colibri | 19f67bb78038966f9f1efb51ced0819105088a530a32bed8fb0df7b5d47e3f39

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2024 20:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

19f67bb78038966f9f1efb51ced0819105088a530a32bed8fb0df7b5d47e3f39.exe
Size

4.9MB
MD5

1487016c15b347c8975ccf3fab67a56b
SHA1

7b7135f7ad70842ae1649f7896c1248575a5d421
SHA256

19f67bb78038966f9f1efb51ced0819105088a530a32bed8fb0df7b5d47e3f39
SHA512

cd021c8329cd45bc769da1b0505db2752c6e0eb2c7af8c62bcedd0e8307e6e7963e7301769cc04729e9634ac81eeb6f598e50d5890da4076022bd90dbc4f04c2
SSDEEP

49152:bl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:

Score

10^/10

colibri dcrat build1 discovery evasion execution infostealer loader rat trojan

Malware Config

Extracted

Family

colibri

Version

1.2.0

Botnet

Build1

http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php

http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php

rc4.plain

Signatures

Colibri Loader
A loader sold as MaaS first seen in August 2021.
loader colibri
Colibri family
colibri
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 33 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	804	1476	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1748	1476	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5100	1476	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3492	1476	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4392	1476	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3136	1476	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5088	1476	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2996	1476	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5076	1476	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4384	1476	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4932	1476	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2896	1476	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	524	1476	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1396	1476	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1696	1476	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2400	1476	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1480	1476	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2672	1476	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2044	1476	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3148	1476	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2724	1476	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2568	1476	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1080	1476	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1948	1476	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3196	1476	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2900	1476	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2660	1476	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2840	1476	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2924	1476	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1460	1476	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2328	1476	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1348	1476	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2312	1476	schtasks.exe	82

UAC bypass 3 TTPs 39 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	19f67bb78038966f9f1efb51ced0819105088a530a32bed8fb0df7b5d47e3f39.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	19f67bb78038966f9f1efb51ced0819105088a530a32bed8fb0df7b5d47e3f39.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	19f67bb78038966f9f1efb51ced0819105088a530a32bed8fb0df7b5d47e3f39.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/3480-2-0x000000001BF00000-0x000000001C02E000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4276	powershell.exe
436	powershell.exe
3128	powershell.exe
508	powershell.exe
1628	powershell.exe
2500	powershell.exe
4260	powershell.exe
4992	powershell.exe
4620	powershell.exe
4256	powershell.exe
4904	powershell.exe

Checks computer location settings 2 TTPs 12 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	19f67bb78038966f9f1efb51ced0819105088a530a32bed8fb0df7b5d47e3f39.exe

Executes dropped EXE 40 IoCs

pid	Process
4908	tmpAEC0.tmp.exe
4192	tmpAEC0.tmp.exe
4808	csrss.exe
1748	tmpEC06.tmp.exe
2380	tmpEC06.tmp.exe
2016	tmpEC06.tmp.exe
724	csrss.exe
3944	tmpCEC.tmp.exe
4620	tmpCEC.tmp.exe
4576	tmpCEC.tmp.exe
2660	csrss.exe
2316	tmp2A86.tmp.exe
4968	tmp2A86.tmp.exe
5032	csrss.exe
1600	tmp5CB1.tmp.exe
2724	tmp5CB1.tmp.exe
3884	csrss.exe
4164	tmp90F0.tmp.exe
1948	tmp90F0.tmp.exe
3832	tmp90F0.tmp.exe
4276	csrss.exe
64	tmpC54F.tmp.exe
3628	tmpC54F.tmp.exe
4516	tmpC54F.tmp.exe
4868	csrss.exe
2200	tmpF73C.tmp.exe
508	tmpF73C.tmp.exe
3660	csrss.exe
1816	tmp2ADF.tmp.exe
5024	tmp2ADF.tmp.exe
4620	csrss.exe
3868	tmp5CFB.tmp.exe
2600	tmp5CFB.tmp.exe
4948	csrss.exe
4844	tmp908E.tmp.exe
2844	tmp908E.tmp.exe
864	csrss.exe
1048	tmpC317.tmp.exe
2596	tmpC317.tmp.exe
2564	csrss.exe

Checks whether UAC is enabled 1 TTPs 26 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	19f67bb78038966f9f1efb51ced0819105088a530a32bed8fb0df7b5d47e3f39.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	19f67bb78038966f9f1efb51ced0819105088a530a32bed8fb0df7b5d47e3f39.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe

Suspicious use of SetThreadContext 12 IoCs

description	pid	Process	procid_target
PID 4908 set thread context of 4192	4908	tmpAEC0.tmp.exe	118
PID 2380 set thread context of 2016	2380	tmpEC06.tmp.exe	156
PID 4620 set thread context of 4576	4620	tmpCEC.tmp.exe	163
PID 2316 set thread context of 4968	2316	tmp2A86.tmp.exe	170
PID 1600 set thread context of 2724	1600	tmp5CB1.tmp.exe	177
PID 1948 set thread context of 3832	1948	tmp90F0.tmp.exe	184
PID 3628 set thread context of 4516	3628	tmpC54F.tmp.exe	191
PID 2200 set thread context of 508	2200	tmpF73C.tmp.exe	197
PID 1816 set thread context of 5024	1816	tmp2ADF.tmp.exe	203
PID 3868 set thread context of 2600	3868	tmp5CFB.tmp.exe	209
PID 4844 set thread context of 2844	4844	tmp908E.tmp.exe	215
PID 1048 set thread context of 2596	1048	tmpC317.tmp.exe	221

Drops file in Program Files directory 20 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\explorer.exe	19f67bb78038966f9f1efb51ced0819105088a530a32bed8fb0df7b5d47e3f39.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\7a0fd90576e088	19f67bb78038966f9f1efb51ced0819105088a530a32bed8fb0df7b5d47e3f39.exe
File opened for modification	C:\Program Files\Uninstall Information\OfficeClickToRun.exe	19f67bb78038966f9f1efb51ced0819105088a530a32bed8fb0df7b5d47e3f39.exe
File opened for modification	C:\Program Files\Microsoft Office 15\StartMenuExperienceHost.exe	19f67bb78038966f9f1efb51ced0819105088a530a32bed8fb0df7b5d47e3f39.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\sihost.exe	19f67bb78038966f9f1efb51ced0819105088a530a32bed8fb0df7b5d47e3f39.exe
File created	C:\Program Files\Uninstall Information\OfficeClickToRun.exe	19f67bb78038966f9f1efb51ced0819105088a530a32bed8fb0df7b5d47e3f39.exe
File created	C:\Program Files\VideoLAN\VLC\skins\taskhostw.exe	19f67bb78038966f9f1efb51ced0819105088a530a32bed8fb0df7b5d47e3f39.exe
File created	C:\Program Files (x86)\Windows Portable Devices\sihost.exe	19f67bb78038966f9f1efb51ced0819105088a530a32bed8fb0df7b5d47e3f39.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\skins\RCXB4DE.tmp	19f67bb78038966f9f1efb51ced0819105088a530a32bed8fb0df7b5d47e3f39.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\skins\taskhostw.exe	19f67bb78038966f9f1efb51ced0819105088a530a32bed8fb0df7b5d47e3f39.exe
File opened for modification	C:\Program Files\Microsoft Office 15\RCXB954.tmp	19f67bb78038966f9f1efb51ced0819105088a530a32bed8fb0df7b5d47e3f39.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\explorer.exe	19f67bb78038966f9f1efb51ced0819105088a530a32bed8fb0df7b5d47e3f39.exe
File created	C:\Program Files\VideoLAN\VLC\skins\ea9f0e6c9e2dcd	19f67bb78038966f9f1efb51ced0819105088a530a32bed8fb0df7b5d47e3f39.exe
File created	C:\Program Files\Microsoft Office 15\StartMenuExperienceHost.exe	19f67bb78038966f9f1efb51ced0819105088a530a32bed8fb0df7b5d47e3f39.exe
File opened for modification	C:\Program Files\Uninstall Information\RCXB2BA.tmp	19f67bb78038966f9f1efb51ced0819105088a530a32bed8fb0df7b5d47e3f39.exe
File created	C:\Program Files\Uninstall Information\e6c9b481da804f	19f67bb78038966f9f1efb51ced0819105088a530a32bed8fb0df7b5d47e3f39.exe
File created	C:\Program Files\Microsoft Office 15\55b276f4edf653	19f67bb78038966f9f1efb51ced0819105088a530a32bed8fb0df7b5d47e3f39.exe
File created	C:\Program Files (x86)\Windows Portable Devices\66fc9ff0ee96c2	19f67bb78038966f9f1efb51ced0819105088a530a32bed8fb0df7b5d47e3f39.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\RCXC222.tmp	19f67bb78038966f9f1efb51ced0819105088a530a32bed8fb0df7b5d47e3f39.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\RCXC437.tmp	19f67bb78038966f9f1efb51ced0819105088a530a32bed8fb0df7b5d47e3f39.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\ShellComponents\services.exe	19f67bb78038966f9f1efb51ced0819105088a530a32bed8fb0df7b5d47e3f39.exe
File created	C:\Windows\ShellComponents\c5b4cb5e9653cc	19f67bb78038966f9f1efb51ced0819105088a530a32bed8fb0df7b5d47e3f39.exe
File opened for modification	C:\Windows\ShellComponents\RCXBBE6.tmp	19f67bb78038966f9f1efb51ced0819105088a530a32bed8fb0df7b5d47e3f39.exe
File opened for modification	C:\Windows\ShellComponents\services.exe	19f67bb78038966f9f1efb51ced0819105088a530a32bed8fb0df7b5d47e3f39.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp5CB1.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpAEC0.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpCEC.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpCEC.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp90F0.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp90F0.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp908E.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpC317.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpEC06.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpEC06.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp2A86.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpF73C.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp2ADF.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp5CFB.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpC54F.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpC54F.tmp.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	19f67bb78038966f9f1efb51ced0819105088a530a32bed8fb0df7b5d47e3f39.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	csrss.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 33 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2900	schtasks.exe
2660	schtasks.exe
1748	schtasks.exe
2996	schtasks.exe
1396	schtasks.exe
1696	schtasks.exe
5076	schtasks.exe
524	schtasks.exe
5100	schtasks.exe
2896	schtasks.exe
1480	schtasks.exe
2724	schtasks.exe
804	schtasks.exe
4932	schtasks.exe
1948	schtasks.exe
3136	schtasks.exe
2400	schtasks.exe
2044	schtasks.exe
1348	schtasks.exe
5088	schtasks.exe
2924	schtasks.exe
2328	schtasks.exe
2312	schtasks.exe
3492	schtasks.exe
4384	schtasks.exe
3148	schtasks.exe
2840	schtasks.exe
3196	schtasks.exe
1460	schtasks.exe
4392	schtasks.exe
2672	schtasks.exe
2568	schtasks.exe
1080	schtasks.exe

Suspicious behavior: EnumeratesProcesses 52 IoCs

pid	Process
3480	19f67bb78038966f9f1efb51ced0819105088a530a32bed8fb0df7b5d47e3f39.exe
3480	19f67bb78038966f9f1efb51ced0819105088a530a32bed8fb0df7b5d47e3f39.exe
3480	19f67bb78038966f9f1efb51ced0819105088a530a32bed8fb0df7b5d47e3f39.exe
3480	19f67bb78038966f9f1efb51ced0819105088a530a32bed8fb0df7b5d47e3f39.exe
3480	19f67bb78038966f9f1efb51ced0819105088a530a32bed8fb0df7b5d47e3f39.exe
3480	19f67bb78038966f9f1efb51ced0819105088a530a32bed8fb0df7b5d47e3f39.exe
3480	19f67bb78038966f9f1efb51ced0819105088a530a32bed8fb0df7b5d47e3f39.exe
4992	powershell.exe
4992	powershell.exe
508	powershell.exe
508	powershell.exe
4620	powershell.exe
4620	powershell.exe
4276	powershell.exe
4276	powershell.exe
1628	powershell.exe
1628	powershell.exe
3128	powershell.exe
3128	powershell.exe
4256	powershell.exe
4256	powershell.exe
4904	powershell.exe
4904	powershell.exe
2500	powershell.exe
2500	powershell.exe
4260	powershell.exe
4260	powershell.exe
508	powershell.exe
436	powershell.exe
436	powershell.exe
4256	powershell.exe
4260	powershell.exe
4992	powershell.exe
1628	powershell.exe
4904	powershell.exe
4620	powershell.exe
4276	powershell.exe
2500	powershell.exe
3128	powershell.exe
436	powershell.exe
4808	csrss.exe
724	csrss.exe
2660	csrss.exe
5032	csrss.exe
3884	csrss.exe
4276	csrss.exe
4868	csrss.exe
3660	csrss.exe
4620	csrss.exe
4948	csrss.exe
864	csrss.exe
2564	csrss.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeDebugPrivilege	3480	19f67bb78038966f9f1efb51ced0819105088a530a32bed8fb0df7b5d47e3f39.exe
Token: SeDebugPrivilege	4992	powershell.exe
Token: SeDebugPrivilege	4260	powershell.exe
Token: SeDebugPrivilege	4256	powershell.exe
Token: SeDebugPrivilege	508	powershell.exe
Token: SeDebugPrivilege	4276	powershell.exe
Token: SeDebugPrivilege	4620	powershell.exe
Token: SeDebugPrivilege	1628	powershell.exe
Token: SeDebugPrivilege	3128	powershell.exe
Token: SeDebugPrivilege	4904	powershell.exe
Token: SeDebugPrivilege	2500	powershell.exe
Token: SeDebugPrivilege	436	powershell.exe
Token: SeDebugPrivilege	4808	csrss.exe
Token: SeDebugPrivilege	724	csrss.exe
Token: SeDebugPrivilege	2660	csrss.exe
Token: SeDebugPrivilege	5032	csrss.exe
Token: SeDebugPrivilege	3884	csrss.exe
Token: SeDebugPrivilege	4276	csrss.exe
Token: SeDebugPrivilege	4868	csrss.exe
Token: SeDebugPrivilege	3660	csrss.exe
Token: SeDebugPrivilege	4620	csrss.exe
Token: SeDebugPrivilege	4948	csrss.exe
Token: SeDebugPrivilege	864	csrss.exe
Token: SeDebugPrivilege	2564	csrss.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3480 wrote to memory of 4908	3480	19f67bb78038966f9f1efb51ced0819105088a530a32bed8fb0df7b5d47e3f39.exe	116
PID 3480 wrote to memory of 4908	3480	19f67bb78038966f9f1efb51ced0819105088a530a32bed8fb0df7b5d47e3f39.exe	116
PID 3480 wrote to memory of 4908	3480	19f67bb78038966f9f1efb51ced0819105088a530a32bed8fb0df7b5d47e3f39.exe	116
PID 4908 wrote to memory of 4192	4908	tmpAEC0.tmp.exe	118
PID 4908 wrote to memory of 4192	4908	tmpAEC0.tmp.exe	118
PID 4908 wrote to memory of 4192	4908	tmpAEC0.tmp.exe	118
PID 4908 wrote to memory of 4192	4908	tmpAEC0.tmp.exe	118
PID 4908 wrote to memory of 4192	4908	tmpAEC0.tmp.exe	118
PID 4908 wrote to memory of 4192	4908	tmpAEC0.tmp.exe	118
PID 4908 wrote to memory of 4192	4908	tmpAEC0.tmp.exe	118
PID 3480 wrote to memory of 436	3480	19f67bb78038966f9f1efb51ced0819105088a530a32bed8fb0df7b5d47e3f39.exe	122
PID 3480 wrote to memory of 436	3480	19f67bb78038966f9f1efb51ced0819105088a530a32bed8fb0df7b5d47e3f39.exe	122
PID 3480 wrote to memory of 4260	3480	19f67bb78038966f9f1efb51ced0819105088a530a32bed8fb0df7b5d47e3f39.exe	123
PID 3480 wrote to memory of 4260	3480	19f67bb78038966f9f1efb51ced0819105088a530a32bed8fb0df7b5d47e3f39.exe	123
PID 3480 wrote to memory of 3128	3480	19f67bb78038966f9f1efb51ced0819105088a530a32bed8fb0df7b5d47e3f39.exe	124
PID 3480 wrote to memory of 3128	3480	19f67bb78038966f9f1efb51ced0819105088a530a32bed8fb0df7b5d47e3f39.exe	124
PID 3480 wrote to memory of 508	3480	19f67bb78038966f9f1efb51ced0819105088a530a32bed8fb0df7b5d47e3f39.exe	125
PID 3480 wrote to memory of 508	3480	19f67bb78038966f9f1efb51ced0819105088a530a32bed8fb0df7b5d47e3f39.exe	125
PID 3480 wrote to memory of 4904	3480	19f67bb78038966f9f1efb51ced0819105088a530a32bed8fb0df7b5d47e3f39.exe	126
PID 3480 wrote to memory of 4904	3480	19f67bb78038966f9f1efb51ced0819105088a530a32bed8fb0df7b5d47e3f39.exe	126
PID 3480 wrote to memory of 4256	3480	19f67bb78038966f9f1efb51ced0819105088a530a32bed8fb0df7b5d47e3f39.exe	127
PID 3480 wrote to memory of 4256	3480	19f67bb78038966f9f1efb51ced0819105088a530a32bed8fb0df7b5d47e3f39.exe	127
PID 3480 wrote to memory of 4276	3480	19f67bb78038966f9f1efb51ced0819105088a530a32bed8fb0df7b5d47e3f39.exe	128
PID 3480 wrote to memory of 4276	3480	19f67bb78038966f9f1efb51ced0819105088a530a32bed8fb0df7b5d47e3f39.exe	128
PID 3480 wrote to memory of 2500	3480	19f67bb78038966f9f1efb51ced0819105088a530a32bed8fb0df7b5d47e3f39.exe	129
PID 3480 wrote to memory of 2500	3480	19f67bb78038966f9f1efb51ced0819105088a530a32bed8fb0df7b5d47e3f39.exe	129
PID 3480 wrote to memory of 1628	3480	19f67bb78038966f9f1efb51ced0819105088a530a32bed8fb0df7b5d47e3f39.exe	131
PID 3480 wrote to memory of 1628	3480	19f67bb78038966f9f1efb51ced0819105088a530a32bed8fb0df7b5d47e3f39.exe	131
PID 3480 wrote to memory of 4620	3480	19f67bb78038966f9f1efb51ced0819105088a530a32bed8fb0df7b5d47e3f39.exe	132
PID 3480 wrote to memory of 4620	3480	19f67bb78038966f9f1efb51ced0819105088a530a32bed8fb0df7b5d47e3f39.exe	132
PID 3480 wrote to memory of 4992	3480	19f67bb78038966f9f1efb51ced0819105088a530a32bed8fb0df7b5d47e3f39.exe	133
PID 3480 wrote to memory of 4992	3480	19f67bb78038966f9f1efb51ced0819105088a530a32bed8fb0df7b5d47e3f39.exe	133
PID 3480 wrote to memory of 4160	3480	19f67bb78038966f9f1efb51ced0819105088a530a32bed8fb0df7b5d47e3f39.exe	143
PID 3480 wrote to memory of 4160	3480	19f67bb78038966f9f1efb51ced0819105088a530a32bed8fb0df7b5d47e3f39.exe	143
PID 4160 wrote to memory of 3144	4160	cmd.exe	147
PID 4160 wrote to memory of 3144	4160	cmd.exe	147
PID 4160 wrote to memory of 4808	4160	cmd.exe	150
PID 4160 wrote to memory of 4808	4160	cmd.exe	150
PID 4808 wrote to memory of 2084	4808	csrss.exe	151
PID 4808 wrote to memory of 2084	4808	csrss.exe	151
PID 4808 wrote to memory of 1028	4808	csrss.exe	152
PID 4808 wrote to memory of 1028	4808	csrss.exe	152
PID 4808 wrote to memory of 1748	4808	csrss.exe	153
PID 4808 wrote to memory of 1748	4808	csrss.exe	153
PID 4808 wrote to memory of 1748	4808	csrss.exe	153
PID 1748 wrote to memory of 2380	1748	tmpEC06.tmp.exe	155
PID 1748 wrote to memory of 2380	1748	tmpEC06.tmp.exe	155
PID 1748 wrote to memory of 2380	1748	tmpEC06.tmp.exe	155
PID 2380 wrote to memory of 2016	2380	tmpEC06.tmp.exe	156
PID 2380 wrote to memory of 2016	2380	tmpEC06.tmp.exe	156
PID 2380 wrote to memory of 2016	2380	tmpEC06.tmp.exe	156
PID 2380 wrote to memory of 2016	2380	tmpEC06.tmp.exe	156
PID 2380 wrote to memory of 2016	2380	tmpEC06.tmp.exe	156
PID 2380 wrote to memory of 2016	2380	tmpEC06.tmp.exe	156
PID 2380 wrote to memory of 2016	2380	tmpEC06.tmp.exe	156
PID 2084 wrote to memory of 724	2084	WScript.exe	157
PID 2084 wrote to memory of 724	2084	WScript.exe	157
PID 724 wrote to memory of 3204	724	csrss.exe	158
PID 724 wrote to memory of 3204	724	csrss.exe	158
PID 724 wrote to memory of 812	724	csrss.exe	159
PID 724 wrote to memory of 812	724	csrss.exe	159
PID 724 wrote to memory of 3944	724	csrss.exe	160
PID 724 wrote to memory of 3944	724	csrss.exe	160
PID 724 wrote to memory of 3944	724	csrss.exe	160

System policy modification 1 TTPs 39 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	19f67bb78038966f9f1efb51ced0819105088a530a32bed8fb0df7b5d47e3f39.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	19f67bb78038966f9f1efb51ced0819105088a530a32bed8fb0df7b5d47e3f39.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	19f67bb78038966f9f1efb51ced0819105088a530a32bed8fb0df7b5d47e3f39.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\19f67bb78038966f9f1efb51ced0819105088a530a32bed8fb0df7b5d47e3f39.exe
"C:\Users\Admin\AppData\Local\Temp\19f67bb78038966f9f1efb51ced0819105088a530a32bed8fb0df7b5d47e3f39.exe"
1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3480
- C:\Users\Admin\AppData\Local\Temp\tmpAEC0.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmpAEC0.tmp.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4908
- - C:\Users\Admin\AppData\Local\Temp\tmpAEC0.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmpAEC0.tmp.exe"
    3⤵
    - Executes dropped EXE
    PID:4192
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:436
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4260
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3128
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:508
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4904
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4256
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4276
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2500
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1628
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4620
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4992
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\2Wc5gw2wpr.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4160
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:3144
- - C:\Users\Admin\csrss.exe
    "C:\Users\Admin\csrss.exe"
    3⤵
    - UAC bypass
    - Checks computer location settings
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:4808
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\09add3be-bf87-46d5-a902-f560f55dbe04.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2084
    - - C:\Users\Admin\csrss.exe
        
        C:\Users\Admin\csrss.exe
        5⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:724
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5194c26a-ff65-4b26-96ae-8f8faeee18d4.vbs"
        6⤵
        
        PID:3204
        
        C:\Users\Admin\csrss.exe
        
        C:\Users\Admin\csrss.exe
        7⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2660
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f03c5a7e-90a0-4aeb-b8f5-73c3b821aed6.vbs"
        8⤵
        
        PID:2632
        
        C:\Users\Admin\csrss.exe
        
        C:\Users\Admin\csrss.exe
        9⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:5032
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8ea24515-bf2a-4268-b22e-b200cc96bb2a.vbs"
        10⤵
        
        PID:60
        
        C:\Users\Admin\csrss.exe
        
        C:\Users\Admin\csrss.exe
        11⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3884
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\15adb3cb-9f0c-4105-975e-1873d406b188.vbs"
        12⤵
        
        PID:1396
        
        C:\Users\Admin\csrss.exe
        
        C:\Users\Admin\csrss.exe
        13⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4276
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e7b56b78-5897-4d88-9554-cfe1e807c83f.vbs"
        14⤵
        
        PID:4476
        
        C:\Users\Admin\csrss.exe
        
        C:\Users\Admin\csrss.exe
        15⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4868
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dd783c30-f7d0-46c5-9840-9492f9096e56.vbs"
        16⤵
        
        PID:3888
        
        C:\Users\Admin\csrss.exe
        
        C:\Users\Admin\csrss.exe
        17⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3660
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\38c45ba6-7372-4e38-aa4d-c2eeaff8c6cd.vbs"
        18⤵
        
        PID:4676
        
        C:\Users\Admin\csrss.exe
        
        C:\Users\Admin\csrss.exe
        19⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4620
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\66936999-f9ef-4e18-9fe3-e2eff88cd4df.vbs"
        20⤵
        
        PID:3748
        
        C:\Users\Admin\csrss.exe
        
        C:\Users\Admin\csrss.exe
        21⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4948
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fd4870a7-6c80-41d2-bb65-fbebfbf313a3.vbs"
        22⤵
        
        PID:1696
        
        C:\Users\Admin\csrss.exe
        
        C:\Users\Admin\csrss.exe
        23⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:864
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6381e945-e077-4822-8345-6dbe2dc610d5.vbs"
        24⤵
        
        PID:4604
        
        C:\Users\Admin\csrss.exe
        
        C:\Users\Admin\csrss.exe
        25⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2564
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d7ee8286-7c6c-472f-8948-5a47d7dff4f5.vbs"
        24⤵
        
        PID:1768
        
        C:\Users\Admin\AppData\Local\Temp\tmpC317.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpC317.tmp.exe"
        24⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1048
        
        C:\Users\Admin\AppData\Local\Temp\tmpC317.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpC317.tmp.exe"
        25⤵
        Executes dropped EXE
        
        PID:2596
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fa041796-df57-476d-9da2-7a1af55fe52e.vbs"
        22⤵
        
        PID:2788
        
        C:\Users\Admin\AppData\Local\Temp\tmp908E.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp908E.tmp.exe"
        22⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4844
        
        C:\Users\Admin\AppData\Local\Temp\tmp908E.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp908E.tmp.exe"
        23⤵
        Executes dropped EXE
        
        PID:2844
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4f7111c5-015e-4ad4-8c1b-e1927f504c25.vbs"
        20⤵
        
        PID:4160
        
        C:\Users\Admin\AppData\Local\Temp\tmp5CFB.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp5CFB.tmp.exe"
        20⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3868
        
        C:\Users\Admin\AppData\Local\Temp\tmp5CFB.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp5CFB.tmp.exe"
        21⤵
        Executes dropped EXE
        
        PID:2600
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\18384b76-6d29-4116-9618-f185f5502655.vbs"
        18⤵
        
        PID:3652
        
        C:\Users\Admin\AppData\Local\Temp\tmp2ADF.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp2ADF.tmp.exe"
        18⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1816
        
        C:\Users\Admin\AppData\Local\Temp\tmp2ADF.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp2ADF.tmp.exe"
        19⤵
        Executes dropped EXE
        
        PID:5024
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ba983c67-4879-43a3-871d-0b90042788cf.vbs"
        16⤵
        
        PID:3508
        
        C:\Users\Admin\AppData\Local\Temp\tmpF73C.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpF73C.tmp.exe"
        16⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2200
        
        C:\Users\Admin\AppData\Local\Temp\tmpF73C.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpF73C.tmp.exe"
        17⤵
        Executes dropped EXE
        
        PID:508
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ed319de3-38dd-44fd-86ed-411727ebaace.vbs"
        14⤵
        
        PID:3512
        
        C:\Users\Admin\AppData\Local\Temp\tmpC54F.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpC54F.tmp.exe"
        14⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:64
        
        C:\Users\Admin\AppData\Local\Temp\tmpC54F.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpC54F.tmp.exe"
        15⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3628
        
        C:\Users\Admin\AppData\Local\Temp\tmpC54F.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpC54F.tmp.exe"
        16⤵
        Executes dropped EXE
        
        PID:4516
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f494687b-d05f-49ee-9842-3e2d3882791d.vbs"
        12⤵
        
        PID:2084
        
        C:\Users\Admin\AppData\Local\Temp\tmp90F0.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp90F0.tmp.exe"
        12⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4164
        
        C:\Users\Admin\AppData\Local\Temp\tmp90F0.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp90F0.tmp.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1948
        
        C:\Users\Admin\AppData\Local\Temp\tmp90F0.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp90F0.tmp.exe"
        14⤵
        Executes dropped EXE
        
        PID:3832
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a50bc2d5-1505-44b6-a87e-945ad463b470.vbs"
        10⤵
        
        PID:4720
        
        C:\Users\Admin\AppData\Local\Temp\tmp5CB1.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp5CB1.tmp.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1600
        
        C:\Users\Admin\AppData\Local\Temp\tmp5CB1.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp5CB1.tmp.exe"
        11⤵
        Executes dropped EXE
        
        PID:2724
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\65cd39a4-17b3-4447-b5fb-305a8ee7c3ab.vbs"
        8⤵
        
        PID:4424
        
        C:\Users\Admin\AppData\Local\Temp\tmp2A86.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp2A86.tmp.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2316
        
        C:\Users\Admin\AppData\Local\Temp\tmp2A86.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp2A86.tmp.exe"
        9⤵
        Executes dropped EXE
        
        PID:4968
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7f1253cc-fcf6-4b40-a140-7c28b28b58cd.vbs"
        6⤵
        
        PID:812
      - C:\Users\Admin\AppData\Local\Temp\tmpCEC.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpCEC.tmp.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3944
        
        C:\Users\Admin\AppData\Local\Temp\tmpCEC.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpCEC.tmp.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4620
        
        C:\Users\Admin\AppData\Local\Temp\tmpCEC.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpCEC.tmp.exe"
        8⤵
        Executes dropped EXE
        
        PID:4576
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\69dc89bc-5a75-46a1-b51b-ab7896b82cf1.vbs"
      4⤵
      PID:1028
  - - C:\Users\Admin\AppData\Local\Temp\tmpEC06.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmpEC06.tmp.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1748
    - - C:\Users\Admin\AppData\Local\Temp\tmpEC06.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpEC06.tmp.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2380
      - C:\Users\Admin\AppData\Local\Temp\tmpEC06.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpEC06.tmp.exe"
        6⤵
        Executes dropped EXE
        
        PID:2016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Admin\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 12 /tr "'C:\Program Files\Uninstall Information\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 7 /tr "'C:\Program Files\Uninstall Information\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 10 /tr "'C:\Program Files\VideoLAN\VLC\skins\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\skins\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 7 /tr "'C:\Program Files\VideoLAN\VLC\skins\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\Documents\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Users\All Users\Documents\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\Documents\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 8 /tr "'C:\Program Files\Microsoft Office 15\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 10 /tr "'C:\Program Files\Microsoft Office 15\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Windows\ShellComponents\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\ShellComponents\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Windows\ShellComponents\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\Local Settings\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Admin\Local Settings\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\Local Settings\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Users\Default User\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Portable Devices\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Portable Devices\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\csrss.exe.log

Filesize
1KB

MD5
4a667f150a4d1d02f53a9f24d89d53d1

SHA1
306e125c9edce66f28fdb63e6c4ca5c9ad6e8c97

SHA256
414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd

SHA512
4edd8e73ce03488a6d92750a782cd4042fbb54a5b3f8d8ba3ea227fda0653c2cd84f0c5d64976c7cdc1f518a2fdc8ff10e2a015ec7acf3cd01b0d62bc98542d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
bd5940f08d0be56e65e5f2aaf47c538e

SHA1
d7e31b87866e5e383ab5499da64aba50f03e8443

SHA256
2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

SHA512
c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

Download Submit
C:\Users\Admin\AppData\Local\Temp\09add3be-bf87-46d5-a902-f560f55dbe04.vbs

Filesize
700B

MD5
8d4c1e171a79aec33888cfb78b96dd9f

SHA1
e280566d4857499b2b0a922cbe776c8dd8f7e8e1

SHA256
5773e97cac0f4aed5a608743ea51b794a7c93e7af766fd35f1c642ec8f82bef6

SHA512
087485025d8acd3dfde413933218551c12ca7e0358f0b42a80961f30a2ea508ee230e6bad24e15dc04eb28e4765133387bdf88862631171752d6797325452bec

Download Submit
C:\Users\Admin\AppData\Local\Temp\15adb3cb-9f0c-4105-975e-1873d406b188.vbs

Filesize
700B

MD5
da12b9c33bde520d210452c87a57236a

SHA1
436bc3d670500d44e2aea94eaa05f339844c1e11

SHA256
2aa9bcd76e450b10f86b1c71a62c01ea5f7e0b542e625dbf18185fbace0d4857

SHA512
064edd9af31fb59c1e81fc338fe479d8efd964a78439f881e98a17fb001a58f15743999dd6cfa63f058bbcaac0a9f3d4bb7a4eb808f32ff32e6cb329ce02163a

Download Submit
C:\Users\Admin\AppData\Local\Temp\2Wc5gw2wpr.bat

Filesize
189B

MD5
5eac130a5d39fc3e4847f3d464b9aaeb

SHA1
50c93a9c734ac56ac0ae87d9be55f31a5b15c50d

SHA256
3ff5b7d2775e7594e6b60acc64485e7ce92649a99506bb7a650dc2ef2799eb79

SHA512
716e1cadc6e97bd1acb5f17ad837df9e1119d2e66e9eb49569f5ac61a6c1a8fee35b7eb713b537d5908651b78d012189045bfb7fb22dfaa1c9506cde166daa43

Download Submit
C:\Users\Admin\AppData\Local\Temp\5194c26a-ff65-4b26-96ae-8f8faeee18d4.vbs

Filesize
699B

MD5
6e76f3960b278eabd8a1deceb8731f6f

SHA1
89b036c9655f4a6f07bac11a06fdfca101353f7f

SHA256
c3d70d1f5e9bd6913ba0814b0fe7bde1b951033574d57d1ad601b3e707f96f5a

SHA512
8021196280564b5c69769e150ca34104e8ab976529bc2e2c1f986c3ac18143c575869ca8a9bf459f6c25a24b846b0046377de8719bfc170b4350b4fc8b56fc82

Download Submit
C:\Users\Admin\AppData\Local\Temp\69dc89bc-5a75-46a1-b51b-ab7896b82cf1.vbs

Filesize
476B

MD5
4f4fb05460260f0757c057ba5f0e05f2

SHA1
70e10697dd21695a1f527b3f713457c6b65cfac0

SHA256
769fe57e8e07481c0dffdb65b793ee1d1cf65e3a6c5ba9f609f85f019130ad3c

SHA512
35e54cc6cb9eadcc733f8bd255c5ac9499f20be0803f687dac91f6d974167fee9244f1ec52bdfb70aef6b6c2177581f28ad74c8a5c04d88db8592cf50ba0d23e

Download Submit
C:\Users\Admin\AppData\Local\Temp\8ea24515-bf2a-4268-b22e-b200cc96bb2a.vbs

Filesize
700B

MD5
799dd7aa9fb74c845cbf9060db6aa102

SHA1
9b041bf3bf7f803b7d0303f44beb8b42ead78f02

SHA256
217aed0a2ced92c0997b677e4b16ef667d9bff3519586bc7340e8dd4c949dbbc

SHA512
4725aca9a02e848acdf7bb4785ca67472aa39884bdc4c1b4052b654aee67ef6429f9928f715bcbfaa9c065b183cea9462786d34170f188df8e56a2a2d1f9a36e

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3vzao3ex.srg.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd783c30-f7d0-46c5-9840-9492f9096e56.vbs

Filesize
700B

MD5
9e666d32b72fa4e9cd3a759c32846f5b

SHA1
7a38726ba8bf76e8946438ee8e6b89acab2d5ebb

SHA256
d4120369da55ad568141907330bac0344297474b3f90e9c8cfcc1fa9ea29a39f

SHA512
1d090679e61ce947425a6101f3804247698249054c50d8ed0af6f329e09882aa4c5be12fd1788c219e79ad4715e89b429a3ebee1810d7792c5aa3c3094797adb

Download Submit
C:\Users\Admin\AppData\Local\Temp\e7b56b78-5897-4d88-9554-cfe1e807c83f.vbs

Filesize
700B

MD5
9f3fd990f0b928d8af8db5e422534174

SHA1
63810899b81a63c6fe33718637a5b4d983d0bbf7

SHA256
23c378c28f0ed3ec999d2f38f8c4b5cd348abb922f59272bfa2b3aa8db895c29

SHA512
38656cde21c930bd0fcf836989b0c8e5fe26542ac3d1d3b771a8ab5ac2e0e70c023eac289e0b7055cd302d2ca101acb60bb5c665c9fed527088a4b37f584808a

Download Submit
C:\Users\Admin\AppData\Local\Temp\f03c5a7e-90a0-4aeb-b8f5-73c3b821aed6.vbs

Filesize
700B

MD5
863f9c0dcf0380f54a22ff83b86cf876

SHA1
e2b1a195353da865f50d21dc863c0c2336308891

SHA256
5049c684eee364cc9eef9e248d67edaf085258e09c019719f8330637d4d62e92

SHA512
72e5b764757851bf89bfd6f3118a24420811f2004112d809418ebd5f818249fefc027c0f132af314ead31bf97a2bb1ee7fb8b81fccce5692dbe74c76f016dde7

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpAEC0.tmp.exe

Filesize
75KB

MD5
e0a68b98992c1699876f818a22b5b907

SHA1
d41e8ad8ba51217eb0340f8f69629ccb474484d0

SHA256
2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

SHA512
856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

Download Submit
C:\Users\Public\Documents\Registry.exe

Filesize
4.9MB

MD5
1487016c15b347c8975ccf3fab67a56b

SHA1
7b7135f7ad70842ae1649f7896c1248575a5d421

SHA256
19f67bb78038966f9f1efb51ced0819105088a530a32bed8fb0df7b5d47e3f39

SHA512
cd021c8329cd45bc769da1b0505db2752c6e0eb2c7af8c62bcedd0e8307e6e7963e7301769cc04729e9634ac81eeb6f598e50d5890da4076022bd90dbc4f04c2

Download Submit
memory/3480-10-0x000000001C660000-0x000000001C66A000-memory.dmp

Filesize
40KB

Download
memory/3480-11-0x000000001C670000-0x000000001C682000-memory.dmp

Filesize
72KB

Download
memory/3480-17-0x000000001C710000-0x000000001C718000-memory.dmp

Filesize
32KB

Download
memory/3480-16-0x000000001C700000-0x000000001C708000-memory.dmp

Filesize
32KB

Download
memory/3480-12-0x000000001CC00000-0x000000001D128000-memory.dmp

Filesize
5.2MB

Download
memory/3480-0-0x00007FF92F923000-0x00007FF92F925000-memory.dmp

Filesize
8KB

Download
memory/3480-137-0x00007FF92F920000-0x00007FF9303E1000-memory.dmp

Filesize
10.8MB

Download
memory/3480-2-0x000000001BF00000-0x000000001C02E000-memory.dmp

Filesize
1.2MB

Download
memory/3480-15-0x000000001C6F0000-0x000000001C6FE000-memory.dmp

Filesize
56KB

Download
memory/3480-14-0x000000001C6E0000-0x000000001C6EE000-memory.dmp

Filesize
56KB

Download
memory/3480-13-0x000000001C6D0000-0x000000001C6DA000-memory.dmp

Filesize
40KB

Download
memory/3480-18-0x000000001C820000-0x000000001C82C000-memory.dmp

Filesize
48KB

Download
memory/3480-5-0x000000001C680000-0x000000001C6D0000-memory.dmp

Filesize
320KB

Download
memory/3480-3-0x00007FF92F920000-0x00007FF9303E1000-memory.dmp

Filesize
10.8MB

Download
memory/3480-1-0x0000000000C80000-0x0000000001174000-memory.dmp

Filesize
5.0MB

Download
memory/3480-6-0x000000001BEA0000-0x000000001BEA8000-memory.dmp

Filesize
32KB

Download
memory/3480-9-0x000000001C650000-0x000000001C660000-memory.dmp

Filesize
64KB

Download
memory/3480-8-0x000000001C630000-0x000000001C646000-memory.dmp

Filesize
88KB

Download
memory/3480-7-0x000000001BEE0000-0x000000001BEF0000-memory.dmp

Filesize
64KB

Download
memory/3480-4-0x000000001BEC0000-0x000000001BEDC000-memory.dmp

Filesize
112KB

Download
memory/4192-67-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/4808-263-0x000000001C5E0000-0x000000001C5F2000-memory.dmp

Filesize
72KB

Download
memory/4992-143-0x000001C824AE0000-0x000001C824B02000-memory.dmp

Filesize
136KB

Download