dcrat | 4e5088984e5d2304a531271ae248973b36e6d96a7f48f0dc56a92ffd951452fc

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20250207-en
resource tags

arch:x64arch:x86image:win7-20250207-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 06:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Size

1.1MB
MD5

8178e5a952fb588b857dfb7ad3317e6a
SHA1

bd304f931d02f01c5f3aa3a680e633b989ddee11
SHA256

070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b
SHA512

27f4516b3faebebe03564899ebe542687f69ba6e93917b66151e472ce011ce7e726eb814c5696d9cea28b7cd297bb32bd75a3de6adceb40e6bdacf18591da87e
SSDEEP

12288:d6NE5eSwJu37+GXJpkaI7ShG54v4ahgVY3whNG8/LI6i4ejmtnbAouuFteLBdBN9:d6NReJXJIwvJgVQSoPEzKkLXa

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 36 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\csrss.exe\", \"C:\\Program Files\\Uninstall Information\\dwm.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\winlogon.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\csrss.exe\", \"C:\\Program Files\\Uninstall Information\\dwm.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\winlogon.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\wininit.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\de-DE\\lsass.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Offline\\System.exe\", \"C:\\Program Files\\Windows Photo Viewer\\fr-FR\\wininit.exe\", \"C:\\Program Files\\Mozilla Firefox\\uninstall\\explorer.exe\", \"C:\\Windows\\Microsoft.NET\\lsm.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\WmiPrvSE.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\audiodg.exe\", \"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\sppsvc.exe\", \"C:\\Windows\\ehome\\es-ES\\OSPPSVC.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\OSPPSVC.exe\", \"C:\\Program Files\\Windows Defender\\en-US\\WmiPrvSE.exe\", \"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\OSPPSVC.exe\", \"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\lsass.exe\", \"C:\\Windows\\ehome\\smss.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\WmiPrvSE.exe\", \"C:\\Windows\\Installer\\{90140000-006E-0409-0000-0000000FF1CE}\\dwm.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\csrss.exe\", \"C:\\Program Files\\Uninstall Information\\dwm.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\winlogon.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\wininit.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\de-DE\\lsass.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Offline\\System.exe\", \"C:\\Program Files\\Windows Photo Viewer\\fr-FR\\wininit.exe\", \"C:\\Program Files\\Mozilla Firefox\\uninstall\\explorer.exe\", \"C:\\Windows\\Microsoft.NET\\lsm.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\WmiPrvSE.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\audiodg.exe\", \"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\sppsvc.exe\", \"C:\\Windows\\ehome\\es-ES\\OSPPSVC.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\OSPPSVC.exe\", \"C:\\Program Files\\Windows Defender\\en-US\\WmiPrvSE.exe\", \"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\OSPPSVC.exe\", \"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\lsass.exe\", \"C:\\Windows\\ehome\\smss.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\WmiPrvSE.exe\", \"C:\\Windows\\Installer\\{90140000-006E-0409-0000-0000000FF1CE}\\dwm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\dllhost.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\csrss.exe\", \"C:\\Program Files\\Uninstall Information\\dwm.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\winlogon.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\wininit.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\de-DE\\lsass.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Offline\\System.exe\", \"C:\\Program Files\\Windows Photo Viewer\\fr-FR\\wininit.exe\", \"C:\\Program Files\\Mozilla Firefox\\uninstall\\explorer.exe\", \"C:\\Windows\\Microsoft.NET\\lsm.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\WmiPrvSE.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\audiodg.exe\", \"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\sppsvc.exe\", \"C:\\Windows\\ehome\\es-ES\\OSPPSVC.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\OSPPSVC.exe\", \"C:\\Program Files\\Windows Defender\\en-US\\WmiPrvSE.exe\", \"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\OSPPSVC.exe\", \"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\lsass.exe\", \"C:\\Windows\\ehome\\smss.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\WmiPrvSE.exe\", \"C:\\Windows\\Installer\\{90140000-006E-0409-0000-0000000FF1CE}\\dwm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\dllhost.exe\", \"C:\\Windows\\Prefetch\\ReadyBoot\\OSPPSVC.exe\", \"C:\\Users\\All Users\\services.exe\", \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\csrss.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\csrss.exe\", \"C:\\Program Files\\Uninstall Information\\dwm.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\winlogon.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\wininit.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\de-DE\\lsass.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Offline\\System.exe\", \"C:\\Program Files\\Windows Photo Viewer\\fr-FR\\wininit.exe\", \"C:\\Program Files\\Mozilla Firefox\\uninstall\\explorer.exe\", \"C:\\Windows\\Microsoft.NET\\lsm.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\WmiPrvSE.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\audiodg.exe\", \"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\sppsvc.exe\", \"C:\\Windows\\ehome\\es-ES\\OSPPSVC.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\OSPPSVC.exe\", \"C:\\Program Files\\Windows Defender\\en-US\\WmiPrvSE.exe\", \"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\OSPPSVC.exe\", \"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\lsass.exe\", \"C:\\Windows\\ehome\\smss.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\WmiPrvSE.exe\", \"C:\\Windows\\Installer\\{90140000-006E-0409-0000-0000000FF1CE}\\dwm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\dllhost.exe\", \"C:\\Windows\\Prefetch\\ReadyBoot\\OSPPSVC.exe\", \"C:\\Users\\All Users\\services.exe\", \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\csrss.exe\", \"C:\\Program Files\\Uninstall Information\\WMIADAP.exe\", \"C:\\Users\\Public\\Pictures\\Sample Pictures\\winlogon.exe\", \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\taskhost.exe\", \"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\OSPPSVC.exe\", \"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe\", \"C:\\Program Files\\MSBuild\\WmiPrvSE.exe\", \"C:\\Users\\Default\\PrintHood\\taskhost.exe\", \"C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\csrss.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\csrss.exe\", \"C:\\Program Files\\Uninstall Information\\dwm.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\winlogon.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\wininit.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\csrss.exe\", \"C:\\Program Files\\Uninstall Information\\dwm.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\winlogon.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\wininit.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\de-DE\\lsass.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Offline\\System.exe\", \"C:\\Program Files\\Windows Photo Viewer\\fr-FR\\wininit.exe\", \"C:\\Program Files\\Mozilla Firefox\\uninstall\\explorer.exe\", \"C:\\Windows\\Microsoft.NET\\lsm.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\WmiPrvSE.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\audiodg.exe\", \"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\sppsvc.exe\", \"C:\\Windows\\ehome\\es-ES\\OSPPSVC.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\OSPPSVC.exe\", \"C:\\Program Files\\Windows Defender\\en-US\\WmiPrvSE.exe\", \"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\OSPPSVC.exe\", \"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\lsass.exe\", \"C:\\Windows\\ehome\\smss.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\WmiPrvSE.exe\", \"C:\\Windows\\Installer\\{90140000-006E-0409-0000-0000000FF1CE}\\dwm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\dllhost.exe\", \"C:\\Windows\\Prefetch\\ReadyBoot\\OSPPSVC.exe\", \"C:\\Users\\All Users\\services.exe\", \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\csrss.exe\", \"C:\\Program Files\\Uninstall Information\\WMIADAP.exe\", \"C:\\Users\\Public\\Pictures\\Sample Pictures\\winlogon.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\csrss.exe\", \"C:\\Program Files\\Uninstall Information\\dwm.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\winlogon.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\wininit.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\de-DE\\lsass.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\csrss.exe\", \"C:\\Program Files\\Uninstall Information\\dwm.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\winlogon.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\wininit.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\de-DE\\lsass.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Offline\\System.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\csrss.exe\", \"C:\\Program Files\\Uninstall Information\\dwm.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\winlogon.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\wininit.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\de-DE\\lsass.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Offline\\System.exe\", \"C:\\Program Files\\Windows Photo Viewer\\fr-FR\\wininit.exe\", \"C:\\Program Files\\Mozilla Firefox\\uninstall\\explorer.exe\", \"C:\\Windows\\Microsoft.NET\\lsm.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\WmiPrvSE.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\audiodg.exe\", \"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\sppsvc.exe\", \"C:\\Windows\\ehome\\es-ES\\OSPPSVC.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\lsm.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\csrss.exe\", \"C:\\Program Files\\Uninstall Information\\dwm.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\winlogon.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\wininit.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\de-DE\\lsass.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Offline\\System.exe\", \"C:\\Program Files\\Windows Photo Viewer\\fr-FR\\wininit.exe\", \"C:\\Program Files\\Mozilla Firefox\\uninstall\\explorer.exe\", \"C:\\Windows\\Microsoft.NET\\lsm.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\WmiPrvSE.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\audiodg.exe\", \"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\sppsvc.exe\", \"C:\\Windows\\ehome\\es-ES\\OSPPSVC.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\OSPPSVC.exe\", \"C:\\Program Files\\Windows Defender\\en-US\\WmiPrvSE.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\csrss.exe\", \"C:\\Program Files\\Uninstall Information\\dwm.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\winlogon.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\wininit.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\de-DE\\lsass.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Offline\\System.exe\", \"C:\\Program Files\\Windows Photo Viewer\\fr-FR\\wininit.exe\", \"C:\\Program Files\\Mozilla Firefox\\uninstall\\explorer.exe\", \"C:\\Windows\\Microsoft.NET\\lsm.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\WmiPrvSE.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\audiodg.exe\", \"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\sppsvc.exe\", \"C:\\Windows\\ehome\\es-ES\\OSPPSVC.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\OSPPSVC.exe\", \"C:\\Program Files\\Windows Defender\\en-US\\WmiPrvSE.exe\", \"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\OSPPSVC.exe\", \"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\lsass.exe\", \"C:\\Windows\\ehome\\smss.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\WmiPrvSE.exe\", \"C:\\Windows\\Installer\\{90140000-006E-0409-0000-0000000FF1CE}\\dwm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\dllhost.exe\", \"C:\\Windows\\Prefetch\\ReadyBoot\\OSPPSVC.exe\", \"C:\\Users\\All Users\\services.exe\", \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\csrss.exe\", \"C:\\Program Files\\Uninstall Information\\WMIADAP.exe\", \"C:\\Users\\Public\\Pictures\\Sample Pictures\\winlogon.exe\", \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\taskhost.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\csrss.exe\", \"C:\\Program Files\\Uninstall Information\\dwm.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\winlogon.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\wininit.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\de-DE\\lsass.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Offline\\System.exe\", \"C:\\Program Files\\Windows Photo Viewer\\fr-FR\\wininit.exe\", \"C:\\Program Files\\Mozilla Firefox\\uninstall\\explorer.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\csrss.exe\", \"C:\\Program Files\\Uninstall Information\\dwm.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\winlogon.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\wininit.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\de-DE\\lsass.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Offline\\System.exe\", \"C:\\Program Files\\Windows Photo Viewer\\fr-FR\\wininit.exe\", \"C:\\Program Files\\Mozilla Firefox\\uninstall\\explorer.exe\", \"C:\\Windows\\Microsoft.NET\\lsm.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\WmiPrvSE.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\csrss.exe\", \"C:\\Program Files\\Uninstall Information\\dwm.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\winlogon.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\wininit.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\de-DE\\lsass.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Offline\\System.exe\", \"C:\\Program Files\\Windows Photo Viewer\\fr-FR\\wininit.exe\", \"C:\\Program Files\\Mozilla Firefox\\uninstall\\explorer.exe\", \"C:\\Windows\\Microsoft.NET\\lsm.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\WmiPrvSE.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\audiodg.exe\", \"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\sppsvc.exe\", \"C:\\Windows\\ehome\\es-ES\\OSPPSVC.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\OSPPSVC.exe\", \"C:\\Program Files\\Windows Defender\\en-US\\WmiPrvSE.exe\", \"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\OSPPSVC.exe\", \"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\lsass.exe\", \"C:\\Windows\\ehome\\smss.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\WmiPrvSE.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\csrss.exe\", \"C:\\Program Files\\Uninstall Information\\dwm.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\winlogon.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\wininit.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\de-DE\\lsass.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Offline\\System.exe\", \"C:\\Program Files\\Windows Photo Viewer\\fr-FR\\wininit.exe\", \"C:\\Program Files\\Mozilla Firefox\\uninstall\\explorer.exe\", \"C:\\Windows\\Microsoft.NET\\lsm.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\WmiPrvSE.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\audiodg.exe\", \"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\sppsvc.exe\", \"C:\\Windows\\ehome\\es-ES\\OSPPSVC.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\OSPPSVC.exe\", \"C:\\Program Files\\Windows Defender\\en-US\\WmiPrvSE.exe\", \"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\OSPPSVC.exe\", \"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\lsass.exe\", \"C:\\Windows\\ehome\\smss.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\WmiPrvSE.exe\", \"C:\\Windows\\Installer\\{90140000-006E-0409-0000-0000000FF1CE}\\dwm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\dllhost.exe\", \"C:\\Windows\\Prefetch\\ReadyBoot\\OSPPSVC.exe\", \"C:\\Users\\All Users\\services.exe\", \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\csrss.exe\", \"C:\\Program Files\\Uninstall Information\\WMIADAP.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\csrss.exe\", \"C:\\Program Files\\Uninstall Information\\dwm.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\winlogon.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\wininit.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\de-DE\\lsass.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Offline\\System.exe\", \"C:\\Program Files\\Windows Photo Viewer\\fr-FR\\wininit.exe\", \"C:\\Program Files\\Mozilla Firefox\\uninstall\\explorer.exe\", \"C:\\Windows\\Microsoft.NET\\lsm.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\WmiPrvSE.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\audiodg.exe\", \"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\sppsvc.exe\", \"C:\\Windows\\ehome\\es-ES\\OSPPSVC.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\OSPPSVC.exe\", \"C:\\Program Files\\Windows Defender\\en-US\\WmiPrvSE.exe\", \"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\OSPPSVC.exe\", \"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\lsass.exe\", \"C:\\Windows\\ehome\\smss.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\WmiPrvSE.exe\", \"C:\\Windows\\Installer\\{90140000-006E-0409-0000-0000000FF1CE}\\dwm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\dllhost.exe\", \"C:\\Windows\\Prefetch\\ReadyBoot\\OSPPSVC.exe\", \"C:\\Users\\All Users\\services.exe\", \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\csrss.exe\", \"C:\\Program Files\\Uninstall Information\\WMIADAP.exe\", \"C:\\Users\\Public\\Pictures\\Sample Pictures\\winlogon.exe\", \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\taskhost.exe\", \"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\OSPPSVC.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\csrss.exe\", \"C:\\Program Files\\Uninstall Information\\dwm.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\csrss.exe\", \"C:\\Program Files\\Uninstall Information\\dwm.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\winlogon.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\wininit.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\de-DE\\lsass.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Offline\\System.exe\", \"C:\\Program Files\\Windows Photo Viewer\\fr-FR\\wininit.exe\", \"C:\\Program Files\\Mozilla Firefox\\uninstall\\explorer.exe\", \"C:\\Windows\\Microsoft.NET\\lsm.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\WmiPrvSE.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\audiodg.exe\", \"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\sppsvc.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\csrss.exe\", \"C:\\Program Files\\Uninstall Information\\dwm.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\winlogon.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\wininit.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\de-DE\\lsass.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Offline\\System.exe\", \"C:\\Program Files\\Windows Photo Viewer\\fr-FR\\wininit.exe\", \"C:\\Program Files\\Mozilla Firefox\\uninstall\\explorer.exe\", \"C:\\Windows\\Microsoft.NET\\lsm.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\WmiPrvSE.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\audiodg.exe\", \"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\sppsvc.exe\", \"C:\\Windows\\ehome\\es-ES\\OSPPSVC.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\OSPPSVC.exe\", \"C:\\Program Files\\Windows Defender\\en-US\\WmiPrvSE.exe\", \"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\OSPPSVC.exe\", \"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\lsass.exe\", \"C:\\Windows\\ehome\\smss.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\WmiPrvSE.exe\", \"C:\\Windows\\Installer\\{90140000-006E-0409-0000-0000000FF1CE}\\dwm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\dllhost.exe\", \"C:\\Windows\\Prefetch\\ReadyBoot\\OSPPSVC.exe\", \"C:\\Users\\All Users\\services.exe\", \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\csrss.exe\", \"C:\\Program Files\\Uninstall Information\\WMIADAP.exe\", \"C:\\Users\\Public\\Pictures\\Sample Pictures\\winlogon.exe\", \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\taskhost.exe\", \"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\OSPPSVC.exe\", \"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe\", \"C:\\Program Files\\MSBuild\\WmiPrvSE.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\csrss.exe\", \"C:\\Program Files\\Uninstall Information\\dwm.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\lsm.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\csrss.exe\", \"C:\\Program Files\\Uninstall Information\\dwm.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\winlogon.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\wininit.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\de-DE\\lsass.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Offline\\System.exe\", \"C:\\Program Files\\Windows Photo Viewer\\fr-FR\\wininit.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\csrss.exe\", \"C:\\Program Files\\Uninstall Information\\dwm.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\winlogon.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\wininit.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\de-DE\\lsass.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Offline\\System.exe\", \"C:\\Program Files\\Windows Photo Viewer\\fr-FR\\wininit.exe\", \"C:\\Program Files\\Mozilla Firefox\\uninstall\\explorer.exe\", \"C:\\Windows\\Microsoft.NET\\lsm.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\csrss.exe\", \"C:\\Program Files\\Uninstall Information\\dwm.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\winlogon.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\wininit.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\de-DE\\lsass.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Offline\\System.exe\", \"C:\\Program Files\\Windows Photo Viewer\\fr-FR\\wininit.exe\", \"C:\\Program Files\\Mozilla Firefox\\uninstall\\explorer.exe\", \"C:\\Windows\\Microsoft.NET\\lsm.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\WmiPrvSE.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\audiodg.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\csrss.exe\", \"C:\\Program Files\\Uninstall Information\\dwm.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\winlogon.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\wininit.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\de-DE\\lsass.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Offline\\System.exe\", \"C:\\Program Files\\Windows Photo Viewer\\fr-FR\\wininit.exe\", \"C:\\Program Files\\Mozilla Firefox\\uninstall\\explorer.exe\", \"C:\\Windows\\Microsoft.NET\\lsm.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\WmiPrvSE.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\audiodg.exe\", \"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\sppsvc.exe\", \"C:\\Windows\\ehome\\es-ES\\OSPPSVC.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\OSPPSVC.exe\", \"C:\\Program Files\\Windows Defender\\en-US\\WmiPrvSE.exe\", \"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\OSPPSVC.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\csrss.exe\", \"C:\\Program Files\\Uninstall Information\\dwm.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\winlogon.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\wininit.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\de-DE\\lsass.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Offline\\System.exe\", \"C:\\Program Files\\Windows Photo Viewer\\fr-FR\\wininit.exe\", \"C:\\Program Files\\Mozilla Firefox\\uninstall\\explorer.exe\", \"C:\\Windows\\Microsoft.NET\\lsm.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\WmiPrvSE.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\audiodg.exe\", \"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\sppsvc.exe\", \"C:\\Windows\\ehome\\es-ES\\OSPPSVC.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\OSPPSVC.exe\", \"C:\\Program Files\\Windows Defender\\en-US\\WmiPrvSE.exe\", \"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\OSPPSVC.exe\", \"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\lsass.exe\", \"C:\\Windows\\ehome\\smss.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\WmiPrvSE.exe\", \"C:\\Windows\\Installer\\{90140000-006E-0409-0000-0000000FF1CE}\\dwm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\dllhost.exe\", \"C:\\Windows\\Prefetch\\ReadyBoot\\OSPPSVC.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\csrss.exe\", \"C:\\Program Files\\Uninstall Information\\dwm.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\winlogon.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\wininit.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\de-DE\\lsass.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Offline\\System.exe\", \"C:\\Program Files\\Windows Photo Viewer\\fr-FR\\wininit.exe\", \"C:\\Program Files\\Mozilla Firefox\\uninstall\\explorer.exe\", \"C:\\Windows\\Microsoft.NET\\lsm.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\WmiPrvSE.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\audiodg.exe\", \"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\sppsvc.exe\", \"C:\\Windows\\ehome\\es-ES\\OSPPSVC.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\OSPPSVC.exe\", \"C:\\Program Files\\Windows Defender\\en-US\\WmiPrvSE.exe\", \"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\OSPPSVC.exe\", \"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\lsass.exe\", \"C:\\Windows\\ehome\\smss.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\WmiPrvSE.exe\", \"C:\\Windows\\Installer\\{90140000-006E-0409-0000-0000000FF1CE}\\dwm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\dllhost.exe\", \"C:\\Windows\\Prefetch\\ReadyBoot\\OSPPSVC.exe\", \"C:\\Users\\All Users\\services.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\csrss.exe\", \"C:\\Program Files\\Uninstall Information\\dwm.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\winlogon.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\wininit.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\de-DE\\lsass.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Offline\\System.exe\", \"C:\\Program Files\\Windows Photo Viewer\\fr-FR\\wininit.exe\", \"C:\\Program Files\\Mozilla Firefox\\uninstall\\explorer.exe\", \"C:\\Windows\\Microsoft.NET\\lsm.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\WmiPrvSE.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\audiodg.exe\", \"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\sppsvc.exe\", \"C:\\Windows\\ehome\\es-ES\\OSPPSVC.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\OSPPSVC.exe\", \"C:\\Program Files\\Windows Defender\\en-US\\WmiPrvSE.exe\", \"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\OSPPSVC.exe\", \"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\lsass.exe\", \"C:\\Windows\\ehome\\smss.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\WmiPrvSE.exe\", \"C:\\Windows\\Installer\\{90140000-006E-0409-0000-0000000FF1CE}\\dwm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\dllhost.exe\", \"C:\\Windows\\Prefetch\\ReadyBoot\\OSPPSVC.exe\", \"C:\\Users\\All Users\\services.exe\", \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\csrss.exe\", \"C:\\Program Files\\Uninstall Information\\WMIADAP.exe\", \"C:\\Users\\Public\\Pictures\\Sample Pictures\\winlogon.exe\", \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\taskhost.exe\", \"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\OSPPSVC.exe\", \"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe\", \"C:\\Program Files\\MSBuild\\WmiPrvSE.exe\", \"C:\\Users\\Default\\PrintHood\\taskhost.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\csrss.exe\", \"C:\\Program Files\\Uninstall Information\\dwm.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\winlogon.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\wininit.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\de-DE\\lsass.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Offline\\System.exe\", \"C:\\Program Files\\Windows Photo Viewer\\fr-FR\\wininit.exe\", \"C:\\Program Files\\Mozilla Firefox\\uninstall\\explorer.exe\", \"C:\\Windows\\Microsoft.NET\\lsm.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\WmiPrvSE.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\audiodg.exe\", \"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\sppsvc.exe\", \"C:\\Windows\\ehome\\es-ES\\OSPPSVC.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\csrss.exe\", \"C:\\Program Files\\Uninstall Information\\dwm.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\winlogon.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\wininit.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\de-DE\\lsass.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Offline\\System.exe\", \"C:\\Program Files\\Windows Photo Viewer\\fr-FR\\wininit.exe\", \"C:\\Program Files\\Mozilla Firefox\\uninstall\\explorer.exe\", \"C:\\Windows\\Microsoft.NET\\lsm.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\WmiPrvSE.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\audiodg.exe\", \"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\sppsvc.exe\", \"C:\\Windows\\ehome\\es-ES\\OSPPSVC.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\OSPPSVC.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\csrss.exe\", \"C:\\Program Files\\Uninstall Information\\dwm.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\winlogon.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\wininit.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\de-DE\\lsass.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Offline\\System.exe\", \"C:\\Program Files\\Windows Photo Viewer\\fr-FR\\wininit.exe\", \"C:\\Program Files\\Mozilla Firefox\\uninstall\\explorer.exe\", \"C:\\Windows\\Microsoft.NET\\lsm.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\WmiPrvSE.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\audiodg.exe\", \"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\sppsvc.exe\", \"C:\\Windows\\ehome\\es-ES\\OSPPSVC.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\OSPPSVC.exe\", \"C:\\Program Files\\Windows Defender\\en-US\\WmiPrvSE.exe\", \"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\OSPPSVC.exe\", \"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\lsass.exe\", \"C:\\Windows\\ehome\\smss.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\csrss.exe\", \"C:\\Program Files\\Uninstall Information\\dwm.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\winlogon.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\wininit.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\de-DE\\lsass.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Offline\\System.exe\", \"C:\\Program Files\\Windows Photo Viewer\\fr-FR\\wininit.exe\", \"C:\\Program Files\\Mozilla Firefox\\uninstall\\explorer.exe\", \"C:\\Windows\\Microsoft.NET\\lsm.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\WmiPrvSE.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\audiodg.exe\", \"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\sppsvc.exe\", \"C:\\Windows\\ehome\\es-ES\\OSPPSVC.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\OSPPSVC.exe\", \"C:\\Program Files\\Windows Defender\\en-US\\WmiPrvSE.exe\", \"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\OSPPSVC.exe\", \"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\lsass.exe\", \"C:\\Windows\\ehome\\smss.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\WmiPrvSE.exe\", \"C:\\Windows\\Installer\\{90140000-006E-0409-0000-0000000FF1CE}\\dwm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\dllhost.exe\", \"C:\\Windows\\Prefetch\\ReadyBoot\\OSPPSVC.exe\", \"C:\\Users\\All Users\\services.exe\", \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\csrss.exe\", \"C:\\Program Files\\Uninstall Information\\WMIADAP.exe\", \"C:\\Users\\Public\\Pictures\\Sample Pictures\\winlogon.exe\", \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\taskhost.exe\", \"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\OSPPSVC.exe\", \"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\csrss.exe\", \"C:\\Program Files\\Uninstall Information\\dwm.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\winlogon.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\wininit.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\de-DE\\lsass.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Offline\\System.exe\", \"C:\\Program Files\\Windows Photo Viewer\\fr-FR\\wininit.exe\", \"C:\\Program Files\\Mozilla Firefox\\uninstall\\explorer.exe\", \"C:\\Windows\\Microsoft.NET\\lsm.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\WmiPrvSE.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\audiodg.exe\", \"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\sppsvc.exe\", \"C:\\Windows\\ehome\\es-ES\\OSPPSVC.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\OSPPSVC.exe\", \"C:\\Program Files\\Windows Defender\\en-US\\WmiPrvSE.exe\", \"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\OSPPSVC.exe\", \"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\lsass.exe\", \"C:\\Windows\\ehome\\smss.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\WmiPrvSE.exe\", \"C:\\Windows\\Installer\\{90140000-006E-0409-0000-0000000FF1CE}\\dwm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\dllhost.exe\", \"C:\\Windows\\Prefetch\\ReadyBoot\\OSPPSVC.exe\", \"C:\\Users\\All Users\\services.exe\", \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\csrss.exe\", \"C:\\Program Files\\Uninstall Information\\WMIADAP.exe\", \"C:\\Users\\Public\\Pictures\\Sample Pictures\\winlogon.exe\", \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\taskhost.exe\", \"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\OSPPSVC.exe\", \"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe\", \"C:\\Program Files\\MSBuild\\WmiPrvSE.exe\", \"C:\\Users\\Default\\PrintHood\\taskhost.exe\", \"C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\lsm.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\csrss.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\csrss.exe\", \"C:\\Program Files\\Uninstall Information\\dwm.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\winlogon.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\wininit.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\de-DE\\lsass.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Offline\\System.exe\", \"C:\\Program Files\\Windows Photo Viewer\\fr-FR\\wininit.exe\", \"C:\\Program Files\\Mozilla Firefox\\uninstall\\explorer.exe\", \"C:\\Windows\\Microsoft.NET\\lsm.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\WmiPrvSE.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\audiodg.exe\", \"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\sppsvc.exe\", \"C:\\Windows\\ehome\\es-ES\\OSPPSVC.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\OSPPSVC.exe\", \"C:\\Program Files\\Windows Defender\\en-US\\WmiPrvSE.exe\", \"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\OSPPSVC.exe\", \"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\lsass.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\csrss.exe\", \"C:\\Program Files\\Uninstall Information\\dwm.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\winlogon.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\wininit.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\de-DE\\lsass.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Offline\\System.exe\", \"C:\\Program Files\\Windows Photo Viewer\\fr-FR\\wininit.exe\", \"C:\\Program Files\\Mozilla Firefox\\uninstall\\explorer.exe\", \"C:\\Windows\\Microsoft.NET\\lsm.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\WmiPrvSE.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\audiodg.exe\", \"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\sppsvc.exe\", \"C:\\Windows\\ehome\\es-ES\\OSPPSVC.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\OSPPSVC.exe\", \"C:\\Program Files\\Windows Defender\\en-US\\WmiPrvSE.exe\", \"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\OSPPSVC.exe\", \"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\lsass.exe\", \"C:\\Windows\\ehome\\smss.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\WmiPrvSE.exe\", \"C:\\Windows\\Installer\\{90140000-006E-0409-0000-0000000FF1CE}\\dwm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\dllhost.exe\", \"C:\\Windows\\Prefetch\\ReadyBoot\\OSPPSVC.exe\", \"C:\\Users\\All Users\\services.exe\", \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\csrss.exe\", \"C:\\Program Files\\Uninstall Information\\WMIADAP.exe\", \"C:\\Users\\Public\\Pictures\\Sample Pictures\\winlogon.exe\", \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\taskhost.exe\", \"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\OSPPSVC.exe\", \"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe\", \"C:\\Program Files\\MSBuild\\WmiPrvSE.exe\", \"C:\\Users\\Default\\PrintHood\\taskhost.exe\", \"C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\fr-FR\\audiodg.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe

Process spawned unexpected child process 64 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2448	2532	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2928	2532	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2812	2532	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2976	2532	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1600	2532	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2140	2532	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2324	2532	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2444	2532	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1560	2532	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2016	2532	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2340	2532	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2352	2532	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1636	2532	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2236	2532	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1308	2532	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1864	2532	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2292	2532	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3008	2532	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2012	2532	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1992	2532	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	656	2532	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	872	2532	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2460	2532	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1584	2532	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2504	2532	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1644	2532	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1160	2532	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	684	2532	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2044	2532	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	292	2532	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	740	2532	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1520	2532	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2112	2532	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1208	2532	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3028	2532	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2656	2532	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2192	2532	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2280	2532	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2216	2532	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2768	2532	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2852	2532	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2988	2532	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1736	2532	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1804	2532	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1492	2532	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1656	2532	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1324	2532	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2744	2532	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2668	2532	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2552	2532	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3020	2532	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2964	2532	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3064	2532	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2828	2532	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1588	2532	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2536	2532	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1336	2532	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1680	2532	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	620	2532	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1672	2532	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1768	2532	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1664	2532	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	284	2532	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2340	2532	schtasks.exe	30

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral25/memory/3048-1-0x00000000001C0000-0x00000000002EC000-memory.dmp	dcrat
behavioral25/files/0x000500000001961b-21.dat	dcrat
behavioral25/memory/2172-253-0x0000000000050000-0x000000000017C000-memory.dmp	dcrat

Executes dropped EXE 2 IoCs

pid	Process
2776	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
2172	winlogon.exe

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\Default User\\csrss.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Program Files\\Windows Photo Viewer\\fr-FR\\wininit.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Windows\\ehome\\smss.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\wininit.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Windows\CurrentVersion\Run\OSPPSVC = "\"C:\\Windows\\Prefetch\\ReadyBoot\\OSPPSVC.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\Users\\Default\\PrintHood\\taskhost.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Program Files (x86)\\Google\\Update\\Offline\\System.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\sppsvc.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Users\\Public\\Pictures\\Sample Pictures\\winlogon.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\Default User\\csrss.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\sppsvc.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Program Files\\Windows Defender\\en-US\\WmiPrvSE.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\csrss.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b = "\"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files\\Uninstall Information\\dwm.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\lsm.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Windows\\Microsoft.NET\\lsm.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\WmiPrvSE.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OSPPSVC = "\"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\OSPPSVC.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Program Files\\MSBuild\\WmiPrvSE.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\csrss.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Program Files\\Mozilla Firefox\\uninstall\\explorer.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Program Files\\Mozilla Firefox\\uninstall\\explorer.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\audiodg = "\"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\audiodg.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Windows\CurrentVersion\Run\OSPPSVC = "\"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\OSPPSVC.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\lsass.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Windows\\Installer\\{90140000-006E-0409-0000-0000000FF1CE}\\dwm.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\dllhost.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\dllhost.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Program Files (x86)\\Internet Explorer\\de-DE\\lsass.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Program Files\\Windows Photo Viewer\\fr-FR\\wininit.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Users\\All Users\\services.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Windows\CurrentVersion\Run\WMIADAP = "\"C:\\Program Files\\Uninstall Information\\WMIADAP.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WMIADAP = "\"C:\\Program Files\\Uninstall Information\\WMIADAP.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\taskhost.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Program Files\\MSBuild\\WmiPrvSE.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\winlogon.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Program Files (x86)\\Internet Explorer\\de-DE\\lsass.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\WmiPrvSE.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\csrss.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\csrss.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Windows\\Microsoft.NET\\lsm.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OSPPSVC = "\"C:\\Windows\\ehome\\es-ES\\OSPPSVC.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Windows\\Installer\\{90140000-006E-0409-0000-0000000FF1CE}\\dwm.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Users\\All Users\\services.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Windows\CurrentVersion\Run\070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b = "\"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Windows\CurrentVersion\Run\audiodg = "\"C:\\Program Files (x86)\\Windows Photo Viewer\\fr-FR\\audiodg.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\WmiPrvSE.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Program Files\\Windows Defender\\en-US\\WmiPrvSE.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Users\\Public\\Pictures\\Sample Pictures\\winlogon.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\audiodg = "\"C:\\Program Files (x86)\\Windows Photo Viewer\\fr-FR\\audiodg.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Windows\CurrentVersion\Run\audiodg = "\"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\audiodg.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Windows\CurrentVersion\Run\OSPPSVC = "\"C:\\Windows\\ehome\\es-ES\\OSPPSVC.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OSPPSVC = "\"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\OSPPSVC.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\winlogon.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\taskhost.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files\\Uninstall Information\\dwm.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\lsm.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Windows\\ehome\\smss.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\lsm.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\wininit.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Windows\CurrentVersion\Run\OSPPSVC = "\"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\OSPPSVC.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Program Files (x86)\\Google\\Update\\Offline\\System.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\lsass.exe\""	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe

Drops file in Program Files directory 37 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Internet Explorer\de-DE\RCXD974.tmp	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
File created	C:\Program Files (x86)\Internet Explorer\de-DE\lsass.exe	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
File created	C:\Program Files\Windows Photo Viewer\fr-FR\56085415360792	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\RCXE387.tmp	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\WmiPrvSE.exe	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
File created	C:\Program Files\Uninstall Information\WMIADAP.exe	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
File opened for modification	C:\Program Files\Uninstall Information\WMIADAP.exe	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\fr-FR\wininit.exe	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\RCXDF7F.tmp	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
File created	C:\Program Files\Uninstall Information\6cb0b6c459d5d3	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
File created	C:\Program Files (x86)\Internet Explorer\de-DE\6203df4a6bafc7	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
File created	C:\Program Files (x86)\Google\Update\Offline\System.exe	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\24dbde2999530e	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\de-DE\lsass.exe	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
File opened for modification	C:\Program Files\Windows Defender\en-US\WmiPrvSE.exe	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
File created	C:\Program Files\Uninstall Information\dwm.exe	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
File created	C:\Program Files\Windows Defender\en-US\WmiPrvSE.exe	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
File created	C:\Program Files\Windows Defender\en-US\24dbde2999530e	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
File opened for modification	C:\Program Files\Uninstall Information\dwm.exe	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
File opened for modification	C:\Program Files\MSBuild\WmiPrvSE.exe	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
File created	C:\Program Files\Uninstall Information\75a57c1bdf437c	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\fr-FR\audiodg.exe	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Offline\System.exe	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
File opened for modification	C:\Program Files\Windows Defender\en-US\RCXF077.tmp	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\fr-FR\42af1c969fbb7b	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\explorer.exe	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
File created	C:\Program Files (x86)\Google\Update\Offline\27d1bcfc3c54e0	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\explorer.exe	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\WmiPrvSE.exe	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
File opened for modification	C:\Program Files\Uninstall Information\RCXD126.tmp	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
File created	C:\Program Files\MSBuild\WmiPrvSE.exe	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
File created	C:\Program Files\MSBuild\24dbde2999530e	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\fr-FR\audiodg.exe	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Offline\RCXDB78.tmp	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\fr-FR\RCXDD7B.tmp	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
File created	C:\Program Files\Windows Photo Viewer\fr-FR\wininit.exe	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\7a0fd90576e088	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe

Drops file in Windows directory 19 IoCs

description	ioc	Process
File created	C:\Windows\Microsoft.NET\101b941d020240	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
File created	C:\Windows\ehome\es-ES\1610b97d3ab4a7	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
File opened for modification	C:\Windows\Microsoft.NET\RCXE183.tmp	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
File opened for modification	C:\Windows\Microsoft.NET\lsm.exe	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
File opened for modification	C:\Windows\ehome\es-ES\RCXEA00.tmp	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
File created	C:\Windows\Prefetch\ReadyBoot\OSPPSVC.exe	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
File created	C:\Windows\Prefetch\ReadyBoot\1610b97d3ab4a7	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
File opened for modification	C:\Windows\ehome\smss.exe	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
File created	C:\Windows\Microsoft.NET\lsm.exe	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
File created	C:\Windows\diagnostics\system\services.exe	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
File opened for modification	C:\Windows\ehome\es-ES\OSPPSVC.exe	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
File created	C:\Windows\Installer\{90140000-006E-0409-0000-0000000FF1CE}\6cb0b6c459d5d3	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
File opened for modification	C:\Windows\Installer\{90140000-006E-0409-0000-0000000FF1CE}\dwm.exe	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
File opened for modification	C:\Windows\Prefetch\ReadyBoot\OSPPSVC.exe	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
File created	C:\Windows\ehome\es-ES\OSPPSVC.exe	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
File created	C:\Windows\ehome\smss.exe	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
File created	C:\Windows\ehome\69ddcba757bf72	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
File created	C:\Windows\Installer\{90140000-006E-0409-0000-0000000FF1CE}\dwm.exe	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
File created	C:\Windows\diagnostics\index\lsass.exe	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1804	schtasks.exe
3024	schtasks.exe
2784	schtasks.exe
2668	schtasks.exe
2504	schtasks.exe
1160	schtasks.exe
1680	schtasks.exe
1672	schtasks.exe
2340	schtasks.exe
1968	schtasks.exe
1756	schtasks.exe
2192	schtasks.exe
1664	schtasks.exe
1552	schtasks.exe
2824	schtasks.exe
2940	schtasks.exe
2768	schtasks.exe
3020	schtasks.exe
1336	schtasks.exe
2472	schtasks.exe
2012	schtasks.exe
1988	schtasks.exe
2504	schtasks.exe
1520	schtasks.exe
1736	schtasks.exe
2656	schtasks.exe
2852	schtasks.exe
1492	schtasks.exe
2064	schtasks.exe
2992	schtasks.exe
1868	schtasks.exe
2112	schtasks.exe
1656	schtasks.exe
2724	schtasks.exe
2680	schtasks.exe
2044	schtasks.exe
2140	schtasks.exe
292	schtasks.exe
1520	schtasks.exe
284	schtasks.exe
2484	schtasks.exe
1632	schtasks.exe
3008	schtasks.exe
2012	schtasks.exe
684	schtasks.exe
2768	schtasks.exe
2904	schtasks.exe
2656	schtasks.exe
1616	schtasks.exe
1560	schtasks.exe
2016	schtasks.exe
1864	schtasks.exe
1812	schtasks.exe
1208	schtasks.exe
2340	schtasks.exe
1308	schtasks.exe
2292	schtasks.exe
1992	schtasks.exe
1644	schtasks.exe
2744	schtasks.exe
2848	schtasks.exe
2968	schtasks.exe
2812	schtasks.exe
656	schtasks.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
3048	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
3048	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
3048	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
2776	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
2776	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
2776	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
2776	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
2776	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
2172	winlogon.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3048	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Token: SeDebugPrivilege	2776	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Token: SeDebugPrivilege	2172	winlogon.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 2776	3048	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe	86
PID 3048 wrote to memory of 2776	3048	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe	86
PID 3048 wrote to memory of 2776	3048	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe	86
PID 2776 wrote to memory of 2172	2776	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe	141
PID 2776 wrote to memory of 2172	2776	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe	141
PID 2776 wrote to memory of 2172	2776	070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe	141

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
"C:\Users\Admin\AppData\Local\Temp\070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Users\Admin\AppData\Local\Temp\070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
  "C:\Users\Admin\AppData\Local\Temp\070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2776
- - C:\Users\Public\Pictures\Sample Pictures\winlogon.exe
    "C:\Users\Public\Pictures\Sample Pictures\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
PID:2448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default User\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:2928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Program Files\Uninstall Information\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
PID:2828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:3064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Program Files\Uninstall Information\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:2964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 5 /tr "'C:\Recovery\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
PID:2976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Recovery\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 9 /tr "'C:\Recovery\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:1600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
PID:2552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Recovery\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:2324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Recovery\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Internet Explorer\de-DE\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\de-DE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:2444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Internet Explorer\de-DE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Google\Update\Offline\System.exe'" /f
1⤵
- Process spawned unexpected child process
PID:1324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Update\Offline\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:2352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Google\Update\Offline\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Photo Viewer\fr-FR\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\fr-FR\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Photo Viewer\fr-FR\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:1636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Program Files\Mozilla Firefox\uninstall\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
PID:1736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\uninstall\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:2988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Program Files\Mozilla Firefox\uninstall\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 12 /tr "'C:\Windows\Microsoft.NET\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Windows\Microsoft.NET\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:2236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 9 /tr "'C:\Windows\Microsoft.NET\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:2216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
PID:2280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 5 /tr "'C:\Recovery\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Recovery\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:3028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 10 /tr "'C:\Recovery\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:1208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 14 /tr "'C:\Windows\ehome\es-ES\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Windows\ehome\es-ES\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 12 /tr "'C:\Windows\ehome\es-ES\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 12 /tr "'C:\Recovery\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Recovery\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:2044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 6 /tr "'C:\Recovery\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Defender\en-US\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\en-US\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Defender\en-US\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:1584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:2460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\lsass.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:1616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\lsass.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:1632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\lsass.exe'" /rl HIGHEST /f
1⤵
PID:3000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Windows\ehome\smss.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\ehome\smss.exe'" /rl HIGHEST /f
1⤵
PID:2172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Windows\ehome\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:1588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe'" /f
1⤵
PID:2524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:2536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
PID:1608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Windows\Installer\{90140000-006E-0409-0000-0000000FF1CE}\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\Installer\{90140000-006E-0409-0000-0000000FF1CE}\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\Windows\Installer\{90140000-006E-0409-0000-0000000FF1CE}\dwm.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:1736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\dllhost.exe'" /f
1⤵
PID:2892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\dllhost.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:1868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 7 /tr "'C:\Windows\Prefetch\ReadyBoot\OSPPSVC.exe'" /f
1⤵
PID:1752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Windows\Prefetch\ReadyBoot\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 14 /tr "'C:\Windows\Prefetch\ReadyBoot\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\services.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:1520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Users\All Users\services.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\services.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
PID:1768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:1208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 7 /tr "'C:\Program Files\Uninstall Information\WMIADAP.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:1988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 8 /tr "'C:\Program Files\Uninstall Information\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:1756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Pictures\Sample Pictures\winlogon.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Public\Pictures\Sample Pictures\winlogon.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Pictures\Sample Pictures\winlogon.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\taskhost.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\taskhost.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\taskhost.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\OSPPSVC.exe'" /f
1⤵
PID:2476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:1968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b0" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe'" /f
1⤵
PID:2020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe'" /rl HIGHEST /f
1⤵
PID:1984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b0" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:1812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 14 /tr "'C:\Program Files\MSBuild\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files\MSBuild\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
PID:2552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 8 /tr "'C:\Program Files\MSBuild\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 9 /tr "'C:\Users\Default\PrintHood\taskhost.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:3024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Users\Default\PrintHood\taskhost.exe'" /rl HIGHEST /f
1⤵
PID:2260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 5 /tr "'C:\Users\Default\PrintHood\taskhost.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\lsm.exe'" /f
1⤵
PID:1056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\lsm.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\lsm.exe'" /rl HIGHEST /f
1⤵
PID:2040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:1552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Photo Viewer\fr-FR\audiodg.exe'" /f
1⤵
PID:2556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\fr-FR\audiodg.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Photo Viewer\fr-FR\audiodg.exe'" /rl HIGHEST /f
1⤵
PID:2976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Recovery\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\wininit.exe

Filesize
1.1MB

MD5
8178e5a952fb588b857dfb7ad3317e6a

SHA1
bd304f931d02f01c5f3aa3a680e633b989ddee11

SHA256
070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b

SHA512
27f4516b3faebebe03564899ebe542687f69ba6e93917b66151e472ce011ce7e726eb814c5696d9cea28b7cd297bb32bd75a3de6adceb40e6bdacf18591da87e

Download Submit
C:\Users\Admin\AppData\Local\Temp\8651dc5980c60d5fc9efb2ba2d74320fcf09dd1b4.5.33labrador55b829c6e7a180740212f4a04459251de059830a

Filesize
1KB

MD5
ad1cc08034a9d9f3f89208d039c49ed2

SHA1
7d0f739c13311cebc28cdb2335bb9dbd1b8c44fe

SHA256
4472ffbefc931e6377faf5ae985c058321e6fda367fdc17fc6627b3103c5406c

SHA512
28979090172617ab0cfc352f8f3bf755bf47719a42e2cd20870d6b54e3b9bf078fdc02fc7a8e8ebe911664febd501e22a12790ba5e6904c23ca96d425e443341

Download Submit
memory/2172-254-0x00000000005F0000-0x0000000000602000-memory.dmp

Filesize
72KB

Download
memory/2172-253-0x0000000000050000-0x000000000017C000-memory.dmp

Filesize
1.2MB

Download
memory/2776-172-0x00000000005D0000-0x00000000005E2000-memory.dmp

Filesize
72KB

Download
memory/2776-171-0x00000000005B0000-0x00000000005C2000-memory.dmp

Filesize
72KB

Download
memory/3048-11-0x0000000002350000-0x000000000235E000-memory.dmp

Filesize
56KB

Download
memory/3048-5-0x00000000021E0000-0x00000000021F6000-memory.dmp

Filesize
88KB

Download
memory/3048-9-0x0000000002300000-0x0000000002312000-memory.dmp

Filesize
72KB

Download
memory/3048-12-0x0000000002360000-0x000000000236C000-memory.dmp

Filesize
48KB

Download
memory/3048-0-0x000007FEF5C13000-0x000007FEF5C14000-memory.dmp

Filesize
4KB

Download
memory/3048-10-0x0000000002340000-0x0000000002348000-memory.dmp

Filesize
32KB

Download
memory/3048-7-0x0000000002310000-0x0000000002320000-memory.dmp

Filesize
64KB

Download
memory/3048-8-0x0000000002150000-0x000000000215C000-memory.dmp

Filesize
48KB

Download
memory/3048-148-0x000007FEF5C13000-0x000007FEF5C14000-memory.dmp

Filesize
4KB

Download
memory/3048-158-0x000007FEF5C10000-0x000007FEF65FC000-memory.dmp

Filesize
9.9MB

Download
memory/3048-170-0x000007FEF5C10000-0x000007FEF65FC000-memory.dmp

Filesize
9.9MB

Download
memory/3048-6-0x0000000000660000-0x0000000000672000-memory.dmp

Filesize
72KB

Download
memory/3048-3-0x0000000002130000-0x000000000214C000-memory.dmp

Filesize
112KB

Download
memory/3048-4-0x00000000005D0000-0x00000000005E0000-memory.dmp

Filesize
64KB

Download
memory/3048-2-0x000007FEF5C10000-0x000007FEF65FC000-memory.dmp

Filesize
9.9MB

Download
memory/3048-1-0x00000000001C0000-0x00000000002EC000-memory.dmp

Filesize
1.2MB

Download