dcrat | b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
05-12-2024 23:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
Size

4.9MB
MD5

736efb699e6c98e7714ac5c408182dcb
SHA1

5365421b2342d1e05d742affab93c76e7bc155e5
SHA256

b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667
SHA512

a9293424da54d3457c7a754b5f66324ed271ce066412b9690b8f1ed502a33501e680731c1818d2836eb68724d3236794534bc0f6fb2d75fb283d9033df3bcb98
SSDEEP

49152:jl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8n:n

Score

10^/10

dcrat evasion execution infostealer rat trojan

Malware Config

Signatures

DcRat 64 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		2864	schtasks.exe
File created	C:\Program Files (x86)\Internet Explorer\886983d96e3d3e		b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
		1852	schtasks.exe
		1704	schtasks.exe
		2184	schtasks.exe
		2492	schtasks.exe
		2480	schtasks.exe
		356	schtasks.exe
		2176	schtasks.exe
		1564	schtasks.exe
		2932	schtasks.exe
		2396	schtasks.exe
		2972	schtasks.exe
File created	C:\Windows\Registration\CRMLog\5940a34987c991		b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
		2916	schtasks.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA		b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
		2644	schtasks.exe
		1720	schtasks.exe
		1768	schtasks.exe
		1704	schtasks.exe
		2480	schtasks.exe
		304	schtasks.exe
		2344	schtasks.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\6203df4a6bafc7		b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
		1308	schtasks.exe
		1784	schtasks.exe
		2272	schtasks.exe
		2976	schtasks.exe
		1428	schtasks.exe
		332	schtasks.exe
		2384	schtasks.exe
		2116	schtasks.exe
		2228	schtasks.exe
		1576	schtasks.exe
		2456	schtasks.exe
		1392	schtasks.exe
		1576	schtasks.exe
		2472	schtasks.exe
		2800	schtasks.exe
		376	schtasks.exe
		2112	schtasks.exe
		2812	schtasks.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\0a1fd5f707cd16		b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
		1368	schtasks.exe
		2608	schtasks.exe
		2284	schtasks.exe
		784	schtasks.exe
		2192	schtasks.exe
File created	C:\Program Files\Windows Media Player\Network Sharing\7a0fd90576e088		b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
		1624	schtasks.exe
		1756	schtasks.exe
		2092	schtasks.exe
		2520	schtasks.exe
		1856	schtasks.exe
		2752	schtasks.exe
		2324	schtasks.exe
		848	schtasks.exe
		868	schtasks.exe
		2776	schtasks.exe
		2000	schtasks.exe
		2720	schtasks.exe
		3064	schtasks.exe
File created	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\886983d96e3d3e		b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
		1924	schtasks.exe

Dcrat family
dcrat

Process spawned unexpected child process 64 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2156	2876	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2800	2876	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2976	2876	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2712	2876	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2916	2876	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2812	2876	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1924	2876	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2708	2876	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2752	2876	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2396	2876	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	332	2876	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1576	2876	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2324	2876	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2564	2876	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	784	2876	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3064	2876	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1368	2876	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2932	2876	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2864	2876	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2112	2876	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1740	2876	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	376	2876	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2480	2876	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2644	2876	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2492	2876	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1980	2876	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2344	2876	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1984	2876	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1964	2876	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1720	2876	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1772	2876	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2192	2876	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2228	2876	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2224	2876	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1624	2876	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	848	2876	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1852	2876	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2456	2876	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1392	2876	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1308	2876	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	356	2876	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1704	2876	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1784	2876	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1768	2876	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2272	2876	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2608	2876	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1704	2876	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2184	2876	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	868	2876	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2972	2876	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2412	2876	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2976	2876	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1576	2876	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2496	2876	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2284	2876	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2924	2876	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2192	2876	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2176	2876	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2776	2876	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	784	2876	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2000	2876	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1756	2876	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2720	2876	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2472	2876	schtasks.exe	31

UAC bypass 3 TTPs 33 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/2316-2-0x000000001BD00000-0x000000001BE2E000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 36 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1580	powershell.exe
1908	powershell.exe
1588	powershell.exe
2700	powershell.exe
1960	powershell.exe
956	powershell.exe
1772	powershell.exe
1064	powershell.exe
2640	powershell.exe
2352	powershell.exe
2236	powershell.exe
2572	powershell.exe
2104	powershell.exe
2636	powershell.exe
2296	powershell.exe
3032	powershell.exe
580	powershell.exe
1508	powershell.exe
1708	powershell.exe
1588	powershell.exe
2528	powershell.exe
2444	powershell.exe
3036	powershell.exe
1396	powershell.exe
2860	powershell.exe
2872	powershell.exe
2524	powershell.exe
2492	powershell.exe
1496	powershell.exe
2300	powershell.exe
1444	powershell.exe
2220	powershell.exe
1748	powershell.exe
2360	powershell.exe
2040	powershell.exe
1960	powershell.exe

Executes dropped EXE 10 IoCs

pid	Process
2920	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
2124	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
1392	audiodg.exe
1076	audiodg.exe
2800	audiodg.exe
1940	audiodg.exe
2844	audiodg.exe
828	audiodg.exe
1188	audiodg.exe
1984	audiodg.exe

Checks whether UAC is enabled 1 TTPs 22 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	audiodg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	audiodg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	audiodg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	audiodg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe

Drops file in Program Files directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\sppsvc.exe	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
File created	C:\Program Files (x86)\Internet Explorer\7a0fd90576e088	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
File created	C:\Program Files (x86)\Internet Explorer\886983d96e3d3e	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\RCXDFDA.tmp	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\csrss.exe	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
File opened for modification	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\csrss.exe	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\lsm.exe	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
File created	C:\Program Files (x86)\Internet Explorer\explorer.exe	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\sppsvc.exe	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\smss.exe	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\RCXD75C.tmp	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\RCXDDD6.tmp	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
File created	C:\Program Files (x86)\Microsoft Office\7a0fd90576e088	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
File opened for modification	C:\Program Files (x86)\Google\Temp\sppsvc.exe	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
File opened for modification	C:\Program Files (x86)\Google\Temp\0a1fd5f707cd16	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\1033\lsm.exe	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\lsass.exe	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\6203df4a6bafc7	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
File created	C:\Program Files\Windows Media Player\Network Sharing\7a0fd90576e088	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
File created	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\886983d96e3d3e	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
File opened for modification	C:\Program Files\Windows Media Player\Network Sharing\RCXE1ED.tmp	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
File created	C:\Program Files (x86)\Google\Temp\0a1fd5f707cd16	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
File created	C:\Program Files\Windows Media Player\Network Sharing\explorer.exe	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
File created	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\csrss.exe	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
File opened for modification	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\RCXEA0C.tmp	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
File created	C:\Program Files (x86)\Google\Temp\sppsvc.exe	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
File opened for modification	C:\Program Files (x86)\Google\Temp\sppsvc.exe	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
File created	C:\Program Files (x86)\Microsoft Office\explorer.exe	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\0a1fd5f707cd16	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\explorer.exe	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
File created	C:\Program Files (x86)\Internet Explorer\csrss.exe	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\lsass.exe	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\101b941d020240	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
File opened for modification	C:\Program Files\Windows Media Player\Network Sharing\explorer.exe	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\explorer.exe	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File created	C:\Windows\Registration\CRMLog\dllhost.exe	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
File created	C:\Windows\Registration\CRMLog\5940a34987c991	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
File opened for modification	C:\Windows\Registration\CRMLog\dllhost.exe	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
File created	C:\Windows\Help\Corporate\audiodg.exe	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
File opened for modification	C:\Windows\DigitalLocker\ja-JP\RCXD960.tmp	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
File opened for modification	C:\Windows\security\logs\RCXDB65.tmp	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
File created	C:\Windows\Help\Corporate\42af1c969fbb7b	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
File opened for modification	C:\Windows\Help\Corporate\audiodg.exe	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
File created	C:\Windows\DigitalLocker\ja-JP\b75386f1303e64	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
File opened for modification	C:\Windows\security\logs\explorer.exe	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
File created	C:\Windows\DigitalLocker\ja-JP\taskhost.exe	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
File created	C:\Windows\security\logs\explorer.exe	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
File created	C:\Windows\security\logs\7a0fd90576e088	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
File opened for modification	C:\Windows\DigitalLocker\ja-JP\taskhost.exe	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
File opened for modification	C:\Windows\Registration\CRMLog\RCXE808.tmp	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1768	schtasks.exe
1624	schtasks.exe
2184	schtasks.exe
2412	schtasks.exe
1056	schtasks.exe
2396	schtasks.exe
2564	schtasks.exe
2344	schtasks.exe
1772	schtasks.exe
2156	schtasks.exe
1576	schtasks.exe
848	schtasks.exe
1852	schtasks.exe
1704	schtasks.exe
2824	schtasks.exe
1052	schtasks.exe
2712	schtasks.exe
1984	schtasks.exe
2972	schtasks.exe
304	schtasks.exe
1704	schtasks.exe
1784	schtasks.exe
2720	schtasks.exe
2472	schtasks.exe
2916	schtasks.exe
2752	schtasks.exe
1368	schtasks.exe
1740	schtasks.exe
3064	schtasks.exe
1720	schtasks.exe
2116	schtasks.exe
2520	schtasks.exe
2480	schtasks.exe
2976	schtasks.exe
2924	schtasks.exe
2092	schtasks.exe
1576	schtasks.exe
1856	schtasks.exe
2708	schtasks.exe
2864	schtasks.exe
2608	schtasks.exe
868	schtasks.exe
2324	schtasks.exe
2456	schtasks.exe
1564	schtasks.exe
332	schtasks.exe
2932	schtasks.exe
2384	schtasks.exe
1608	schtasks.exe
2284	schtasks.exe
2192	schtasks.exe
2776	schtasks.exe
1756	schtasks.exe
2112	schtasks.exe
2644	schtasks.exe
2192	schtasks.exe
2228	schtasks.exe
2976	schtasks.exe
784	schtasks.exe
1392	schtasks.exe
2176	schtasks.exe
784	schtasks.exe
1428	schtasks.exe
332	schtasks.exe

Suspicious behavior: EnumeratesProcesses 55 IoCs

pid	Process
2316	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
2316	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
2316	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
2316	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
2316	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
2316	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
2316	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
1396	powershell.exe
2352	powershell.exe
580	powershell.exe
1444	powershell.exe
2236	powershell.exe
1748	powershell.exe
1580	powershell.exe
1508	powershell.exe
2300	powershell.exe
1708	powershell.exe
2104	powershell.exe
2636	powershell.exe
2920	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
2528	powershell.exe
2220	powershell.exe
2524	powershell.exe
1960	powershell.exe
2872	powershell.exe
2860	powershell.exe
3032	powershell.exe
2360	powershell.exe
1588	powershell.exe
2040	powershell.exe
2444	powershell.exe
2296	powershell.exe
2124	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
2124	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
2124	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
3036	powershell.exe
1496	powershell.exe
1960	powershell.exe
1588	powershell.exe
956	powershell.exe
2492	powershell.exe
1908	powershell.exe
2572	powershell.exe
2700	powershell.exe
2640	powershell.exe
1772	powershell.exe
1064	powershell.exe
1392	audiodg.exe
1076	audiodg.exe
2800	audiodg.exe
1940	audiodg.exe
2844	audiodg.exe
828	audiodg.exe
1188	audiodg.exe
1984	audiodg.exe

Suspicious use of AdjustPrivilegeToken 47 IoCs

description	pid	Process
Token: SeDebugPrivilege	2316	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
Token: SeDebugPrivilege	1396	powershell.exe
Token: SeDebugPrivilege	2352	powershell.exe
Token: SeDebugPrivilege	580	powershell.exe
Token: SeDebugPrivilege	1444	powershell.exe
Token: SeDebugPrivilege	2236	powershell.exe
Token: SeDebugPrivilege	1748	powershell.exe
Token: SeDebugPrivilege	1580	powershell.exe
Token: SeDebugPrivilege	1508	powershell.exe
Token: SeDebugPrivilege	1708	powershell.exe
Token: SeDebugPrivilege	2300	powershell.exe
Token: SeDebugPrivilege	2104	powershell.exe
Token: SeDebugPrivilege	2636	powershell.exe
Token: SeDebugPrivilege	2920	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
Token: SeDebugPrivilege	2528	powershell.exe
Token: SeDebugPrivilege	2220	powershell.exe
Token: SeDebugPrivilege	2524	powershell.exe
Token: SeDebugPrivilege	1960	powershell.exe
Token: SeDebugPrivilege	2872	powershell.exe
Token: SeDebugPrivilege	2860	powershell.exe
Token: SeDebugPrivilege	3032	powershell.exe
Token: SeDebugPrivilege	2360	powershell.exe
Token: SeDebugPrivilege	1588	powershell.exe
Token: SeDebugPrivilege	2040	powershell.exe
Token: SeDebugPrivilege	2444	powershell.exe
Token: SeDebugPrivilege	2296	powershell.exe
Token: SeDebugPrivilege	2124	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
Token: SeDebugPrivilege	3036	powershell.exe
Token: SeDebugPrivilege	1496	powershell.exe
Token: SeDebugPrivilege	1960	powershell.exe
Token: SeDebugPrivilege	1588	powershell.exe
Token: SeDebugPrivilege	956	powershell.exe
Token: SeDebugPrivilege	2492	powershell.exe
Token: SeDebugPrivilege	1908	powershell.exe
Token: SeDebugPrivilege	2572	powershell.exe
Token: SeDebugPrivilege	2700	powershell.exe
Token: SeDebugPrivilege	2640	powershell.exe
Token: SeDebugPrivilege	1772	powershell.exe
Token: SeDebugPrivilege	1064	powershell.exe
Token: SeDebugPrivilege	1392	audiodg.exe
Token: SeDebugPrivilege	1076	audiodg.exe
Token: SeDebugPrivilege	2800	audiodg.exe
Token: SeDebugPrivilege	1940	audiodg.exe
Token: SeDebugPrivilege	2844	audiodg.exe
Token: SeDebugPrivilege	828	audiodg.exe
Token: SeDebugPrivilege	1188	audiodg.exe
Token: SeDebugPrivilege	1984	audiodg.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 580	2316	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe	65
PID 2316 wrote to memory of 580	2316	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe	65
PID 2316 wrote to memory of 580	2316	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe	65
PID 2316 wrote to memory of 1748	2316	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe	66
PID 2316 wrote to memory of 1748	2316	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe	66
PID 2316 wrote to memory of 1748	2316	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe	66
PID 2316 wrote to memory of 1396	2316	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe	67
PID 2316 wrote to memory of 1396	2316	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe	67
PID 2316 wrote to memory of 1396	2316	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe	67
PID 2316 wrote to memory of 2352	2316	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe	69
PID 2316 wrote to memory of 2352	2316	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe	69
PID 2316 wrote to memory of 2352	2316	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe	69
PID 2316 wrote to memory of 2636	2316	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe	72
PID 2316 wrote to memory of 2636	2316	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe	72
PID 2316 wrote to memory of 2636	2316	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe	72
PID 2316 wrote to memory of 2104	2316	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe	74
PID 2316 wrote to memory of 2104	2316	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe	74
PID 2316 wrote to memory of 2104	2316	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe	74
PID 2316 wrote to memory of 2236	2316	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe	75
PID 2316 wrote to memory of 2236	2316	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe	75
PID 2316 wrote to memory of 2236	2316	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe	75
PID 2316 wrote to memory of 1580	2316	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe	76
PID 2316 wrote to memory of 1580	2316	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe	76
PID 2316 wrote to memory of 1580	2316	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe	76
PID 2316 wrote to memory of 1444	2316	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe	77
PID 2316 wrote to memory of 1444	2316	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe	77
PID 2316 wrote to memory of 1444	2316	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe	77
PID 2316 wrote to memory of 1708	2316	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe	78
PID 2316 wrote to memory of 1708	2316	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe	78
PID 2316 wrote to memory of 1708	2316	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe	78
PID 2316 wrote to memory of 1508	2316	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe	80
PID 2316 wrote to memory of 1508	2316	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe	80
PID 2316 wrote to memory of 1508	2316	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe	80
PID 2316 wrote to memory of 2300	2316	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe	81
PID 2316 wrote to memory of 2300	2316	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe	81
PID 2316 wrote to memory of 2300	2316	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe	81
PID 2316 wrote to memory of 2920	2316	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe	89
PID 2316 wrote to memory of 2920	2316	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe	89
PID 2316 wrote to memory of 2920	2316	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe	89
PID 2920 wrote to memory of 1960	2920	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe	99
PID 2920 wrote to memory of 1960	2920	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe	99
PID 2920 wrote to memory of 1960	2920	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe	99
PID 2920 wrote to memory of 2220	2920	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe	100
PID 2920 wrote to memory of 2220	2920	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe	100
PID 2920 wrote to memory of 2220	2920	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe	100
PID 2920 wrote to memory of 2040	2920	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe	101
PID 2920 wrote to memory of 2040	2920	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe	101
PID 2920 wrote to memory of 2040	2920	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe	101
PID 2920 wrote to memory of 2360	2920	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe	104
PID 2920 wrote to memory of 2360	2920	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe	104
PID 2920 wrote to memory of 2360	2920	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe	104
PID 2920 wrote to memory of 1588	2920	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe	105
PID 2920 wrote to memory of 1588	2920	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe	105
PID 2920 wrote to memory of 1588	2920	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe	105
PID 2920 wrote to memory of 2860	2920	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe	106
PID 2920 wrote to memory of 2860	2920	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe	106
PID 2920 wrote to memory of 2860	2920	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe	106
PID 2920 wrote to memory of 2444	2920	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe	107
PID 2920 wrote to memory of 2444	2920	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe	107
PID 2920 wrote to memory of 2444	2920	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe	107
PID 2920 wrote to memory of 2524	2920	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe	108
PID 2920 wrote to memory of 2524	2920	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe	108
PID 2920 wrote to memory of 2524	2920	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe	108
PID 2920 wrote to memory of 2872	2920	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe	109

System policy modification 1 TTPs 33 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
"C:\Users\Admin\AppData\Local\Temp\b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe"
1⤵
- DcRat
- UAC bypass
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2316
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:580
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1748
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1396
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2352
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2636
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2104
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2236
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1580
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1444
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1708
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1508
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2300
- C:\Users\Admin\AppData\Local\Temp\b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
  "C:\Users\Admin\AppData\Local\Temp\b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2920
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1960
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2220
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2040
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2360
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1588
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2860
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2444
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2524
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2872
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2528
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2296
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3032
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\gOBUt9HLXL.bat"
    3⤵
    PID:2840
  - - C:\Windows\system32\w32tm.exe
      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
      4⤵
      PID:2228
  - - C:\Users\Admin\AppData\Local\Temp\b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe
      "C:\Users\Admin\AppData\Local\Temp\b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667.exe"
      4⤵
      UAC bypass
      Executes dropped EXE
      Checks whether UAC is enabled
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      System policy modification
      PID:2124
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2492
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1908
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1960
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3036
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:956
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1496
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1588
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1772
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2572
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1064
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2700
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2640
    - - C:\Windows\Help\Corporate\audiodg.exe
        
        "C:\Windows\Help\Corporate\audiodg.exe"
        5⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1392
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5a53ada1-1f55-4af1-8dcd-25938700c6b6.vbs"
        6⤵
        
        PID:1072
        
        C:\Windows\Help\Corporate\audiodg.exe
        
        C:\Windows\Help\Corporate\audiodg.exe
        7⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1076
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8ab7985b-2f0b-4300-ac48-6fa54d5b5b18.vbs"
        8⤵
        
        PID:1536
        
        C:\Windows\Help\Corporate\audiodg.exe
        
        C:\Windows\Help\Corporate\audiodg.exe
        9⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2800
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bb836b54-8281-4e39-93c5-4e9096e1c155.vbs"
        10⤵
        
        PID:972
        
        C:\Windows\Help\Corporate\audiodg.exe
        
        C:\Windows\Help\Corporate\audiodg.exe
        11⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1940
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d493830c-4bf4-4b26-8c87-98d2c1cc2bdb.vbs"
        12⤵
        
        PID:1056
        
        C:\Windows\Help\Corporate\audiodg.exe
        
        C:\Windows\Help\Corporate\audiodg.exe
        13⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2844
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\90eb4238-e1e7-4773-8c0c-a39402adecc3.vbs"
        14⤵
        
        PID:2696
        
        C:\Windows\Help\Corporate\audiodg.exe
        
        C:\Windows\Help\Corporate\audiodg.exe
        15⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:828
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d941dbcb-6c8c-40e2-8292-41f768a7970f.vbs"
        16⤵
        
        PID:2020
        
        C:\Windows\Help\Corporate\audiodg.exe
        
        C:\Windows\Help\Corporate\audiodg.exe
        17⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1188
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6a341ea7-5dc5-4363-bd96-71ba6e752acb.vbs"
        18⤵
        
        PID:928
        
        C:\Windows\Help\Corporate\audiodg.exe
        
        C:\Windows\Help\Corporate\audiodg.exe
        19⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1984
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2a34f656-e5ac-4ba2-8db4-f288fe9186de.vbs"
        20⤵
        
        PID:316
        
        C:\Windows\Help\Corporate\audiodg.exe
        
        C:\Windows\Help\Corporate\audiodg.exe
        21⤵
        
        PID:1940
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\58513749-883f-4179-9d88-17bfa1db1e48.vbs"
        20⤵
        
        PID:1388
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\42c0ce5f-ad1e-4aec-a641-4117d910aaa1.vbs"
        18⤵
        
        PID:696
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\da32e904-3492-4667-9e02-9f2a146f37cf.vbs"
        16⤵
        
        PID:2508
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3c0f27b5-2e7b-47ea-a1c2-647cf1f81273.vbs"
        14⤵
        
        PID:2376
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1d16183e-f1e4-4d35-adb4-aa594017b4ec.vbs"
        12⤵
        
        PID:2956
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4da4270a-5fdb-4be5-8828-495a0ba482e8.vbs"
        10⤵
        
        PID:1508
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f035cf58-93b7-436a-a6de-9d1ea009608a.vbs"
        8⤵
        
        PID:1736
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\eb26d21a-79f9-48e3-9c16-c56fe077621d.vbs"
        6⤵
        
        PID:1320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:2800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 12 /tr "'C:\Windows\DigitalLocker\ja-JP\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Windows\DigitalLocker\ja-JP\taskhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 10 /tr "'C:\Windows\DigitalLocker\ja-JP\taskhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:2812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Windows\security\logs\explorer.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:1924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\security\logs\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Windows\security\logs\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\lsass.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Internet Explorer\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Internet Explorer\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Media Player\Network Sharing\explorer.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\Network Sharing\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Media Player\Network Sharing\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\dllhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\OSPPSVC.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Windows\Registration\CRMLog\dllhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:2492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\Registration\CRMLog\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:1980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Windows\Registration\CRMLog\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:1964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Google\Temp\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
PID:2224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Temp\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Google\Temp\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft Office\explorer.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Office\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft Office\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\sppsvc.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:1308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\NetHood\taskhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Users\Admin\NetHood\taskhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\NetHood\taskhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:2272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\lsass.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\All Users\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\spoolsv.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 11 /tr "'C:\Windows\Help\Corporate\audiodg.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Windows\Help\Corporate\audiodg.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 9 /tr "'C:\Windows\Help\Corporate\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:2496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\explorer.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\Default User\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Google\Temp\sppsvc.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Temp\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Google\Temp\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Internet Explorer\explorer.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:2000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Internet Explorer\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 11 /tr "'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\WMIADAP.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- DcRat
PID:2480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 11 /tr "'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:1564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 12 /tr "'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\WmiPrvSE.exe'" /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:1428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 6 /tr "'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\WMIADAP.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:1056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:1856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:2384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\sppsvc.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:2092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:1608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 6 /tr "'C:\Program Files\Microsoft Office\Office14\1033\lsm.exe'" /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:2116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\Office14\1033\lsm.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:1052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 11 /tr "'C:\Program Files\Microsoft Office\Office14\1033\lsm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:2520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\RCXE3F1.tmp

Filesize
4.9MB

MD5
cc0572c10ea6f375204cea06c0ba5002

SHA1
1bd37add90ba7b4efa3f64dd3e259568874baf68

SHA256
92b6b93fcc9340772eb9abbab4aacc21e5ea420d069fdf609af11b7f99d84e73

SHA512
f45dae509b1181fcbdacaa0e02e8bda9b1f0dc97ae3b2342fd474beb0e34234f53f37cb498e6fdad4fe860c98829edcf497a3f365be1858b5b981452e0e7fabf

Download Submit
C:\Program Files (x86)\Google\Temp\0a1fd5f707cd16

Filesize
47B

MD5
3d93d3d1f46d795dc7e213dd9075e30c

SHA1
899a1e3ed1ebab279c8a71f5c6569ef35831ae77

SHA256
5f2a6a6f1de4076707a99909dcfc758a314d1e722f2830199c9e8c3dcae48608

SHA512
b3c13825f5951a3949e1f3b3472dfb6cff0e50ab87c8b9d138f7758994a57071f7a27128c5e11acc361fb0e5e29ab44391ab137ee537d67ca92176e60b466eb4

Download Submit
C:\Program Files (x86)\Internet Explorer\csrss.exe

Filesize
4.9MB

MD5
736efb699e6c98e7714ac5c408182dcb

SHA1
5365421b2342d1e05d742affab93c76e7bc155e5

SHA256
b0f29930fd3eb0ee3807127cb7cdc14fdbba8578ac794fec5e9f225fc5c7b667

SHA512
a9293424da54d3457c7a754b5f66324ed271ce066412b9690b8f1ed502a33501e680731c1818d2836eb68724d3236794534bc0f6fb2d75fb283d9033df3bcb98

Download Submit
C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\RCXEA0C.tmp

Filesize
4.9MB

MD5
f839f59d9a153b38829c72515130f5de

SHA1
85253f55dbdd303a0d56006f4d2edc57b56c1c72

SHA256
f6794d48ac9d08581f257ab174f64932ae7652665f26a1a77f13ff98391522a6

SHA512
1348041146f72bef788d0474218f0e6c59766f205a8733501cd777417dec6bde7bd27a6801001601954aff0ae7fbe80d2f89560239919cd8fc8275c3e4a88e15

Download Submit
C:\Users\Admin\AppData\Local\Temp\5a53ada1-1f55-4af1-8dcd-25938700c6b6.vbs

Filesize
713B

MD5
8d436102c4c5cfe1ff18ff0ff76c9a10

SHA1
fde4477bea10f979dbe9ceec5850069e2619086d

SHA256
4a4ad376f5cd780aa97c338b01617a98dc98dc6fbb80822cc0e7ac5b8aa622e5

SHA512
9b2f55028fb2b06828651b7dc882258b258563e2540d1717d85f07962e56c09fe3c3289b356a61ce1297fe9220dd6081fe1298daf54aeda688cfd144696c65e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\8ab7985b-2f0b-4300-ac48-6fa54d5b5b18.vbs

Filesize
713B

MD5
24e976e7ee5b5a1c2c15b46fb9534e98

SHA1
075b65abab43fe46039fe58eb55553c2239ec57e

SHA256
541b001e01966b7493c1c347dac3fc49bcb64ee8a1e8860adc1a365844cf413c

SHA512
1a52ac0909dd4f21f25e11f4f3de5288eaf91a8be67d6a111a0fe6ee64092cc0a4d28f5b0420cc6568ce801afe9f246393c0bf60517405cd8241ee0337d9e3e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\90eb4238-e1e7-4773-8c0c-a39402adecc3.vbs

Filesize
713B

MD5
823d5e8cac0c921495a155f72409e9e3

SHA1
17413fb7d07ade91588e30af8d67b228beac2bf9

SHA256
368faa8e64bcf13aecfa511bf828e1104fc9c9484d9789c0fb1b7dd5eacc1381

SHA512
96bc8203065e99d44c187b0cda6d149c5d3e1dcc23c2260a49defb9e1083b8f2bf5e8a57ea5ff4584c7b3a19ddc9a37190c959d6474ec3dc20727ec1155aaee9

Download Submit
C:\Users\Admin\AppData\Local\Temp\bb836b54-8281-4e39-93c5-4e9096e1c155.vbs

Filesize
713B

MD5
f969aa3b5fe4b3f607e06728aa244385

SHA1
ecf3440cea52aa415f9bf576be30384e10431895

SHA256
3d6d3f6ecde41a02d697b1bd1d4277d348e0186a084c68626ba020acae416987

SHA512
b341efea0887583b4ba16d4dfa95b290a15f3b2475417e90a69b43392d985464f1bc381434edd51ac68a5a1b0092a79acb854ce0d5501b899671d28e0d116b38

Download Submit
C:\Users\Admin\AppData\Local\Temp\d493830c-4bf4-4b26-8c87-98d2c1cc2bdb.vbs

Filesize
713B

MD5
1ee0b0589d4df8c5f1866cc1d80a1e92

SHA1
53058a7106197ce88b21a6f67086cb6b1e3d5d91

SHA256
9a7569a415245777a2ff066d959d38c13e078582a78e1a0f8fbe8073b429477c

SHA512
b97fb592e837adca063f8a5fb00c934e46ee629055e96413726d57e5ba10b10be2036ef6030ba05f21136d8f4fa2a35e7147d74b7c177e3de609b9fc16d4f21c

Download Submit
C:\Users\Admin\AppData\Local\Temp\eb26d21a-79f9-48e3-9c16-c56fe077621d.vbs

Filesize
489B

MD5
0da7e82cef12a9e7b9b151b10c58beee

SHA1
a6547bedef920689638795d27835d51102a6e89e

SHA256
bdbc8c51b46b51268cf3068f06237e18dc48d5ecb44bb72484a7edef75e7c930

SHA512
108e5e58f49d5da1c0bb79a50a64fc10328ed7e0a52a9761d633d0b439be7f2e930fd24f8cc1bd467fde675bfe9af1bd4d1884bd7fdd4fdd4a4a387f32aa9f6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\gOBUt9HLXL.bat

Filesize
267B

MD5
821e13acfe8136bc9ffde41b9a04ca8f

SHA1
3d8ef5a24996359e67667467d0557861a2a8e773

SHA256
2b4bc5a91c58490dd75a824656948761623651444492762b32d5c279153c1393

SHA512
ab5127403798a2e024ecfa429b176c486139c8dafb8f3cdea3db22732c09d116bdfc59701c499385e1f4c6e533c04728a5cf9a8d3d8931e22eeac6c58be24d47

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp232A.tmp.exe

Filesize
75KB

MD5
e0a68b98992c1699876f818a22b5b907

SHA1
d41e8ad8ba51217eb0340f8f69629ccb474484d0

SHA256
2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

SHA512
856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
12e502bdb883cd4c156404d663f69908

SHA1
38dfe2fe16c49416f794e91439e229eb77f40277

SHA256
bd404fb60b71e575178ef9ea2af61b72817b4996425f07ca1c9d2759279e0c6b

SHA512
be444fd5c3c99bc66cb6f2d1f87111f7d6f9ea7ee88919fc7a8f0935e0c51f394db80684c7d87844820ab675ee9e2c3d7b22cb4c7e14436254feb4195ab2d38c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ARPK01ZJLK2FYEIRP99H.temp

Filesize
7KB

MD5
91e09598af107b80f6bda2696c5226b9

SHA1
5defbb84cb19e41852d6b7c23e0a513641481d44

SHA256
a71e925c1cceb416035bba8cca5970ab06720a0ebb501180ddb1609166143566

SHA512
cc298f4ca16ad1500cd9ef9616fea357ceac4c435cd01e2517c7d027c282ff2ea98f5d47c35c607a6c622697dd32c2b7b30307eea36c2caebb94587977ce9c09

Download Submit
memory/828-451-0x0000000000EF0000-0x00000000013E4000-memory.dmp

Filesize
5.0MB

Download
memory/1188-462-0x0000000001250000-0x0000000001744000-memory.dmp

Filesize
5.0MB

Download
memory/1188-463-0x0000000000AC0000-0x0000000000AD2000-memory.dmp

Filesize
72KB

Download
memory/1392-333-0x0000000000F70000-0x0000000001464000-memory.dmp

Filesize
5.0MB

Download
memory/1392-380-0x0000000000530000-0x0000000000542000-memory.dmp

Filesize
72KB

Download
memory/1396-131-0x0000000002350000-0x0000000002358000-memory.dmp

Filesize
32KB

Download
memory/1396-130-0x000000001B540000-0x000000001B822000-memory.dmp

Filesize
2.9MB

Download
memory/1940-423-0x0000000000120000-0x0000000000614000-memory.dmp

Filesize
5.0MB

Download
memory/1940-484-0x0000000000130000-0x0000000000624000-memory.dmp

Filesize
5.0MB

Download
memory/2124-260-0x0000000002440000-0x0000000002452000-memory.dmp

Filesize
72KB

Download
memory/2124-259-0x0000000000A70000-0x0000000000F64000-memory.dmp

Filesize
5.0MB

Download
memory/2316-12-0x0000000000E60000-0x0000000000E6E000-memory.dmp

Filesize
56KB

Download
memory/2316-9-0x00000000008C0000-0x00000000008CA000-memory.dmp

Filesize
40KB

Download
memory/2316-1-0x00000000002E0000-0x00000000007D4000-memory.dmp

Filesize
5.0MB

Download
memory/2316-178-0x000007FEF5BA0000-0x000007FEF658C000-memory.dmp

Filesize
9.9MB

Download
memory/2316-16-0x0000000000EA0000-0x0000000000EAC000-memory.dmp

Filesize
48KB

Download
memory/2316-15-0x0000000000E90000-0x0000000000E98000-memory.dmp

Filesize
32KB

Download
memory/2316-14-0x0000000000E80000-0x0000000000E88000-memory.dmp

Filesize
32KB

Download
memory/2316-13-0x0000000000E70000-0x0000000000E7E000-memory.dmp

Filesize
56KB

Download
memory/2316-0-0x000007FEF5BA3000-0x000007FEF5BA4000-memory.dmp

Filesize
4KB

Download
memory/2316-11-0x0000000000C40000-0x0000000000C4A000-memory.dmp

Filesize
40KB

Download
memory/2316-10-0x0000000000AC0000-0x0000000000AD2000-memory.dmp

Filesize
72KB

Download
memory/2316-2-0x000000001BD00000-0x000000001BE2E000-memory.dmp

Filesize
1.2MB

Download
memory/2316-3-0x000007FEF5BA0000-0x000007FEF658C000-memory.dmp

Filesize
9.9MB

Download
memory/2316-8-0x00000000002D0000-0x00000000002E0000-memory.dmp

Filesize
64KB

Download
memory/2316-7-0x0000000000C20000-0x0000000000C36000-memory.dmp

Filesize
88KB

Download
memory/2316-5-0x00000000002B0000-0x00000000002B8000-memory.dmp

Filesize
32KB

Download
memory/2316-4-0x0000000000290000-0x00000000002AC000-memory.dmp

Filesize
112KB

Download
memory/2316-6-0x00000000002C0000-0x00000000002D0000-memory.dmp

Filesize
64KB

Download
memory/2528-216-0x000000001B690000-0x000000001B972000-memory.dmp

Filesize
2.9MB

Download
memory/2528-218-0x00000000022B0000-0x00000000022B8000-memory.dmp

Filesize
32KB

Download
memory/2800-408-0x0000000000FB0000-0x00000000014A4000-memory.dmp

Filesize
5.0MB

Download
memory/2844-438-0x0000000000E20000-0x0000000001314000-memory.dmp

Filesize
5.0MB

Download