dcrat | 2e98237175f01ec0b438492e9beb7c985a82827337d7926f3fe0b6316bb6c7e4

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/12/2024, 11:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2e98237175f01ec0b438492e9beb7c985a82827337d7926f3fe0b6316bb6c7e4N.exe
Size

4.9MB
MD5

d8b8aede9dcb3c6ead52f11fc0826520
SHA1

6b5981a21251b5d0833a8dc8e7b4c71787c3d6e6
SHA256

2e98237175f01ec0b438492e9beb7c985a82827337d7926f3fe0b6316bb6c7e4
SHA512

c3bbcbf837ae31dccf70e966dcb57e6bce105aef5163ebb44111fc7dc810cb34691292cd4ad30ab0e1516a75f569addfafaf6c3a4b026c2a1446f1182bb005b1
SSDEEP

49152:rl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:

Score

10^/10

dcrat evasion execution infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 27 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2320	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2280	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2812	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2816	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2744	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2944	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2648	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2800	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2776	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2616	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2656	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2732	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1104	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1352	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1760	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1812	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2024	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1732	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1284	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1792	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2180	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2016	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1928	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1916	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2844	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2572	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	556	2184	schtasks.exe	30

UAC bypass 3 TTPs 36 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2e98237175f01ec0b438492e9beb7c985a82827337d7926f3fe0b6316bb6c7e4N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2e98237175f01ec0b438492e9beb7c985a82827337d7926f3fe0b6316bb6c7e4N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	2e98237175f01ec0b438492e9beb7c985a82827337d7926f3fe0b6316bb6c7e4N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/1724-3-0x000000001B690000-0x000000001B7BE000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2468	powershell.exe
964	powershell.exe
1780	powershell.exe
3064	powershell.exe
1808	powershell.exe
2172	powershell.exe
1640	powershell.exe
1272	powershell.exe
1020	powershell.exe
572	powershell.exe
1784	powershell.exe
1560	powershell.exe

Executes dropped EXE 11 IoCs

pid	Process
2512	taskhost.exe
2304	taskhost.exe
2208	taskhost.exe
2340	taskhost.exe
816	taskhost.exe
2264	taskhost.exe
3032	taskhost.exe
1788	taskhost.exe
2628	taskhost.exe
1740	taskhost.exe
2016	taskhost.exe

Checks whether UAC is enabled 1 TTPs 24 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2e98237175f01ec0b438492e9beb7c985a82827337d7926f3fe0b6316bb6c7e4N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2e98237175f01ec0b438492e9beb7c985a82827337d7926f3fe0b6316bb6c7e4N.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhost.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Windows NT\Accessories\it-IT\RCXD966.tmp	2e98237175f01ec0b438492e9beb7c985a82827337d7926f3fe0b6316bb6c7e4N.exe
File opened for modification	C:\Program Files (x86)\Windows NT\Accessories\it-IT\winlogon.exe	2e98237175f01ec0b438492e9beb7c985a82827337d7926f3fe0b6316bb6c7e4N.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\it-IT\winlogon.exe	2e98237175f01ec0b438492e9beb7c985a82827337d7926f3fe0b6316bb6c7e4N.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\it-IT\cc11b995f2a76d	2e98237175f01ec0b438492e9beb7c985a82827337d7926f3fe0b6316bb6c7e4N.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\LiveKernelReports\wininit.exe	2e98237175f01ec0b438492e9beb7c985a82827337d7926f3fe0b6316bb6c7e4N.exe
File created	C:\Windows\LiveKernelReports\wininit.exe	2e98237175f01ec0b438492e9beb7c985a82827337d7926f3fe0b6316bb6c7e4N.exe
File created	C:\Windows\LiveKernelReports\56085415360792	2e98237175f01ec0b438492e9beb7c985a82827337d7926f3fe0b6316bb6c7e4N.exe
File opened for modification	C:\Windows\LiveKernelReports\RCXD4F1.tmp	2e98237175f01ec0b438492e9beb7c985a82827337d7926f3fe0b6316bb6c7e4N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 27 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2744	schtasks.exe
2732	schtasks.exe
2180	schtasks.exe
1812	schtasks.exe
2944	schtasks.exe
1732	schtasks.exe
1916	schtasks.exe
2572	schtasks.exe
2648	schtasks.exe
2024	schtasks.exe
1284	schtasks.exe
2016	schtasks.exe
1928	schtasks.exe
2280	schtasks.exe
2656	schtasks.exe
1104	schtasks.exe
1352	schtasks.exe
2816	schtasks.exe
2776	schtasks.exe
1760	schtasks.exe
1792	schtasks.exe
2616	schtasks.exe
2844	schtasks.exe
556	schtasks.exe
2320	schtasks.exe
2812	schtasks.exe
2800	schtasks.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
1724	2e98237175f01ec0b438492e9beb7c985a82827337d7926f3fe0b6316bb6c7e4N.exe
3064	powershell.exe
964	powershell.exe
1272	powershell.exe
2172	powershell.exe
2468	powershell.exe
2512	taskhost.exe
1780	powershell.exe
1784	powershell.exe
1560	powershell.exe
1640	powershell.exe
1808	powershell.exe
1020	powershell.exe
572	powershell.exe
2304	taskhost.exe
2208	taskhost.exe
2340	taskhost.exe
816	taskhost.exe
2264	taskhost.exe
3032	taskhost.exe
1788	taskhost.exe
2628	taskhost.exe
1740	taskhost.exe
2016	taskhost.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeDebugPrivilege	1724	2e98237175f01ec0b438492e9beb7c985a82827337d7926f3fe0b6316bb6c7e4N.exe
Token: SeDebugPrivilege	3064	powershell.exe
Token: SeDebugPrivilege	964	powershell.exe
Token: SeDebugPrivilege	2512	taskhost.exe
Token: SeDebugPrivilege	1272	powershell.exe
Token: SeDebugPrivilege	2172	powershell.exe
Token: SeDebugPrivilege	2468	powershell.exe
Token: SeDebugPrivilege	1780	powershell.exe
Token: SeDebugPrivilege	1784	powershell.exe
Token: SeDebugPrivilege	1560	powershell.exe
Token: SeDebugPrivilege	1640	powershell.exe
Token: SeDebugPrivilege	1808	powershell.exe
Token: SeDebugPrivilege	1020	powershell.exe
Token: SeDebugPrivilege	572	powershell.exe
Token: SeDebugPrivilege	2304	taskhost.exe
Token: SeDebugPrivilege	2208	taskhost.exe
Token: SeDebugPrivilege	2340	taskhost.exe
Token: SeDebugPrivilege	816	taskhost.exe
Token: SeDebugPrivilege	2264	taskhost.exe
Token: SeDebugPrivilege	3032	taskhost.exe
Token: SeDebugPrivilege	1788	taskhost.exe
Token: SeDebugPrivilege	2628	taskhost.exe
Token: SeDebugPrivilege	1740	taskhost.exe
Token: SeDebugPrivilege	2016	taskhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 1272	1724	2e98237175f01ec0b438492e9beb7c985a82827337d7926f3fe0b6316bb6c7e4N.exe	59
PID 1724 wrote to memory of 1272	1724	2e98237175f01ec0b438492e9beb7c985a82827337d7926f3fe0b6316bb6c7e4N.exe	59
PID 1724 wrote to memory of 1272	1724	2e98237175f01ec0b438492e9beb7c985a82827337d7926f3fe0b6316bb6c7e4N.exe	59
PID 1724 wrote to memory of 2468	1724	2e98237175f01ec0b438492e9beb7c985a82827337d7926f3fe0b6316bb6c7e4N.exe	60
PID 1724 wrote to memory of 2468	1724	2e98237175f01ec0b438492e9beb7c985a82827337d7926f3fe0b6316bb6c7e4N.exe	60
PID 1724 wrote to memory of 2468	1724	2e98237175f01ec0b438492e9beb7c985a82827337d7926f3fe0b6316bb6c7e4N.exe	60
PID 1724 wrote to memory of 1020	1724	2e98237175f01ec0b438492e9beb7c985a82827337d7926f3fe0b6316bb6c7e4N.exe	61
PID 1724 wrote to memory of 1020	1724	2e98237175f01ec0b438492e9beb7c985a82827337d7926f3fe0b6316bb6c7e4N.exe	61
PID 1724 wrote to memory of 1020	1724	2e98237175f01ec0b438492e9beb7c985a82827337d7926f3fe0b6316bb6c7e4N.exe	61
PID 1724 wrote to memory of 572	1724	2e98237175f01ec0b438492e9beb7c985a82827337d7926f3fe0b6316bb6c7e4N.exe	62
PID 1724 wrote to memory of 572	1724	2e98237175f01ec0b438492e9beb7c985a82827337d7926f3fe0b6316bb6c7e4N.exe	62
PID 1724 wrote to memory of 572	1724	2e98237175f01ec0b438492e9beb7c985a82827337d7926f3fe0b6316bb6c7e4N.exe	62
PID 1724 wrote to memory of 964	1724	2e98237175f01ec0b438492e9beb7c985a82827337d7926f3fe0b6316bb6c7e4N.exe	63
PID 1724 wrote to memory of 964	1724	2e98237175f01ec0b438492e9beb7c985a82827337d7926f3fe0b6316bb6c7e4N.exe	63
PID 1724 wrote to memory of 964	1724	2e98237175f01ec0b438492e9beb7c985a82827337d7926f3fe0b6316bb6c7e4N.exe	63
PID 1724 wrote to memory of 1784	1724	2e98237175f01ec0b438492e9beb7c985a82827337d7926f3fe0b6316bb6c7e4N.exe	64
PID 1724 wrote to memory of 1784	1724	2e98237175f01ec0b438492e9beb7c985a82827337d7926f3fe0b6316bb6c7e4N.exe	64
PID 1724 wrote to memory of 1784	1724	2e98237175f01ec0b438492e9beb7c985a82827337d7926f3fe0b6316bb6c7e4N.exe	64
PID 1724 wrote to memory of 1780	1724	2e98237175f01ec0b438492e9beb7c985a82827337d7926f3fe0b6316bb6c7e4N.exe	65
PID 1724 wrote to memory of 1780	1724	2e98237175f01ec0b438492e9beb7c985a82827337d7926f3fe0b6316bb6c7e4N.exe	65
PID 1724 wrote to memory of 1780	1724	2e98237175f01ec0b438492e9beb7c985a82827337d7926f3fe0b6316bb6c7e4N.exe	65
PID 1724 wrote to memory of 1560	1724	2e98237175f01ec0b438492e9beb7c985a82827337d7926f3fe0b6316bb6c7e4N.exe	66
PID 1724 wrote to memory of 1560	1724	2e98237175f01ec0b438492e9beb7c985a82827337d7926f3fe0b6316bb6c7e4N.exe	66
PID 1724 wrote to memory of 1560	1724	2e98237175f01ec0b438492e9beb7c985a82827337d7926f3fe0b6316bb6c7e4N.exe	66
PID 1724 wrote to memory of 3064	1724	2e98237175f01ec0b438492e9beb7c985a82827337d7926f3fe0b6316bb6c7e4N.exe	67
PID 1724 wrote to memory of 3064	1724	2e98237175f01ec0b438492e9beb7c985a82827337d7926f3fe0b6316bb6c7e4N.exe	67
PID 1724 wrote to memory of 3064	1724	2e98237175f01ec0b438492e9beb7c985a82827337d7926f3fe0b6316bb6c7e4N.exe	67
PID 1724 wrote to memory of 1808	1724	2e98237175f01ec0b438492e9beb7c985a82827337d7926f3fe0b6316bb6c7e4N.exe	68
PID 1724 wrote to memory of 1808	1724	2e98237175f01ec0b438492e9beb7c985a82827337d7926f3fe0b6316bb6c7e4N.exe	68
PID 1724 wrote to memory of 1808	1724	2e98237175f01ec0b438492e9beb7c985a82827337d7926f3fe0b6316bb6c7e4N.exe	68
PID 1724 wrote to memory of 2172	1724	2e98237175f01ec0b438492e9beb7c985a82827337d7926f3fe0b6316bb6c7e4N.exe	69
PID 1724 wrote to memory of 2172	1724	2e98237175f01ec0b438492e9beb7c985a82827337d7926f3fe0b6316bb6c7e4N.exe	69
PID 1724 wrote to memory of 2172	1724	2e98237175f01ec0b438492e9beb7c985a82827337d7926f3fe0b6316bb6c7e4N.exe	69
PID 1724 wrote to memory of 1640	1724	2e98237175f01ec0b438492e9beb7c985a82827337d7926f3fe0b6316bb6c7e4N.exe	70
PID 1724 wrote to memory of 1640	1724	2e98237175f01ec0b438492e9beb7c985a82827337d7926f3fe0b6316bb6c7e4N.exe	70
PID 1724 wrote to memory of 1640	1724	2e98237175f01ec0b438492e9beb7c985a82827337d7926f3fe0b6316bb6c7e4N.exe	70
PID 1724 wrote to memory of 2512	1724	2e98237175f01ec0b438492e9beb7c985a82827337d7926f3fe0b6316bb6c7e4N.exe	83
PID 1724 wrote to memory of 2512	1724	2e98237175f01ec0b438492e9beb7c985a82827337d7926f3fe0b6316bb6c7e4N.exe	83
PID 1724 wrote to memory of 2512	1724	2e98237175f01ec0b438492e9beb7c985a82827337d7926f3fe0b6316bb6c7e4N.exe	83
PID 2512 wrote to memory of 1700	2512	taskhost.exe	84
PID 2512 wrote to memory of 1700	2512	taskhost.exe	84
PID 2512 wrote to memory of 1700	2512	taskhost.exe	84
PID 2512 wrote to memory of 1240	2512	taskhost.exe	85
PID 2512 wrote to memory of 1240	2512	taskhost.exe	85
PID 2512 wrote to memory of 1240	2512	taskhost.exe	85
PID 1700 wrote to memory of 2304	1700	WScript.exe	86
PID 1700 wrote to memory of 2304	1700	WScript.exe	86
PID 1700 wrote to memory of 2304	1700	WScript.exe	86
PID 2304 wrote to memory of 2320	2304	taskhost.exe	87
PID 2304 wrote to memory of 2320	2304	taskhost.exe	87
PID 2304 wrote to memory of 2320	2304	taskhost.exe	87
PID 2304 wrote to memory of 1920	2304	taskhost.exe	88
PID 2304 wrote to memory of 1920	2304	taskhost.exe	88
PID 2304 wrote to memory of 1920	2304	taskhost.exe	88
PID 2320 wrote to memory of 2208	2320	WScript.exe	89
PID 2320 wrote to memory of 2208	2320	WScript.exe	89
PID 2320 wrote to memory of 2208	2320	WScript.exe	89
PID 2208 wrote to memory of 2276	2208	taskhost.exe	90
PID 2208 wrote to memory of 2276	2208	taskhost.exe	90
PID 2208 wrote to memory of 2276	2208	taskhost.exe	90
PID 2208 wrote to memory of 2292	2208	taskhost.exe	91
PID 2208 wrote to memory of 2292	2208	taskhost.exe	91
PID 2208 wrote to memory of 2292	2208	taskhost.exe	91
PID 2276 wrote to memory of 2340	2276	WScript.exe	92

System policy modification 1 TTPs 36 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2e98237175f01ec0b438492e9beb7c985a82827337d7926f3fe0b6316bb6c7e4N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	2e98237175f01ec0b438492e9beb7c985a82827337d7926f3fe0b6316bb6c7e4N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2e98237175f01ec0b438492e9beb7c985a82827337d7926f3fe0b6316bb6c7e4N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2e98237175f01ec0b438492e9beb7c985a82827337d7926f3fe0b6316bb6c7e4N.exe
"C:\Users\Admin\AppData\Local\Temp\2e98237175f01ec0b438492e9beb7c985a82827337d7926f3fe0b6316bb6c7e4N.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1724
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1272
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2468
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1020
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:572
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:964
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1784
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1780
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1560
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3064
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1808
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2172
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1640
- C:\MSOCache\All Users\taskhost.exe
  "C:\MSOCache\All Users\taskhost.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2512
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a7b7d2c9-7390-4c25-877e-7b8883360b3e.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1700
  - - C:\MSOCache\All Users\taskhost.exe
      "C:\MSOCache\All Users\taskhost.exe"
      4⤵
      UAC bypass
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:2304
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\29d6bb9b-ab18-49e6-b42b-33cd7ce55a40.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2320
      - C:\MSOCache\All Users\taskhost.exe
        
        "C:\MSOCache\All Users\taskhost.exe"
        6⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2208
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\af715113-231c-4ea2-9f3d-a23fd9415884.vbs"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2276
        
        C:\MSOCache\All Users\taskhost.exe
        
        "C:\MSOCache\All Users\taskhost.exe"
        8⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2340
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d5424572-7f0f-42db-a125-edc88a86ae20.vbs"
        9⤵
        
        PID:1052
        
        C:\MSOCache\All Users\taskhost.exe
        
        "C:\MSOCache\All Users\taskhost.exe"
        10⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:816
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dbd4e136-307f-4b96-8bff-26b30999bb24.vbs"
        11⤵
        
        PID:540
        
        C:\MSOCache\All Users\taskhost.exe
        
        "C:\MSOCache\All Users\taskhost.exe"
        12⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2264
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c6433cde-e332-40d6-b3a4-0a27cf70d115.vbs"
        13⤵
        
        PID:3028
        
        C:\MSOCache\All Users\taskhost.exe
        
        "C:\MSOCache\All Users\taskhost.exe"
        14⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3032
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\157d6a25-6df1-4e7c-8a46-493bc6c47a10.vbs"
        15⤵
        
        PID:1672
        
        C:\MSOCache\All Users\taskhost.exe
        
        "C:\MSOCache\All Users\taskhost.exe"
        16⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1788
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5c0516b4-839a-4db9-bc8d-e13c860640ab.vbs"
        17⤵
        
        PID:2616
        
        C:\MSOCache\All Users\taskhost.exe
        
        "C:\MSOCache\All Users\taskhost.exe"
        18⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2628
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0b4caac5-0a4d-4dd6-b36e-ae28083a66e2.vbs"
        19⤵
        
        PID:2832
        
        C:\MSOCache\All Users\taskhost.exe
        
        "C:\MSOCache\All Users\taskhost.exe"
        20⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1740
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\95d99af1-0746-4144-9fde-6a937a6e43fe.vbs"
        21⤵
        
        PID:1940
        
        C:\MSOCache\All Users\taskhost.exe
        
        "C:\MSOCache\All Users\taskhost.exe"
        22⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2016
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\937d0258-c8d1-4836-8459-fb646253aa00.vbs"
        21⤵
        
        PID:1532
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\00e42dea-d856-430b-93ad-778d0c7d256f.vbs"
        19⤵
        
        PID:2348
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\94081a07-29d9-4fed-831d-31016c56adda.vbs"
        17⤵
        
        PID:1484
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f2dc5042-ab18-43c4-933a-7979162f0179.vbs"
        15⤵
        
        PID:2208
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f6e81e3b-fafd-43a1-838e-0a380b93ecd1.vbs"
        13⤵
        
        PID:2460
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8aaf6d60-27ca-4992-8648-9f971fcef770.vbs"
        11⤵
        
        PID:2964
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0e61dda2-e993-4263-9ace-f37cc397057d.vbs"
        9⤵
        
        PID:2004
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\81dd7175-113d-4fa9-ae42-b07f5842d1ea.vbs"
        7⤵
        
        PID:2292
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dfe9be9d-a3bb-47a9-9186-70661173202f.vbs"
        5⤵
        
        PID:1920
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\27c6446b-236c-4ca6-b5f3-c7ea29e6517d.vbs"
    3⤵
    PID:1240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "2e98237175f01ec0b438492e9beb7c985a82827337d7926f3fe0b6316bb6c7e4N2" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\2e98237175f01ec0b438492e9beb7c985a82827337d7926f3fe0b6316bb6c7e4N.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "2e98237175f01ec0b438492e9beb7c985a82827337d7926f3fe0b6316bb6c7e4N" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\2e98237175f01ec0b438492e9beb7c985a82827337d7926f3fe0b6316bb6c7e4N.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "2e98237175f01ec0b438492e9beb7c985a82827337d7926f3fe0b6316bb6c7e4N2" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\2e98237175f01ec0b438492e9beb7c985a82827337d7926f3fe0b6316bb6c7e4N.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 13 /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 12 /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\MSOCache\All Users\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\Windows\LiveKernelReports\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\LiveKernelReports\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\Windows\LiveKernelReports\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows NT\Accessories\it-IT\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\Accessories\it-IT\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows NT\Accessories\it-IT\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 8 /tr "'C:\Users\Public\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Users\Public\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 11 /tr "'C:\Users\Public\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\0b4caac5-0a4d-4dd6-b36e-ae28083a66e2.vbs

Filesize
710B

MD5
480294658f4152f587eea785066fa99c

SHA1
ef5e45c5d359447183e7cb945d63bfb8cec3b966

SHA256
2c85e5709f8ea68b99427234289d0a2b527a277307bf7e647352c8290aabad90

SHA512
bcc23b6b5916adc4a85133eeb25a466342316c37ff45dd3cb74f02254608e94fe6514d5a9931819298b3169d8521d11b24572c8490d6e13d7f2051ffa0b27428

Download Submit
C:\Users\Admin\AppData\Local\Temp\157d6a25-6df1-4e7c-8a46-493bc6c47a10.vbs

Filesize
710B

MD5
ad3e0b1428fb0c505b9fe442684ba2a5

SHA1
2443ddd186989bb00c8e373adf0fb506445d46c1

SHA256
737cdaa7a84f9b13c25dddbd76f77dfa01a94c052985c0c9a3aa785e9980c1e9

SHA512
1375f9d4375378dae11589a9ca952ddf13865e11671c9a5f77e852ff2a17f0b96b1bcf8cf9993fef14ac59a9fdaaf8e4f4e5dc03702fa490a768d0b57d9cda19

Download Submit
C:\Users\Admin\AppData\Local\Temp\27c6446b-236c-4ca6-b5f3-c7ea29e6517d.vbs

Filesize
486B

MD5
09f5bbe889b955a45836c39a3ed442cc

SHA1
47d68631944ecfc357666cccdab3b3c8cf4fa9bd

SHA256
d1cad0c4d806592ee534ee56c34cc884e81de61e953694b30c2b01dd942b1a4a

SHA512
f1312be9257027befb52981c9009822ffaea02fb679acb0b231055d26c1768e7692de7b9403b3a5eb963d5cccdd3609665798685842dea184cb66bb8a6356a83

Download Submit
C:\Users\Admin\AppData\Local\Temp\29d6bb9b-ab18-49e6-b42b-33cd7ce55a40.vbs

Filesize
710B

MD5
2d0dc8e284d46e37d8c6eee3eecff078

SHA1
c69bf1adeb2ec546dae1faf3d1b0fcb5dc0369de

SHA256
6670c9c5c08ff3664301eee8dade69809f568781cfe60165a27d68ed9bc6061d

SHA512
eaf6ad2c83e596697ea09ce902d7b3bff957a08143030b70985512afa5043269c10e8640995fd425b16175fa70d9fbf1f5964c087d35478711cec74f27b5cd2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\5c0516b4-839a-4db9-bc8d-e13c860640ab.vbs

Filesize
710B

MD5
b4b13777bceddd80e67083653f7071ae

SHA1
26331550bdb2d74b80ddbfa4fe54e8006c3fc854

SHA256
9c7ad49ae6403e23497c31a621db274ccbef34eed2e78e22932ec4ab81e70f2e

SHA512
2bf58e3af4d5423e17528d5f649ad290bbc393fe6f0408fed47412a7d305263786fb7abf3dd33d885d88952e71d93fa875035455b414fd4933099c9745a7a2e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\95d99af1-0746-4144-9fde-6a937a6e43fe.vbs

Filesize
710B

MD5
f5f9413ef3c9d1a98bedf151d7270b25

SHA1
d5fbeefc762e2b87a05165fe7af5b4d7db948993

SHA256
3eeec9432e06f1d5aac89c2cb06ae2a3f0b78e018434d2f0ea7aefb8cc75b9ba

SHA512
3673c1db51e3d1e53aada1c553a34f6ebb73194f6b616d850a8f890e0073e82883f78f5793bbe3496052266e8c950bafdfb955dd6d7c7b9776f5eea4695ee679

Download Submit
C:\Users\Admin\AppData\Local\Temp\a7b7d2c9-7390-4c25-877e-7b8883360b3e.vbs

Filesize
710B

MD5
c911c4bd587a689e1383425558a34ea4

SHA1
7e13092d9c78022fd93133e5e180dffe0f45cca5

SHA256
167ec839bfa1cd9be8dcc0349981222f60af17405c44483e687a0700424a0141

SHA512
984184d1f178673360a4793d1f0f0374a1b844e52b4730b5ec4d8254b2e38a3d0e3bba56e1307a351145b1885f5c5beede706972d4915a33ca1c9ff969bec7d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\af715113-231c-4ea2-9f3d-a23fd9415884.vbs

Filesize
710B

MD5
318263a228c31e928d705f8149bfa7af

SHA1
20a83b1111d01ada74f4832fb618be44aa9d9949

SHA256
ab9966650431a2e31a0db25c26686f412388b11ee433d0ea43eb57cab1482817

SHA512
41b1719abff25dc4e1b7238c15cf898eb1ae03309d84b30f17bf362886cbb035f3c37d06430bbdbb7e81b457f7c4048c931a4c9685a3adce48802c4612a5c297

Download Submit
C:\Users\Admin\AppData\Local\Temp\c6433cde-e332-40d6-b3a4-0a27cf70d115.vbs

Filesize
710B

MD5
61cff87a3d63331f7d4f37bc5a8929f7

SHA1
5e573fb7ff52fd53d030b8d2b009f2324414499b

SHA256
3f7ba957a93a0608bd1e66301f5e9f230b4eab18dc87e4cb28a343bee19846a9

SHA512
7e2f31893d0299312beebeaeb5b3c644d4a98b88d7e703fe00e9ca10cb243e7e78bccc9f7834feb3583640f871e7dc616b3f6ec68af8d00edd5439c6a5bf7e87

Download Submit
C:\Users\Admin\AppData\Local\Temp\d5424572-7f0f-42db-a125-edc88a86ae20.vbs

Filesize
710B

MD5
4672a4685bb6899bb12c21ca08af900c

SHA1
780b4cd8d0b2926e6714f7446d44d5931b6d7af5

SHA256
c43814ae692f45f191917e2f03cd2d3f89098f931e15d0c2e8724e2e2e1dab57

SHA512
8f690d6fd3bf8c1a33e53512c984551445224769c4b816738ab97550e84cd79e2c02c37347a2ad49d4a560f28ee6fd51716887d11075a5716663ea18263c3277

Download Submit
C:\Users\Admin\AppData\Local\Temp\dbd4e136-307f-4b96-8bff-26b30999bb24.vbs

Filesize
709B

MD5
d0c71d199be2399a60596334afc9cb26

SHA1
acdabc9ae297a0918a20d569411db21d30c00193

SHA256
80b608838f37f2840b9d39300ece58b730ac54b92bdcee8431a107f595cd7815

SHA512
caa9ed373d789cca51fe1be329f87a94d40754d06f86f6e0c14221fd49f142b30bac460ccdb3911a2b7c97446e3fb998aff48416575e5fe9d30cd1b8a54053e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpED9A.tmp.exe

Filesize
75KB

MD5
e0a68b98992c1699876f818a22b5b907

SHA1
d41e8ad8ba51217eb0340f8f69629ccb474484d0

SHA256
2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

SHA512
856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
aea3bc1c97b60fa1766af18f240e7080

SHA1
1ff09abc4ba82ee57531467cfeefb2fb41e542ad

SHA256
2caa1996fe847dab6a386cebdd8226b40832d11f8027248ca5dfb2f2231ce7b9

SHA512
b642bd7f889765adf393df0fd68d2c1e5e71e26e02cd0695c7693e3dff1338704adbc21977531e78ea8cd9180701c85b6fd7b208ddafd2a152931af19d8087c7

Download Submit
C:\Windows\LiveKernelReports\wininit.exe

Filesize
4.9MB

MD5
d8b8aede9dcb3c6ead52f11fc0826520

SHA1
6b5981a21251b5d0833a8dc8e7b4c71787c3d6e6

SHA256
2e98237175f01ec0b438492e9beb7c985a82827337d7926f3fe0b6316bb6c7e4

SHA512
c3bbcbf837ae31dccf70e966dcb57e6bce105aef5163ebb44111fc7dc810cb34691292cd4ad30ab0e1516a75f569addfafaf6c3a4b026c2a1446f1182bb005b1

Download Submit
memory/816-227-0x0000000001210000-0x0000000001704000-memory.dmp

Filesize
5.0MB

Download
memory/1724-11-0x0000000000CE0000-0x0000000000CEA000-memory.dmp

Filesize
40KB

Download
memory/1724-8-0x0000000000A80000-0x0000000000A90000-memory.dmp

Filesize
64KB

Download
memory/1724-1-0x0000000000FF0000-0x00000000014E4000-memory.dmp

Filesize
5.0MB

Download
memory/1724-2-0x000007FEF5020000-0x000007FEF5A0C000-memory.dmp

Filesize
9.9MB

Download
memory/1724-3-0x000000001B690000-0x000000001B7BE000-memory.dmp

Filesize
1.2MB

Download
memory/1724-16-0x0000000000DB0000-0x0000000000DBC000-memory.dmp

Filesize
48KB

Download
memory/1724-119-0x000007FEF5020000-0x000007FEF5A0C000-memory.dmp

Filesize
9.9MB

Download
memory/1724-15-0x0000000000DA0000-0x0000000000DA8000-memory.dmp

Filesize
32KB

Download
memory/1724-13-0x0000000000D80000-0x0000000000D8E000-memory.dmp

Filesize
56KB

Download
memory/1724-12-0x0000000000CF0000-0x0000000000CFE000-memory.dmp

Filesize
56KB

Download
memory/1724-0-0x000007FEF5023000-0x000007FEF5024000-memory.dmp

Filesize
4KB

Download
memory/1724-10-0x0000000000CD0000-0x0000000000CE2000-memory.dmp

Filesize
72KB

Download
memory/1724-9-0x0000000000C40000-0x0000000000C4A000-memory.dmp

Filesize
40KB

Download
memory/1724-4-0x00000000004A0000-0x00000000004BC000-memory.dmp

Filesize
112KB

Download
memory/1724-5-0x00000000004C0000-0x00000000004C8000-memory.dmp

Filesize
32KB

Download
memory/1724-14-0x0000000000D90000-0x0000000000D98000-memory.dmp

Filesize
32KB

Download
memory/1724-7-0x0000000000C20000-0x0000000000C36000-memory.dmp

Filesize
88KB

Download
memory/1724-6-0x0000000000A70000-0x0000000000A80000-memory.dmp

Filesize
64KB

Download
memory/1740-302-0x0000000000220000-0x0000000000714000-memory.dmp

Filesize
5.0MB

Download
memory/1788-271-0x0000000001360000-0x0000000001854000-memory.dmp

Filesize
5.0MB

Download
memory/1788-272-0x0000000000BE0000-0x0000000000BF2000-memory.dmp

Filesize
72KB

Download
memory/2016-317-0x00000000008D0000-0x0000000000DC4000-memory.dmp

Filesize
5.0MB

Download
memory/2340-212-0x0000000000A00000-0x0000000000A12000-memory.dmp

Filesize
72KB

Download
memory/2340-211-0x00000000000C0000-0x00000000005B4000-memory.dmp

Filesize
5.0MB

Download
memory/2512-111-0x00000000010D0000-0x00000000015C4000-memory.dmp

Filesize
5.0MB

Download
memory/2628-287-0x00000000003A0000-0x0000000000894000-memory.dmp

Filesize
5.0MB

Download
memory/3032-256-0x0000000000260000-0x0000000000754000-memory.dmp

Filesize
5.0MB

Download
memory/3064-110-0x000000001B600000-0x000000001B8E2000-memory.dmp

Filesize
2.9MB

Download
memory/3064-112-0x0000000002880000-0x0000000002888000-memory.dmp

Filesize
32KB

Download