dcrat | d1a77a1cb9e4123494d9646d4d064289d6c96dd7a1ebde4dc0aab169c42018f0

Analysis

max time kernel
150s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12-11-2024 20:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d1a77a1cb9e4123494d9646d4d064289d6c96dd7a1ebde4dc0aab169c42018f0.exe
Size

3.7MB
MD5

b0f05d80b12c67dc9d26fe6d4f0debd0
SHA1

9bf6fee145f08c3ea7d41e6f6755187e92f11978
SHA256

d1a77a1cb9e4123494d9646d4d064289d6c96dd7a1ebde4dc0aab169c42018f0
SHA512

19632526b95ea7435c05af10ceb74179e902201389c62476c7cd5281a5dea338283921166a2272cbe12caf58b2207b18b58834b5c2b1c17df87b2f83fc3824d9
SSDEEP

98304:UbF26GgA01Iz8pS1m+j/C7N2DXXrbpqto0:U1A6IIAY+j6pG/Yb

Score

10^/10

dcrat discovery evasion infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 57 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1644	1428	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4684	1428	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4808	1428	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3220	1428	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4856	1428	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3708	1428	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1028	1428	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4692	1428	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4880	1428	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3228	1428	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1664	1428	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4816	1428	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1464	1428	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2512	1428	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4576	1428	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2400	1428	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3604	1428	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3264	1428	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4916	1428	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1524	1428	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4868	1428	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4480	1428	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4264	1428	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4416	1428	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1996	1428	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3556	1428	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1576	1428	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	208	1428	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1968	1428	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4332	1428	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1788	1428	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1056	1428	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3452	1428	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3804	1428	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4016	1428	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2264	1428	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1540	1428	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1632	1428	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1912	1428	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3652	1428	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3044	1428	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1812	1428	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2992	1428	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3388	1428	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4324	1428	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2092	1428	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1636	1428	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4936	1428	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1260	1428	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4976	1428	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4588	1428	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5052	1428	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2744	1428	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3776	1428	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4980	1428	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5048	1428	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4160	1428	schtasks.exe	91

UAC bypass 3 TTPs 45 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	reviewnet.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	reviewnet.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reviewnet.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x000a000000023b67-15.dat	dcrat
behavioral2/memory/468-17-0x0000000000970000-0x0000000000CDA000-memory.dmp	dcrat

Checks computer location settings 2 TTPs 17 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	d1a77a1cb9e4123494d9646d4d064289d6c96dd7a1ebde4dc0aab169c42018f0.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	reviewnet.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	wininit.exe

Executes dropped EXE 15 IoCs

pid	Process
468	reviewnet.exe
3216	wininit.exe
3752	wininit.exe
1976	wininit.exe
1196	wininit.exe
4760	wininit.exe
2608	wininit.exe
1028	wininit.exe
4916	wininit.exe
540	wininit.exe
3264	wininit.exe
1760	wininit.exe
4488	wininit.exe
4760	wininit.exe
3264	wininit.exe

Checks whether UAC is enabled 1 TTPs 30 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reviewnet.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wininit.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	reviewnet.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wininit.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wininit.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wininit.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wininit.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wininit.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wininit.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wininit.exe

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Media Player\Visualizations\5b884080fd4f94	reviewnet.exe
File created	C:\Program Files\Crashpad\reports\29c1c3cc0f7685	reviewnet.exe
File created	C:\Program Files\Common Files\microsoft shared\Stationery\conhost.exe	reviewnet.exe
File created	C:\Program Files\ModifiableWindowsApps\services.exe	reviewnet.exe
File created	C:\Program Files\Crashpad\attachments\cmd.exe	reviewnet.exe
File created	C:\Program Files\Crashpad\attachments\ebf1f9fa8afd6d	reviewnet.exe
File created	C:\Program Files\ModifiableWindowsApps\WaaSMedicAgent.exe	reviewnet.exe
File created	C:\Program Files\Windows Media Player\Visualizations\fontdrvhost.exe	reviewnet.exe
File created	C:\Program Files\Crashpad\reports\unsecapp.exe	reviewnet.exe
File created	C:\Program Files\Common Files\microsoft shared\Stationery\088424020bedd6	reviewnet.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\dllhost.exe	reviewnet.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\5940a34987c991	reviewnet.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\Offline Web Pages\dllhost.exe	reviewnet.exe
File created	C:\Windows\Offline Web Pages\5940a34987c991	reviewnet.exe
File created	C:\Windows\en-US\SppExtComObj.exe	reviewnet.exe
File opened for modification	C:\Windows\en-US\SppExtComObj.exe	reviewnet.exe
File created	C:\Windows\en-US\e1ef82546f0b02	reviewnet.exe
File created	C:\Windows\Setup\State\RuntimeBroker.exe	reviewnet.exe
File created	C:\Windows\Setup\State\9e8d7a4ca61bd9	reviewnet.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d1a77a1cb9e4123494d9646d4d064289d6c96dd7a1ebde4dc0aab169c42018f0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 16 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	reviewnet.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	d1a77a1cb9e4123494d9646d4d064289d6c96dd7a1ebde4dc0aab169c42018f0.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	wininit.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 57 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4856	schtasks.exe
4868	schtasks.exe
2264	schtasks.exe
1636	schtasks.exe
4332	schtasks.exe
1260	schtasks.exe
3228	schtasks.exe
3220	schtasks.exe
4816	schtasks.exe
4324	schtasks.exe
4588	schtasks.exe
2744	schtasks.exe
4684	schtasks.exe
4808	schtasks.exe
1056	schtasks.exe
2992	schtasks.exe
2092	schtasks.exe
4980	schtasks.exe
1524	schtasks.exe
1576	schtasks.exe
1968	schtasks.exe
1788	schtasks.exe
1912	schtasks.exe
1664	schtasks.exe
3604	schtasks.exe
4264	schtasks.exe
5052	schtasks.exe
5048	schtasks.exe
4160	schtasks.exe
4692	schtasks.exe
2400	schtasks.exe
4916	schtasks.exe
4416	schtasks.exe
4936	schtasks.exe
1632	schtasks.exe
3708	schtasks.exe
1996	schtasks.exe
3776	schtasks.exe
3556	schtasks.exe
3652	schtasks.exe
1812	schtasks.exe
4880	schtasks.exe
2512	schtasks.exe
1540	schtasks.exe
3388	schtasks.exe
1644	schtasks.exe
1464	schtasks.exe
4576	schtasks.exe
4480	schtasks.exe
208	schtasks.exe
3804	schtasks.exe
3452	schtasks.exe
3044	schtasks.exe
4976	schtasks.exe
1028	schtasks.exe
3264	schtasks.exe
4016	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
468	reviewnet.exe
468	reviewnet.exe
468	reviewnet.exe
468	reviewnet.exe
468	reviewnet.exe
468	reviewnet.exe
468	reviewnet.exe
468	reviewnet.exe
468	reviewnet.exe
468	reviewnet.exe
468	reviewnet.exe
468	reviewnet.exe
468	reviewnet.exe
468	reviewnet.exe
468	reviewnet.exe
468	reviewnet.exe
468	reviewnet.exe
468	reviewnet.exe
468	reviewnet.exe
468	reviewnet.exe
468	reviewnet.exe
468	reviewnet.exe
468	reviewnet.exe
468	reviewnet.exe
3216	wininit.exe
3216	wininit.exe
3216	wininit.exe
3216	wininit.exe
3216	wininit.exe
3216	wininit.exe
3216	wininit.exe
3216	wininit.exe
3216	wininit.exe
3216	wininit.exe
3216	wininit.exe
3216	wininit.exe
3216	wininit.exe
3216	wininit.exe
3216	wininit.exe
3216	wininit.exe
3216	wininit.exe
3216	wininit.exe
3216	wininit.exe
3216	wininit.exe
3216	wininit.exe
3216	wininit.exe
3216	wininit.exe
3216	wininit.exe
3216	wininit.exe
3216	wininit.exe
3216	wininit.exe
3216	wininit.exe
3216	wininit.exe
3216	wininit.exe
3216	wininit.exe
3216	wininit.exe
3216	wininit.exe
3216	wininit.exe
3216	wininit.exe
3216	wininit.exe
3216	wininit.exe
3216	wininit.exe
3216	wininit.exe
3216	wininit.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	468	reviewnet.exe
Token: SeDebugPrivilege	3216	wininit.exe
Token: SeDebugPrivilege	3752	wininit.exe
Token: SeDebugPrivilege	1976	wininit.exe
Token: SeDebugPrivilege	1196	wininit.exe
Token: SeDebugPrivilege	4760	wininit.exe
Token: SeDebugPrivilege	2608	wininit.exe
Token: SeDebugPrivilege	1028	wininit.exe
Token: SeDebugPrivilege	4916	wininit.exe
Token: SeDebugPrivilege	540	wininit.exe
Token: SeDebugPrivilege	3264	wininit.exe
Token: SeDebugPrivilege	1760	wininit.exe
Token: SeDebugPrivilege	4488	wininit.exe
Token: SeDebugPrivilege	4760	wininit.exe
Token: SeDebugPrivilege	3264	wininit.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 208 wrote to memory of 4752	208	d1a77a1cb9e4123494d9646d4d064289d6c96dd7a1ebde4dc0aab169c42018f0.exe	85
PID 208 wrote to memory of 4752	208	d1a77a1cb9e4123494d9646d4d064289d6c96dd7a1ebde4dc0aab169c42018f0.exe	85
PID 208 wrote to memory of 4752	208	d1a77a1cb9e4123494d9646d4d064289d6c96dd7a1ebde4dc0aab169c42018f0.exe	85
PID 208 wrote to memory of 440	208	d1a77a1cb9e4123494d9646d4d064289d6c96dd7a1ebde4dc0aab169c42018f0.exe	86
PID 208 wrote to memory of 440	208	d1a77a1cb9e4123494d9646d4d064289d6c96dd7a1ebde4dc0aab169c42018f0.exe	86
PID 208 wrote to memory of 440	208	d1a77a1cb9e4123494d9646d4d064289d6c96dd7a1ebde4dc0aab169c42018f0.exe	86
PID 4752 wrote to memory of 2428	4752	WScript.exe	93
PID 4752 wrote to memory of 2428	4752	WScript.exe	93
PID 4752 wrote to memory of 2428	4752	WScript.exe	93
PID 2428 wrote to memory of 468	2428	cmd.exe	95
PID 2428 wrote to memory of 468	2428	cmd.exe	95
PID 468 wrote to memory of 4272	468	reviewnet.exe	155
PID 468 wrote to memory of 4272	468	reviewnet.exe	155
PID 4272 wrote to memory of 3532	4272	cmd.exe	157
PID 4272 wrote to memory of 3532	4272	cmd.exe	157
PID 4272 wrote to memory of 3216	4272	cmd.exe	164
PID 4272 wrote to memory of 3216	4272	cmd.exe	164
PID 3216 wrote to memory of 4084	3216	wininit.exe	166
PID 3216 wrote to memory of 4084	3216	wininit.exe	166
PID 3216 wrote to memory of 1272	3216	wininit.exe	167
PID 3216 wrote to memory of 1272	3216	wininit.exe	167
PID 4084 wrote to memory of 3752	4084	WScript.exe	171
PID 4084 wrote to memory of 3752	4084	WScript.exe	171
PID 3752 wrote to memory of 4676	3752	wininit.exe	174
PID 3752 wrote to memory of 4676	3752	wininit.exe	174
PID 3752 wrote to memory of 2192	3752	wininit.exe	175
PID 3752 wrote to memory of 2192	3752	wininit.exe	175
PID 4676 wrote to memory of 1976	4676	WScript.exe	177
PID 4676 wrote to memory of 1976	4676	WScript.exe	177
PID 1976 wrote to memory of 4584	1976	wininit.exe	179
PID 1976 wrote to memory of 4584	1976	wininit.exe	179
PID 1976 wrote to memory of 2208	1976	wininit.exe	180
PID 1976 wrote to memory of 2208	1976	wininit.exe	180
PID 4584 wrote to memory of 1196	4584	WScript.exe	182
PID 4584 wrote to memory of 1196	4584	WScript.exe	182
PID 1196 wrote to memory of 1524	1196	wininit.exe	184
PID 1196 wrote to memory of 1524	1196	wininit.exe	184
PID 1196 wrote to memory of 3216	1196	wininit.exe	185
PID 1196 wrote to memory of 3216	1196	wininit.exe	185
PID 1524 wrote to memory of 4760	1524	WScript.exe	187
PID 1524 wrote to memory of 4760	1524	WScript.exe	187
PID 4760 wrote to memory of 2424	4760	wininit.exe	189
PID 4760 wrote to memory of 2424	4760	wininit.exe	189
PID 4760 wrote to memory of 3780	4760	wininit.exe	190
PID 4760 wrote to memory of 3780	4760	wininit.exe	190
PID 2424 wrote to memory of 2608	2424	WScript.exe	193
PID 2424 wrote to memory of 2608	2424	WScript.exe	193
PID 2608 wrote to memory of 3692	2608	wininit.exe	195
PID 2608 wrote to memory of 3692	2608	wininit.exe	195
PID 2608 wrote to memory of 1044	2608	wininit.exe	196
PID 2608 wrote to memory of 1044	2608	wininit.exe	196
PID 3692 wrote to memory of 1028	3692	WScript.exe	199
PID 3692 wrote to memory of 1028	3692	WScript.exe	199
PID 1028 wrote to memory of 4168	1028	wininit.exe	201
PID 1028 wrote to memory of 4168	1028	wininit.exe	201
PID 1028 wrote to memory of 4820	1028	wininit.exe	202
PID 1028 wrote to memory of 4820	1028	wininit.exe	202
PID 4168 wrote to memory of 4916	4168	WScript.exe	204
PID 4168 wrote to memory of 4916	4168	WScript.exe	204
PID 4916 wrote to memory of 1332	4916	wininit.exe	206
PID 4916 wrote to memory of 1332	4916	wininit.exe	206
PID 4916 wrote to memory of 3876	4916	wininit.exe	207
PID 4916 wrote to memory of 3876	4916	wininit.exe	207
PID 1332 wrote to memory of 540	1332	WScript.exe	209

System policy modification 1 TTPs 45 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	reviewnet.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reviewnet.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	reviewnet.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\d1a77a1cb9e4123494d9646d4d064289d6c96dd7a1ebde4dc0aab169c42018f0.exe
"C:\Users\Admin\AppData\Local\Temp\d1a77a1cb9e4123494d9646d4d064289d6c96dd7a1ebde4dc0aab169c42018f0.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:208
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\MssurrogateBrowserDrivermonitor\wcYORPbCatQJR5AFuaKjs.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4752
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\MssurrogateBrowserDrivermonitor\Qi30CUagccjw.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2428
  - - C:\MssurrogateBrowserDrivermonitor\reviewnet.exe
      "C:\MssurrogateBrowserDrivermonitor\reviewnet.exe"
      4⤵
      UAC bypass
      Checks computer location settings
      Executes dropped EXE
      Checks whether UAC is enabled
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:468
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\vm34McNXba.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4272
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:3532
      - C:\Recovery\WindowsRE\wininit.exe
        
        "C:\Recovery\WindowsRE\wininit.exe"
        6⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:3216
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c9a6b6d4-b4af-402d-aa3b-833005a43e38.vbs"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:4084
        
        C:\Recovery\WindowsRE\wininit.exe
        
        C:\Recovery\WindowsRE\wininit.exe
        8⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:3752
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1e6ffc69-153c-4008-8773-0faf3d205730.vbs"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:4676
        
        C:\Recovery\WindowsRE\wininit.exe
        
        C:\Recovery\WindowsRE\wininit.exe
        10⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1976
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1bc3a4b7-e2ee-4dd8-a976-bcd6f963a411.vbs"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:4584
        
        C:\Recovery\WindowsRE\wininit.exe
        
        C:\Recovery\WindowsRE\wininit.exe
        12⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1196
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2c1bcd4b-f3d3-4d4a-aa10-1684ac1ae2ee.vbs"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:1524
        
        C:\Recovery\WindowsRE\wininit.exe
        
        C:\Recovery\WindowsRE\wininit.exe
        14⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:4760
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3cef5c35-44c1-4036-ac43-db74f5f5c5d7.vbs"
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:2424
        
        C:\Recovery\WindowsRE\wininit.exe
        
        C:\Recovery\WindowsRE\wininit.exe
        16⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2608
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ba3666c3-bccc-4a5b-9d5c-682c4cd7c744.vbs"
        17⤵
        Suspicious use of WriteProcessMemory
        
        PID:3692
        
        C:\Recovery\WindowsRE\wininit.exe
        
        C:\Recovery\WindowsRE\wininit.exe
        18⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1028
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\599fb552-b280-412d-a47c-2e7c22b45914.vbs"
        19⤵
        Suspicious use of WriteProcessMemory
        
        PID:4168
        
        C:\Recovery\WindowsRE\wininit.exe
        
        C:\Recovery\WindowsRE\wininit.exe
        20⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:4916
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\720d8293-3b07-4317-9890-cb4620fd7d41.vbs"
        21⤵
        Suspicious use of WriteProcessMemory
        
        PID:1332
        
        C:\Recovery\WindowsRE\wininit.exe
        
        C:\Recovery\WindowsRE\wininit.exe
        22⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:540
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5533b09d-4c1d-45b6-8ee2-f69248b671a1.vbs"
        23⤵
        
        PID:1872
        
        C:\Recovery\WindowsRE\wininit.exe
        
        C:\Recovery\WindowsRE\wininit.exe
        24⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3264
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7b8bf11d-75e7-4177-b5e6-7460566b5bd6.vbs"
        25⤵
        
        PID:4132
        
        C:\Recovery\WindowsRE\wininit.exe
        
        C:\Recovery\WindowsRE\wininit.exe
        26⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1760
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a758ae4f-c70f-422a-a210-5a3fa8f1cbe5.vbs"
        27⤵
        
        PID:4808
        
        C:\Recovery\WindowsRE\wininit.exe
        
        C:\Recovery\WindowsRE\wininit.exe
        28⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4488
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b5d27ddd-b3fe-449d-abe1-ae57b72c2fbe.vbs"
        29⤵
        
        PID:4908
        
        C:\Recovery\WindowsRE\wininit.exe
        
        C:\Recovery\WindowsRE\wininit.exe
        30⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4760
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dbaf1cd4-48f1-455c-8d23-a0454695d6c5.vbs"
        31⤵
        
        PID:4460
        
        C:\Recovery\WindowsRE\wininit.exe
        
        C:\Recovery\WindowsRE\wininit.exe
        32⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3264
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\17afc447-5bbf-4381-9407-5641285e73a1.vbs"
        33⤵
        
        PID:224
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8b2e3d8d-3a81-4587-87bb-8b64f97d56aa.vbs"
        33⤵
        
        PID:3128
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3a671dab-7d1b-4cec-9962-fe62fa6fd290.vbs"
        31⤵
        
        PID:4012
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0963be25-1c0a-40f8-9b38-eb32a2892535.vbs"
        29⤵
        
        PID:2440
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\80262ab9-21a5-4c6c-b00e-69f8643a1e88.vbs"
        27⤵
        
        PID:548
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2bbefbd0-12bf-4f1a-b142-ba6f4fee96fa.vbs"
        25⤵
        
        PID:3056
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f3c65996-cef4-4d65-8d2d-73d46c56c3d5.vbs"
        23⤵
        
        PID:3440
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5d51c01b-1f5e-48cf-a886-d73098ea95b0.vbs"
        21⤵
        
        PID:3876
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7a8d4efb-4431-4440-8c4d-470a2ed97f56.vbs"
        19⤵
        
        PID:4820
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d3ba3c50-4d30-4fb8-83fc-0e373e3e76b1.vbs"
        17⤵
        
        PID:1044
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\be55c717-5f49-46a5-82d2-365ccc00b9b6.vbs"
        15⤵
        
        PID:3780
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ef67546b-4570-40f6-bc55-7dcfaa8af9f8.vbs"
        13⤵
        
        PID:3216
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4b561d07-47f8-4fcb-a22d-11b509bc8877.vbs"
        11⤵
        
        PID:2208
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\daae4211-0956-4b07-b23c-70ad210d556d.vbs"
        9⤵
        
        PID:2192
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\959eb904-3fd0-49df-9c19-ff9e1ac1b075.vbs"
        7⤵
        
        PID:1272
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\MssurrogateBrowserDrivermonitor\file.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 14 /tr "'C:\Windows\en-US\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Windows\en-US\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 6 /tr "'C:\Windows\en-US\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "reviewnetr" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\reviewnet.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "reviewnet" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\reviewnet.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "reviewnetr" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\reviewnet.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\Users\Public\Desktop\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\Public\Desktop\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Users\Public\Desktop\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 12 /tr "'C:\Program Files\Crashpad\attachments\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files\Crashpad\attachments\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 6 /tr "'C:\Program Files\Crashpad\attachments\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Windows\Setup\State\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\Setup\State\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Windows\Setup\State\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Users\Public\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Public\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Users\Public\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Media Player\Visualizations\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\Visualizations\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Media Player\Visualizations\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 10 /tr "'C:\Program Files\Crashpad\reports\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Program Files\Crashpad\reports\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 5 /tr "'C:\Program Files\Crashpad\reports\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\SendTo\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Admin\SendTo\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\SendTo\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\Program Files\Common Files\microsoft shared\Stationery\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\Common Files\microsoft shared\Stationery\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\Program Files\Common Files\microsoft shared\Stationery\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\MssurrogateBrowserDrivermonitor\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\MssurrogateBrowserDrivermonitor\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\MssurrogateBrowserDrivermonitor\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Windows\Offline Web Pages\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\Offline Web Pages\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Windows\Offline Web Pages\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\Default User\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 10 /tr "'C:\Users\Default\Downloads\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Users\Default\Downloads\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Downloads\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 14 /tr "'C:\MssurrogateBrowserDrivermonitor\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\MssurrogateBrowserDrivermonitor\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 5 /tr "'C:\MssurrogateBrowserDrivermonitor\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MssurrogateBrowserDrivermonitor\Qi30CUagccjw.bat

Filesize
50B

MD5
934b57a6b87ad62fbf72805fc7ed30d0

SHA1
04111b17e6b836077bca5c092dfd4e59657fbfae

SHA256
25bfd4297df8354c427f96c5569594300935745c03f15aa1e4097cff1be3f70d

SHA512
5737cbaa48b1c5804072681e58e8e9d55aa7d996614dd3ff6501afaea693aca3fe7275a811c7aad1bbb88057fea7a31a393cadf7c2761aeca32e1e1f83940b07

Download Submit
C:\MssurrogateBrowserDrivermonitor\file.vbs

Filesize
34B

MD5
677cc4360477c72cb0ce00406a949c61

SHA1
b679e8c3427f6c5fc47c8ac46cd0e56c9424de05

SHA256
f1cccb5ae4aa51d293bd3c7d2a1a04cb7847d22c5db8e05ac64e9a6d7455aa0b

SHA512
7cfe2cc92f9e659f0a15a295624d611b3363bd01eb5bcf9bc7681ea9b70b0564d192d570d294657c8dc2c93497fa3b4526c975a9bf35d69617c31d9936573c6a

Download Submit
C:\MssurrogateBrowserDrivermonitor\reviewnet.exe

Filesize
3.4MB

MD5
7d995f38d429ff33eaf4ce89f60585f9

SHA1
160f3163b335110d718e98390add6ca7a110a8ca

SHA256
49877051396a67dc531bb04d9745c78820a04e21ab3a6071906739ef48098b68

SHA512
61cb35e8469cd396b8487ca31542d0f505179283aa7d645344f2de7ffa47cfda0013bdfa2c5b29edd16978bce9a90fe2795a62e3dd4b900d9db5431b2d81f887

Download Submit
C:\MssurrogateBrowserDrivermonitor\wcYORPbCatQJR5AFuaKjs.vbe

Filesize
220B

MD5
b7946fc546ca743f534d88dddeee3f00

SHA1
668ed69a0b7a298e08a68e80161f7eeead3128a5

SHA256
8673980ed61a75db17016d3fe892f2c37ddc037f34032e2fd35626ed146d80d2

SHA512
7ee3cec4df1a0b2c5984ccf860a004dcaa3c3fa258370edabb50ccd3f92a8d3ab8daf1af1f5087a67a24bf285a34b040f36d7673f1f8e413dc931a201967712a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\wininit.exe.log

Filesize
1KB

MD5
49b64127208271d8f797256057d0b006

SHA1
b99bd7e2b4e9ed24de47fb3341ea67660b84cca1

SHA256
2a5d403a2e649d8eceef8f785eeb0f6d33888ec6bbf251b3c347e34cb32b1e77

SHA512
f7c728923c893dc9bc88ad2159e0abcda41e1b40ff7e7756e6252d135ed238a2248a2662b3392449836dd1b0b580f0c866cc33e409527484fe4602e3d3f10e3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\1bc3a4b7-e2ee-4dd8-a976-bcd6f963a411.vbs

Filesize
709B

MD5
10030b8650216e5697c251e832860a1c

SHA1
d3ea29dd460e786742c2b985d2a4c7f34170399d

SHA256
efe11761cdbf2da55af6cd12d7eb23fc577c3e6591816eb9ac7163da0b6f2ac1

SHA512
2a8221ff168a342fd4b2ca6ecc295fee6ed10ee36a10ceee4e2988e712d7b99006fb543d55bd07d7831bd28361dc16d34f8eaab6cf6537226e979638debc59e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\1e6ffc69-153c-4008-8773-0faf3d205730.vbs

Filesize
709B

MD5
a4202fb34e74c4eefb25e649fd684f0e

SHA1
e3982c9eb41c0e24919c58af38cec210e6720342

SHA256
9b858ab7345523e49158f20d0a6c77794f05d69039a6dfe49930c879e95174f5

SHA512
04c6c4254bfcd30272c276b91832833c4c9ac7fa70d1d0f7bf836316f79f8fd72dcb34273b0d566ac8cd93425d5162edab71730d49431f8dca65d220fe264b5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\2c1bcd4b-f3d3-4d4a-aa10-1684ac1ae2ee.vbs

Filesize
709B

MD5
d2a74e34a030599e9719b46bb56a64d2

SHA1
17be7f5c41878f9d9a06a060d5d98b3ed0237873

SHA256
46b5f3cbf47c514a210cb9318c1c919b15c274b28adb69acc2b5914617fbbaff

SHA512
ad63bf094cf585bf8681adf83b793778308c07975d4f8af4039dccfbb0f7abf15df386cfb588feca0700d49775eabc6045c33e129925464967b3baaad66638a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\3cef5c35-44c1-4036-ac43-db74f5f5c5d7.vbs

Filesize
709B

MD5
0ca858f68176444ddcfcffdce18f3df1

SHA1
6918ebe86d089e0da5ec9c201f3e6f4778a69805

SHA256
8dc6697682103d98c3ed3193578f58109a81dfc3bb423baa4379ed777069556d

SHA512
cd0fa87b8a4a05dcd4d4fb179e9f218d7e4b1d92224fa15c018fac22dbc02194bdcc0d34104d8f7329bbcd4456d8b335f7efa3a2afe73f130bb38c10591fe074

Download Submit
C:\Users\Admin\AppData\Local\Temp\5533b09d-4c1d-45b6-8ee2-f69248b671a1.vbs

Filesize
708B

MD5
db5d951f24ce698c4b9f5529f0f50289

SHA1
58d7cb1c5dc9e5352069918287ab8218566ee42b

SHA256
03b9b4b5e130fba2d34365e26884625acb6327250812dd9acdca277224cf000b

SHA512
0bd93595eafa079fb510a20520bdef1c0675e6b53da3252d97130357bc4083d678cb8a839d88ec18d4264989a48daa96719462b5ad5a7f5418166c396bee9b47

Download Submit
C:\Users\Admin\AppData\Local\Temp\599fb552-b280-412d-a47c-2e7c22b45914.vbs

Filesize
709B

MD5
0c3401745d41256ddd3461c107b938fa

SHA1
ea146ee2e47336ad27edb16ba3f85b6da76852fe

SHA256
ca0e1531d7bdc7ebd2e5b6f682546e65fcfc061a8f7b07baf68cde64439894c1

SHA512
f6052c55fc4dbcbe59d936cb66772aaeff9395c2c34bdeff96ee42f5c371499c692e48cea98cb7d535eccdac80b6ba792cf411caebef0dbf7c1b094200c566dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\720d8293-3b07-4317-9890-cb4620fd7d41.vbs

Filesize
709B

MD5
32ea7714b75094a5db9472ccd639faa6

SHA1
1ba678bc5d018a5fba31f69f12b4f92c8ddc088a

SHA256
57ee4c1e95fdc86b1b1d0908b5433bcf0551c1c69901cb6f7900d7093a0464f9

SHA512
13829b9307c5d8e357cdd31f92e6a41cb31a78eba6b652a44bfd93fc1368d8b7f47d1b6f5c4dda3a2f9fd4f8d471be1939c05080bd1559dc015262851c98e95e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7b8bf11d-75e7-4177-b5e6-7460566b5bd6.vbs

Filesize
709B

MD5
f67e5b8a620df2dbe7f5afeded32d908

SHA1
0939f24b123eced48a4003c2c3bbb6fdfbdc2842

SHA256
16174c449fbb584db0a80df8c195fb5ff3facd08a37942af45433b75026264b7

SHA512
9ad6c779f31b98a4b4a7e6d5576fc99c25af54c6edb1e0aa6d2c3079c17503bafc7cc76372391d4d800bb95f27db99f8df0c3e9646d179cdbbace842d0b53271

Download Submit
C:\Users\Admin\AppData\Local\Temp\959eb904-3fd0-49df-9c19-ff9e1ac1b075.vbs

Filesize
485B

MD5
4bbea4f9195d114e75bc972246ec647e

SHA1
c1fe4d4962fc6f237aab9c54cff4456477f04fd6

SHA256
4319fd7e7bb4beadd84573ef179b08e10c338eeb458f74649396064d38a9f5f0

SHA512
7d62e1098f16ae3014527a414c76363856684ffaf3cb65ff390d1646ec3319539cb19ab9f20d3763b6a00fe569abfb0bb9560e6d658bfc1c09759aa9d7d8ac75

Download Submit
C:\Users\Admin\AppData\Local\Temp\a758ae4f-c70f-422a-a210-5a3fa8f1cbe5.vbs

Filesize
709B

MD5
86f0d6ffb22f0bdcda7b9874db9c180b

SHA1
8fc73cfbdb1293b5cbc2f473cf476d3c373c10b6

SHA256
8662f32753567b6263b1cb6c4819b6777b234d8cbd7ae6da312b59b5ff578397

SHA512
dfd31ec7718707ac16c56d108b22230e7f17c3afa2788fa6831d38dfa4646d01e9ac453197594e86c5bb38424ebbb34e27a1c8265ea61f1d0eb37342664dcfc5

Download Submit
C:\Users\Admin\AppData\Local\Temp\b5d27ddd-b3fe-449d-abe1-ae57b72c2fbe.vbs

Filesize
709B

MD5
175748edf4626206049f759592e0b67d

SHA1
1b37616ebb585d1b80162fe5e4190973d95648a6

SHA256
bfc8e0a6494079189f95d2701038e07f5bc20da88a76905bee19690e66cff312

SHA512
2dfb955329321a82ca178cb66b9ba5193b0da58e5890d2d3b12cd1ee622fce0fc60e2fd09cac60393f658efd82770568b0a9f0efe3a5fc2aaa24ab27c93e5e7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\ba3666c3-bccc-4a5b-9d5c-682c4cd7c744.vbs

Filesize
709B

MD5
c9c18fbabb1c02ac1ed05a9d1779c579

SHA1
09d72fa4aa4736251b95d9a5221f514c619f03a0

SHA256
54cece1f9ebfdd95f79f7020f8763eff05d0b50b754e55fd36010b8fefb26730

SHA512
43faf6d6746f4574c7130a8ccdea5d20d6f44ad88b1fc332de34d2dc7fb185261cd8e93056d78c5dea84c67253cbf4674b7b997cd8356897aff8b41793baeaca

Download Submit
C:\Users\Admin\AppData\Local\Temp\c9a6b6d4-b4af-402d-aa3b-833005a43e38.vbs

Filesize
709B

MD5
95eef1921b064e392fff82d5ee5bcf57

SHA1
2e368724e5d2504bc9135012cb21512fc1cfc5e2

SHA256
360c63989f981bf2d8d09180b280994efda22ee048e1cc2bc8a7500b2e61f850

SHA512
fea1ff17f741bfa71e64a0fa5d7f9d8009660b60aaed6fb63bd4b57cb00d132cb4ce2a2092f81565723abeb3e705a9b30694c1c9a850f6d304f039a1b37dc3f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\vm34McNXba.bat

Filesize
198B

MD5
12452457e4b21319f6c65b7bf4b66eee

SHA1
e66a7d68fa930964ee052e9b6c88dde54adf6a7f

SHA256
2a3fbc6bc06af99a8b510e791c476b24ea0da8e0ccf958261eb230884e15b3a1

SHA512
18d517f006af0a84a68c7827b8ca9097db8434fbe99a3bb596c2216fc2653cb28de7976915901d253f1a5e69c3b36ffb99e9b3de9ffe324350e2f9c21c608155

Download Submit
memory/468-29-0x0000000002FB0000-0x0000000002FB8000-memory.dmp

Filesize
32KB

Download
memory/468-32-0x000000001C160000-0x000000001C1B6000-memory.dmp

Filesize
344KB

Download
memory/468-34-0x000000001BA30000-0x000000001BA38000-memory.dmp

Filesize
32KB

Download
memory/468-35-0x000000001BA40000-0x000000001BA4C000-memory.dmp

Filesize
48KB

Download
memory/468-36-0x000000001C1B0000-0x000000001C1B8000-memory.dmp

Filesize
32KB

Download
memory/468-37-0x000000001C1C0000-0x000000001C1D2000-memory.dmp

Filesize
72KB

Download
memory/468-38-0x000000001C720000-0x000000001CC48000-memory.dmp

Filesize
5.2MB

Download
memory/468-39-0x000000001C1F0000-0x000000001C1FC000-memory.dmp

Filesize
48KB

Download
memory/468-40-0x000000001C200000-0x000000001C20C000-memory.dmp

Filesize
48KB

Download
memory/468-41-0x000000001C210000-0x000000001C218000-memory.dmp

Filesize
32KB

Download
memory/468-42-0x000000001C220000-0x000000001C22C000-memory.dmp

Filesize
48KB

Download
memory/468-43-0x000000001C230000-0x000000001C23C000-memory.dmp

Filesize
48KB

Download
memory/468-44-0x000000001C4B0000-0x000000001C4B8000-memory.dmp

Filesize
32KB

Download
memory/468-45-0x000000001C440000-0x000000001C44C000-memory.dmp

Filesize
48KB

Download
memory/468-46-0x000000001C450000-0x000000001C45A000-memory.dmp

Filesize
40KB

Download
memory/468-48-0x000000001C470000-0x000000001C478000-memory.dmp

Filesize
32KB

Download
memory/468-47-0x000000001C460000-0x000000001C46E000-memory.dmp

Filesize
56KB

Download
memory/468-49-0x000000001C480000-0x000000001C48E000-memory.dmp

Filesize
56KB

Download
memory/468-50-0x000000001C490000-0x000000001C498000-memory.dmp

Filesize
32KB

Download
memory/468-51-0x000000001C4A0000-0x000000001C4AC000-memory.dmp

Filesize
48KB

Download
memory/468-52-0x000000001C4C0000-0x000000001C4C8000-memory.dmp

Filesize
32KB

Download
memory/468-53-0x000000001C5D0000-0x000000001C5DA000-memory.dmp

Filesize
40KB

Download
memory/468-54-0x000000001C4D0000-0x000000001C4DC000-memory.dmp

Filesize
48KB

Download
memory/468-33-0x000000001BA20000-0x000000001BA2C000-memory.dmp

Filesize
48KB

Download
memory/468-31-0x000000001BA10000-0x000000001BA1A000-memory.dmp

Filesize
40KB

Download
memory/468-30-0x000000001BA00000-0x000000001BA10000-memory.dmp

Filesize
64KB

Download
memory/468-28-0x0000000002FC0000-0x0000000002FCC000-memory.dmp

Filesize
48KB

Download
memory/468-25-0x0000000002F80000-0x0000000002F96000-memory.dmp

Filesize
88KB

Download
memory/468-17-0x0000000000970000-0x0000000000CDA000-memory.dmp

Filesize
3.4MB

Download
memory/468-27-0x0000000002FA0000-0x0000000002FB2000-memory.dmp

Filesize
72KB

Download
memory/468-26-0x0000000002F60000-0x0000000002F68000-memory.dmp

Filesize
32KB

Download
memory/468-18-0x0000000001630000-0x000000000163E000-memory.dmp

Filesize
56KB

Download
memory/468-23-0x0000000001660000-0x0000000001668000-memory.dmp

Filesize
32KB

Download
memory/468-19-0x0000000001640000-0x000000000164E000-memory.dmp

Filesize
56KB

Download
memory/468-24-0x0000000001680000-0x0000000001690000-memory.dmp

Filesize
64KB

Download
memory/468-22-0x0000000002FD0000-0x0000000003020000-memory.dmp

Filesize
320KB

Download
memory/468-21-0x0000000002F40000-0x0000000002F5C000-memory.dmp

Filesize
112KB

Download
memory/468-20-0x0000000001650000-0x0000000001658000-memory.dmp

Filesize
32KB

Download
memory/1760-217-0x000000001BE60000-0x000000001BE72000-memory.dmp

Filesize
72KB

Download
memory/1976-125-0x000000001C630000-0x000000001C642000-memory.dmp

Filesize
72KB

Download
memory/2608-160-0x000000001C010000-0x000000001C022000-memory.dmp

Filesize
72KB

Download
memory/3264-205-0x000000001B810000-0x000000001B822000-memory.dmp

Filesize
72KB

Download
memory/3264-252-0x000000001C580000-0x000000001C592000-memory.dmp

Filesize
72KB

Download
memory/4760-148-0x000000001C710000-0x000000001C722000-memory.dmp

Filesize
72KB

Download
memory/4760-240-0x0000000002F30000-0x0000000002F42000-memory.dmp

Filesize
72KB

Download