dcrat | ca2f91b5d5d54a3fb916249210e53552b78ec7f4ffdce9be81884be15bef2847

Analysis

max time kernel
148s
max time network
137s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20-11-2024 03:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ca2f91b5d5d54a3fb916249210e53552b78ec7f4ffdce9be81884be15bef2847.exe
Size

4.9MB
MD5

4e3ae6b4f8ea1c5d2fb3a8bc008e2fff
SHA1

22329e6ce220cce52f7dde6e03c082d31f27bbae
SHA256

ca2f91b5d5d54a3fb916249210e53552b78ec7f4ffdce9be81884be15bef2847
SHA512

6394d0a6883e478bf7f196ef1c829ff7d579ebfde1ddbdd5c59a57eb40ba82c5c15f41f71bfa4f31227198c8d722c5872c0aa01d5e750dd19523a8237db5b655
SSDEEP

49152:Ll5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:

Score

10^/10

dcrat evasion execution infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 12 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2224	2344	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2264	2344	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2240	2344	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2788	2344	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2832	2344	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2212	2344	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2840	2344	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2868	2344	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2676	2344	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2748	2344	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2812	2344	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2588	2344	schtasks.exe

UAC bypass 3 TTPs 39 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

ca2f91b5d5d54a3fb916249210e53552b78ec7f4ffdce9be81884be15bef2847.exedwm.exedwm.exedwm.exedwm.exedwm.exedwm.exedwm.exedwm.exedwm.exedwm.exedwm.exedwm.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	ca2f91b5d5d54a3fb916249210e53552b78ec7f4ffdce9be81884be15bef2847.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	ca2f91b5d5d54a3fb916249210e53552b78ec7f4ffdce9be81884be15bef2847.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ca2f91b5d5d54a3fb916249210e53552b78ec7f4ffdce9be81884be15bef2847.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
behavioral1/memory/2356-3-0x000000001BAD0000-0x000000001BBFE000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	process
1188	powershell.exe
1956	powershell.exe
1728	powershell.exe
1936	powershell.exe
2336	powershell.exe
1648	powershell.exe
904	powershell.exe
1960	powershell.exe
1700	powershell.exe
316	powershell.exe
1968	powershell.exe
1508	powershell.exe

Executes dropped EXE 12 IoCs

Processes:

dwm.exedwm.exedwm.exedwm.exedwm.exedwm.exedwm.exedwm.exedwm.exedwm.exedwm.exedwm.exe

pid process

2400 dwm.exe
1772 dwm.exe
1272 dwm.exe
1216 dwm.exe
2428 dwm.exe
2572 dwm.exe
880 dwm.exe
1664 dwm.exe
3024 dwm.exe
2592 dwm.exe
3036 dwm.exe
3012 dwm.exe

pid	process
2400	dwm.exe
1772	dwm.exe
1272	dwm.exe
1216	dwm.exe
2428	dwm.exe
2572	dwm.exe
880	dwm.exe
1664	dwm.exe
3024	dwm.exe
2592	dwm.exe
3036	dwm.exe
3012	dwm.exe

Checks whether UAC is enabled 1 TTPs 26 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

dwm.exedwm.exedwm.exedwm.exedwm.exedwm.exedwm.exedwm.exedwm.exedwm.exedwm.exedwm.execa2f91b5d5d54a3fb916249210e53552b78ec7f4ffdce9be81884be15bef2847.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dwm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dwm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dwm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dwm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ca2f91b5d5d54a3fb916249210e53552b78ec7f4ffdce9be81884be15bef2847.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dwm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ca2f91b5d5d54a3fb916249210e53552b78ec7f4ffdce9be81884be15bef2847.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe

Drops file in Program Files directory 8 IoCs

Processes:

ca2f91b5d5d54a3fb916249210e53552b78ec7f4ffdce9be81884be15bef2847.exe

description	ioc	process
File opened for modification	C:\Program Files\Windows Media Player\RCXD173.tmp	ca2f91b5d5d54a3fb916249210e53552b78ec7f4ffdce9be81884be15bef2847.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\RCXD3B5.tmp	ca2f91b5d5d54a3fb916249210e53552b78ec7f4ffdce9be81884be15bef2847.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\dwm.exe	ca2f91b5d5d54a3fb916249210e53552b78ec7f4ffdce9be81884be15bef2847.exe
File created	C:\Program Files\Windows Media Player\csrss.exe	ca2f91b5d5d54a3fb916249210e53552b78ec7f4ffdce9be81884be15bef2847.exe
File opened for modification	C:\Program Files\Windows Media Player\csrss.exe	ca2f91b5d5d54a3fb916249210e53552b78ec7f4ffdce9be81884be15bef2847.exe
File created	C:\Program Files\Windows Media Player\886983d96e3d3e	ca2f91b5d5d54a3fb916249210e53552b78ec7f4ffdce9be81884be15bef2847.exe
File created	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\dwm.exe	ca2f91b5d5d54a3fb916249210e53552b78ec7f4ffdce9be81884be15bef2847.exe
File created	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\6cb0b6c459d5d3	ca2f91b5d5d54a3fb916249210e53552b78ec7f4ffdce9be81884be15bef2847.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 12 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
2868	schtasks.exe
2676	schtasks.exe
2588	schtasks.exe
2240	schtasks.exe
2788	schtasks.exe
2832	schtasks.exe
2212	schtasks.exe
2840	schtasks.exe
2224	schtasks.exe
2264	schtasks.exe
2748	schtasks.exe
2812	schtasks.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

Processes:

ca2f91b5d5d54a3fb916249210e53552b78ec7f4ffdce9be81884be15bef2847.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedwm.exedwm.exedwm.exedwm.exedwm.exedwm.exedwm.exedwm.exedwm.exedwm.exedwm.exedwm.exe

pid	process
2356	ca2f91b5d5d54a3fb916249210e53552b78ec7f4ffdce9be81884be15bef2847.exe
2356	ca2f91b5d5d54a3fb916249210e53552b78ec7f4ffdce9be81884be15bef2847.exe
2356	ca2f91b5d5d54a3fb916249210e53552b78ec7f4ffdce9be81884be15bef2847.exe
1936	powershell.exe
316	powershell.exe
1508	powershell.exe
2336	powershell.exe
1648	powershell.exe
904	powershell.exe
1700	powershell.exe
1968	powershell.exe
1956	powershell.exe
1960	powershell.exe
1188	powershell.exe
1728	powershell.exe
2400	dwm.exe
1772	dwm.exe
1272	dwm.exe
1216	dwm.exe
2428	dwm.exe
2572	dwm.exe
880	dwm.exe
1664	dwm.exe
3024	dwm.exe
2592	dwm.exe
3036	dwm.exe
3012	dwm.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

Processes:

ca2f91b5d5d54a3fb916249210e53552b78ec7f4ffdce9be81884be15bef2847.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedwm.exepowershell.exepowershell.exedwm.exedwm.exedwm.exedwm.exedwm.exedwm.exedwm.exedwm.exedwm.exedwm.exedwm.exe

description	pid	process
Token: SeDebugPrivilege	2356	ca2f91b5d5d54a3fb916249210e53552b78ec7f4ffdce9be81884be15bef2847.exe
Token: SeDebugPrivilege	1936	powershell.exe
Token: SeDebugPrivilege	316	powershell.exe
Token: SeDebugPrivilege	1508	powershell.exe
Token: SeDebugPrivilege	2336	powershell.exe
Token: SeDebugPrivilege	1648	powershell.exe
Token: SeDebugPrivilege	904	powershell.exe
Token: SeDebugPrivilege	1700	powershell.exe
Token: SeDebugPrivilege	1968	powershell.exe
Token: SeDebugPrivilege	1956	powershell.exe
Token: SeDebugPrivilege	1960	powershell.exe
Token: SeDebugPrivilege	2400	dwm.exe
Token: SeDebugPrivilege	1188	powershell.exe
Token: SeDebugPrivilege	1728	powershell.exe
Token: SeDebugPrivilege	1772	dwm.exe
Token: SeDebugPrivilege	1272	dwm.exe
Token: SeDebugPrivilege	1216	dwm.exe
Token: SeDebugPrivilege	2428	dwm.exe
Token: SeDebugPrivilege	2572	dwm.exe
Token: SeDebugPrivilege	880	dwm.exe
Token: SeDebugPrivilege	1664	dwm.exe
Token: SeDebugPrivilege	3024	dwm.exe
Token: SeDebugPrivilege	2592	dwm.exe
Token: SeDebugPrivilege	3036	dwm.exe
Token: SeDebugPrivilege	3012	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

ca2f91b5d5d54a3fb916249210e53552b78ec7f4ffdce9be81884be15bef2847.exedwm.exeWScript.exedwm.exeWScript.exedwm.exeWScript.exe

description	pid	process	target process
PID 2356 wrote to memory of 1936	2356	ca2f91b5d5d54a3fb916249210e53552b78ec7f4ffdce9be81884be15bef2847.exe	powershell.exe
PID 2356 wrote to memory of 1936	2356	ca2f91b5d5d54a3fb916249210e53552b78ec7f4ffdce9be81884be15bef2847.exe	powershell.exe
PID 2356 wrote to memory of 1936	2356	ca2f91b5d5d54a3fb916249210e53552b78ec7f4ffdce9be81884be15bef2847.exe	powershell.exe
PID 2356 wrote to memory of 1968	2356	ca2f91b5d5d54a3fb916249210e53552b78ec7f4ffdce9be81884be15bef2847.exe	powershell.exe
PID 2356 wrote to memory of 1968	2356	ca2f91b5d5d54a3fb916249210e53552b78ec7f4ffdce9be81884be15bef2847.exe	powershell.exe
PID 2356 wrote to memory of 1968	2356	ca2f91b5d5d54a3fb916249210e53552b78ec7f4ffdce9be81884be15bef2847.exe	powershell.exe
PID 2356 wrote to memory of 1508	2356	ca2f91b5d5d54a3fb916249210e53552b78ec7f4ffdce9be81884be15bef2847.exe	powershell.exe
PID 2356 wrote to memory of 1508	2356	ca2f91b5d5d54a3fb916249210e53552b78ec7f4ffdce9be81884be15bef2847.exe	powershell.exe
PID 2356 wrote to memory of 1508	2356	ca2f91b5d5d54a3fb916249210e53552b78ec7f4ffdce9be81884be15bef2847.exe	powershell.exe
PID 2356 wrote to memory of 2336	2356	ca2f91b5d5d54a3fb916249210e53552b78ec7f4ffdce9be81884be15bef2847.exe	powershell.exe
PID 2356 wrote to memory of 2336	2356	ca2f91b5d5d54a3fb916249210e53552b78ec7f4ffdce9be81884be15bef2847.exe	powershell.exe
PID 2356 wrote to memory of 2336	2356	ca2f91b5d5d54a3fb916249210e53552b78ec7f4ffdce9be81884be15bef2847.exe	powershell.exe
PID 2356 wrote to memory of 316	2356	ca2f91b5d5d54a3fb916249210e53552b78ec7f4ffdce9be81884be15bef2847.exe	powershell.exe
PID 2356 wrote to memory of 316	2356	ca2f91b5d5d54a3fb916249210e53552b78ec7f4ffdce9be81884be15bef2847.exe	powershell.exe
PID 2356 wrote to memory of 316	2356	ca2f91b5d5d54a3fb916249210e53552b78ec7f4ffdce9be81884be15bef2847.exe	powershell.exe
PID 2356 wrote to memory of 1728	2356	ca2f91b5d5d54a3fb916249210e53552b78ec7f4ffdce9be81884be15bef2847.exe	powershell.exe
PID 2356 wrote to memory of 1728	2356	ca2f91b5d5d54a3fb916249210e53552b78ec7f4ffdce9be81884be15bef2847.exe	powershell.exe
PID 2356 wrote to memory of 1728	2356	ca2f91b5d5d54a3fb916249210e53552b78ec7f4ffdce9be81884be15bef2847.exe	powershell.exe
PID 2356 wrote to memory of 1648	2356	ca2f91b5d5d54a3fb916249210e53552b78ec7f4ffdce9be81884be15bef2847.exe	powershell.exe
PID 2356 wrote to memory of 1648	2356	ca2f91b5d5d54a3fb916249210e53552b78ec7f4ffdce9be81884be15bef2847.exe	powershell.exe
PID 2356 wrote to memory of 1648	2356	ca2f91b5d5d54a3fb916249210e53552b78ec7f4ffdce9be81884be15bef2847.exe	powershell.exe
PID 2356 wrote to memory of 1956	2356	ca2f91b5d5d54a3fb916249210e53552b78ec7f4ffdce9be81884be15bef2847.exe	powershell.exe
PID 2356 wrote to memory of 1956	2356	ca2f91b5d5d54a3fb916249210e53552b78ec7f4ffdce9be81884be15bef2847.exe	powershell.exe
PID 2356 wrote to memory of 1956	2356	ca2f91b5d5d54a3fb916249210e53552b78ec7f4ffdce9be81884be15bef2847.exe	powershell.exe
PID 2356 wrote to memory of 1700	2356	ca2f91b5d5d54a3fb916249210e53552b78ec7f4ffdce9be81884be15bef2847.exe	powershell.exe
PID 2356 wrote to memory of 1700	2356	ca2f91b5d5d54a3fb916249210e53552b78ec7f4ffdce9be81884be15bef2847.exe	powershell.exe
PID 2356 wrote to memory of 1700	2356	ca2f91b5d5d54a3fb916249210e53552b78ec7f4ffdce9be81884be15bef2847.exe	powershell.exe
PID 2356 wrote to memory of 1960	2356	ca2f91b5d5d54a3fb916249210e53552b78ec7f4ffdce9be81884be15bef2847.exe	powershell.exe
PID 2356 wrote to memory of 1960	2356	ca2f91b5d5d54a3fb916249210e53552b78ec7f4ffdce9be81884be15bef2847.exe	powershell.exe
PID 2356 wrote to memory of 1960	2356	ca2f91b5d5d54a3fb916249210e53552b78ec7f4ffdce9be81884be15bef2847.exe	powershell.exe
PID 2356 wrote to memory of 1188	2356	ca2f91b5d5d54a3fb916249210e53552b78ec7f4ffdce9be81884be15bef2847.exe	powershell.exe
PID 2356 wrote to memory of 1188	2356	ca2f91b5d5d54a3fb916249210e53552b78ec7f4ffdce9be81884be15bef2847.exe	powershell.exe
PID 2356 wrote to memory of 1188	2356	ca2f91b5d5d54a3fb916249210e53552b78ec7f4ffdce9be81884be15bef2847.exe	powershell.exe
PID 2356 wrote to memory of 904	2356	ca2f91b5d5d54a3fb916249210e53552b78ec7f4ffdce9be81884be15bef2847.exe	powershell.exe
PID 2356 wrote to memory of 904	2356	ca2f91b5d5d54a3fb916249210e53552b78ec7f4ffdce9be81884be15bef2847.exe	powershell.exe
PID 2356 wrote to memory of 904	2356	ca2f91b5d5d54a3fb916249210e53552b78ec7f4ffdce9be81884be15bef2847.exe	powershell.exe
PID 2356 wrote to memory of 2400	2356	ca2f91b5d5d54a3fb916249210e53552b78ec7f4ffdce9be81884be15bef2847.exe	dwm.exe
PID 2356 wrote to memory of 2400	2356	ca2f91b5d5d54a3fb916249210e53552b78ec7f4ffdce9be81884be15bef2847.exe	dwm.exe
PID 2356 wrote to memory of 2400	2356	ca2f91b5d5d54a3fb916249210e53552b78ec7f4ffdce9be81884be15bef2847.exe	dwm.exe
PID 2400 wrote to memory of 2652	2400	dwm.exe	WScript.exe
PID 2400 wrote to memory of 2652	2400	dwm.exe	WScript.exe
PID 2400 wrote to memory of 2652	2400	dwm.exe	WScript.exe
PID 2400 wrote to memory of 2392	2400	dwm.exe	WScript.exe
PID 2400 wrote to memory of 2392	2400	dwm.exe	WScript.exe
PID 2400 wrote to memory of 2392	2400	dwm.exe	WScript.exe
PID 2652 wrote to memory of 1772	2652	WScript.exe	dwm.exe
PID 2652 wrote to memory of 1772	2652	WScript.exe	dwm.exe
PID 2652 wrote to memory of 1772	2652	WScript.exe	dwm.exe
PID 1772 wrote to memory of 1568	1772	dwm.exe	WScript.exe
PID 1772 wrote to memory of 1568	1772	dwm.exe	WScript.exe
PID 1772 wrote to memory of 1568	1772	dwm.exe	WScript.exe
PID 1772 wrote to memory of 2488	1772	dwm.exe	WScript.exe
PID 1772 wrote to memory of 2488	1772	dwm.exe	WScript.exe
PID 1772 wrote to memory of 2488	1772	dwm.exe	WScript.exe
PID 1568 wrote to memory of 1272	1568	WScript.exe	dwm.exe
PID 1568 wrote to memory of 1272	1568	WScript.exe	dwm.exe
PID 1568 wrote to memory of 1272	1568	WScript.exe	dwm.exe
PID 1272 wrote to memory of 3012	1272	dwm.exe	WScript.exe
PID 1272 wrote to memory of 3012	1272	dwm.exe	WScript.exe
PID 1272 wrote to memory of 3012	1272	dwm.exe	WScript.exe
PID 1272 wrote to memory of 2472	1272	dwm.exe	WScript.exe
PID 1272 wrote to memory of 2472	1272	dwm.exe	WScript.exe
PID 1272 wrote to memory of 2472	1272	dwm.exe	WScript.exe
PID 3012 wrote to memory of 1216	3012	WScript.exe	dwm.exe

System policy modification 1 TTPs 39 IoCs

evasion

Modify Registry

T1112

Processes:

ca2f91b5d5d54a3fb916249210e53552b78ec7f4ffdce9be81884be15bef2847.exedwm.exedwm.exedwm.exedwm.exedwm.exedwm.exedwm.exedwm.exedwm.exedwm.exedwm.exedwm.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	ca2f91b5d5d54a3fb916249210e53552b78ec7f4ffdce9be81884be15bef2847.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	ca2f91b5d5d54a3fb916249210e53552b78ec7f4ffdce9be81884be15bef2847.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ca2f91b5d5d54a3fb916249210e53552b78ec7f4ffdce9be81884be15bef2847.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\ca2f91b5d5d54a3fb916249210e53552b78ec7f4ffdce9be81884be15bef2847.exe
"C:\Users\Admin\AppData\Local\Temp\ca2f91b5d5d54a3fb916249210e53552b78ec7f4ffdce9be81884be15bef2847.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2356
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1936
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1508
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2336
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:316
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1728
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1648
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1956
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1700
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1960
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1188
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:904
- C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\dwm.exe
  "C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\dwm.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2400
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ed063ad6-4f2e-4072-bbb8-5f6fbd6bb9db.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2652
  - - C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\dwm.exe
      "C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\dwm.exe"
      4⤵
      UAC bypass
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:1772
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\947d8181-c07a-444d-b5a4-fc1525bb5127.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1568
      - C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\dwm.exe
        
        "C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\dwm.exe"
        6⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1272
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fd4425e2-9e96-457c-ad60-10f1ec4afd3a.vbs"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:3012
        
        C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\dwm.exe
        
        "C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\dwm.exe"
        8⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1216
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\be5f20e8-0050-4bb6-b5b6-d8715e8eaa79.vbs"
        9⤵
        
        PID:1808
        
        C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\dwm.exe
        
        "C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\dwm.exe"
        10⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2428
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bdbbd813-ff84-49d2-b667-7c3c618b2530.vbs"
        11⤵
        
        PID:2604
        
        C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\dwm.exe
        
        "C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\dwm.exe"
        12⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2572
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8eaaa74e-e353-4d0e-9dc8-c4ed4bf1fb52.vbs"
        13⤵
        
        PID:2496
        
        C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\dwm.exe
        
        "C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\dwm.exe"
        14⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:880
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bc153a04-e34e-4827-839d-8fba6f7388e2.vbs"
        15⤵
        
        PID:2080
        
        C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\dwm.exe
        
        "C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\dwm.exe"
        16⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1664
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\585a2c84-cca9-4d29-8261-4ec3402366aa.vbs"
        17⤵
        
        PID:2644
        
        C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\dwm.exe
        
        "C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\dwm.exe"
        18⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3024
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\053e6fa7-0562-42b2-832f-85331e4db59b.vbs"
        19⤵
        
        PID:2896
        
        C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\dwm.exe
        
        "C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\dwm.exe"
        20⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2592
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\09cd76fb-c208-4588-a8d8-c7901cef6689.vbs"
        21⤵
        
        PID:2828
        
        C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\dwm.exe
        
        "C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\dwm.exe"
        22⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3036
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3184a355-ca44-4f20-a56b-d3a17ecea68b.vbs"
        23⤵
        
        PID:1124
        
        C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\dwm.exe
        
        "C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\dwm.exe"
        24⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3012
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9765060a-04ff-418d-a6cf-1359912d5570.vbs"
        25⤵
        
        PID:1648
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\81f5eb6b-20c8-406b-9b43-e531f61205d1.vbs"
        25⤵
        
        PID:2240
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c3f8ee90-d0c5-448d-9954-6b5784cf6073.vbs"
        23⤵
        
        PID:2656
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7d8017e9-61ea-4158-b560-f95709749f40.vbs"
        21⤵
        
        PID:3016
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f0e33050-b105-4e5d-b2cd-deb3884399a3.vbs"
        19⤵
        
        PID:2748
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d8caae27-9492-4a14-843d-2df65afce10b.vbs"
        17⤵
        
        PID:2836
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8841600c-42f3-4b5c-b183-ccb903205101.vbs"
        15⤵
        
        PID:2128
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\adb2b0b4-7d46-4c2a-9902-c989cfbbc09b.vbs"
        13⤵
        
        PID:1284
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\697b6704-5d7f-45da-a971-2efbdebeefd9.vbs"
        11⤵
        
        PID:304
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\12f5ff0b-ddf3-4817-a403-d25c9917f940.vbs"
        9⤵
        
        PID:2276
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c6ae294b-b16f-49d7-9edc-0e1fa6079cac.vbs"
        7⤵
        
        PID:2472
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\df531624-66dd-44ac-8efa-062372ce9ced.vbs"
        5⤵
        
        PID:2488
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\83633363-49e1-4e88-b057-2f89bcd75f4d.vbs"
    3⤵
    PID:2392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Media Player\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Media Player\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default User\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\dwm.exe

Filesize
4.9MB

MD5
4e3ae6b4f8ea1c5d2fb3a8bc008e2fff

SHA1
22329e6ce220cce52f7dde6e03c082d31f27bbae

SHA256
ca2f91b5d5d54a3fb916249210e53552b78ec7f4ffdce9be81884be15bef2847

SHA512
6394d0a6883e478bf7f196ef1c829ff7d579ebfde1ddbdd5c59a57eb40ba82c5c15f41f71bfa4f31227198c8d722c5872c0aa01d5e750dd19523a8237db5b655

Download Submit
C:\Users\Admin\AppData\Local\Temp\053e6fa7-0562-42b2-832f-85331e4db59b.vbs

Filesize
756B

MD5
32e3773bb9f82e60f0e70bef6c166839

SHA1
f147c59cd47b9db09f3fd2f3e7b30fd56b27e576

SHA256
9e0dc99791378c204df50295ca2e4a2b7e04849e12d2296ca6272d7c1382d751

SHA512
422d544049bc9dacb378f2e27c3c88c445a31e296dbff48fc23520dcc455b314bd6fbc0960821a304ffebc51ea87d6d8bce389a25ba22e6fe782f30eeb695b1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\09cd76fb-c208-4588-a8d8-c7901cef6689.vbs

Filesize
756B

MD5
d5cca9233b58e20bc52e738d3826b526

SHA1
1f429467472e9addbabe5aac8803d7830fa4a436

SHA256
cce09abce992d6b9fb9942b5178969b662d131e65f8e6ff944ed0de0881a9b92

SHA512
c1a9bb24db67e83659e0362a0c5818f5dab8d0b63c08774fbed1e7cd8ee942961060d0998e5f81ce43575e0bce44742362c63f45c46d814fb1ee3ac3dc4353e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\25e5c97c67c57ef9b1ec77b808c3fc3df07db528.exe

Filesize
4.9MB

MD5
8ac2c588d98fef05c0e92611ba5170bd

SHA1
36913efb1e9195d196970b3d5a9609744f7cf3a0

SHA256
15866298cfdcf9ebd3ce1bae8b0679c951293ba4e2c7b63d5a228209df679fcd

SHA512
26449becd15e1400735ed02c79440857600ca1bf86481d9fbe8ef4ce12e8d976ed341e9b10d298d8c69f945f4d6df5511949a4b8fcf13e7c38354037866a0f96

Download Submit
C:\Users\Admin\AppData\Local\Temp\3184a355-ca44-4f20-a56b-d3a17ecea68b.vbs

Filesize
756B

MD5
4580a5a32d91e586fbb4123e9e762c54

SHA1
c29fcc395759211865c5e6420f38f5b517425ed6

SHA256
cd77b90fed02c854d809bd7705cc76705d0ea81568d0f5ecb65bec1f59f1159c

SHA512
13d85a736fbfde598f068c0e73020066c42a3bb237117f60b13f727e462bc6c56e801f4591e99d43b19729323f3a68ea64da8a57bdb5205dd8ed081506b83de3

Download Submit
C:\Users\Admin\AppData\Local\Temp\585a2c84-cca9-4d29-8261-4ec3402366aa.vbs

Filesize
756B

MD5
c39de33b0b18c7e387629cba225bb503

SHA1
da0378a48652906ea9d2c9f92758bc801bd37064

SHA256
b99ccc78c5eff9da2d0d177a220591c3e7ded7f9ba17af7c1982580587910899

SHA512
f6e37c94cbd9b8ad6a7ea1e16d687f09d15b46a165e207a6cfc1479d4a1255c4f132a259d3fa90f5cbc062d5af6ef3491c2d074ab0a262ba163e268eede1ef4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\83633363-49e1-4e88-b057-2f89bcd75f4d.vbs

Filesize
532B

MD5
1dce60531468ab3af35cc1127516a48c

SHA1
4c0d6a668cc27daf94db525f96df9762a77e6e65

SHA256
82ca855894f37d83e84203c2244e1e7295bce092a2932e43dc0215608e2e39aa

SHA512
032dae7a18bee8b2e960f11d4decc33a0eb7bca3f4702125c73fa2dafc173fb75d8fa056b26528a1d10994b84ba01445a8a5b37a62ca3b8f1c24ad2f2c02c7f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\8eaaa74e-e353-4d0e-9dc8-c4ed4bf1fb52.vbs

Filesize
756B

MD5
d3970d4fadf31f4c7e73788e84f21a24

SHA1
1979dd8e5ff8c1001549d0e9d5b781985b6d50f7

SHA256
48ecd8fe6ef717c90ba05c12925a06210ccc4394e3fcd30b1e507342d20fe6f6

SHA512
97bf442b46188bd0dc618b89bacae31a9432cef2d388c3488cbc4e42b5ca1eb40559bbfcb3f1a438ef1fba3e4efb01138da5b0f64df0fd69cb9b72b778cdf1a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\947d8181-c07a-444d-b5a4-fc1525bb5127.vbs

Filesize
756B

MD5
048193943b139d33eae3aa5a9a77a121

SHA1
ff0d68a671c96ceab8271e10d07cdb71d4083bb5

SHA256
bce55f64b63107f3d85107d9f96ef01fd11c880e389085e31e0d75832d4a74e8

SHA512
cf567ab0d47a3d5f6b784129f279504a704ea7b3613ce32073e1af456ebad664e630724389055d2f8bf8b615142720bb2ad6e4629eb9b22375eb827a6a0a912f

Download Submit
C:\Users\Admin\AppData\Local\Temp\9765060a-04ff-418d-a6cf-1359912d5570.vbs

Filesize
756B

MD5
22d14df990fb4ed48931309e48b423cc

SHA1
fe3a5eca6f2ddc39c3c6b34aeab88b8118c0c4e0

SHA256
41b6b1ef45f7ddd3a0c3ffa29d4b0a00fcc98feb28cb8e216cab130b9b854349

SHA512
6bc4dab26ccdcd390fb262b42bccc0b219628455f80cb447c665f9cf89a02f75d5c4b3ea7b99fb94fa63e5aa82e9404e867d0f72ff4859623d548c02a6bcd2a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\RCXCF50.tmp

Filesize
4.9MB

MD5
a1bce312b028723b0cc7b3714d99dc65

SHA1
36b5e16b84b7e5c0c45d2b0a27561b47de00d336

SHA256
0f1ff3c74195bae101e12ba97bdf2842e3b5ca532544c793e12057312f05e047

SHA512
4485e61e5de1f040cb3d56f207e6a3836871143f39f7366c8ecf518acf4dac553d42d23430430c7f2126d8192ccc92d65348d261d4fd6801c3a025c4fe698335

Download Submit
C:\Users\Admin\AppData\Local\Temp\bc153a04-e34e-4827-839d-8fba6f7388e2.vbs

Filesize
755B

MD5
2881335ef8d9ef33f614cc2d47ff1d21

SHA1
403161fc3e9873f14563a853bc54e0d44ac6d538

SHA256
fc73418ef6fc009d5809a207aaef45a740c9135120050251e517cb23d1edc0e2

SHA512
b123bfb671d45e37948bfa79eb2ea49436e215cf333fd6ba58bc05189a7078aeb1106cd7cc52cce490c9dcb4c4dcef8b89e98adaf1913a0965560fa56811cf7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\bdbbd813-ff84-49d2-b667-7c3c618b2530.vbs

Filesize
756B

MD5
809491d5a47fb9bc12eb5432dbdb9294

SHA1
f71fd73f28049970e9285847ac0d632cfe66c547

SHA256
7450762562157f481bba96127b78bb654912bbfe4165d3c8fcd6ab89574de5f2

SHA512
e1bf88fbb8dc5a95063c4a056b743d12a82f153afa88ca7cb657d0c60af59bcb216e479947ba4b7a45192b275e566dc0e163159a70b5e0249339545264413b86

Download Submit
C:\Users\Admin\AppData\Local\Temp\be5f20e8-0050-4bb6-b5b6-d8715e8eaa79.vbs

Filesize
756B

MD5
7e705f7748b6d5fc7398899e12eac143

SHA1
db6e7381e5a89c1bde1097bf85fb7c08434c43bf

SHA256
5ed866373e3a41566c221f550d313a445b3002a4de15f16eeef1c8fba932d0e2

SHA512
70d40b34229eab9f793c517815a43a21a30201e5da044f589529da5ef0439ce54de8fd3082f7044cbf19bbc10eb363258bb5d171a99d3fc26602150eeb1bd732

Download Submit
C:\Users\Admin\AppData\Local\Temp\ed063ad6-4f2e-4072-bbb8-5f6fbd6bb9db.vbs

Filesize
756B

MD5
338f021b8bc4a747ca7fc9efb16b52b3

SHA1
e068a334de0fe95a8ebb1cbcb8c75b264ed3b964

SHA256
d1e59f2505c41ae89429814eb8f90d5fcb8bbb86cf5e210ccc884ace148e9326

SHA512
351c0e45075dd957e03a9b7c483ff8b7136341d8f28d2202126611e301972c2afdf38fb29f174aab4a4a0822d3b73bd5f281a9c4070af14e7d59fa4118bcf5b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\fd4425e2-9e96-457c-ad60-10f1ec4afd3a.vbs

Filesize
756B

MD5
1607771ce9edc61d22135b3f59891f14

SHA1
7ded0831e2456333e0681d9af81d1a5b4700b22b

SHA256
98b424d639f709992b1fbcc624d512e7370146e99c4ef3cd765deae4c7847ce4

SHA512
ebe975f9c4b59b9efb2243904b2cca414e05e16ec1f8969efa1fd9d89aa82236d3e7ba12548f8b9d33504a781753cab8f840325f86f3aced1d41e5321163ec2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpE87B.tmp.exe

Filesize
75KB

MD5
e0a68b98992c1699876f818a22b5b907

SHA1
d41e8ad8ba51217eb0340f8f69629ccb474484d0

SHA256
2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

SHA512
856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
c1bcbafb1d4583090da97dc3611871e2

SHA1
a771535141d2df68338b1b491627b4581eaa59ff

SHA256
8f9904f0bbbaf0a709c47e409624326aa5a38e0e2e7b3b2f4cbe90ad9ead4bcf

SHA512
4be1a6b8a17f9faef1d961c9ec5352f92e0c7f5786146fc9ed6dcf49f46ebd2df18e7914329e55dbf885f2f3ec211345c2f4a4d26677cd1488a55b0c3465031f

Download Submit
memory/880-210-0x0000000000950000-0x0000000000E44000-memory.dmp

Filesize
5.0MB

Download
memory/1216-165-0x0000000001080000-0x0000000001574000-memory.dmp

Filesize
5.0MB

Download
memory/1272-150-0x00000000000B0000-0x00000000005A4000-memory.dmp

Filesize
5.0MB

Download
memory/1508-78-0x000000001B4F0000-0x000000001B7D2000-memory.dmp

Filesize
2.9MB

Download
memory/1664-225-0x00000000007B0000-0x00000000007C2000-memory.dmp

Filesize
72KB

Download
memory/1936-80-0x0000000002910000-0x0000000002918000-memory.dmp

Filesize
32KB

Download
memory/2356-9-0x0000000000C80000-0x0000000000C8A000-memory.dmp

Filesize
40KB

Download
memory/2356-7-0x0000000000A70000-0x0000000000A86000-memory.dmp

Filesize
88KB

Download
memory/2356-13-0x0000000002580000-0x000000000258E000-memory.dmp

Filesize
56KB

Download
memory/2356-12-0x0000000002570000-0x000000000257E000-memory.dmp

Filesize
56KB

Download
memory/2356-0-0x000007FEF57B3000-0x000007FEF57B4000-memory.dmp

Filesize
4KB

Download
memory/2356-11-0x00000000024E0000-0x00000000024EA000-memory.dmp

Filesize
40KB

Download
memory/2356-90-0x000007FEF57B0000-0x000007FEF619C000-memory.dmp

Filesize
9.9MB

Download
memory/2356-10-0x00000000024D0000-0x00000000024E2000-memory.dmp

Filesize
72KB

Download
memory/2356-1-0x0000000000210000-0x0000000000704000-memory.dmp

Filesize
5.0MB

Download
memory/2356-16-0x0000000002630000-0x000000000263C000-memory.dmp

Filesize
48KB

Download
memory/2356-2-0x000007FEF57B0000-0x000007FEF619C000-memory.dmp

Filesize
9.9MB

Download
memory/2356-8-0x0000000000760000-0x0000000000770000-memory.dmp

Filesize
64KB

Download
memory/2356-3-0x000000001BAD0000-0x000000001BBFE000-memory.dmp

Filesize
1.2MB

Download
memory/2356-14-0x0000000002590000-0x0000000002598000-memory.dmp

Filesize
32KB

Download
memory/2356-15-0x00000000025A0000-0x00000000025A8000-memory.dmp

Filesize
32KB

Download
memory/2356-6-0x0000000000750000-0x0000000000760000-memory.dmp

Filesize
64KB

Download
memory/2356-4-0x0000000000720000-0x000000000073C000-memory.dmp

Filesize
112KB

Download
memory/2356-5-0x0000000000740000-0x0000000000748000-memory.dmp

Filesize
32KB

Download
memory/2400-72-0x0000000000EF0000-0x00000000013E4000-memory.dmp

Filesize
5.0MB

Download
memory/2428-180-0x0000000000050000-0x0000000000544000-memory.dmp

Filesize
5.0MB

Download
memory/2572-195-0x0000000000170000-0x0000000000664000-memory.dmp

Filesize
5.0MB

Download
memory/2592-255-0x00000000002E0000-0x00000000007D4000-memory.dmp

Filesize
5.0MB

Download
memory/3012-285-0x0000000000230000-0x0000000000724000-memory.dmp

Filesize
5.0MB

Download
memory/3012-286-0x0000000000990000-0x00000000009A2000-memory.dmp

Filesize
72KB

Download
memory/3024-240-0x0000000000AD0000-0x0000000000FC4000-memory.dmp

Filesize
5.0MB

Download
memory/3036-270-0x00000000012F0000-0x00000000017E4000-memory.dmp

Filesize
5.0MB

Download