe
2760	schtasks.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
2116	7c2553e0b991923e0c4aa1410cf06cb686a455c5ea2867fc00778da787f8dc05N.exe
1724	powershell.exe
700	powershell.exe
2688	powershell.exe
2700	powershell.exe
2416	powershell.exe
1700	powershell.exe
772	powershell.exe
2252	powershell.exe
796	powershell.exe
1372	powershell.exe
1980	powershell.exe
940	powershell.exe
1656	lsass.exe
1960	lsass.exe
756	lsass.exe
2184	lsass.exe
1660	lsass.exe
2452	lsass.exe
1672	lsass.exe
2392	lsass.exe
2584	lsass.exe
1432	lsass.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	2116	7c2553e0b991923e0c4aa1410cf06cb686a455c5ea2867fc00778da787f8dc05N.exe
Token: SeDebugPrivilege	1724	powershell.exe
Token: SeDebugPrivilege	700	powershell.exe
Token: SeDebugPrivilege	2688	powershell.exe
Token: SeDebugPrivilege	2700	powershell.exe
Token: SeDebugPrivilege	2416	powershell.exe
Token: SeDebugPrivilege	1700	powershell.exe
Token: SeDebugPrivilege	772	powershell.exe
Token: SeDebugPrivilege	2252	powershell.exe
Token: SeDebugPrivilege	796	powershell.exe
Token: SeDebugPrivilege	1372	powershell.exe
Token: SeDebugPrivilege	1980	powershell.exe
Token: SeDebugPrivilege	940	powershell.exe
Token: SeDebugPrivilege	1656	lsass.exe
Token: SeDebugPrivilege	1960	lsass.exe
Token: SeDebugPrivilege	756	lsass.exe
Token: SeDebugPrivilege	2184	lsass.exe
Token: SeDebugPrivilege	1660	lsass.exe
Token: SeDebugPrivilege	2452	lsass.exe
Token: SeDebugPrivilege	1672	lsass.exe
Token: SeDebugPrivilege	2392	lsass.exe
Token: SeDebugPrivilege	2584	lsass.exe
Token: SeDebugPrivilege	1432	lsass.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 2688	2116	7c2553e0b991923e0c4aa1410cf06cb686a455c5ea2867fc00778da787f8dc05N.exe	58
PID 2116 wrote to memory of 2688	2116	7c2553e0b991923e0c4aa1410cf06cb686a455c5ea2867fc00778da787f8dc05N.exe	58
PID 2116 wrote to memory of 2688	2116	7c2553e0b991923e0c4aa1410cf06cb686a455c5ea2867fc00778da787f8dc05N.exe	58
PID 2116 wrote to memory of 772	2116	7c2553e0b991923e0c4aa1410cf06cb686a455c5ea2867fc00778da787f8dc05N.exe	59
PID 2116 wrote to memory of 772	2116	7c2553e0b991923e0c4aa1410cf06cb686a455c5ea2867fc00778da787f8dc05N.exe	59
PID 2116 wrote to memory of 772	2116	7c2553e0b991923e0c4aa1410cf06cb686a455c5ea2867fc00778da787f8dc05N.exe	59
PID 2116 wrote to memory of 1372	2116	7c2553e0b991923e0c4aa1410cf06cb686a455c5ea2867fc00778da787f8dc05N.exe	60
PID 2116 wrote to memory of 1372	2116	7c2553e0b991923e0c4aa1410cf06cb686a455c5ea2867fc00778da787f8dc05N.exe	60
PID 2116 wrote to memory of 1372	2116	7c2553e0b991923e0c4aa1410cf06cb686a455c5ea2867fc00778da787f8dc05N.exe	60
PID 2116 wrote to memory of 2700	2116	7c2553e0b991923e0c4aa1410cf06cb686a455c5ea2867fc00778da787f8dc05N.exe	61
PID 2116 wrote to memory of 2700	2116	7c2553e0b991923e0c4aa1410cf06cb686a455c5ea2867fc00778da787f8dc05N.exe	61
PID 2116 wrote to memory of 2700	2116	7c2553e0b991923e0c4aa1410cf06cb686a455c5ea2867fc00778da787f8dc05N.exe	61
PID 2116 wrote to memory of 796	2116	7c2553e0b991923e0c4aa1410cf06cb686a455c5ea2867fc00778da787f8dc05N.exe	62
PID 2116 wrote to memory of 796	2116	7c2553e0b991923e0c4aa1410cf06cb686a455c5ea2867fc00778da787f8dc05N.exe	62
PID 2116 wrote to memory of 796	2116	7c2553e0b991923e0c4aa1410cf06cb686a455c5ea2867fc00778da787f8dc05N.exe	62
PID 2116 wrote to memory of 1724	2116	7c2553e0b991923e0c4aa1410cf06cb686a455c5ea2867fc00778da787f8dc05N.exe	65
PID 2116 wrote to memory of 1724	2116	7c2553e0b991923e0c4aa1410cf06cb686a455c5ea2867fc00778da787f8dc05N.exe	65
PID 2116 wrote to memory of 1724	2116	7c2553e0b991923e0c4aa1410cf06cb686a455c5ea2867fc00778da787f8dc05N.exe	65
PID 2116 wrote to memory of 940	2116	7c2553e0b991923e0c4aa1410cf06cb686a455c5ea2867fc00778da787f8dc05N.exe	66
PID 2116 wrote to memory of 940	2116	7c2553e0b991923e0c4aa1410cf06cb686a455c5ea2867fc00778da787f8dc05N.exe	66
PID 2116 wrote to memory of 940	2116	7c2553e0b991923e0c4aa1410cf06cb686a455c5ea2867fc00778da787f8dc05N.exe	66
PID 2116 wrote to memory of 1700	2116	7c2553e0b991923e0c4aa1410cf06cb686a455c5ea2867fc00778da787f8dc05N.exe	68
PID 2116 wrote to memory of 1700	2116	7c2553e0b991923e0c4aa1410cf06cb686a455c5ea2867fc00778da787f8dc05N.exe	68
PID 2116 wrote to memory of 1700	2116	7c2553e0b991923e0c4aa1410cf06cb686a455c5ea2867fc00778da787f8dc05N.exe	68
PID 2116 wrote to memory of 1980	2116	7c2553e0b991923e0c4aa1410cf06cb686a455c5ea2867fc00778da787f8dc05N.exe	69
PID 2116 wrote to memory of 1980	2116	7c2553e0b991923e0c4aa1410cf06cb686a455c5ea2867fc00778da787f8dc05N.exe	69
PID 2116 wrote to memory of 1980	2116	7c2553e0b991923e0c4aa1410cf06cb686a455c5ea2867fc00778da787f8dc05N.exe	69
PID 2116 wrote to memory of 700	2116	7c2553e0b991923e0c4aa1410cf06cb686a455c5ea2867fc00778da787f8dc05N.exe	70
PID 2116 wrote to memory of 700	2116	7c2553e0b991923e0c4aa1410cf06cb686a455c5ea2867fc00778da787f8dc05N.exe	70
PID 2116 wrote to memory of 700	2116	7c2553e0b991923e0c4aa1410cf06cb686a455c5ea2867fc00778da787f8dc05N.exe	70
PID 2116 wrote to memory of 2252	2116	7c2553e0b991923e0c4aa1410cf06cb686a455c5ea2867fc00778da787f8dc05N.exe	71
PID 2116 wrote to memory of 2252	2116	7c2553e0b991923e0c4aa1410cf06cb686a455c5ea2867fc00778da787f8dc05N.exe	71
PID 2116 wrote to memory of 2252	2116	7c2553e0b991923e0c4aa1410cf06cb686a455c5ea2867fc00778da787f8dc05N.exe	71
PID 2116 wrote to memory of 2416	2116	7c2553e0b991923e0c4aa1410cf06cb686a455c5ea2867fc00778da787f8dc05N.exe	72
PID 2116 wrote to memory of 2416	2116	7c2553e0b991923e0c4aa1410cf06cb686a455c5ea2867fc00778da787f8dc05N.exe	72
PID 2116 wrote to memory of 2416	2116	7c2553e0b991923e0c4aa1410cf06cb686a455c5ea2867fc00778da787f8dc05N.exe	72
PID 2116 wrote to memory of 1656	2116	7c2553e0b991923e0c4aa1410cf06cb686a455c5ea2867fc00778da787f8dc05N.exe	82
PID 2116 wrote to memory of 1656	2116	7c2553e0b991923e0c4aa1410cf06cb686a455c5ea2867fc00778da787f8dc05N.exe	82
PID 2116 wrote to memory of 1656	2116	7c2553e0b991923e0c4aa1410cf06cb686a455c5ea2867fc00778da787f8dc05N.exe	82
PID 1656 wrote to memory of 1440	1656	lsass.exe	83
PID 1656 wrote to memory of 1440	1656	lsass.exe	83
PID 1656 wrote to memory of 1440	1656	lsass.exe	83
PID 1656 wrote to memory of 2412	1656	lsass.exe	84
PID 1656 wrote to memory of 2412	1656	lsass.exe	84
PID 1656 wrote to memory of 2412	1656	lsass.exe	84
PID 1440 wrote to memory of 1960	1440	WScript.exe	85
PID 1440 wrote to memory of 1960	1440	WScript.exe	85
PID 1440 wrote to memory of 1960	1440	WScript.exe	85
PID 1960 wrote to memory of 1344	1960	lsass.exe	86
PID 1960 wrote to memory of 1344	1960	lsass.exe	86
PID 1960 wrote to memory of 1344	1960	lsass.exe	86
PID 1960 wrote to memory of 2224	1960	lsass.exe	87
PID 1960 wrote to memory of 2224	1960	lsass.exe	87
PID 1960 wrote to memory of 2224	1960	lsass.exe	87
PID 1344 wrote to memory of 756	1344	WScript.exe	88
PID 1344 wrote to memory of 756	1344	WScript.exe	88
PID 1344 wrote to memory of 756	1344	WScript.exe	88
PID 756 wrote to memory of 1800	756	lsass.exe	89
PID 756 wrote to memory of 1800	756	lsass.exe	89
PID 756 wrote to memory of 1800	756	lsass.exe	89
PID 756 wrote to memory of 532	756	lsass.exe	90
PID 756 wrote to memory of 532	756	lsass.exe	90
PID 756 wrote to memory of 532	756	lsass.exe	90
PID 1800 wrote to memory of 2184	1800	WScript.exe	91

System policy modification 1 TTPs 36 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	7c2553e0b991923e0c4aa1410cf06cb686a455c5ea2867fc00778da787f8dc05N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	7c2553e0b991923e0c4aa1410cf06cb686a455c5ea2867fc00778da787f8dc05N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	7c2553e0b991923e0c4aa1410cf06cb686a455c5ea2867fc00778da787f8dc05N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\7c2553e0b991923e0c4aa1410cf06cb686a455c5ea2867fc00778da787f8dc05N.exe
"C:\Users\Admin\AppData\Local\Temp\7c2553e0b991923e0c4aa1410cf06cb686a455c5ea2867fc00778da787f8dc05N.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2116
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2688
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:772
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1372
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2700
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:796
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1724
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:940
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1700
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1980
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:700
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2252
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2416
- C:\Windows\Installer\{90140000-006E-0409-0000-0000000FF1CE}\lsass.exe
  "C:\Windows\Installer\{90140000-006E-0409-0000-0000000FF1CE}\lsass.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1656
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\546913cb-430c-400f-a62d-8890fa58a570.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1440
  - - C:\Windows\Installer\{90140000-006E-0409-0000-0000000FF1CE}\lsass.exe
      C:\Windows\Installer\{90140000-006E-0409-0000-0000000FF1CE}\lsass.exe
      4⤵
      UAC bypass
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:1960
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\54d7e262-aa79-475f-98b5-9e375f17f7d8.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1344
      - C:\Windows\Installer\{90140000-006E-0409-0000-0000000FF1CE}\lsass.exe
        
        C:\Windows\Installer\{90140000-006E-0409-0000-0000000FF1CE}\lsass.exe
        6⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:756
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ce573882-0c3b-4049-95a8-7e75ffcf7c0d.vbs"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1800
        
        C:\Windows\Installer\{90140000-006E-0409-0000-0000000FF1CE}\lsass.exe
        
        C:\Windows\Installer\{90140000-006E-0409-0000-0000000FF1CE}\lsass.exe
        8⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2184
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b8a7652b-3ac4-456f-b0c9-42667d19210b.vbs"
        9⤵
        
        PID:2928
        
        C:\Windows\Installer\{90140000-006E-0409-0000-0000000FF1CE}\lsass.exe
        
        C:\Windows\Installer\{90140000-006E-0409-0000-0000000FF1CE}\lsass.exe
        10⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1660
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6900c962-27aa-4eac-8a46-abddc60463c2.vbs"
        11⤵
        
        PID:1428
        
        C:\Windows\Installer\{90140000-006E-0409-0000-0000000FF1CE}\lsass.exe
        
        C:\Windows\Installer\{90140000-006E-0409-0000-0000000FF1CE}\lsass.exe
        12⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2452
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\484c9f7f-dca6-4ce6-874d-58bec08a6a4d.vbs"
        13⤵
        
        PID:2644
        
        C:\Windows\Installer\{90140000-006E-0409-0000-0000000FF1CE}\lsass.exe
        
        C:\Windows\Installer\{90140000-006E-0409-0000-0000000FF1CE}\lsass.exe
        14⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1672
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b03098c3-7dd3-4cd4-bb08-44123d95bcf7.vbs"
        15⤵
        
        PID:296
        
        C:\Windows\Installer\{90140000-006E-0409-0000-0000000FF1CE}\lsass.exe
        
        C:\Windows\Installer\{90140000-006E-0409-0000-0000000FF1CE}\lsass.exe
        16⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        System policy modification
        
        PID:1692
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d495fcd0-46f7-4ef3-9bdc-1de9c3113325.vbs"
        17⤵
        
        PID:848
        
        C:\Windows\Installer\{90140000-006E-0409-0000-0000000FF1CE}\lsass.exe
        
        C:\Windows\Installer\{90140000-006E-0409-0000-0000000FF1CE}\lsass.exe
        18⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2392
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\85aa2f0e-c44b-40a8-b15b-a195664aba03.vbs"
        19⤵
        
        PID:2912
        
        C:\Windows\Installer\{90140000-006E-0409-0000-0000000FF1CE}\lsass.exe
        
        C:\Windows\Installer\{90140000-006E-0409-0000-0000000FF1CE}\lsass.exe
        20⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2584
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\96b0dcea-8f85-44b3-b13d-0b6e97689444.vbs"
        21⤵
        
        PID:2336
        
        C:\Windows\Installer\{90140000-006E-0409-0000-0000000FF1CE}\lsass.exe
        
        C:\Windows\Installer\{90140000-006E-0409-0000-0000000FF1CE}\lsass.exe
        22⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1432
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\18c9c30d-b1df-4e2b-b00b-5cd05c59d62e.vbs"
        23⤵
        
        PID:2816
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fb6f9e49-23e3-40ec-a9f6-69566deaf14b.vbs"
        23⤵
        
        PID:1736
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\07915b13-ee25-4275-8464-7894a7c04a8a.vbs"
        21⤵
        
        PID:924
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\44c27853-ed63-4b29-aa62-a1fb7adb2e8e.vbs"
        19⤵
        
        PID:2084
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d746cb3b-6a99-4f0d-8af4-7bcf7ab2af0e.vbs"
        17⤵
        
        PID:2676
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b078440d-bbe7-452f-9d51-3b713ce0a1bf.vbs"
        15⤵
        
        PID:2208
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5799b6d0-0477-43cc-84e3-266fa0aa7f5c.vbs"
        13⤵
        
        PID:1640
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\61c72093-5822-4eb3-8dc5-e63f2ffdfa74.vbs"
        11⤵
        
        PID:2320
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0502a8b1-1563-4298-b270-82136b6fdb5b.vbs"
        9⤵
        
        PID:2172
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6014d4d0-a319-4a34-8476-b4a6ae29c234.vbs"
        7⤵
        
        PID:532
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6533cb1c-da4e-44c5-8bdd-e7fcb32495f9.vbs"
        5⤵
        
        PID:2224
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\62b622bf-9fd5-49cd-98f8-d59913b3d37f.vbs"
    3⤵
    PID:2412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\Recent\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Users\Admin\Recent\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\Recent\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 13 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 14 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Defender\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Defender\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Windows\Installer\{90140000-006E-0409-0000-0000000FF1CE}\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\Installer\{90140000-006E-0409-0000-0000000FF1CE}\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Windows\Installer\{90140000-006E-0409-0000-0000000FF1CE}\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Program Files\Microsoft Games\Minesweeper\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\Microsoft Games\Minesweeper\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Program Files\Microsoft Games\Minesweeper\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Program Files\MSBuild\Microsoft\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Program Files\MSBuild\Microsoft\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\smss.exe

Filesize
4.9MB

MD5
ae0ba9569cf7c10b38e333294ecd7e70

SHA1
ea845af8e5d2a2faee5881f904e79f6316e461dd

SHA256
7c2553e0b991923e0c4aa1410cf06cb686a455c5ea2867fc00778da787f8dc05

SHA512
b9959a49727c1867aeb71d71c9b26cbf0094bb6a310dec981f110d09d9b2aa3d33b9800ae6736cd66c51720ae76d0b6b5887e138377429f6aea6c142b247bd2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\18c9c30d-b1df-4e2b-b00b-5cd05c59d62e.vbs

Filesize
745B

MD5
3ca23dda3eb23240f009041e8c2c2cde

SHA1
c08a9cecb8a64a4572f2177ce6702ae0a165ad82

SHA256
f4f13b2480b40c216df636d2e787047ddd2f6c30d9cf55ca9b69e4ebf6c267a0

SHA512
b3120fc7cf664e7d04aa9e0ce82a553a153f395966de08dd73f21fcf159e7aa72f8bfbc5d06bc33b1e42865f2fa997b1a86b60604b0cf0e67c2fe10c5bde6983

Download Submit
C:\Users\Admin\AppData\Local\Temp\484c9f7f-dca6-4ce6-874d-58bec08a6a4d.vbs

Filesize
745B

MD5
64ab5f79fdb88aaa2a04ef8c0e894d04

SHA1
93b527157a3f9c312508ac0deb14104c4e975b85

SHA256
07cffcae38f54e96b251acdb8238f7c4913ee6aa4c8ecac6a66dcff71edeede5

SHA512
040b0ebe904062865d24f938ddc22fa82c7f7eaee2941377fd07d4f915033f5868c68a4fec0d9140c1638d9db80881927c70670cd1241a637b2850321549873f

Download Submit
C:\Users\Admin\AppData\Local\Temp\546913cb-430c-400f-a62d-8890fa58a570.vbs

Filesize
745B

MD5
eaa8b438685d072ba5ad770ee4c6d2b7

SHA1
d95a8b0fdc858acae4f5618b6a731f6e02629ad6

SHA256
8f4d683a82a4d9fac4d16e0d8dec28a057990b76831da9292a92e79157c3c1e9

SHA512
891bec1005e289da2f2545235d6ec5af816988322294eccd04a46744324d788dc421606847ef808902992ee4c8fc7f66f053a1880c25c10726ebf5aca6755d0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\54d7e262-aa79-475f-98b5-9e375f17f7d8.vbs

Filesize
745B

MD5
a23eaad8898ab0c509fe1210bf567c87

SHA1
94d0b592f2ad32780e96c1b08f77be5760620c12

SHA256
2fb7ff8e55eb61a9af1685f534bf0b3a6fb45cd7023b87b3fab347af84073f98

SHA512
6afa5a23dd69537a58a24bc0bff86a632f826269683325ae48d890ae7c7ea6bea88233ee4e45541d0d5772ad47fa573288fd9df5caa8b72a780bc4d34545386a

Download Submit
C:\Users\Admin\AppData\Local\Temp\62b622bf-9fd5-49cd-98f8-d59913b3d37f.vbs

Filesize
521B

MD5
2eb03d9cd27a72f4c85ac24fa2d50bc6

SHA1
665e8610555186f9138f8a5573c12cdb6254f9bb

SHA256
71571047c853315b44ff0a0c9f7de31086a1813c9dea714af3aff9244e995438

SHA512
8be8b2676f84882ff89a598c396b876ecacbe2db36448cb4c28cf3a609202967c40179aaa6fd146d096a1fa32348e7c3fa8142c1852f4b919eef8f06585bcc48

Download Submit
C:\Users\Admin\AppData\Local\Temp\6900c962-27aa-4eac-8a46-abddc60463c2.vbs

Filesize
745B

MD5
d0db09b9c562900f82da8bf123157c5c

SHA1
d9db15775b668d41f1aca8dcdce3381970270ad9

SHA256
218d3108fd9a015b42d0f65084c3283eb0010b9e972753e5c56002e01f2d19e9

SHA512
75ee6bb35363260a779e2fb958c5bb19cc25554b6b7e4e36a3e08bc0defdc36c3d8b12f1ba05279d8667637868ae2174ec7612654f315a573db6de277218e6f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\85aa2f0e-c44b-40a8-b15b-a195664aba03.vbs

Filesize
745B

MD5
5cbeb22665ae9c9434d4ea8a5dd3e1d3

SHA1
3b7b730f27600cc32c8668fcfead2ef235490a2a

SHA256
43b8b67e52d1dfaa5d9f0f726c5aef6fd0b2e4e166d4f4454c2c9a4e254b4bd4

SHA512
65ae7ebcdfec9bf0f7cf16b1b0cd7eaa78c3d2f558f062c53c286b4d6dd90ba666e77e4a490498c9222d8fe5a7d8e37d9c0c0230533b2ed24100c9c444948a7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\96b0dcea-8f85-44b3-b13d-0b6e97689444.vbs

Filesize
745B

MD5
fe726d12c961aaef57cbae2855a3c7c5

SHA1
9364416412b0302c57ed4d51c1228e809fe3dbf4

SHA256
ae4a8cb173ae98644007944b3d89c986c4d722e1d4a41f1dbf3368928a1a04d8

SHA512
9e4c0bbe180add933b48037488b6a30db44a1d4510f7567d66770321667a052a435d0f111719189ef2803017880a24cb90e9913d907a8812da77ed73a7797380

Download Submit
C:\Users\Admin\AppData\Local\Temp\b03098c3-7dd3-4cd4-bb08-44123d95bcf7.vbs

Filesize
745B

MD5
172743ce22abeaaff82a37ea22a2b129

SHA1
c6d8dc6dbd8494fe744a34c0af70c10d9266a651

SHA256
03d64b9aaba2fca91caaab0fecc50b598cf0aa77094a92d406a7a25836a9f2f2

SHA512
73cf30ec7813f55bb96663c48ec692af9428e1b3d95f6dc8a41e5c79b25ad8e044ada57d10c04943dd413cbb598d4a2d4ca53c8398117d755e331948dac662e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\b8a7652b-3ac4-456f-b0c9-42667d19210b.vbs

Filesize
745B

MD5
f0187c70c896fa686feebecc36cdc356

SHA1
53f4db383850956699a4b2ab6006dc14ef4d0194

SHA256
af7d0a636b279aabfab2554b2b66afd427ac6c29f688d87335ddde942453ee98

SHA512
81d4dda6dcb5a0cddae781f45ef827e89a5e8a141183a3ff45859eb2981c104c6ba80906f88c4786d80987a3de8c6226bdd207d945b519478b0aa93cd059b067

Download Submit
C:\Users\Admin\AppData\Local\Temp\ce573882-0c3b-4049-95a8-7e75ffcf7c0d.vbs

Filesize
744B

MD5
b57c767014fd0a28198d9d4c6f6c659b

SHA1
5b6579b318f0a3fc44bf70b4ef48bf08d556b6e9

SHA256
524e74581200f0051bc2021c937237d14315e9343066621af825efc1b5118430

SHA512
838094b2a60f25c7a0b322866d976ddc36456602dcb7ed51ff663eb10be5edfd4430d1a5b3ff1a74c9e089c0cb74a301096cdc0b2e009d6fddd1ad6405f0831a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp2B06.tmp.exe

Filesize
75KB

MD5
e0a68b98992c1699876f818a22b5b907

SHA1
d41e8ad8ba51217eb0340f8f69629ccb474484d0

SHA256
2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

SHA512
856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
bfd897d07ac23f97e56b5aa3518a37a8

SHA1
3acd9a3ef9a26cb93b907ba70748b28849149f23

SHA256
79f0d71874653192513885e5a518bbc30fe4a165947d7ffcdbdfb6c776bd6a90

SHA512
c48243d9bd0df6a4b649b4e46eadaedc4b5b2b88af922bbad0ce0956b3da37ed96c685bce5b12ca4b21e383b223d891c690ce50f93aa02fc7d21af8802b6ddb7

Download Submit
memory/940-165-0x000000001B270000-0x000000001B552000-memory.dmp

Filesize
2.9MB

Download
memory/1656-172-0x0000000000EF0000-0x0000000000F02000-memory.dmp

Filesize
72KB

Download
memory/1656-167-0x00000000010C0000-0x00000000015B4000-memory.dmp

Filesize
5.0MB

Download
memory/1700-166-0x00000000025A0000-0x00000000025A8000-memory.dmp

Filesize
32KB

Download
memory/1960-183-0x0000000000800000-0x0000000000812000-memory.dmp

Filesize
72KB

Download
memory/2116-9-0x0000000002520000-0x000000000252A000-memory.dmp

Filesize
40KB

Download
memory/2116-11-0x00000000026A0000-0x00000000026AA000-memory.dmp

Filesize
40KB

Download
memory/2116-92-0x000007FEF6183000-0x000007FEF6184000-memory.dmp

Filesize
4KB

Download
memory/2116-16-0x000000001ABB0000-0x000000001ABBC000-memory.dmp

Filesize
48KB

Download
memory/2116-15-0x000000001ABA0000-0x000000001ABA8000-memory.dmp

Filesize
32KB

Download
memory/2116-168-0x000007FEF6180000-0x000007FEF6B6C000-memory.dmp

Filesize
9.9MB

Download
memory/2116-14-0x000000001AB90000-0x000000001AB98000-memory.dmp

Filesize
32KB

Download
memory/2116-13-0x000000001AB80000-0x000000001AB8E000-memory.dmp

Filesize
56KB

Download
memory/2116-12-0x00000000026B0000-0x00000000026BE000-memory.dmp

Filesize
56KB

Download
memory/2116-103-0x000007FEF6180000-0x000007FEF6B6C000-memory.dmp

Filesize
9.9MB

Download
memory/2116-10-0x0000000002530000-0x0000000002542000-memory.dmp

Filesize
72KB

Download
memory/2116-0-0x000007FEF6183000-0x000007FEF6184000-memory.dmp

Filesize
4KB

Download
memory/2116-8-0x0000000002510000-0x0000000002520000-memory.dmp

Filesize
64KB

Download
memory/2116-7-0x0000000000950000-0x0000000000966000-memory.dmp

Filesize
88KB

Download
memory/2116-6-0x0000000000940000-0x0000000000950000-memory.dmp

Filesize
64KB

Download
memory/2116-5-0x0000000000920000-0x0000000000928000-memory.dmp

Filesize
32KB

Download
memory/2116-4-0x0000000000900000-0x000000000091C000-memory.dmp

Filesize
112KB

Download
memory/2116-3-0x000000001B250000-0x000000001B37E000-memory.dmp

Filesize
1.2MB

Download
memory/2116-2-0x000007FEF6180000-0x000007FEF6B6C000-memory.dmp

Filesize
9.9MB

Download
memory/2116-1-0x00000000001F0000-0x00000000006E4000-memory.dmp

Filesize
5.0MB

Download