colibri | 3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2024 22:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Size

4.9MB
MD5

a3f2103c4f5ac8042b106094412ec0d9
SHA1

55d76c32a1a7d471364add79e90dcf03a48ee226
SHA256

3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef
SHA512

2949789e3862a1e406ae20489134cab6a803702941be4e5730189a61a29265b2b170a5bc03340c165a8864936c8791da109eba25f2152f5be13c8d273346effe
SSDEEP

49152:Dl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:

Score

10^/10

colibri dcrat build1 discovery evasion execution infostealer loader rat trojan

Malware Config

Extracted

Family

colibri

Version

1.2.0

Botnet

Build1

http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php

http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php

rc4.plain

Signatures

Colibri Loader
A loader sold as MaaS first seen in August 2021.
loader colibri
Colibri family
colibri
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 54 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3256	1056	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4124	1056	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4580	1056	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	320	1056	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1952	1056	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5100	1056	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2316	1056	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5064	1056	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3152	1056	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2872	1056	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4264	1056	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3148	1056	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5056	1056	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	364	1056	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3496	1056	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1824	1056	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1712	1056	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	400	1056	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4248	1056	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4624	1056	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3672	1056	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4496	1056	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3184	1056	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	8	1056	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3616	1056	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4644	1056	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4468	1056	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3656	1056	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	632	1056	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	232	1056	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	220	1056	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3504	1056	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3980	1056	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3448	1056	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4500	1056	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	872	1056	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2356	1056	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3468	1056	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3008	1056	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4784	1056	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4236	1056	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2684	1056	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3864	1056	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2096	1056	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2372	1056	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2280	1056	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2988	1056	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4148	1056	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3004	1056	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2652	1056	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1784	1056	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	848	1056	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3276	1056	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4400	1056	schtasks.exe	83

UAC bypass 3 TTPs 42 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

csrss.execsrss.execsrss.execsrss.exe3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
behavioral2/memory/1724-3-0x000000001B330000-0x000000001B45E000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	Process
2304	powershell.exe
220	powershell.exe
4228	powershell.exe
2888	powershell.exe
2100	powershell.exe
468	powershell.exe
4568	powershell.exe
5020	powershell.exe
4044	powershell.exe
3260	powershell.exe
872	powershell.exe

Checks computer location settings 2 TTPs 13 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

csrss.execsrss.execsrss.execsrss.execsrss.exe3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	csrss.exe

Executes dropped EXE 41 IoCs

Processes:

tmpB9EC.tmp.exetmpB9EC.tmp.execsrss.exetmp50C.tmp.exetmp50C.tmp.execsrss.exetmp220A.tmp.exetmp220A.tmp.execsrss.exetmp5399.tmp.exetmp5399.tmp.execsrss.execsrss.exetmp8E22.tmp.exetmp8E22.tmp.exetmp8E22.tmp.exetmp8E22.tmp.execsrss.exetmpBE69.tmp.exetmpBE69.tmp.execsrss.exetmpF0C4.tmp.exetmpF0C4.tmp.execsrss.exetmpDD1.tmp.exetmpDD1.tmp.execsrss.exetmp2968.tmp.exetmp2968.tmp.execsrss.exetmp5A2C.tmp.exetmp5A2C.tmp.execsrss.exetmp8AB2.tmp.exetmp8AB2.tmp.exetmp8AB2.tmp.execsrss.exetmpBACA.tmp.exetmpBACA.tmp.exetmpBACA.tmp.execsrss.exe

pid	Process
2004	tmpB9EC.tmp.exe
3212	tmpB9EC.tmp.exe
4468	csrss.exe
380	tmp50C.tmp.exe
4936	tmp50C.tmp.exe
2988	csrss.exe
644	tmp220A.tmp.exe
3064	tmp220A.tmp.exe
1504	csrss.exe
4632	tmp5399.tmp.exe
468	tmp5399.tmp.exe
4608	csrss.exe
2740	csrss.exe
2216	tmp8E22.tmp.exe
4804	tmp8E22.tmp.exe
2988	tmp8E22.tmp.exe
2568	tmp8E22.tmp.exe
3256	csrss.exe
624	tmpBE69.tmp.exe
4584	tmpBE69.tmp.exe
1836	csrss.exe
4808	tmpF0C4.tmp.exe
1192	tmpF0C4.tmp.exe
3292	csrss.exe
3060	tmpDD1.tmp.exe
2140	tmpDD1.tmp.exe
4584	csrss.exe
4740	tmp2968.tmp.exe
2340	tmp2968.tmp.exe
4440	csrss.exe
3812	tmp5A2C.tmp.exe
3528	tmp5A2C.tmp.exe
2216	csrss.exe
3308	tmp8AB2.tmp.exe
3608	tmp8AB2.tmp.exe
3356	tmp8AB2.tmp.exe
2660	csrss.exe
1532	tmpBACA.tmp.exe
864	tmpBACA.tmp.exe
3880	tmpBACA.tmp.exe
3496	csrss.exe

Checks whether UAC is enabled 1 TTPs 28 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

csrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.exe3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.execsrss.execsrss.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe

Suspicious use of SetThreadContext 12 IoCs

Processes:

tmpB9EC.tmp.exetmp50C.tmp.exetmp220A.tmp.exetmp5399.tmp.exetmp8E22.tmp.exetmpBE69.tmp.exetmpF0C4.tmp.exetmpDD1.tmp.exetmp2968.tmp.exetmp5A2C.tmp.exetmp8AB2.tmp.exetmpBACA.tmp.exe

description	pid	Process	procid_target
PID 2004 set thread context of 3212	2004	tmpB9EC.tmp.exe	141
PID 380 set thread context of 4936	380	tmp50C.tmp.exe	185
PID 644 set thread context of 3064	644	tmp220A.tmp.exe	196
PID 4632 set thread context of 468	4632	tmp5399.tmp.exe	206
PID 2988 set thread context of 2568	2988	tmp8E22.tmp.exe	222
PID 624 set thread context of 4584	624	tmpBE69.tmp.exe	232
PID 4808 set thread context of 1192	4808	tmpF0C4.tmp.exe	242
PID 3060 set thread context of 2140	3060	tmpDD1.tmp.exe	250
PID 4740 set thread context of 2340	4740	tmp2968.tmp.exe	260
PID 3812 set thread context of 3528	3812	tmp5A2C.tmp.exe	270
PID 3608 set thread context of 3356	3608	tmp8AB2.tmp.exe	280
PID 864 set thread context of 3880	864	tmpBACA.tmp.exe	290

Drops file in Program Files directory 28 IoCs

Processes:

3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\RCXD9A8.tmp	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\msadc\en-US\RCXDDB1.tmp	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
File opened for modification	C:\Program Files (x86)\Windows Multimedia Platform\RCXD128.tmp	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
File opened for modification	C:\Program Files (x86)\Windows Multimedia Platform\csrss.exe	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\RuntimeBroker.exe	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\6ccacd8608530f	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\RCXBA0C.tmp	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
File created	C:\Program Files\Google\fontdrvhost.exe	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\886983d96e3d3e	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
File opened for modification	C:\Program Files\Google\fontdrvhost.exe	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
File created	C:\Program Files (x86)\Common Files\System\msadc\en-US\e6c9b481da804f	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
File opened for modification	C:\Program Files\Google\RCXBC20.tmp	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\RCXD551.tmp	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\csrss.exe	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
File created	C:\Program Files (x86)\Windows Sidebar\RuntimeBroker.exe	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
File created	C:\Program Files\Crashpad\reports\Registry.exe	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\dwm.exe	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
File opened for modification	C:\Program Files\Crashpad\reports\Registry.exe	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\Idle.exe	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\dwm.exe	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
File created	C:\Program Files\Crashpad\reports\ee2ad38f3d4382	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\Idle.exe	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
File opened for modification	C:\Program Files\Crashpad\reports\RCXDBAD.tmp	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
File created	C:\Program Files (x86)\Windows Sidebar\9e8d7a4ca61bd9	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\6cb0b6c459d5d3	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
File created	C:\Program Files (x86)\Common Files\System\msadc\en-US\OfficeClickToRun.exe	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
File created	C:\Program Files\Google\5b884080fd4f94	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\msadc\en-US\OfficeClickToRun.exe	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe

Drops file in Windows directory 12 IoCs

Processes:

3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe

description	ioc	Process
File created	C:\Windows\INF\wsearchidxpi\6cb0b6c459d5d3	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
File created	C:\Windows\LiveKernelReports\886983d96e3d3e	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
File opened for modification	C:\Windows\INF\wsearchidxpi\RCXCA7E.tmp	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
File opened for modification	C:\Windows\INF\wsearchidxpi\dwm.exe	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
File created	C:\Windows\Branding\f3b6ecef712a24	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
File created	C:\Windows\INF\wsearchidxpi\dwm.exe	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
File opened for modification	C:\Windows\Branding\RCXBE44.tmp	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
File opened for modification	C:\Windows\Branding\spoolsv.exe	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
File opened for modification	C:\Windows\LiveKernelReports\RCXD33C.tmp	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
File opened for modification	C:\Windows\LiveKernelReports\csrss.exe	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
File created	C:\Windows\Branding\spoolsv.exe	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
File created	C:\Windows\LiveKernelReports\csrss.exe	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

tmpB9EC.tmp.exetmp8AB2.tmp.exetmpBACA.tmp.exetmpBACA.tmp.exetmp50C.tmp.exetmp8E22.tmp.exetmpBE69.tmp.exetmp5A2C.tmp.exetmp8E22.tmp.exetmpDD1.tmp.exetmp8AB2.tmp.exetmp220A.tmp.exetmp5399.tmp.exetmp8E22.tmp.exetmpF0C4.tmp.exetmp2968.tmp.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpB9EC.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp8AB2.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpBACA.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpBACA.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp50C.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp8E22.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpBE69.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp5A2C.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp8E22.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpDD1.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp8AB2.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp220A.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp5399.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp8E22.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpF0C4.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp2968.tmp.exe

Modifies registry class 13 IoCs

Processes:

csrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.exe3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.execsrss.execsrss.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	csrss.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 54 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

pid	Process
3616	schtasks.exe
4236	schtasks.exe
5064	schtasks.exe
5056	schtasks.exe
4496	schtasks.exe
2280	schtasks.exe
4468	schtasks.exe
3008	schtasks.exe
2096	schtasks.exe
364	schtasks.exe
3504	schtasks.exe
4400	schtasks.exe
2316	schtasks.exe
4624	schtasks.exe
872	schtasks.exe
4784	schtasks.exe
848	schtasks.exe
4248	schtasks.exe
1824	schtasks.exe
3184	schtasks.exe
3148	schtasks.exe
3864	schtasks.exe
3468	schtasks.exe
1712	schtasks.exe
3672	schtasks.exe
4644	schtasks.exe
3656	schtasks.exe
632	schtasks.exe
232	schtasks.exe
1784	schtasks.exe
3496	schtasks.exe
8	schtasks.exe
3276	schtasks.exe
1952	schtasks.exe
320	schtasks.exe
220	schtasks.exe
4124	schtasks.exe
2372	schtasks.exe
2872	schtasks.exe
3256	schtasks.exe
2684	schtasks.exe
400	schtasks.exe
2988	schtasks.exe
4148	schtasks.exe
2652	schtasks.exe
4264	schtasks.exe
3448	schtasks.exe
2356	schtasks.exe
3004	schtasks.exe
4580	schtasks.exe
3152	schtasks.exe
5100	schtasks.exe
4500	schtasks.exe
3980	schtasks.exe

Suspicious behavior: EnumeratesProcesses 61 IoCs

Processes:

3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.exe

pid	Process
1724	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
1724	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
1724	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
1724	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
1724	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
1724	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
1724	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
1724	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
1724	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
1724	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
1724	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
1724	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
1724	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
1724	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
1724	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
4568	powershell.exe
4568	powershell.exe
3260	powershell.exe
3260	powershell.exe
4044	powershell.exe
4044	powershell.exe
2304	powershell.exe
2304	powershell.exe
468	powershell.exe
468	powershell.exe
220	powershell.exe
220	powershell.exe
2888	powershell.exe
2888	powershell.exe
5020	powershell.exe
5020	powershell.exe
4228	powershell.exe
4228	powershell.exe
872	powershell.exe
872	powershell.exe
4568	powershell.exe
2100	powershell.exe
2100	powershell.exe
2100	powershell.exe
3260	powershell.exe
2888	powershell.exe
468	powershell.exe
4044	powershell.exe
220	powershell.exe
2304	powershell.exe
5020	powershell.exe
4228	powershell.exe
872	powershell.exe
4468	csrss.exe
2988	csrss.exe
1504	csrss.exe
4608	csrss.exe
2740	csrss.exe
3256	csrss.exe
1836	csrss.exe
3292	csrss.exe
4584	csrss.exe
4440	csrss.exe
2216	csrss.exe
2660	csrss.exe
3496	csrss.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

Processes:

description	pid	Process
Token: SeDebugPrivilege	1724	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Token: SeDebugPrivilege	4568	powershell.exe
Token: SeDebugPrivilege	4044	powershell.exe
Token: SeDebugPrivilege	3260	powershell.exe
Token: SeDebugPrivilege	2304	powershell.exe
Token: SeDebugPrivilege	468	powershell.exe
Token: SeDebugPrivilege	220	powershell.exe
Token: SeDebugPrivilege	2888	powershell.exe
Token: SeDebugPrivilege	5020	powershell.exe
Token: SeDebugPrivilege	4228	powershell.exe
Token: SeDebugPrivilege	872	powershell.exe
Token: SeDebugPrivilege	2100	powershell.exe
Token: SeDebugPrivilege	4468	csrss.exe
Token: SeDebugPrivilege	2988	csrss.exe
Token: SeDebugPrivilege	1504	csrss.exe
Token: SeDebugPrivilege	4608	csrss.exe
Token: SeDebugPrivilege	2740	csrss.exe
Token: SeDebugPrivilege	3256	csrss.exe
Token: SeDebugPrivilege	1836	csrss.exe
Token: SeDebugPrivilege	3292	csrss.exe
Token: SeDebugPrivilege	4584	csrss.exe
Token: SeDebugPrivilege	4440	csrss.exe
Token: SeDebugPrivilege	2216	csrss.exe
Token: SeDebugPrivilege	2660	csrss.exe
Token: SeDebugPrivilege	3496	csrss.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exetmpB9EC.tmp.execmd.execsrss.exetmp50C.tmp.exeWScript.execsrss.exetmp220A.tmp.exe

description	pid	Process	procid_target
PID 1724 wrote to memory of 2004	1724	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	139
PID 1724 wrote to memory of 2004	1724	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	139
PID 1724 wrote to memory of 2004	1724	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	139
PID 2004 wrote to memory of 3212	2004	tmpB9EC.tmp.exe	141
PID 2004 wrote to memory of 3212	2004	tmpB9EC.tmp.exe	141
PID 2004 wrote to memory of 3212	2004	tmpB9EC.tmp.exe	141
PID 2004 wrote to memory of 3212	2004	tmpB9EC.tmp.exe	141
PID 2004 wrote to memory of 3212	2004	tmpB9EC.tmp.exe	141
PID 2004 wrote to memory of 3212	2004	tmpB9EC.tmp.exe	141
PID 2004 wrote to memory of 3212	2004	tmpB9EC.tmp.exe	141
PID 1724 wrote to memory of 2100	1724	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	150
PID 1724 wrote to memory of 2100	1724	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	150
PID 1724 wrote to memory of 468	1724	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	151
PID 1724 wrote to memory of 468	1724	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	151
PID 1724 wrote to memory of 3260	1724	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	152
PID 1724 wrote to memory of 3260	1724	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	152
PID 1724 wrote to memory of 4044	1724	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	153
PID 1724 wrote to memory of 4044	1724	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	153
PID 1724 wrote to memory of 220	1724	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	154
PID 1724 wrote to memory of 220	1724	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	154
PID 1724 wrote to memory of 4568	1724	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	156
PID 1724 wrote to memory of 4568	1724	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	156
PID 1724 wrote to memory of 5020	1724	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	157
PID 1724 wrote to memory of 5020	1724	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	157
PID 1724 wrote to memory of 2304	1724	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	160
PID 1724 wrote to memory of 2304	1724	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	160
PID 1724 wrote to memory of 872	1724	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	163
PID 1724 wrote to memory of 872	1724	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	163
PID 1724 wrote to memory of 2888	1724	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	164
PID 1724 wrote to memory of 2888	1724	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	164
PID 1724 wrote to memory of 4228	1724	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	165
PID 1724 wrote to memory of 4228	1724	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	165
PID 1724 wrote to memory of 3004	1724	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	171
PID 1724 wrote to memory of 3004	1724	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	171
PID 3004 wrote to memory of 1788	3004	cmd.exe	174
PID 3004 wrote to memory of 1788	3004	cmd.exe	174
PID 3004 wrote to memory of 4468	3004	cmd.exe	179
PID 3004 wrote to memory of 4468	3004	cmd.exe	179
PID 4468 wrote to memory of 4100	4468	csrss.exe	181
PID 4468 wrote to memory of 4100	4468	csrss.exe	181
PID 4468 wrote to memory of 2828	4468	csrss.exe	182
PID 4468 wrote to memory of 2828	4468	csrss.exe	182
PID 4468 wrote to memory of 380	4468	csrss.exe	183
PID 4468 wrote to memory of 380	4468	csrss.exe	183
PID 4468 wrote to memory of 380	4468	csrss.exe	183
PID 380 wrote to memory of 4936	380	tmp50C.tmp.exe	185
PID 380 wrote to memory of 4936	380	tmp50C.tmp.exe	185
PID 380 wrote to memory of 4936	380	tmp50C.tmp.exe	185
PID 380 wrote to memory of 4936	380	tmp50C.tmp.exe	185
PID 380 wrote to memory of 4936	380	tmp50C.tmp.exe	185
PID 380 wrote to memory of 4936	380	tmp50C.tmp.exe	185
PID 380 wrote to memory of 4936	380	tmp50C.tmp.exe	185
PID 4100 wrote to memory of 2988	4100	WScript.exe	188
PID 4100 wrote to memory of 2988	4100	WScript.exe	188
PID 2988 wrote to memory of 2140	2988	csrss.exe	190
PID 2988 wrote to memory of 2140	2988	csrss.exe	190
PID 2988 wrote to memory of 2372	2988	csrss.exe	191
PID 2988 wrote to memory of 2372	2988	csrss.exe	191
PID 2988 wrote to memory of 644	2988	csrss.exe	194
PID 2988 wrote to memory of 644	2988	csrss.exe	194
PID 2988 wrote to memory of 644	2988	csrss.exe	194
PID 644 wrote to memory of 3064	644	tmp220A.tmp.exe	196
PID 644 wrote to memory of 3064	644	tmp220A.tmp.exe	196
PID 644 wrote to memory of 3064	644	tmp220A.tmp.exe	196

System policy modification 1 TTPs 42 IoCs

evasion

Modify Registry

T1112

Processes:

csrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.exe3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.execsrss.execsrss.execsrss.execsrss.execsrss.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
"C:\Users\Admin\AppData\Local\Temp\3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe"
1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1724
- C:\Users\Admin\AppData\Local\Temp\tmpB9EC.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmpB9EC.tmp.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2004
- - C:\Users\Admin\AppData\Local\Temp\tmpB9EC.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmpB9EC.tmp.exe"
    3⤵
    - Executes dropped EXE
    PID:3212
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2100
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:468
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3260
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4044
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:220
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4568
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5020
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2304
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:872
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2888
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4228
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\i4H4mZQsoo.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3004
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:1788
- - C:\Users\Default\Links\csrss.exe
    "C:\Users\Default\Links\csrss.exe"
    3⤵
    - UAC bypass
    - Checks computer location settings
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:4468
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0d50ef3f-0600-49c9-990b-ba462dcefae7.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4100
    - - C:\Users\Default\Links\csrss.exe
        
        C:\Users\Default\Links\csrss.exe
        5⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2988
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1a19143b-43ba-4683-a002-947368f20872.vbs"
        6⤵
        
        PID:2140
        
        C:\Users\Default\Links\csrss.exe
        
        C:\Users\Default\Links\csrss.exe
        7⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1504
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\80f15865-99be-4a2f-8ee7-daeb99980d31.vbs"
        8⤵
        
        PID:4824
        
        C:\Users\Default\Links\csrss.exe
        
        C:\Users\Default\Links\csrss.exe
        9⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4608
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\05249ae2-b9a0-4782-a2d0-d7d822c1559c.vbs"
        10⤵
        
        PID:3880
        
        C:\Users\Default\Links\csrss.exe
        
        C:\Users\Default\Links\csrss.exe
        11⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2740
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\030528c0-16c7-45f1-95bd-93d778cad916.vbs"
        12⤵
        
        PID:556
        
        C:\Users\Default\Links\csrss.exe
        
        C:\Users\Default\Links\csrss.exe
        13⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3256
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6166217c-509b-45db-8875-363c7a618c8f.vbs"
        14⤵
        
        PID:1692
        
        C:\Users\Default\Links\csrss.exe
        
        C:\Users\Default\Links\csrss.exe
        15⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1836
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ef0109cb-c1ad-48b7-8ffa-683ea128b6d4.vbs"
        16⤵
        
        PID:4716
        
        C:\Users\Default\Links\csrss.exe
        
        C:\Users\Default\Links\csrss.exe
        17⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3292
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2ab0a590-15ca-428f-876e-1df72772e6b1.vbs"
        18⤵
        
        PID:4528
        
        C:\Users\Default\Links\csrss.exe
        
        C:\Users\Default\Links\csrss.exe
        19⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4584
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fb358c9e-5f1e-43b9-abd8-463e8c345aac.vbs"
        20⤵
        
        PID:3448
        
        C:\Users\Default\Links\csrss.exe
        
        C:\Users\Default\Links\csrss.exe
        21⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4440
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\253ff381-6f20-42e8-91a3-7160ad8d7cd0.vbs"
        22⤵
        
        PID:1576
        
        C:\Users\Default\Links\csrss.exe
        
        C:\Users\Default\Links\csrss.exe
        23⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2216
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\05be7670-b334-43df-be87-8b1d92177616.vbs"
        24⤵
        
        PID:3992
        
        C:\Users\Default\Links\csrss.exe
        
        C:\Users\Default\Links\csrss.exe
        25⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2660
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c3f72690-15e2-43a9-a507-2f3f8432de08.vbs"
        26⤵
        
        PID:2224
        
        C:\Users\Default\Links\csrss.exe
        
        C:\Users\Default\Links\csrss.exe
        27⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3496
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7b6b8a5c-afa2-43b7-ae0f-b9b05a434a02.vbs"
        26⤵
        
        PID:3768
        
        C:\Users\Admin\AppData\Local\Temp\tmpBACA.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpBACA.tmp.exe"
        26⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1532
        
        C:\Users\Admin\AppData\Local\Temp\tmpBACA.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpBACA.tmp.exe"
        27⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:864
        
        C:\Users\Admin\AppData\Local\Temp\tmpBACA.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpBACA.tmp.exe"
        28⤵
        Executes dropped EXE
        
        PID:3880
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0a07f606-70e9-44a6-84ad-01881165f3be.vbs"
        24⤵
        
        PID:4824
        
        C:\Users\Admin\AppData\Local\Temp\tmp8AB2.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp8AB2.tmp.exe"
        24⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3308
        
        C:\Users\Admin\AppData\Local\Temp\tmp8AB2.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp8AB2.tmp.exe"
        25⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3608
        
        C:\Users\Admin\AppData\Local\Temp\tmp8AB2.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp8AB2.tmp.exe"
        26⤵
        Executes dropped EXE
        
        PID:3356
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f14a7487-1cfe-4ac9-a67b-bbb42ae4b1e8.vbs"
        22⤵
        
        PID:3420
        
        C:\Users\Admin\AppData\Local\Temp\tmp5A2C.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp5A2C.tmp.exe"
        22⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3812
        
        C:\Users\Admin\AppData\Local\Temp\tmp5A2C.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp5A2C.tmp.exe"
        23⤵
        Executes dropped EXE
        
        PID:3528
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2dc8776a-741d-4a65-8272-62d0c573dcf4.vbs"
        20⤵
        
        PID:5056
        
        C:\Users\Admin\AppData\Local\Temp\tmp2968.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp2968.tmp.exe"
        20⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4740
        
        C:\Users\Admin\AppData\Local\Temp\tmp2968.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp2968.tmp.exe"
        21⤵
        Executes dropped EXE
        
        PID:2340
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\50f9253c-d8e0-48f7-96a6-0547f5f389b2.vbs"
        18⤵
        
        PID:2656
        
        C:\Users\Admin\AppData\Local\Temp\tmpDD1.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpDD1.tmp.exe"
        18⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3060
        
        C:\Users\Admin\AppData\Local\Temp\tmpDD1.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpDD1.tmp.exe"
        19⤵
        Executes dropped EXE
        
        PID:2140
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e432bdd1-2f89-4a18-ad81-ca9b3fcebe33.vbs"
        16⤵
        
        PID:4840
        
        C:\Users\Admin\AppData\Local\Temp\tmpF0C4.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpF0C4.tmp.exe"
        16⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4808
        
        C:\Users\Admin\AppData\Local\Temp\tmpF0C4.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpF0C4.tmp.exe"
        17⤵
        Executes dropped EXE
        
        PID:1192
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a1b071a5-5a07-4544-9060-d79ff21a12ea.vbs"
        14⤵
        
        PID:2612
        
        C:\Users\Admin\AppData\Local\Temp\tmpBE69.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpBE69.tmp.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:624
        
        C:\Users\Admin\AppData\Local\Temp\tmpBE69.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpBE69.tmp.exe"
        15⤵
        Executes dropped EXE
        
        PID:4584
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3312e92c-2f6d-499c-8aa2-16b912adb68e.vbs"
        12⤵
        
        PID:1084
        
        C:\Users\Admin\AppData\Local\Temp\tmp8E22.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp8E22.tmp.exe"
        12⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2216
        
        C:\Users\Admin\AppData\Local\Temp\tmp8E22.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp8E22.tmp.exe"
        13⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4804
        
        C:\Users\Admin\AppData\Local\Temp\tmp8E22.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp8E22.tmp.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2988
        
        C:\Users\Admin\AppData\Local\Temp\tmp8E22.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp8E22.tmp.exe"
        15⤵
        Executes dropped EXE
        
        PID:2568
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fdcce4a0-9dd5-4fc2-8aee-4005e526199a.vbs"
        10⤵
        
        PID:4404
        
        C:\Users\Admin\AppData\Local\Temp\tmp70D6.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp70D6.tmp.exe"
        10⤵
        
        PID:2332
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\127e46a4-344a-4b48-9dff-b544dbffd7bb.vbs"
        8⤵
        
        PID:632
        
        C:\Users\Admin\AppData\Local\Temp\tmp5399.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp5399.tmp.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4632
        
        C:\Users\Admin\AppData\Local\Temp\tmp5399.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp5399.tmp.exe"
        9⤵
        Executes dropped EXE
        
        PID:468
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f94b8242-18bb-43a6-964f-0cbb778a468e.vbs"
        6⤵
        
        PID:2372
      - C:\Users\Admin\AppData\Local\Temp\tmp220A.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp220A.tmp.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:644
        
        C:\Users\Admin\AppData\Local\Temp\tmp220A.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp220A.tmp.exe"
        7⤵
        Executes dropped EXE
        
        PID:3064
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e8d9f157-f3dc-4c9f-865c-97e2b4350d33.vbs"
      4⤵
      PID:2828
  - - C:\Users\Admin\AppData\Local\Temp\tmp50C.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp50C.tmp.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:380
    - - C:\Users\Admin\AppData\Local\Temp\tmp50C.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp50C.tmp.exe"
        5⤵
        Executes dropped EXE
        
        PID:4936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\Users\Public\Documents\My Pictures\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Public\Documents\My Pictures\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\Users\Public\Documents\My Pictures\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Program Files\Google\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\Google\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Program Files\Google\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\Windows\Branding\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\Branding\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Windows\Branding\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\Links\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Users\Admin\Links\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\Links\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Users\Default\Links\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default\Links\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Users\Default\Links\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\Desktop\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Users\All Users\Desktop\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\Desktop\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:8

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\Windows\INF\wsearchidxpi\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\INF\wsearchidxpi\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Windows\INF\wsearchidxpi\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Users\All Users\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Windows\LiveKernelReports\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\LiveKernelReports\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Windows\LiveKernelReports\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Sidebar\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Sidebar\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 7 /tr "'C:\Program Files\Crashpad\reports\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files\Crashpad\reports\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 13 /tr "'C:\Program Files\Crashpad\reports\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Common Files\System\msadc\en-US\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\System\msadc\en-US\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Common Files\System\msadc\en-US\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\unsecapp.exe

Filesize
4.9MB

MD5
3e5dd01b1274862015760e1ed628d914

SHA1
2a2d43da6f8b5fd3f2a8212de7876cf629a72111

SHA256
f4d1a04c79026bb5e69e7175c3e0f68c98e792a1ef1a644950c0dc0e00656d30

SHA512
186701cad7a127d0e635372f039fa376c80b9cc7cca4bea31f352fe4669a338f442352a0cf0b1d700870ef2f8a5df0897d748eb6ab0f3cab386a1d0836a0f5be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\csrss.exe.log

Filesize
1KB

MD5
4a667f150a4d1d02f53a9f24d89d53d1

SHA1
306e125c9edce66f28fdb63e6c4ca5c9ad6e8c97

SHA256
414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd

SHA512
4edd8e73ce03488a6d92750a782cd4042fbb54a5b3f8d8ba3ea227fda0653c2cd84f0c5d64976c7cdc1f518a2fdc8ff10e2a015ec7acf3cd01b0d62bc98542d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d3e9c29fe44e90aae6ed30ccf799ca8

SHA1
c7974ef72264bbdf13a2793ccf1aed11bc565dce

SHA256
2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

SHA512
60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e448fe0d240184c6597a31d3be2ced58

SHA1
372b8d8c19246d3e38cd3ba123cc0f56070f03cd

SHA256
c660f0db85a1e7f0f68db19868979bf50bd541531babf77a701e1b1ce5e6a391

SHA512
0b7f7eae7700d32b18eee3677cb7f89b46ace717fa7e6b501d6c47d54f15dff7e12b49f5a7d36a6ffe4c16165c7d55162db4f3621db545b6af638035752beab4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e243a38635ff9a06c87c2a61a2200656

SHA1
ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc

SHA256
af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f

SHA512
4418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
bd5940f08d0be56e65e5f2aaf47c538e

SHA1
d7e31b87866e5e383ab5499da64aba50f03e8443

SHA256
2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

SHA512
c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
59d97011e091004eaffb9816aa0b9abd

SHA1
1602a56b01dd4b7c577ca27d3117e4bcc1aa657b

SHA256
18f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d

SHA512
d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\030528c0-16c7-45f1-95bd-93d778cad916.vbs

Filesize
708B

MD5
7cb793c2c776c0ec66aadc84c178f767

SHA1
67688c52db1a41862faf24febb4b9186979531ad

SHA256
a853893f3abcf598d1eeabec15a788bc6cc04ab41ee4268e8412189a81e0c0e7

SHA512
98f76b4da9b2b32130d2226ded7ecb9326514582dcee38ab00712fd3b010a8da54716753a21af0beeb6aae82e4e344d278fb15e68a2ca69d1ca198a7fc914783

Download Submit
C:\Users\Admin\AppData\Local\Temp\05249ae2-b9a0-4782-a2d0-d7d822c1559c.vbs

Filesize
708B

MD5
c247a3737b834e8ae7cf8abc205336ff

SHA1
c5a46c864701fdef73b88f2119927c87d501db7a

SHA256
934812bb34bb7f12a572e3e754d658efea6626819926bec969eef976924a2e3d

SHA512
ab922b051b94d93c8620dcd97206dfd2af2c95a7003d7844458ab3ae581e988f1a890f50016e37bf8452b9ab510b09dcb3ca4f31bc5e04f026eea24f7dce4e9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\0d50ef3f-0600-49c9-990b-ba462dcefae7.vbs

Filesize
708B

MD5
1f579c5d94c73f0af3988b712c4915f3

SHA1
b834a9953893f88983fc177ca41cfebe991fc3fb

SHA256
50a7fb487d7e1d0ec50cc345a22b7b54f67cb4160877c8aa24f01ef688997e5b

SHA512
50221922e9d06cf2cccb023fb47011df4975365b8491ba7543be361d41941a46ae3d7e570bb81c7935440d69f5ce28ec6eab094c366f1f9ae84d5b79dbdaf670

Download Submit
C:\Users\Admin\AppData\Local\Temp\1a19143b-43ba-4683-a002-947368f20872.vbs

Filesize
708B

MD5
aa29d8c7f24e986c9c1e14bcdb6785cc

SHA1
6b5e366c750269557a64b172c187c09f74640eb0

SHA256
9801e1d28c56c415f058a35ffc1587795087762ae68900c0720f06ae6d58ce3e

SHA512
dd3d46cec5a9ea6527b4445e5204bf5830fdcb4737f9e7fd8239c3141161b58ecde3780fca1e74bdcda9577dc3244f3e04892affbdb1ef595017d04da35f954d

Download Submit
C:\Users\Admin\AppData\Local\Temp\6166217c-509b-45db-8875-363c7a618c8f.vbs

Filesize
708B

MD5
8c0e37a0e249461be365e65516e72b42

SHA1
07da0533b9e1fcc1b460de4ffac0f9c7840daae1

SHA256
ec13c4b6bf73b460ae73d183267be4ed75fbae6ab99443be16246f9b76493161

SHA512
db0ced4fefaf31211e55402cdb93013d1a2e03ec9e91d387ba46f8737021605fdb546eff8a308cea38aa48923662d733d7a53553b85da5258f30d6e7b87b5e1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\80f15865-99be-4a2f-8ee7-daeb99980d31.vbs

Filesize
708B

MD5
ebdfe1431953f2fa8c0907398c7ced77

SHA1
7b734bc35ec88c5b97dd4d4844b808de3c40f9b3

SHA256
2e4e078bdc2b8ac9c99d662c01e7e6a94d4e9ab2a4fc214b9770b3ab9e83e7eb

SHA512
b69e39a5942aad01aa3f8a1f254b2f9668e930b5fa0fc5d51246ba591136e34af62f81bc41c56c5af496f65271c17116e0dd8c57f89fd389eff3d53aa14ed151

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ubasbfyr.wxi.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\b4755bd2710fc18d967eced899ef82e2d75fbf1a.exe

Filesize
4.9MB

MD5
4f3c75cbf4635d29558eb862a9546d34

SHA1
32d78c2795d7ba0d3a2d9ac4eb899456aaf729b7

SHA256
c80af7d13f9605875b53a0be2f03adc60af954272f1332dc64f9df6a916612cd

SHA512
430cbb05a3beae603d126aa82ff469f035f5acd7b67e3b4a7752f93dce71f95134093fc76b043875deba4ef8006b13965a72bbe42b1bac6220766bb70c0ba102

Download Submit
C:\Users\Admin\AppData\Local\Temp\e8d9f157-f3dc-4c9f-865c-97e2b4350d33.vbs

Filesize
484B

MD5
e5cfc892e614ca13b43c70c17d025af0

SHA1
7865271ae4d862fe022c1921ad426dca04f0d1ea

SHA256
71a7303e60c4fad5c3d97cd995119c946a8a0675a22cfb088b4cd9c8cff4b56a

SHA512
5a8a63cd989f451d641668495edf9972b9f6cdc853ec13682c76fdffa478195928a5f5b1cbf479a01f899c0990e05b8c5ddbd284361ae89c514ec4d068f2efcc

Download Submit
C:\Users\Admin\AppData\Local\Temp\ef0109cb-c1ad-48b7-8ffa-683ea128b6d4.vbs

Filesize
708B

MD5
a8238df26e83c5f5329316db32ac05be

SHA1
a5cac3264f69df2074670014599d910531ac75d6

SHA256
78eef6344c5b9e0a30afd953269427758442b127ca9ed7703ef992aeccbfdeb8

SHA512
ba872e79b288b27e3b58f6fcf6112c7b8ada6396e77994ff32058e9bd9da2ddb1ffe0b22d73ccc78011040095af7029ac66b6d63080c245dd20bdde247218232

Download Submit
C:\Users\Admin\AppData\Local\Temp\i4H4mZQsoo.bat

Filesize
197B

MD5
622828981ab7a0e8d1e71616503276b7

SHA1
4a13c05fd59cf8b5018338d9ec70de620bae76c5

SHA256
32c46ad0e5c7308f067c40b3d2a470845c52a7d47560b3eef50c8d91700019ca

SHA512
287caaf47f6e1dbd5a6835ab6739826759a5b9226c954c45595d051ea2870c46107c90e6e0f4a81bc60f77886c7d39e8cfa0dd2b246c4ada0f5a3ac546e0ae42

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpB9EC.tmp.exe

Filesize
75KB

MD5
e0a68b98992c1699876f818a22b5b907

SHA1
d41e8ad8ba51217eb0340f8f69629ccb474484d0

SHA256
2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

SHA512
856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

Download Submit
C:\Users\Admin\Links\TextInputHost.exe

Filesize
4.9MB

MD5
a3f2103c4f5ac8042b106094412ec0d9

SHA1
55d76c32a1a7d471364add79e90dcf03a48ee226

SHA256
3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef

SHA512
2949789e3862a1e406ae20489134cab6a803702941be4e5730189a61a29265b2b170a5bc03340c165a8864936c8791da109eba25f2152f5be13c8d273346effe

Download Submit
memory/1724-12-0x000000001BFF0000-0x000000001C518000-memory.dmp

Filesize
5.2MB

Download
memory/1724-11-0x000000001B300000-0x000000001B312000-memory.dmp

Filesize
72KB

Download
memory/1724-199-0x00007FFF769F0000-0x00007FFF774B1000-memory.dmp

Filesize
10.8MB

Download
memory/1724-142-0x00007FFF769F3000-0x00007FFF769F5000-memory.dmp

Filesize
8KB

Download
memory/1724-1-0x0000000000060000-0x0000000000554000-memory.dmp

Filesize
5.0MB

Download
memory/1724-2-0x00007FFF769F0000-0x00007FFF774B1000-memory.dmp

Filesize
10.8MB

Download
memory/1724-17-0x000000001BAF0000-0x000000001BAF8000-memory.dmp

Filesize
32KB

Download
memory/1724-18-0x000000001BC00000-0x000000001BC0C000-memory.dmp

Filesize
48KB

Download
memory/1724-16-0x000000001BAE0000-0x000000001BAE8000-memory.dmp

Filesize
32KB

Download
memory/1724-13-0x000000001B310000-0x000000001B31A000-memory.dmp

Filesize
40KB

Download
memory/1724-14-0x000000001BAC0000-0x000000001BACE000-memory.dmp

Filesize
56KB

Download
memory/1724-15-0x000000001BAD0000-0x000000001BADE000-memory.dmp

Filesize
56KB

Download
memory/1724-0-0x00007FFF769F3000-0x00007FFF769F5000-memory.dmp

Filesize
8KB

Download
memory/1724-157-0x00007FFF769F0000-0x00007FFF774B1000-memory.dmp

Filesize
10.8MB

Download
memory/1724-10-0x0000000002710000-0x000000000271A000-memory.dmp

Filesize
40KB

Download
memory/1724-9-0x0000000002700000-0x0000000002710000-memory.dmp

Filesize
64KB

Download
memory/1724-6-0x00000000026C0000-0x00000000026C8000-memory.dmp

Filesize
32KB

Download
memory/1724-8-0x00000000026E0000-0x00000000026F6000-memory.dmp

Filesize
88KB

Download
memory/1724-7-0x00000000026D0000-0x00000000026E0000-memory.dmp

Filesize
64KB

Download
memory/1724-5-0x000000001BA70000-0x000000001BAC0000-memory.dmp

Filesize
320KB

Download
memory/1724-4-0x00000000026A0000-0x00000000026BC000-memory.dmp

Filesize
112KB

Download
memory/1724-3-0x000000001B330000-0x000000001B45E000-memory.dmp

Filesize
1.2MB

Download
memory/1836-465-0x000000001CF70000-0x000000001CF82000-memory.dmp

Filesize
72KB

Download
memory/2660-554-0x000000001DBF0000-0x000000001DC02000-memory.dmp

Filesize
72KB

Download
memory/3212-81-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/3260-217-0x000001A0C1070000-0x000001A0C1092000-memory.dmp

Filesize
136KB

Download