dcrat | 0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5

Analysis

max time kernel
119s
max time network
116s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19-12-2024 11:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5N.exe
Size

4.9MB
MD5

8ae5271e85f7f0ff3bd5df1f96d57b40
SHA1

9bb09274523bc1b88f7c48922549a9c7464f2027
SHA256

0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5
SHA512

4b02bc90828f55e2510221b6c334d4c4ebe706be3ab8371b1e222bf8cd939407a40e76a0d1d1df3d14309c7ca6eec89c96bb7dc590ed990206e773577a17d8e6
SSDEEP

49152:Ll5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:

Score

10^/10

dcrat evasion execution infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 36 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2744	2304	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2808	2304	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2916	2304	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2864	2304	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	524	2304	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2760	2304	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2848	2304	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2764	2304	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2604	2304	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2652	2304	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2212	2304	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2276	2304	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2164	2304	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	672	2304	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1820	2304	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2108	2304	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2980	2304	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	852	2304	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1940	2304	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2368	2304	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2944	2304	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2956	2304	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1292	2304	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1700	2304	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1908	2304	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2292	2304	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2004	2304	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2488	2304	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2240	2304	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	920	2304	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2236	2304	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2028	2304	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1920	2304	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	444	2304	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3024	2304	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2332	2304	schtasks.exe	30

UAC bypass 3 TTPs 27 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/1732-2-0x000000001B4C0000-0x000000001B5EE000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1268	powershell.exe
2688	powershell.exe
1528	powershell.exe
1704	powershell.exe
2412	powershell.exe
1600	powershell.exe
2360	powershell.exe
2512	powershell.exe
2424	powershell.exe
2344	powershell.exe
2684	powershell.exe
2420	powershell.exe

Executes dropped EXE 8 IoCs

pid	Process
888	wininit.exe
1368	wininit.exe
2828	wininit.exe
2612	wininit.exe
2932	wininit.exe
2780	wininit.exe
608	wininit.exe
1828	wininit.exe

Checks whether UAC is enabled 1 TTPs 18 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wininit.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wininit.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wininit.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wininit.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wininit.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5N.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe

Drops file in Program Files directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\RCXC9AA.tmp	0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5N.exe
File created	C:\Program Files\Windows Photo Viewer\es-ES\69ddcba757bf72	0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5N.exe
File created	C:\Program Files\Microsoft Games\Chess\de-DE\c5b4cb5e9653cc	0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5N.exe
File created	C:\Program Files (x86)\Microsoft.NET\Idle.exe	0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5N.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\es-ES\RCXC2C4.tmp	0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5N.exe
File created	C:\Program Files\7-Zip\Lang\lsass.exe	0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5N.exe
File created	C:\Program Files\Microsoft Games\Chess\de-DE\services.exe	0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5N.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lsass.exe	0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5N.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\RCXDB20.tmp	0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5N.exe
File created	C:\Program Files\7-Zip\Lang\6203df4a6bafc7	0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5N.exe
File opened for modification	C:\Program Files\Microsoft Games\Chess\de-DE\RCXCE1F.tmp	0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5N.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\Idle.exe	0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5N.exe
File created	C:\Program Files\Windows Photo Viewer\es-ES\smss.exe	0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5N.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\es-ES\smss.exe	0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5N.exe
File created	C:\Program Files (x86)\Microsoft.NET\6ccacd8608530f	0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5N.exe
File opened for modification	C:\Program Files\Microsoft Games\Chess\de-DE\services.exe	0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5N.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SchCache\wininit.exe	0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5N.exe
File opened for modification	C:\Windows\SchCache\RCXD090.tmp	0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5N.exe
File opened for modification	C:\Windows\SchCache\wininit.exe	0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5N.exe
File created	C:\Windows\Boot\audiodg.exe	0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5N.exe
File created	C:\Windows\SoftwareDistribution\csrss.exe	0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5N.exe
File created	C:\Windows\SoftwareDistribution\886983d96e3d3e	0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5N.exe
File opened for modification	C:\Windows\SoftwareDistribution\RCXD90D.tmp	0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5N.exe
File opened for modification	C:\Windows\SoftwareDistribution\csrss.exe	0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5N.exe
File created	C:\Windows\SchCache\56085415360792	0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 36 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2236	schtasks.exe
2652	schtasks.exe
852	schtasks.exe
1292	schtasks.exe
3024	schtasks.exe
524	schtasks.exe
2848	schtasks.exe
2604	schtasks.exe
2764	schtasks.exe
2368	schtasks.exe
2956	schtasks.exe
1920	schtasks.exe
2332	schtasks.exe
2164	schtasks.exe
672	schtasks.exe
2108	schtasks.exe
1940	schtasks.exe
2944	schtasks.exe
920	schtasks.exe
2028	schtasks.exe
2916	schtasks.exe
2212	schtasks.exe
2980	schtasks.exe
2276	schtasks.exe
1700	schtasks.exe
1908	schtasks.exe
2292	schtasks.exe
2004	schtasks.exe
2744	schtasks.exe
2808	schtasks.exe
2864	schtasks.exe
2240	schtasks.exe
444	schtasks.exe
2760	schtasks.exe
1820	schtasks.exe
2488	schtasks.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
1732	0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5N.exe
1732	0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5N.exe
1732	0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5N.exe
2420	powershell.exe
2688	powershell.exe
2424	powershell.exe
2512	powershell.exe
1268	powershell.exe
1600	powershell.exe
1528	powershell.exe
2360	powershell.exe
2344	powershell.exe
2684	powershell.exe
2412	powershell.exe
1704	powershell.exe
888	wininit.exe
1368	wininit.exe
2828	wininit.exe
2612	wininit.exe
2932	wininit.exe
2780	wininit.exe
608	wininit.exe
1828	wininit.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	1732	0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5N.exe
Token: SeDebugPrivilege	2420	powershell.exe
Token: SeDebugPrivilege	2688	powershell.exe
Token: SeDebugPrivilege	2424	powershell.exe
Token: SeDebugPrivilege	2512	powershell.exe
Token: SeDebugPrivilege	1268	powershell.exe
Token: SeDebugPrivilege	1600	powershell.exe
Token: SeDebugPrivilege	1528	powershell.exe
Token: SeDebugPrivilege	2360	powershell.exe
Token: SeDebugPrivilege	2344	powershell.exe
Token: SeDebugPrivilege	2412	powershell.exe
Token: SeDebugPrivilege	2684	powershell.exe
Token: SeDebugPrivilege	1704	powershell.exe
Token: SeDebugPrivilege	888	wininit.exe
Token: SeDebugPrivilege	1368	wininit.exe
Token: SeDebugPrivilege	2828	wininit.exe
Token: SeDebugPrivilege	2612	wininit.exe
Token: SeDebugPrivilege	2932	wininit.exe
Token: SeDebugPrivilege	2780	wininit.exe
Token: SeDebugPrivilege	608	wininit.exe
Token: SeDebugPrivilege	1828	wininit.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 2344	1732	0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5N.exe	68
PID 1732 wrote to memory of 2344	1732	0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5N.exe	68
PID 1732 wrote to memory of 2344	1732	0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5N.exe	68
PID 1732 wrote to memory of 1528	1732	0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5N.exe	69
PID 1732 wrote to memory of 1528	1732	0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5N.exe	69
PID 1732 wrote to memory of 1528	1732	0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5N.exe	69
PID 1732 wrote to memory of 2684	1732	0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5N.exe	70
PID 1732 wrote to memory of 2684	1732	0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5N.exe	70
PID 1732 wrote to memory of 2684	1732	0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5N.exe	70
PID 1732 wrote to memory of 1600	1732	0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5N.exe	71
PID 1732 wrote to memory of 1600	1732	0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5N.exe	71
PID 1732 wrote to memory of 1600	1732	0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5N.exe	71
PID 1732 wrote to memory of 1704	1732	0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5N.exe	72
PID 1732 wrote to memory of 1704	1732	0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5N.exe	72
PID 1732 wrote to memory of 1704	1732	0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5N.exe	72
PID 1732 wrote to memory of 2412	1732	0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5N.exe	74
PID 1732 wrote to memory of 2412	1732	0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5N.exe	74
PID 1732 wrote to memory of 2412	1732	0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5N.exe	74
PID 1732 wrote to memory of 2688	1732	0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5N.exe	75
PID 1732 wrote to memory of 2688	1732	0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5N.exe	75
PID 1732 wrote to memory of 2688	1732	0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5N.exe	75
PID 1732 wrote to memory of 2360	1732	0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5N.exe	76
PID 1732 wrote to memory of 2360	1732	0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5N.exe	76
PID 1732 wrote to memory of 2360	1732	0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5N.exe	76
PID 1732 wrote to memory of 2512	1732	0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5N.exe	77
PID 1732 wrote to memory of 2512	1732	0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5N.exe	77
PID 1732 wrote to memory of 2512	1732	0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5N.exe	77
PID 1732 wrote to memory of 2424	1732	0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5N.exe	78
PID 1732 wrote to memory of 2424	1732	0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5N.exe	78
PID 1732 wrote to memory of 2424	1732	0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5N.exe	78
PID 1732 wrote to memory of 2420	1732	0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5N.exe	79
PID 1732 wrote to memory of 2420	1732	0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5N.exe	79
PID 1732 wrote to memory of 2420	1732	0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5N.exe	79
PID 1732 wrote to memory of 1268	1732	0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5N.exe	80
PID 1732 wrote to memory of 1268	1732	0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5N.exe	80
PID 1732 wrote to memory of 1268	1732	0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5N.exe	80
PID 1732 wrote to memory of 2616	1732	0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5N.exe	92
PID 1732 wrote to memory of 2616	1732	0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5N.exe	92
PID 1732 wrote to memory of 2616	1732	0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5N.exe	92
PID 2616 wrote to memory of 2848	2616	cmd.exe	94
PID 2616 wrote to memory of 2848	2616	cmd.exe	94
PID 2616 wrote to memory of 2848	2616	cmd.exe	94
PID 2616 wrote to memory of 888	2616	cmd.exe	95
PID 2616 wrote to memory of 888	2616	cmd.exe	95
PID 2616 wrote to memory of 888	2616	cmd.exe	95
PID 888 wrote to memory of 1952	888	wininit.exe	96
PID 888 wrote to memory of 1952	888	wininit.exe	96
PID 888 wrote to memory of 1952	888	wininit.exe	96
PID 888 wrote to memory of 1976	888	wininit.exe	97
PID 888 wrote to memory of 1976	888	wininit.exe	97
PID 888 wrote to memory of 1976	888	wininit.exe	97
PID 1952 wrote to memory of 1368	1952	WScript.exe	98
PID 1952 wrote to memory of 1368	1952	WScript.exe	98
PID 1952 wrote to memory of 1368	1952	WScript.exe	98
PID 1368 wrote to memory of 1328	1368	wininit.exe	99
PID 1368 wrote to memory of 1328	1368	wininit.exe	99
PID 1368 wrote to memory of 1328	1368	wininit.exe	99
PID 1368 wrote to memory of 2944	1368	wininit.exe	100
PID 1368 wrote to memory of 2944	1368	wininit.exe	100
PID 1368 wrote to memory of 2944	1368	wininit.exe	100
PID 1328 wrote to memory of 2828	1328	WScript.exe	101
PID 1328 wrote to memory of 2828	1328	WScript.exe	101
PID 1328 wrote to memory of 2828	1328	WScript.exe	101
PID 2828 wrote to memory of 2668	2828	wininit.exe	102

System policy modification 1 TTPs 27 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5N.exe
"C:\Users\Admin\AppData\Local\Temp\0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5N.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1732
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2344
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1528
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2684
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1600
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1704
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2412
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2688
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2360
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2512
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2424
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2420
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1268
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\602Zy6uMFq.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2616
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:2848
- - C:\Windows\SchCache\wininit.exe
    "C:\Windows\SchCache\wininit.exe"
    3⤵
    - UAC bypass
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:888
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0dde6109-8774-45d1-b5cf-6e181e5b0a55.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1952
    - - C:\Windows\SchCache\wininit.exe
        
        C:\Windows\SchCache\wininit.exe
        5⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1368
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3d6f8078-86fc-4cdb-bf2e-34041753866e.vbs"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1328
        
        C:\Windows\SchCache\wininit.exe
        
        C:\Windows\SchCache\wininit.exe
        7⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2828
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\aedc99df-5e8f-416a-bf14-5b27ffe9e3c5.vbs"
        8⤵
        
        PID:2668
        
        C:\Windows\SchCache\wininit.exe
        
        C:\Windows\SchCache\wininit.exe
        9⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2612
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\338d3d26-ef33-4ccb-919c-f746f463e1fa.vbs"
        10⤵
        
        PID:1268
        
        C:\Windows\SchCache\wininit.exe
        
        C:\Windows\SchCache\wininit.exe
        11⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2932
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4f4ebed4-0d8e-48f4-b723-e4bc0771156a.vbs"
        12⤵
        
        PID:544
        
        C:\Windows\SchCache\wininit.exe
        
        C:\Windows\SchCache\wininit.exe
        13⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2780
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\046055c1-7689-4e70-a2eb-5c526ad43c40.vbs"
        14⤵
        
        PID:1368
        
        C:\Windows\SchCache\wininit.exe
        
        C:\Windows\SchCache\wininit.exe
        15⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:608
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b3ed4cd5-22a5-4165-92e7-d619f46ec690.vbs"
        16⤵
        
        PID:1476
        
        C:\Windows\SchCache\wininit.exe
        
        C:\Windows\SchCache\wininit.exe
        17⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1828
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\521de8c1-8ddb-4f88-80d8-81c636dc6602.vbs"
        18⤵
        
        PID:1120
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bf007f97-1e14-40f3-bf6b-dfddca6afa95.vbs"
        18⤵
        
        PID:1792
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5d0f20fd-4ada-4e4e-a06f-5b1470fa095b.vbs"
        16⤵
        
        PID:2468
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d4619ce6-f8d8-4ade-aa8f-bbfa8921f148.vbs"
        14⤵
        
        PID:844
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b3f5c434-9262-4d95-b726-e022d6a7091e.vbs"
        12⤵
        
        PID:1512
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\da1cbdcf-6dc2-4a52-b2aa-26787eed6e3c.vbs"
        10⤵
        
        PID:1592
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\52cb52aa-ac2d-4ce5-91cc-e292bdda0773.vbs"
        8⤵
        
        PID:3052
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a709bb6e-19d3-4907-9506-0105853b5747.vbs"
        6⤵
        
        PID:2944
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\aa7ae631-577f-48b6-8a49-68ff192b5372.vbs"
      4⤵
      PID:1976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Photo Viewer\es-ES\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\es-ES\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Photo Viewer\es-ES\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Users\Default\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\Default\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Users\Default\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Program Files\Google\Chrome\Application\SetupMetrics\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\Application\SetupMetrics\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Program Files\Google\Chrome\Application\SetupMetrics\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Program Files\7-Zip\Lang\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Program Files\7-Zip\Lang\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Program Files\Microsoft Games\Chess\de-DE\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Microsoft Games\Chess\de-DE\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Program Files\Microsoft Games\Chess\de-DE\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Windows\SchCache\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\SchCache\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Windows\SchCache\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\MSOCache\All Users\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Windows\SoftwareDistribution\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\SoftwareDistribution\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Windows\SoftwareDistribution\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft.NET\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft.NET\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Idle.exe

Filesize
4.9MB

MD5
8ae5271e85f7f0ff3bd5df1f96d57b40

SHA1
9bb09274523bc1b88f7c48922549a9c7464f2027

SHA256
0f65cda1b8996dcb7b0352359dc6226e69f010a7d9f4335e64acecaad904f4b5

SHA512
4b02bc90828f55e2510221b6c334d4c4ebe706be3ab8371b1e222bf8cd939407a40e76a0d1d1df3d14309c7ca6eec89c96bb7dc590ed990206e773577a17d8e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\046055c1-7689-4e70-a2eb-5c526ad43c40.vbs

Filesize
707B

MD5
22b3301363a56ec3f5c6ffa25e9f2d0c

SHA1
1c0febf6b93927edcc929de1a659dac329b92553

SHA256
4ec390f7968918498d1a09d31c66f46066deab61a189df6ff71693eca7ce7164

SHA512
9f56124947e26a79c720899e81497282c3c3d9a87cd5a233006f4708653c74206f4685e186508af60959593226b4673ca404db902636ef698610975d4f4545c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\0dde6109-8774-45d1-b5cf-6e181e5b0a55.vbs

Filesize
706B

MD5
7d1c8fdd7943eab37371e53622e49a29

SHA1
34ec57eb6eda5d433854ae48259cd87909cac150

SHA256
a2074ed09b0a9b333c506f0060b5746d773e708a25f6feaeee92a2bce190d78e

SHA512
a089e7def6ea68656d0209990f1b158cc484c3dae78d20167debbef744eee6c9318d3d8a581ac65f9fda03c45b005db7c7f929aaf45efc574ee7c53f5c2e897a

Download Submit
C:\Users\Admin\AppData\Local\Temp\338d3d26-ef33-4ccb-919c-f746f463e1fa.vbs

Filesize
707B

MD5
35b2c3fbd215e9efe0f520cc8c5516ee

SHA1
045bd00399b967dc647344a9c4e749d2efed8fb4

SHA256
17738da54dc06a3997a0308618865cf3a51d124e29cba544eba634de93670784

SHA512
832b03941c805c881bf26c8bc62f2711f3839bac5d2152f2c842538fe4d169fe5d7b3f2cf261f119da157762e9d61a9ae019c93ebb2f8081840b37ac5f138269

Download Submit
C:\Users\Admin\AppData\Local\Temp\3d6f8078-86fc-4cdb-bf2e-34041753866e.vbs

Filesize
707B

MD5
8ac86ccc7f59542aa01c065174238a26

SHA1
7fb7c2d21bafe8630c45678af606af6216237874

SHA256
067259563836b8b220b3f6b18082c1ccaae159ef5d52c9a7a128649f07c60e1f

SHA512
580dffa223f2c07819e2fa0e7f231981ce3d5555d9f9c7b4813049823858c381e998079b98e7c4039d22ed6b78b6fab58a01e328988d521f68aa7155973b1a95

Download Submit
C:\Users\Admin\AppData\Local\Temp\4f4ebed4-0d8e-48f4-b723-e4bc0771156a.vbs

Filesize
707B

MD5
d3bcdc5a7f59f7c1b039ff985a2dcbd5

SHA1
91511787e72f5a7411c02505fdb14973a431c9a7

SHA256
9c4a76fdf3c680508c6f8f2a5654975814a49e485371b363c9ecc0923016d0b9

SHA512
11dc34f3aeb114df7b4e503fe2f48fabbb3ef0d60fd35213ba4ab09451057bd885fe8da7f86277d2adf4931d31cdcab3adcb84b2649e82f4bd7cb46b96466390

Download Submit
C:\Users\Admin\AppData\Local\Temp\521de8c1-8ddb-4f88-80d8-81c636dc6602.vbs

Filesize
707B

MD5
6c10e83439cc69a5dbfd0174d298dccd

SHA1
3b14b7acf08d13aa270b824ad5221ff6c53f3c57

SHA256
b0e0131f8e709d9d61351597c5e0242a9c8f9e65f8243ee4775db6a61a9dd2ef

SHA512
fe89f51a5850b113c51b04647fc5d91b05c8969a0a878199314ee8372ce5682dc28941a6f99e89bc75f8a7fda5bf79d4be4d6d820a58ed9db9823722a23a3151

Download Submit
C:\Users\Admin\AppData\Local\Temp\602Zy6uMFq.bat

Filesize
196B

MD5
38d387cf249214105a3c0ce487ab4a76

SHA1
9c2b8d3f56bf7684f159ccf62362d52b76fd0592

SHA256
aea70e9d83d807efaa95059437fa9a6ee1ef49219c816fdb33c8243b66bc2081

SHA512
8d904ac9fbcf69edec96c09c39d9b7cb91779e0bdfca847beb578caa69ad102685d08b66cef6c732b0069ecf39b2f6e163242c8d013cbbdcbcdbd184f63bbb64

Download Submit
C:\Users\Admin\AppData\Local\Temp\aa7ae631-577f-48b6-8a49-68ff192b5372.vbs

Filesize
483B

MD5
9724fd6e828e1794744757f1e690f680

SHA1
ebf005eca70ad2d4298eb7d0fe0a892739de2b79

SHA256
761d57528bae993379565cc4d0528fba571ca832b378b97d310f42b6281dc82e

SHA512
198e356cdae936a2bdb6c8d5b84e7b93c58db612f3686415571c0f08d49c96190d7ce4e7e50a5b50e789135d9b7c429548652ae36bbefc772b93e673130294ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\aedc99df-5e8f-416a-bf14-5b27ffe9e3c5.vbs

Filesize
707B

MD5
39d5a15b330677778ffea88cf420dbf9

SHA1
9ba5ef479bc3e1f2913659e58109a42b4ae32cb4

SHA256
05a19b574fa474ba837dfba13d4e3d62623780f228df13d5b7dcf3148222a6bf

SHA512
7e4ae99f88744a8c609082c7f8e3c7161850c9029f1659d2f5cd9e22a79c991d1f86f91aefb357bccc82906212c4a1890e9d06531fada498f24027a1bbf059bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\b3ed4cd5-22a5-4165-92e7-d619f46ec690.vbs

Filesize
706B

MD5
1415b6617c886b46757bb344704df9bb

SHA1
f4814161fec56c9fdaadfca8fdc1ea34689ca84a

SHA256
e0ff39a29ac7a34446e9f07357cc7c7e5607a2927192a3c36f05d4f8ee2a6525

SHA512
f2dc78c41efb45dbbf31de67be8e04fb2bdff62960e763dfd90f8cbea7432b2b276da9efb3087ec4300c8b9e52e434c5c2cbf0fb3f005e325d0a56744caee79d

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp38A.tmp.exe

Filesize
75KB

MD5
e0a68b98992c1699876f818a22b5b907

SHA1
d41e8ad8ba51217eb0340f8f69629ccb474484d0

SHA256
2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

SHA512
856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
4d7c5d81ff74523c8c00f47f08e10601

SHA1
df004b460f588d06d57d77001943339825fa71cc

SHA256
09a083c7937b1169dc987708334ebe68c58908cbf7d4c9aad54505f6dd412e43

SHA512
f57d578652dbe7ef93644dd0d278ab15565067cb1215c17194d099cc33dbce07b39ac1d6d01fd6c473a3d106bbb5976aa2d4c7ac1b782eeb8bc3d7f02ffd8e99

Download Submit
C:\Windows\SoftwareDistribution\RCXD90D.tmp

Filesize
4.9MB

MD5
b31241d73e960cba12dda1290f01e01a

SHA1
17540b431f39e3729024788a17b7e108b63135e1

SHA256
f8b6ffdb58f28173a45a305d598b7d17713e4cabe13093685d8cf0b9c6eaa9d2

SHA512
afd0df633b1131b603459a822b83e1342068fb95894a4a7715a66fd68583390d4e61e135fbf39e61c87cfcb2d14e9cc30f75dce822f88502a0480a330043310a

Download Submit
memory/608-285-0x0000000000E90000-0x0000000001384000-memory.dmp

Filesize
5.0MB

Download
memory/888-194-0x0000000000EB0000-0x00000000013A4000-memory.dmp

Filesize
5.0MB

Download
memory/1368-208-0x0000000000BC0000-0x0000000000BD2000-memory.dmp

Filesize
72KB

Download
memory/1732-7-0x0000000002390000-0x00000000023A6000-memory.dmp

Filesize
88KB

Download
memory/1732-10-0x00000000025E0000-0x00000000025F2000-memory.dmp

Filesize
72KB

Download
memory/1732-124-0x000007FEF57B3000-0x000007FEF57B4000-memory.dmp

Filesize
4KB

Download
memory/1732-130-0x000007FEF57B0000-0x000007FEF619C000-memory.dmp

Filesize
9.9MB

Download
memory/1732-14-0x000000001AB10000-0x000000001AB18000-memory.dmp

Filesize
32KB

Download
memory/1732-8-0x0000000002430000-0x0000000002440000-memory.dmp

Filesize
64KB

Download
memory/1732-1-0x0000000000100000-0x00000000005F4000-memory.dmp

Filesize
5.0MB

Download
memory/1732-9-0x0000000002440000-0x000000000244A000-memory.dmp

Filesize
40KB

Download
memory/1732-16-0x000000001AC30000-0x000000001AC3C000-memory.dmp

Filesize
48KB

Download
memory/1732-3-0x000007FEF57B0000-0x000007FEF619C000-memory.dmp

Filesize
9.9MB

Download
memory/1732-6-0x0000000002380000-0x0000000002390000-memory.dmp

Filesize
64KB

Download
memory/1732-15-0x000000001AC20000-0x000000001AC28000-memory.dmp

Filesize
32KB

Download
memory/1732-13-0x000000001AB00000-0x000000001AB0E000-memory.dmp

Filesize
56KB

Download
memory/1732-5-0x0000000000B20000-0x0000000000B28000-memory.dmp

Filesize
32KB

Download
memory/1732-11-0x00000000025F0000-0x00000000025FA000-memory.dmp

Filesize
40KB

Download
memory/1732-12-0x000000001AAF0000-0x000000001AAFE000-memory.dmp

Filesize
56KB

Download
memory/1732-0-0x000007FEF57B3000-0x000007FEF57B4000-memory.dmp

Filesize
4KB

Download
memory/1732-2-0x000000001B4C0000-0x000000001B5EE000-memory.dmp

Filesize
1.2MB

Download
memory/1732-4-0x0000000002360000-0x000000000237C000-memory.dmp

Filesize
112KB

Download
memory/2420-148-0x0000000002340000-0x0000000002348000-memory.dmp

Filesize
32KB

Download
memory/2420-147-0x000000001B750000-0x000000001BA32000-memory.dmp

Filesize
2.9MB

Download
memory/2612-239-0x00000000003B0000-0x00000000008A4000-memory.dmp

Filesize
5.0MB

Download
memory/2780-270-0x00000000002C0000-0x00000000007B4000-memory.dmp

Filesize
5.0MB

Download
memory/2828-224-0x00000000024D0000-0x00000000024E2000-memory.dmp

Filesize
72KB

Download
memory/2828-223-0x0000000000270000-0x0000000000764000-memory.dmp

Filesize
5.0MB

Download
memory/2932-255-0x0000000000690000-0x00000000006A2000-memory.dmp

Filesize
72KB

Download
memory/2932-254-0x0000000000BE0000-0x00000000010D4000-memory.dmp

Filesize
5.0MB

Download