colibri | c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2

Analysis

max time kernel
120s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20-11-2024 05:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
Size

4.9MB
MD5

7bcee51d69d6f7f7872dade20a2c5916
SHA1

4ad1278f8368527aa02d08c6ee86da5b22be2cab
SHA256

c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2
SHA512

8da8506093074361776f8b1693a2058fc6775be636034237c8ef7f5a03d422b881a9c8ea047b8d89bc314c649ba0c3bd7a16ac8dcd4c41d788135845bd151e34
SSDEEP

49152:bl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8u:G

Score

10^/10

colibri dcrat build1 discovery evasion execution infostealer loader rat trojan

Malware Config

Extracted

Family

colibri

Version

1.2.0

Botnet

Build1

http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php

http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php

rc4.plain

Signatures

Colibri Loader
A loader sold as MaaS first seen in August 2021.
loader colibri
Colibri family
colibri

DcRat 64 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

Processes:

c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	ioc	process
File created	C:\Program Files\VideoLAN\VLC\skins\29c1c3cc0f7685	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
4936	schtasks.exe
4920	schtasks.exe
1020	schtasks.exe
1668	schtasks.exe
1144	schtasks.exe
3012	schtasks.exe
3248	schtasks.exe
3188	schtasks.exe
3628	schtasks.exe
4944	schtasks.exe
2200	schtasks.exe
3676	schtasks.exe
3548	schtasks.exe
2000	schtasks.exe
4872	schtasks.exe
2684	schtasks.exe
640	schtasks.exe
2064	schtasks.exe
760	schtasks.exe
1424	schtasks.exe
4432	schtasks.exe
872	schtasks.exe
3000	schtasks.exe
4444	schtasks.exe
4124	schtasks.exe
1072	schtasks.exe
3532	schtasks.exe
4040	schtasks.exe
2272	schtasks.exe
2384	schtasks.exe
1104	schtasks.exe
4108	schtasks.exe
3016	schtasks.exe
4016	schtasks.exe
1824	schtasks.exe
468	schtasks.exe
612	schtasks.exe
3212	schtasks.exe
3228	schtasks.exe
2380	schtasks.exe
File created	C:\Program Files\Windows Mail\f3b6ecef712a24	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
File created	C:\Program Files\Microsoft Office 15\66fc9ff0ee96c2	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
4068	schtasks.exe
5088	schtasks.exe
4016	schtasks.exe
5080	schtasks.exe
4220	schtasks.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
4628	schtasks.exe
2776	schtasks.exe
4952	schtasks.exe
5076	schtasks.exe
1728	schtasks.exe
3128	schtasks.exe
3524	schtasks.exe
4496	schtasks.exe
4984	schtasks.exe
4628	schtasks.exe
2348	schtasks.exe
3272	schtasks.exe
3612	schtasks.exe
2392	schtasks.exe
4188	schtasks.exe

Dcrat family
dcrat

Process spawned unexpected child process 64 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4872	1928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1952	1928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	952	1928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2792	1928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3272	1928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1412	1928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3128	1928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4220	1928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2392	1928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2380	1928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1104	1928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3000	1928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2684	1928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5076	1928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2384	1928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2000	1928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4936	1928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2596	1928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4984	1928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3628	1928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4488	1928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1524	1928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4444	1928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3188	1928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4016	1928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4920	1928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2988	1928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4108	1928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4628	1928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4188	1928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1020	1928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3612	1928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	872	1928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3016	1928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5080	1928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4628	1928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1668	1928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	640	1928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4948	1928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1144	1928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2776	1928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4016	1928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4944	1928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1824	1928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	468	1928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3524	1928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2416	1928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4484	1928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3652	1928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4952	1928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2200	1928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4124	1928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2572	1928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5076	1928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2064	1928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2916	1928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5012	1928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3612	1928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3708	1928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1072	1928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	924	1928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	612	1928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2348	1928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4068	1928	schtasks.exe

UAC bypass 3 TTPs 36 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

winlogon.exewinlogon.exewinlogon.exec24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exewinlogon.exewinlogon.exewinlogon.exec24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
behavioral2/memory/5116-2-0x000000001BF70000-0x000000001C09E000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 22 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	process
4464	powershell.exe
3968	powershell.exe
4220	powershell.exe
2652	powershell.exe
4588	powershell.exe
5048	powershell.exe
1856	powershell.exe
5056	powershell.exe
644	powershell.exe
1880	powershell.exe
4164	powershell.exe
3012	powershell.exe
3960	powershell.exe
3740	powershell.exe
4936	powershell.exe
3804	powershell.exe
5056	powershell.exe
968	powershell.exe
3992	powershell.exe
4372	powershell.exe
4488	powershell.exe
1560	powershell.exe

Checks computer location settings 2 TTPs 11 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

winlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exec24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exec24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exewinlogon.exewinlogon.exewinlogon.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	winlogon.exe

Executes dropped EXE 32 IoCs

Processes:

tmp8EA4.tmp.exetmp8EA4.tmp.exetmp8EA4.tmp.exec24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exetmpCC49.tmp.exetmpCC49.tmp.exewinlogon.exetmpFFEB.tmp.exetmpFFEB.tmp.exewinlogon.exetmp1FF7.tmp.exetmp1FF7.tmp.exewinlogon.exetmp3F08.tmp.exetmp3F08.tmp.exewinlogon.exetmp72BA.tmp.exetmp72BA.tmp.exewinlogon.exetmp90E1.tmp.exetmp90E1.tmp.exewinlogon.exetmpC30D.tmp.exetmpC30D.tmp.exewinlogon.exetmpDF20.tmp.exetmpDF20.tmp.exewinlogon.exewinlogon.exetmp2D8E.tmp.exetmp2D8E.tmp.exewinlogon.exe

pid	process
4944	tmp8EA4.tmp.exe
4508	tmp8EA4.tmp.exe
3996	tmp8EA4.tmp.exe
3772	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
3592	tmpCC49.tmp.exe
4724	tmpCC49.tmp.exe
2144	winlogon.exe
3504	tmpFFEB.tmp.exe
2888	tmpFFEB.tmp.exe
3364	winlogon.exe
3064	tmp1FF7.tmp.exe
3576	tmp1FF7.tmp.exe
924	winlogon.exe
1580	tmp3F08.tmp.exe
4752	tmp3F08.tmp.exe
2144	winlogon.exe
4924	tmp72BA.tmp.exe
2508	tmp72BA.tmp.exe
2460	winlogon.exe
4576	tmp90E1.tmp.exe
916	tmp90E1.tmp.exe
4496	winlogon.exe
3436	tmpC30D.tmp.exe
4644	tmpC30D.tmp.exe
4740	winlogon.exe
2364	tmpDF20.tmp.exe
740	tmpDF20.tmp.exe
3308	winlogon.exe
3732	winlogon.exe
1664	tmp2D8E.tmp.exe
220	tmp2D8E.tmp.exe
4132	winlogon.exe

Checks whether UAC is enabled 1 TTPs 24 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

winlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exec24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exec24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe

Suspicious use of SetThreadContext 10 IoCs

Processes:

tmp8EA4.tmp.exetmpCC49.tmp.exetmpFFEB.tmp.exetmp1FF7.tmp.exetmp3F08.tmp.exetmp72BA.tmp.exetmp90E1.tmp.exetmpC30D.tmp.exetmpDF20.tmp.exetmp2D8E.tmp.exe

description	pid	process	target process
PID 4508 set thread context of 3996	4508	tmp8EA4.tmp.exe	tmp8EA4.tmp.exe
PID 3592 set thread context of 4724	3592	tmpCC49.tmp.exe	tmpCC49.tmp.exe
PID 3504 set thread context of 2888	3504	tmpFFEB.tmp.exe	tmpFFEB.tmp.exe
PID 3064 set thread context of 3576	3064	tmp1FF7.tmp.exe	tmp1FF7.tmp.exe
PID 1580 set thread context of 4752	1580	tmp3F08.tmp.exe	tmp3F08.tmp.exe
PID 4924 set thread context of 2508	4924	tmp72BA.tmp.exe	tmp72BA.tmp.exe
PID 4576 set thread context of 916	4576	tmp90E1.tmp.exe	tmp90E1.tmp.exe
PID 3436 set thread context of 4644	3436	tmpC30D.tmp.exe	tmpC30D.tmp.exe
PID 2364 set thread context of 740	2364	tmpDF20.tmp.exe	tmpDF20.tmp.exe
PID 1664 set thread context of 220	1664	tmp2D8E.tmp.exe	tmp2D8E.tmp.exe

Drops file in Program Files directory 41 IoCs

Processes:

c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exec24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe

description	ioc	process
File opened for modification	C:\Program Files\Microsoft Office\Registry.exe	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
File created	C:\Program Files\Microsoft Office 15\66fc9ff0ee96c2	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
File opened for modification	C:\Program Files\Uninstall Information\RuntimeBroker.exe	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
File opened for modification	C:\Program Files\Windows Mail\RCX9E3D.tmp	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
File created	C:\Program Files (x86)\Windows Defender\fr-FR\9e8d7a4ca61bd9	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\Idle.exe	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
File opened for modification	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\RuntimeBroker.exe	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
File opened for modification	C:\Program Files\Windows Sidebar\Shared Gadgets\Idle.exe	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
File created	C:\Program Files\Windows NT\Accessories\lsass.exe	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
File created	C:\Program Files\dotnet\MoUsoCoreWorker.exe	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
File opened for modification	C:\Program Files\Windows NT\Accessories\lsass.exe	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\skins\unsecapp.exe	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
File created	C:\Program Files\Windows NT\Accessories\6203df4a6bafc7	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
File created	C:\Program Files\Uninstall Information\RuntimeBroker.exe	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
File created	C:\Program Files\Uninstall Information\9e8d7a4ca61bd9	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
File opened for modification	C:\Program Files\Microsoft Office 15\sihost.exe	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
File opened for modification	C:\Program Files\Windows Mail\spoolsv.exe	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\fr-FR\RuntimeBroker.exe	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\6ccacd8608530f	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
File created	C:\Program Files\Microsoft Office\Registry.exe	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
File created	C:\Program Files\VideoLAN\VLC\skins\unsecapp.exe	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
File created	C:\Program Files (x86)\Microsoft.NET\RedistList\taskhostw.exe	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
File created	C:\Program Files (x86)\Microsoft.NET\RedistList\ea9f0e6c9e2dcd	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\skins\RCX9540.tmp	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\RedistList\RCXA4F7.tmp	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\9e8d7a4ca61bd9	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
File created	C:\Program Files\Windows Mail\5940a34987c991	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
File opened for modification	C:\Program Files\Microsoft Office 15\RCX9988.tmp	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\RedistList\taskhostw.exe	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
File created	C:\Program Files\Windows Mail\dllhost.exe	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
File created	C:\Program Files\Microsoft Office\ee2ad38f3d4382	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
File created	C:\Program Files\VideoLAN\VLC\skins\29c1c3cc0f7685	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
File created	C:\Program Files\Windows Mail\spoolsv.exe	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
File created	C:\Program Files (x86)\Windows Defender\fr-FR\RuntimeBroker.exe	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\RuntimeBroker.exe	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
File created	C:\Program Files\dotnet\1f93f77a7f4778	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
File created	C:\Program Files\Microsoft Office 15\sihost.exe	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
File created	C:\Program Files\Windows Mail\f3b6ecef712a24	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
File opened for modification	C:\Program Files\Uninstall Information\RCX931C.tmp	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
File opened for modification	C:\Program Files\Windows Mail\dllhost.exe	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
File opened for modification	C:\Program Files\dotnet\MoUsoCoreWorker.exe	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe

Drops file in Windows directory 18 IoCs

Processes:

c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exec24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe

description	ioc	process
File opened for modification	C:\Windows\ja-JP\RCXA0CE.tmp	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
File created	C:\Windows\ShellComponents\cc11b995f2a76d	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
File opened for modification	C:\Windows\Provisioning\Autopilot\SppExtComObj.exe	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
File created	C:\Windows\ja-JP\RuntimeBroker.exe	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
File created	C:\Windows\ja-JP\9e8d7a4ca61bd9	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
File opened for modification	C:\Windows\ja-JP\RuntimeBroker.exe	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
File created	C:\Windows\Provisioning\Autopilot\e1ef82546f0b02	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
File created	C:\Windows\debug\7a0fd90576e088	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
File created	C:\Windows\Provisioning\Autopilot\SppExtComObj.exe	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
File created	C:\Windows\ShellComponents\winlogon.exe	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
File created	C:\Windows\Globalization\dllhost.exe	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
File created	C:\Windows\Globalization\5940a34987c991	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
File opened for modification	C:\Windows\Globalization\dllhost.exe	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
File created	C:\Windows\OCR\ja-jp\Idle.exe	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
File created	C:\Windows\System\Speech\sppsvc.exe	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
File created	C:\Windows\debug\explorer.exe	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
File opened for modification	C:\Windows\debug\explorer.exe	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
File opened for modification	C:\Windows\ShellComponents\winlogon.exe	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

tmp8EA4.tmp.exetmp90E1.tmp.exetmpDF20.tmp.exetmp8EA4.tmp.exetmpCC49.tmp.exetmpFFEB.tmp.exetmp1FF7.tmp.exetmp3F08.tmp.exetmp72BA.tmp.exetmpC30D.tmp.exetmp2D8E.tmp.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp8EA4.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp90E1.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpDF20.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp8EA4.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpCC49.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpFFEB.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp1FF7.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp3F08.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp72BA.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpC30D.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp2D8E.tmp.exe

Modifies registry class 11 IoCs

Processes:

winlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exec24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exec24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

pid	process
1952	schtasks.exe
1524	schtasks.exe
4872	schtasks.exe
3228	schtasks.exe
4496	schtasks.exe
3272	schtasks.exe
640	schtasks.exe
3524	schtasks.exe
1728	schtasks.exe
952	schtasks.exe
5076	schtasks.exe
2988	schtasks.exe
3652	schtasks.exe
2572	schtasks.exe
2916	schtasks.exe
3708	schtasks.exe
924	schtasks.exe
4040	schtasks.exe
2596	schtasks.exe
1144	schtasks.exe
2000	schtasks.exe
4488	schtasks.exe
3612	schtasks.exe
2384	schtasks.exe
4188	schtasks.exe
4952	schtasks.exe
2348	schtasks.exe
2684	schtasks.exe
1020	schtasks.exe
4948	schtasks.exe
2776	schtasks.exe
2064	schtasks.exe
3676	schtasks.exe
3248	schtasks.exe
2380	schtasks.exe
3188	schtasks.exe
872	schtasks.exe
2416	schtasks.exe
5076	schtasks.exe
612	schtasks.exe
760	schtasks.exe
4944	schtasks.exe
2792	schtasks.exe
1412	schtasks.exe
3128	schtasks.exe
3628	schtasks.exe
2200	schtasks.exe
2888	schtasks.exe
1424	schtasks.exe
3012	schtasks.exe
1996	schtasks.exe
3000	schtasks.exe
4444	schtasks.exe
3016	schtasks.exe
468	schtasks.exe
4124	schtasks.exe
4432	schtasks.exe
4936	schtasks.exe
3612	schtasks.exe
5012	schtasks.exe
1072	schtasks.exe
2272	schtasks.exe
1104	schtasks.exe
4984	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

pid	process
5116	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
4220	powershell.exe
4220	powershell.exe
5056	powershell.exe
5056	powershell.exe
5048	powershell.exe
5048	powershell.exe
1880	powershell.exe
3992	powershell.exe
3992	powershell.exe
1880	powershell.exe
4164	powershell.exe
4164	powershell.exe
4588	powershell.exe
4588	powershell.exe
2652	powershell.exe
2652	powershell.exe
3012	powershell.exe
3012	powershell.exe
4464	powershell.exe
4464	powershell.exe
4220	powershell.exe
968	powershell.exe
968	powershell.exe
968	powershell.exe
5048	powershell.exe
2652	powershell.exe
1880	powershell.exe
4464	powershell.exe
5056	powershell.exe
3992	powershell.exe
4588	powershell.exe
4164	powershell.exe
3012	powershell.exe
3772	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
3772	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
3772	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
3772	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
3772	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
3772	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
3772	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
3772	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
3772	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
3772	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
3772	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
3772	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
3772	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
3772	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
3772	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
3772	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
3772	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
3772	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
1856	powershell.exe
1856	powershell.exe
3960	powershell.exe
3960	powershell.exe
3804	powershell.exe
3804	powershell.exe
1560	powershell.exe
1560	powershell.exe
4936	powershell.exe
4936	powershell.exe
4372	powershell.exe
4372	powershell.exe

Suspicious use of AdjustPrivilegeToken 34 IoCs

Processes:

c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exec24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exe

description	pid	process
Token: SeDebugPrivilege	5116	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
Token: SeDebugPrivilege	4220	powershell.exe
Token: SeDebugPrivilege	5056	powershell.exe
Token: SeDebugPrivilege	2652	powershell.exe
Token: SeDebugPrivilege	5048	powershell.exe
Token: SeDebugPrivilege	3992	powershell.exe
Token: SeDebugPrivilege	4464	powershell.exe
Token: SeDebugPrivilege	1880	powershell.exe
Token: SeDebugPrivilege	4164	powershell.exe
Token: SeDebugPrivilege	4588	powershell.exe
Token: SeDebugPrivilege	968	powershell.exe
Token: SeDebugPrivilege	3012	powershell.exe
Token: SeDebugPrivilege	3772	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
Token: SeDebugPrivilege	1856	powershell.exe
Token: SeDebugPrivilege	3960	powershell.exe
Token: SeDebugPrivilege	3804	powershell.exe
Token: SeDebugPrivilege	1560	powershell.exe
Token: SeDebugPrivilege	4936	powershell.exe
Token: SeDebugPrivilege	4372	powershell.exe
Token: SeDebugPrivilege	3740	powershell.exe
Token: SeDebugPrivilege	644	powershell.exe
Token: SeDebugPrivilege	5056	powershell.exe
Token: SeDebugPrivilege	3968	powershell.exe
Token: SeDebugPrivilege	4488	powershell.exe
Token: SeDebugPrivilege	2144	winlogon.exe
Token: SeDebugPrivilege	3364	winlogon.exe
Token: SeDebugPrivilege	924	winlogon.exe
Token: SeDebugPrivilege	2144	winlogon.exe
Token: SeDebugPrivilege	2460	winlogon.exe
Token: SeDebugPrivilege	4496	winlogon.exe
Token: SeDebugPrivilege	4740	winlogon.exe
Token: SeDebugPrivilege	3308	winlogon.exe
Token: SeDebugPrivilege	3732	winlogon.exe
Token: SeDebugPrivilege	4132	winlogon.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exetmp8EA4.tmp.exetmp8EA4.tmp.execmd.exec24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exetmpCC49.tmp.exe

description	pid	process	target process
PID 5116 wrote to memory of 4944	5116	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe	tmp8EA4.tmp.exe
PID 5116 wrote to memory of 4944	5116	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe	tmp8EA4.tmp.exe
PID 5116 wrote to memory of 4944	5116	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe	tmp8EA4.tmp.exe
PID 4944 wrote to memory of 4508	4944	tmp8EA4.tmp.exe	tmp8EA4.tmp.exe
PID 4944 wrote to memory of 4508	4944	tmp8EA4.tmp.exe	tmp8EA4.tmp.exe
PID 4944 wrote to memory of 4508	4944	tmp8EA4.tmp.exe	tmp8EA4.tmp.exe
PID 4508 wrote to memory of 3996	4508	tmp8EA4.tmp.exe	tmp8EA4.tmp.exe
PID 4508 wrote to memory of 3996	4508	tmp8EA4.tmp.exe	tmp8EA4.tmp.exe
PID 4508 wrote to memory of 3996	4508	tmp8EA4.tmp.exe	tmp8EA4.tmp.exe
PID 4508 wrote to memory of 3996	4508	tmp8EA4.tmp.exe	tmp8EA4.tmp.exe
PID 4508 wrote to memory of 3996	4508	tmp8EA4.tmp.exe	tmp8EA4.tmp.exe
PID 4508 wrote to memory of 3996	4508	tmp8EA4.tmp.exe	tmp8EA4.tmp.exe
PID 4508 wrote to memory of 3996	4508	tmp8EA4.tmp.exe	tmp8EA4.tmp.exe
PID 5116 wrote to memory of 4220	5116	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe	powershell.exe
PID 5116 wrote to memory of 4220	5116	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe	powershell.exe
PID 5116 wrote to memory of 5048	5116	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe	powershell.exe
PID 5116 wrote to memory of 5048	5116	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe	powershell.exe
PID 5116 wrote to memory of 1880	5116	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe	powershell.exe
PID 5116 wrote to memory of 1880	5116	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe	powershell.exe
PID 5116 wrote to memory of 5056	5116	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe	powershell.exe
PID 5116 wrote to memory of 5056	5116	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe	powershell.exe
PID 5116 wrote to memory of 2652	5116	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe	powershell.exe
PID 5116 wrote to memory of 2652	5116	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe	powershell.exe
PID 5116 wrote to memory of 4464	5116	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe	powershell.exe
PID 5116 wrote to memory of 4464	5116	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe	powershell.exe
PID 5116 wrote to memory of 3992	5116	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe	powershell.exe
PID 5116 wrote to memory of 3992	5116	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe	powershell.exe
PID 5116 wrote to memory of 4588	5116	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe	powershell.exe
PID 5116 wrote to memory of 4588	5116	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe	powershell.exe
PID 5116 wrote to memory of 3012	5116	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe	powershell.exe
PID 5116 wrote to memory of 3012	5116	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe	powershell.exe
PID 5116 wrote to memory of 968	5116	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe	powershell.exe
PID 5116 wrote to memory of 968	5116	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe	powershell.exe
PID 5116 wrote to memory of 4164	5116	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe	powershell.exe
PID 5116 wrote to memory of 4164	5116	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe	powershell.exe
PID 5116 wrote to memory of 4664	5116	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe	cmd.exe
PID 5116 wrote to memory of 4664	5116	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe	cmd.exe
PID 4664 wrote to memory of 972	4664	cmd.exe	w32tm.exe
PID 4664 wrote to memory of 972	4664	cmd.exe	w32tm.exe
PID 4664 wrote to memory of 3772	4664	cmd.exe	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
PID 4664 wrote to memory of 3772	4664	cmd.exe	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
PID 3772 wrote to memory of 3592	3772	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe	tmpCC49.tmp.exe
PID 3772 wrote to memory of 3592	3772	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe	tmpCC49.tmp.exe
PID 3772 wrote to memory of 3592	3772	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe	tmpCC49.tmp.exe
PID 3592 wrote to memory of 4724	3592	tmpCC49.tmp.exe	tmpCC49.tmp.exe
PID 3592 wrote to memory of 4724	3592	tmpCC49.tmp.exe	tmpCC49.tmp.exe
PID 3592 wrote to memory of 4724	3592	tmpCC49.tmp.exe	tmpCC49.tmp.exe
PID 3592 wrote to memory of 4724	3592	tmpCC49.tmp.exe	tmpCC49.tmp.exe
PID 3592 wrote to memory of 4724	3592	tmpCC49.tmp.exe	tmpCC49.tmp.exe
PID 3592 wrote to memory of 4724	3592	tmpCC49.tmp.exe	tmpCC49.tmp.exe
PID 3592 wrote to memory of 4724	3592	tmpCC49.tmp.exe	tmpCC49.tmp.exe
PID 3772 wrote to memory of 1856	3772	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe	powershell.exe
PID 3772 wrote to memory of 1856	3772	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe	powershell.exe
PID 3772 wrote to memory of 644	3772	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe	powershell.exe
PID 3772 wrote to memory of 644	3772	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe	powershell.exe
PID 3772 wrote to memory of 3804	3772	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe	powershell.exe
PID 3772 wrote to memory of 3804	3772	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe	powershell.exe
PID 3772 wrote to memory of 4372	3772	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe	powershell.exe
PID 3772 wrote to memory of 4372	3772	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe	powershell.exe
PID 3772 wrote to memory of 3960	3772	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe	powershell.exe
PID 3772 wrote to memory of 3960	3772	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe	powershell.exe
PID 3772 wrote to memory of 3740	3772	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe	powershell.exe
PID 3772 wrote to memory of 3740	3772	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe	powershell.exe
PID 3772 wrote to memory of 5056	3772	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe	powershell.exe

System policy modification 1 TTPs 36 IoCs

evasion

Modify Registry

T1112

Processes:

winlogon.exewinlogon.exec24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exec24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
"C:\Users\Admin\AppData\Local\Temp\c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe"
1⤵
- DcRat
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5116
- C:\Users\Admin\AppData\Local\Temp\tmp8EA4.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp8EA4.tmp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4944
- - C:\Users\Admin\AppData\Local\Temp\tmp8EA4.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp8EA4.tmp.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4508
  - - C:\Users\Admin\AppData\Local\Temp\tmp8EA4.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp8EA4.tmp.exe"
      4⤵
      Executes dropped EXE
      PID:3996
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4220
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5048
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1880
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5056
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2652
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4464
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3992
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4588
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3012
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4164
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\7CZQjHFyf3.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4664
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:972
- - C:\Users\Admin\AppData\Local\Temp\c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe
    "C:\Users\Admin\AppData\Local\Temp\c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe"
    3⤵
    - UAC bypass
    - Checks computer location settings
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:3772
  - - C:\Users\Admin\AppData\Local\Temp\tmpCC49.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmpCC49.tmp.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3592
    - - C:\Users\Admin\AppData\Local\Temp\tmpCC49.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpCC49.tmp.exe"
        5⤵
        Executes dropped EXE
        
        PID:4724
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1856
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:644
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3804
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4372
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3960
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:3740
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:5056
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1560
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4936
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:4488
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:3968
  - - C:\Windows\ShellComponents\winlogon.exe
      "C:\Windows\ShellComponents\winlogon.exe"
      4⤵
      UAC bypass
      Checks computer location settings
      Executes dropped EXE
      Checks whether UAC is enabled
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      System policy modification
      PID:2144
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5a58d04e-6648-448f-9d1b-79534cd086ce.vbs"
        5⤵
        
        PID:2684
      - C:\Windows\ShellComponents\winlogon.exe
        
        C:\Windows\ShellComponents\winlogon.exe
        6⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3364
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f8d3b0de-9581-4d23-8aa6-120929d36942.vbs"
        7⤵
        
        PID:5028
        
        C:\Windows\ShellComponents\winlogon.exe
        
        C:\Windows\ShellComponents\winlogon.exe
        8⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:924
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ebc6fdba-446f-44e7-9aca-9be7a8787bf1.vbs"
        9⤵
        
        PID:4532
        
        C:\Windows\ShellComponents\winlogon.exe
        
        C:\Windows\ShellComponents\winlogon.exe
        10⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2144
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\52881cff-52b2-41df-8a8c-9fc8ff40a43d.vbs"
        11⤵
        
        PID:3768
        
        C:\Windows\ShellComponents\winlogon.exe
        
        C:\Windows\ShellComponents\winlogon.exe
        12⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2460
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fdfc6c82-2532-4efb-a21f-e9ea5fc1b998.vbs"
        13⤵
        
        PID:1128
        
        C:\Windows\ShellComponents\winlogon.exe
        
        C:\Windows\ShellComponents\winlogon.exe
        14⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4496
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a5043af6-5cae-4f23-bfc1-b6fea0eb7c90.vbs"
        15⤵
        
        PID:1276
        
        C:\Windows\ShellComponents\winlogon.exe
        
        C:\Windows\ShellComponents\winlogon.exe
        16⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4740
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\acb3236b-f66e-4f01-80ac-b43e76084f44.vbs"
        17⤵
        
        PID:5044
        
        C:\Windows\ShellComponents\winlogon.exe
        
        C:\Windows\ShellComponents\winlogon.exe
        18⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3308
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d9e95ae0-5dec-4abd-9012-fcb872c662fb.vbs"
        19⤵
        
        PID:1704
        
        C:\Windows\ShellComponents\winlogon.exe
        
        C:\Windows\ShellComponents\winlogon.exe
        20⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3732
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dae766dc-0063-4ce6-9a9d-cd5fd07de3f4.vbs"
        21⤵
        
        PID:1980
        
        C:\Windows\ShellComponents\winlogon.exe
        
        C:\Windows\ShellComponents\winlogon.exe
        22⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4132
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7f4232dc-5746-4b1b-92b0-6e985e44ed07.vbs"
        21⤵
        
        PID:2892
        
        C:\Users\Admin\AppData\Local\Temp\tmp2D8E.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp2D8E.tmp.exe"
        21⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1664
        
        C:\Users\Admin\AppData\Local\Temp\tmp2D8E.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp2D8E.tmp.exe"
        22⤵
        Executes dropped EXE
        
        PID:220
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\473c286a-b727-4123-8cbb-8d0a0b469d88.vbs"
        19⤵
        
        PID:1576
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\892b64e4-3ff7-40cf-a71d-3a7b2932fcef.vbs"
        17⤵
        
        PID:4656
        
        C:\Users\Admin\AppData\Local\Temp\tmpDF20.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpDF20.tmp.exe"
        17⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2364
        
        C:\Users\Admin\AppData\Local\Temp\tmpDF20.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpDF20.tmp.exe"
        18⤵
        Executes dropped EXE
        
        PID:740
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d95d19da-5b44-45a0-8943-609bde9138c0.vbs"
        15⤵
        
        PID:404
        
        C:\Users\Admin\AppData\Local\Temp\tmpC30D.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpC30D.tmp.exe"
        15⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3436
        
        C:\Users\Admin\AppData\Local\Temp\tmpC30D.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpC30D.tmp.exe"
        16⤵
        Executes dropped EXE
        
        PID:4644
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6e87fb8a-db64-4431-8d35-ff04150e7b39.vbs"
        13⤵
        
        PID:2972
        
        C:\Users\Admin\AppData\Local\Temp\tmp90E1.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp90E1.tmp.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4576
        
        C:\Users\Admin\AppData\Local\Temp\tmp90E1.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp90E1.tmp.exe"
        14⤵
        Executes dropped EXE
        
        PID:916
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d86c523a-7105-471f-aa87-c6e0a38ce854.vbs"
        11⤵
        
        PID:3336
        
        C:\Users\Admin\AppData\Local\Temp\tmp72BA.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp72BA.tmp.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4924
        
        C:\Users\Admin\AppData\Local\Temp\tmp72BA.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp72BA.tmp.exe"
        12⤵
        Executes dropped EXE
        
        PID:2508
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\96ab909a-5e2f-4074-8a65-071c96d18f60.vbs"
        9⤵
        
        PID:3184
        
        C:\Users\Admin\AppData\Local\Temp\tmp3F08.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp3F08.tmp.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1580
        
        C:\Users\Admin\AppData\Local\Temp\tmp3F08.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp3F08.tmp.exe"
        10⤵
        Executes dropped EXE
        
        PID:4752
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\06a83d83-4ef8-4f5b-873d-ea6f3c42a1f7.vbs"
        7⤵
        
        PID:3540
        
        C:\Users\Admin\AppData\Local\Temp\tmp1FF7.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp1FF7.tmp.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3064
        
        C:\Users\Admin\AppData\Local\Temp\tmp1FF7.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp1FF7.tmp.exe"
        8⤵
        Executes dropped EXE
        
        PID:3576
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0e0a10c9-8761-4b01-b0a5-7488eb3955df.vbs"
        5⤵
        
        PID:4168
    - - C:\Users\Admin\AppData\Local\Temp\tmpFFEB.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpFFEB.tmp.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3504
      - C:\Users\Admin\AppData\Local\Temp\tmpFFEB.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpFFEB.tmp.exe"
        6⤵
        Executes dropped EXE
        
        PID:2888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\Cookies\fontdrvhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Admin\Cookies\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\Cookies\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Program Files\Uninstall Information\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:4220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files\Uninstall Information\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:2392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 10 /tr "'C:\Program Files\VideoLAN\VLC\skins\unsecapp.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\skins\unsecapp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 7 /tr "'C:\Program Files\VideoLAN\VLC\skins\unsecapp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\Documents\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\All Users\Documents\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\Documents\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 8 /tr "'C:\Program Files\Microsoft Office 15\sihost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\sihost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 10 /tr "'C:\Program Files\Microsoft Office 15\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Users\Default\Recent\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Default\Recent\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Recent\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Mail\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Mail\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Windows\ja-JP\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:4016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\ja-JP\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:4920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Windows\ja-JP\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\dllhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:4108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Default User\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:4628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\taskhostw.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\taskhostw.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\taskhostw.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Defender\fr-FR\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\fr-FR\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:5080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Defender\fr-FR\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:4628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 14 /tr "'C:\Windows\Provisioning\Autopilot\SppExtComObj.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:1668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Windows\Provisioning\Autopilot\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 8 /tr "'C:\Windows\Provisioning\Autopilot\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:4016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\All Users\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:1824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows NT\Accessories\lsass.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\Windows NT\Accessories\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows NT\Accessories\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:4484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\Microsoft\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\All Users\Microsoft\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\Microsoft\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Windows\debug\explorer.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\debug\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Windows\debug\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Mail\dllhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Mail\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\Contacts\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Users\Admin\Contacts\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\Contacts\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\Idle.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:4068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
PID:3532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
PID:5088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Users\Public\fontdrvhost.exe'" /f
1⤵
PID:2296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Public\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Users\Public\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:4040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\My Documents\wininit.exe'" /f
1⤵
- DcRat
PID:3212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\Admin\My Documents\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:3676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\My Documents\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:3228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Windows\ShellComponents\winlogon.exe'" /f
1⤵
- DcRat
PID:3548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\ShellComponents\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Windows\ShellComponents\winlogon.exe'" /rl HIGHEST /f
1⤵
PID:3504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MoUsoCoreWorkerM" /sc MINUTE /mo 5 /tr "'C:\Program Files\dotnet\MoUsoCoreWorker.exe'" /f
1⤵
PID:3256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MoUsoCoreWorker" /sc ONLOGON /tr "'C:\Program Files\dotnet\MoUsoCoreWorker.exe'" /rl HIGHEST /f
1⤵
PID:3184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MoUsoCoreWorkerM" /sc MINUTE /mo 14 /tr "'C:\Program Files\dotnet\MoUsoCoreWorker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:1424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Windows\Globalization\dllhost.exe'" /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:3012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\Globalization\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:4496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Windows\Globalization\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:3248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 5 /tr "'C:\Program Files\Microsoft Office\Registry.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:1996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\Registry.exe'" /rl HIGHEST /f
1⤵
PID:4884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 13 /tr "'C:\Program Files\Microsoft Office\Registry.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:2272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /f
1⤵
PID:1532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:1728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:4432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Microsoft Office 15\sihost.exe

Filesize
4.9MB

MD5
56a8abd730c961c7e715e937ebbe0a4d

SHA1
534ea0016625df550591f34128f57bfad5d2eab0

SHA256
8966f38bc88370f503a40e5538a6651842975df59e9eb5082908eafe4c4e410b

SHA512
f1bdf67a7857c5395813f6af24bc2676625e7feacd9af6b98fb23256ecc03ea64f09da8ea0526126529809e24d195749cf92dd515c31a0bb997101839639e017

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2.exe.log

Filesize
1KB

MD5
bbb951a34b516b66451218a3ec3b0ae1

SHA1
7393835a2476ae655916e0a9687eeaba3ee876e9

SHA256
eb70c64ae99d14ac2588b7a84854fbf3c420532d7fe4dfd49c7b5a70c869943a

SHA512
63bcbfcf8e7421c66855c487c31b2991a989bdea0c1edd4c40066b52fa3eb3d9d37db1cd21b8eb4f33dd5870cc20532c8f485eab9c0b4f6b0793a35c077f2d6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\winlogon.exe.log

Filesize
1KB

MD5
4a667f150a4d1d02f53a9f24d89d53d1

SHA1
306e125c9edce66f28fdb63e6c4ca5c9ad6e8c97

SHA256
414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd

SHA512
4edd8e73ce03488a6d92750a782cd4042fbb54a5b3f8d8ba3ea227fda0653c2cd84f0c5d64976c7cdc1f518a2fdc8ff10e2a015ec7acf3cd01b0d62bc98542d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
2e907f77659a6601fcc408274894da2e

SHA1
9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

SHA256
385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

SHA512
34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
a8e8360d573a4ff072dcc6f09d992c88

SHA1
3446774433ceaf0b400073914facab11b98b6807

SHA256
bf5e284e8f95122bf75ead61c7e2b40f55c96742b05330b5b1cb7915991df13b

SHA512
4ee5167643d82082f57c42616007ef9be57f43f9731921bdf7bca611a914724ad94072d3c8f5b130fa54129e5328ccdebf37ba74339c37deb53e79df5cdf0dbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e8ce785f8ccc6d202d56fefc59764945

SHA1
ca032c62ddc5e0f26d84eff9895eb87f14e15960

SHA256
d85c19fc6b9d25e2168a2cc50ff38bd226fbf4f02aa7ac038a5f319522d2ffa4

SHA512
66460aec4afee582556270f8ee6048d130a090f1c12a2632ed71a99a4073e9931e9e1cc286e32debffb95a90bd955f0f0d6ec891b1c5cd2f0aae41eb6d25832f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
705e397ba2c670b0b9fcebdd31e0feea

SHA1
8566fe7e0903b7495e659ba0588b72e3ce538c3b

SHA256
ae5d0de2ba6fe534bf67dcdbbfd71cf3f8c26f3d6ec852d73362d274a242732f

SHA512
a2914a193cbea13119567199082c52eebe67719c80bc056b3820c6a4b2e8cf8c7ecd3e38975f6ffc616b171ab722a6664f44f65496fdaf114615c1bbdf98306c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
150616521d490e160cd33b97d678d206

SHA1
71594f5b97a4a61fe5f120eb10bcd6b73d7e6e78

SHA256
94595c05912cbb8380f7ed34499eb01fb91707a1ed1c02c02002a4361e889827

SHA512
7043dc4b336b1688205fbe762e731478ecaa0036c9f5e0434c79b8a6f8fa58b0705c8674fd6a047e6009edc52c37ce4e2ce81694e13b79a3e8183a32307f3815

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3505effaead0f06d098f1aec01836881

SHA1
94bafdbeb2f5adbd8cec709574df5b8dbcc5eba3

SHA256
5d39a25ff8842c7c14aa14f99c5e3e1606fb7516c57f03dc41069df3c3de0517

SHA512
934d8eab5bc2ec20e800c668f3c3434829feade4771918a22d712f7ba39f91f93877a1e9dc1beac966646af0c9dd2cf118041535143b3abc585fea8dfb1299f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
9405862a3b15dc34824f6a0e5f077f4f

SHA1
bbe0000e06be94fa61d6e223fb38b1289908723d

SHA256
0a0869426bca171c080316948a4638a7152018ea5e07de97b2d51e0d90905210

SHA512
fc7ae988b81dec5b13ae9878350cd9d063538bfb2bc14f099087836ed54cd77a36bc7c4276fa075a80a3cd20e7620fa2ba5a8b5b7bf98698b10752749187148d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
fd86c55419dcac3423864e0b93f54bef

SHA1
9868d6cc8332229c610002cd554d6cf13324b2de

SHA256
981dafd14ebbd0e40789a623c7f74770131706fbac0881f52339b752ed45eebb

SHA512
70d7a2e579ace5f00dbe51c409c138506215997f12dfb73c26ee51ab2267e84ccaeace74d76f7378a1519f3d8cb4d8dc082fe481379ecdbee17c6e9a6dbdfe58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3c625954a51c4bbd8141206b00f6fc0a

SHA1
4128cb2f9d2984844e303e2e330e448334e5c273

SHA256
952515feb4929cfad2435c679a5fad19242e938e8a7c97afebb1f3d996bd3ec4

SHA512
3f7c4ea0551de5b6237ca13419413e6e73e85632e9bb09b5354d6310b5969f9c3a2dc27142e75e8572c2c65b2bc7615269fad27dcea2f91c389b6758e2630517

Download Submit
C:\Users\Admin\AppData\Local\Temp\0e0a10c9-8761-4b01-b0a5-7488eb3955df.vbs

Filesize
491B

MD5
8596a01f10e1681fc9a8b425acecf975

SHA1
2ff2669b684c897380721b817173937bc43ca8ef

SHA256
080b9d6b2fe2186c82e536fc243cc738c65ea95cc19e9ca00b52b7bbcaf5fbf1

SHA512
50ac58a675699da39bc514ad9f274c816c81e917b283716b773d5cfb02904fe75804236ee7bdd88963b2fa82d01f6a7544e1d0c54299821875ba9b8b5c3b8d25

Download Submit
C:\Users\Admin\AppData\Local\Temp\5a58d04e-6648-448f-9d1b-79534cd086ce.vbs

Filesize
715B

MD5
b557905f90ca27cad6845429c53e81c1

SHA1
672b1d1fc441f06043fe25a522b34813156ff15e

SHA256
48e51053c896e78d97258f289c251d06996d571fb71802d3e8062359345c1b19

SHA512
f7f969fd733b96c7b28b468aba317d978df63ee8f9472182a53293d8ff46391b73d6cfbed634d62a708a63f8f610171e1f860f1863be663a5468eae35d8bd3f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7CZQjHFyf3.bat

Filesize
267B

MD5
2a233f119b2be83b7936ef65059818f0

SHA1
1592c2d6652a6881dcfcd9e089dc9248b89d2b77

SHA256
f8fd25a3091559fc53ead7543e251c46028dc255fd15aeb3051af3584d89ab49

SHA512
349fbc0bb56e7158845a8201780e01be19e6a7cf534aaa0187c2ccfa3b1205d9181be4feaa8b183369375b77fff82922c4e3a74d68bf23693e9b0b8bb2d04c2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_l3pw2cet.l0k.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\e8e9e1053a6e45a09172be457ddfb669a53a3ecf.exe

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\ebc6fdba-446f-44e7-9aca-9be7a8787bf1.vbs

Filesize
714B

MD5
254b909fa41b5444150b6f899c8d6e60

SHA1
13045f8ca56d5e47eb731942675acc462d0cea04

SHA256
3589a6e556412868167aafc441d761cfc30717b3390fcee59b7b76ba545446df

SHA512
26e0a3b077c8c8b90873dbaad152226737d59f6e2aee07d8627a0789c4878ab49dae541e58121a600b152c520ebcbab77ae04d01a8381e9b42817761009541da

Download Submit
C:\Users\Admin\AppData\Local\Temp\f8d3b0de-9581-4d23-8aa6-120929d36942.vbs

Filesize
715B

MD5
18900bd70fad4e7f046f2fc77fa00650

SHA1
c3ba5f6d4ff6a7bacd43b106de9213d79fef6764

SHA256
cedee6174fab9d34990ac4f026d7f61a8d422a1a2f25f535c29f2398446dd05b

SHA512
ede07f131daceeb7656ab668d66f2e801a4814a5bad624f62af3eb758ef32d5504516bee0a111ed282b8aa413c88bbcaae50bc88969980d66c7da43106e1bceb

Download Submit
C:\Users\Admin\AppData\Local\Temp\fdfc6c82-2532-4efb-a21f-e9ea5fc1b998.vbs

Filesize
715B

MD5
053d8247d8fef59747dd5cdc5ef61f8c

SHA1
6bc5548a6b2f2cb83aa97d749d4760d5ae62de67

SHA256
466da2e35006d32dc2e0c9916e2468cecab465f61758745121b4e9bd3d457d90

SHA512
8109ecfd325f934584e5d9b31c36091cee74203d0f11e7c116fa7dd7f7671551ab315cc290545a8d434330f6299440ac4c0129962f9e7afa2e4ceff040f22b89

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp8EA4.tmp.exe

Filesize
75KB

MD5
e0a68b98992c1699876f818a22b5b907

SHA1
d41e8ad8ba51217eb0340f8f69629ccb474484d0

SHA256
2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

SHA512
856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

Download Submit
C:\Users\Public\Documents\RuntimeBroker.exe

Filesize
4.9MB

MD5
7bcee51d69d6f7f7872dade20a2c5916

SHA1
4ad1278f8368527aa02d08c6ee86da5b22be2cab

SHA256
c24f2fb77a06cdfe4e9c074b1e2accb305b0ad091c1668372cc1f5249612b8b2

SHA512
8da8506093074361776f8b1693a2058fc6775be636034237c8ef7f5a03d422b881a9c8ea047b8d89bc314c649ba0c3bd7a16ac8dcd4c41d788135845bd151e34

Download Submit
memory/968-252-0x0000021EF8740000-0x0000021EF888E000-memory.dmp

Filesize
1.3MB

Download
memory/1880-250-0x0000023A3E480000-0x0000023A3E5CE000-memory.dmp

Filesize
1.3MB

Download
memory/2144-521-0x000000001BC50000-0x000000001BC62000-memory.dmp

Filesize
72KB

Download
memory/2652-257-0x0000020CB8350000-0x0000020CB849E000-memory.dmp

Filesize
1.3MB

Download
memory/2652-146-0x0000020CA0200000-0x0000020CA0222000-memory.dmp

Filesize
136KB

Download
memory/3012-272-0x000001793AA00000-0x000001793AB4E000-memory.dmp

Filesize
1.3MB

Download
memory/3308-687-0x000000001BD70000-0x000000001BD82000-memory.dmp

Filesize
72KB

Download
memory/3772-278-0x000000001B690000-0x000000001B6A2000-memory.dmp

Filesize
72KB

Download
memory/3992-271-0x0000019AE93A0000-0x0000019AE94EE000-memory.dmp

Filesize
1.3MB

Download
memory/3996-63-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/4132-713-0x000000001BB40000-0x000000001BB52000-memory.dmp

Filesize
72KB

Download
memory/4164-265-0x000002772E350000-0x000002772E49E000-memory.dmp

Filesize
1.3MB

Download
memory/4220-247-0x0000017FD7070000-0x0000017FD71BE000-memory.dmp

Filesize
1.3MB

Download
memory/4464-260-0x000002616AC70000-0x000002616ADBE000-memory.dmp

Filesize
1.3MB

Download
memory/4588-275-0x0000024FB89F0000-0x0000024FB8B3E000-memory.dmp

Filesize
1.3MB

Download
memory/4740-670-0x00000000033D0000-0x00000000033E2000-memory.dmp

Filesize
72KB

Download
memory/5048-266-0x00000274DEAA0000-0x00000274DEBEE000-memory.dmp

Filesize
1.3MB

Download
memory/5056-254-0x000002AE18550000-0x000002AE1869E000-memory.dmp

Filesize
1.3MB

Download
memory/5116-13-0x000000001BF40000-0x000000001BF4A000-memory.dmp

Filesize
40KB

Download
memory/5116-5-0x000000001BEF0000-0x000000001BF40000-memory.dmp

Filesize
320KB

Download
memory/5116-15-0x000000001C6A0000-0x000000001C6AE000-memory.dmp

Filesize
56KB

Download
memory/5116-18-0x000000001C6D0000-0x000000001C6DC000-memory.dmp

Filesize
48KB

Download
memory/5116-17-0x000000001C6C0000-0x000000001C6C8000-memory.dmp

Filesize
32KB

Download
memory/5116-14-0x000000001BF50000-0x000000001BF5E000-memory.dmp

Filesize
56KB

Download
memory/5116-12-0x000000001CBD0000-0x000000001D0F8000-memory.dmp

Filesize
5.2MB

Download
memory/5116-11-0x0000000003400000-0x0000000003412000-memory.dmp

Filesize
72KB

Download
memory/5116-10-0x00000000033F0000-0x00000000033FA000-memory.dmp

Filesize
40KB

Download
memory/5116-8-0x00000000033C0000-0x00000000033D6000-memory.dmp

Filesize
88KB

Download
memory/5116-9-0x00000000033E0000-0x00000000033F0000-memory.dmp

Filesize
64KB

Download
memory/5116-16-0x000000001C6B0000-0x000000001C6B8000-memory.dmp

Filesize
32KB

Download
memory/5116-6-0x00000000033A0000-0x00000000033A8000-memory.dmp

Filesize
32KB

Download
memory/5116-7-0x00000000033B0000-0x00000000033C0000-memory.dmp

Filesize
64KB

Download
memory/5116-4-0x0000000003230000-0x000000000324C000-memory.dmp

Filesize
112KB

Download
memory/5116-3-0x00007FFE00F30000-0x00007FFE019F1000-memory.dmp

Filesize
10.8MB

Download
memory/5116-2-0x000000001BF70000-0x000000001C09E000-memory.dmp

Filesize
1.2MB

Download
memory/5116-1-0x0000000000C30000-0x0000000001124000-memory.dmp

Filesize
5.0MB

Download
memory/5116-0-0x00007FFE00F33000-0x00007FFE00F35000-memory.dmp

Filesize
8KB

Download
memory/5116-137-0x00007FFE00F33000-0x00007FFE00F35000-memory.dmp

Filesize
8KB

Download
memory/5116-140-0x00007FFE00F30000-0x00007FFE019F1000-memory.dmp

Filesize
10.8MB

Download