dcrat | 894a461e0d709023ba6ec45f748b38a79ae12cf398702244ef2ffa93dd644133

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20250313-en
resource tags

arch:x64arch:x86image:win10v2004-20250313-enlocale:en-usos:windows10-2004-x64system
submitted
22/03/2025, 06:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ab89f9e5fc235d4e0bf6b72be96e777b.exe
Size

5.9MB
MD5

ab89f9e5fc235d4e0bf6b72be96e777b
SHA1

c714d6e77c07fa5c3f5ba33f5696e1c537db4a24
SHA256

a51a0a522e7881f8eafb519d98f0560f0aa4ec99cea8d9766d018de6fa6085ca
SHA512

7f1b46016e1af5bdb80ec16f5936c076fcb17785f5e03df23c11f203b533419f4919d3aa41f160c586a674b6e71c86b1e3552c1c46e667be002634622326dc94
SSDEEP

98304:RyeUxPQ0JMLyWIvqrhH05I8TderKjHDFUh9HkEXJfw4S:RyeU11Rvqmu8TWKnF6N/1wz

Score

10^/10

dcrat defense_evasion execution infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 54 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4748	5024	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4964	5024	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4764	5024	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4188	5024	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	540	5024	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2244	5024	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4984	5024	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2232	5024	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2324	5024	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3252	5024	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4996	5024	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5040	5024	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1224	5024	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5848	5024	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2628	5024	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3956	5024	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4336	5024	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1412	5024	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1472	5024	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1744	5024	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6112	5024	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6008	5024	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5492	5024	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2000	5024	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2376	5024	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3328	5024	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5928	5024	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1060	5024	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4280	5024	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3028	5024	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5440	5024	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5368	5024	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2956	5024	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3760	5024	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1476	5024	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4464	5024	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3152	5024	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3248	5024	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1916	5024	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5552	5024	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2480	5024	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4452	5024	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3136	5024	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5760	5024	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3676	5024	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5712	5024	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4440	5024	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1580	5024	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4808	5024	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	320	5024	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6056	5024	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2552	5024	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2536	5024	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5328	5024	schtasks.exe	88

UAC bypass 3 TTPs 12 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	ab89f9e5fc235d4e0bf6b72be96e777b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	ab89f9e5fc235d4e0bf6b72be96e777b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ab89f9e5fc235d4e0bf6b72be96e777b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	explorer.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 13 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5500	powershell.exe
2324	powershell.exe
3624	powershell.exe
4984	powershell.exe
1840	powershell.exe
4940	powershell.exe
3364	powershell.exe
4968	powershell.exe
4364	powershell.exe
4644	powershell.exe
5040	powershell.exe
5028	powershell.exe
5060	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	ab89f9e5fc235d4e0bf6b72be96e777b.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\International\Geo\Nation	ab89f9e5fc235d4e0bf6b72be96e777b.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\International\Geo\Nation	explorer.exe

Executes dropped EXE 3 IoCs

pid	Process
5004	explorer.exe
832	explorer.exe
864	explorer.exe

Checks whether UAC is enabled 1 TTPs 8 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ab89f9e5fc235d4e0bf6b72be96e777b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ab89f9e5fc235d4e0bf6b72be96e777b.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	explorer.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs

pid	Process
2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe
2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe
5004	explorer.exe
5004	explorer.exe
832	explorer.exe
832	explorer.exe
864	explorer.exe
864	explorer.exe

Drops file in Program Files directory 20 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\edge_BITS_4752_384041223\RCX8437.tmp	ab89f9e5fc235d4e0bf6b72be96e777b.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\RCX8F5B.tmp	ab89f9e5fc235d4e0bf6b72be96e777b.exe
File opened for modification	C:\Program Files (x86)\Windows NT\Accessories\en-US\RCX94B0.tmp	ab89f9e5fc235d4e0bf6b72be96e777b.exe
File created	C:\Program Files\edge_BITS_4752_384041223\22eafd247d37c3	ab89f9e5fc235d4e0bf6b72be96e777b.exe
File opened for modification	C:\Program Files\edge_BITS_4752_384041223\RCX8426.tmp	ab89f9e5fc235d4e0bf6b72be96e777b.exe
File opened for modification	C:\Program Files (x86)\Windows NT\Accessories\en-US\RCX9422.tmp	ab89f9e5fc235d4e0bf6b72be96e777b.exe
File opened for modification	C:\Program Files (x86)\Windows NT\Accessories\en-US\fontdrvhost.exe	ab89f9e5fc235d4e0bf6b72be96e777b.exe
File created	C:\Program Files\edge_BITS_4752_384041223\TextInputHost.exe	ab89f9e5fc235d4e0bf6b72be96e777b.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\dllhost.exe	ab89f9e5fc235d4e0bf6b72be96e777b.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\SppExtComObj.exe	ab89f9e5fc235d4e0bf6b72be96e777b.exe
File opened for modification	C:\Program Files\edge_BITS_4752_384041223\TextInputHost.exe	ab89f9e5fc235d4e0bf6b72be96e777b.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\dllhost.exe	ab89f9e5fc235d4e0bf6b72be96e777b.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\5940a34987c991	ab89f9e5fc235d4e0bf6b72be96e777b.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\SppExtComObj.exe	ab89f9e5fc235d4e0bf6b72be96e777b.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\RCX8F6C.tmp	ab89f9e5fc235d4e0bf6b72be96e777b.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\RCX9DCD.tmp	ab89f9e5fc235d4e0bf6b72be96e777b.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\RCX9E4B.tmp	ab89f9e5fc235d4e0bf6b72be96e777b.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\en-US\fontdrvhost.exe	ab89f9e5fc235d4e0bf6b72be96e777b.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\en-US\5b884080fd4f94	ab89f9e5fc235d4e0bf6b72be96e777b.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\e1ef82546f0b02	ab89f9e5fc235d4e0bf6b72be96e777b.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\Media\Landscape\RuntimeBroker.exe	ab89f9e5fc235d4e0bf6b72be96e777b.exe
File created	C:\Windows\Media\Landscape\9e8d7a4ca61bd9	ab89f9e5fc235d4e0bf6b72be96e777b.exe
File opened for modification	C:\Windows\Media\Landscape\RCXAB54.tmp	ab89f9e5fc235d4e0bf6b72be96e777b.exe
File opened for modification	C:\Windows\Media\Landscape\RCXAB65.tmp	ab89f9e5fc235d4e0bf6b72be96e777b.exe
File opened for modification	C:\Windows\Media\Landscape\RuntimeBroker.exe	ab89f9e5fc235d4e0bf6b72be96e777b.exe
File created	C:\Windows\servicing\InboxFodMetadataCache\sysmon.exe	ab89f9e5fc235d4e0bf6b72be96e777b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	ab89f9e5fc235d4e0bf6b72be96e777b.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 54 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2552	schtasks.exe
1224	schtasks.exe
4964	schtasks.exe
2244	schtasks.exe
1060	schtasks.exe
4280	schtasks.exe
1476	schtasks.exe
3152	schtasks.exe
3956	schtasks.exe
2000	schtasks.exe
5440	schtasks.exe
4464	schtasks.exe
3248	schtasks.exe
5712	schtasks.exe
2232	schtasks.exe
3252	schtasks.exe
1472	schtasks.exe
3328	schtasks.exe
3760	schtasks.exe
2536	schtasks.exe
5040	schtasks.exe
6008	schtasks.exe
5928	schtasks.exe
4440	schtasks.exe
6056	schtasks.exe
5328	schtasks.exe
5848	schtasks.exe
4748	schtasks.exe
4764	schtasks.exe
540	schtasks.exe
2376	schtasks.exe
5368	schtasks.exe
5552	schtasks.exe
4452	schtasks.exe
4188	schtasks.exe
4984	schtasks.exe
2628	schtasks.exe
1412	schtasks.exe
5492	schtasks.exe
2956	schtasks.exe
1916	schtasks.exe
3676	schtasks.exe
4996	schtasks.exe
4336	schtasks.exe
3028	schtasks.exe
5760	schtasks.exe
320	schtasks.exe
2324	schtasks.exe
1744	schtasks.exe
6112	schtasks.exe
2480	schtasks.exe
3136	schtasks.exe
1580	schtasks.exe
4808	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe
2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe
2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe
2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe
2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe
2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe
2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe
2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe
2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe
2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe
2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe
2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe
2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe
2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe
2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe
2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe
2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe
2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe
2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe
2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe
2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe
2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe
2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe
2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe
2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe
2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe
2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe
2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe
2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe
2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe
2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe
2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe
2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe
2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe
2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe
2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe
2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe
2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe
2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe
2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe
2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe
2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe
2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe
2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe
2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe
2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe
2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe
2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe
2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe
2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe
2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe
2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe
2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe
2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe
2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe
2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe
2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe
2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe
2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe
2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe
2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe
3624	powershell.exe
3624	powershell.exe
3364	powershell.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe
Token: SeDebugPrivilege	3624	powershell.exe
Token: SeDebugPrivilege	3364	powershell.exe
Token: SeDebugPrivilege	5500	powershell.exe
Token: SeDebugPrivilege	4364	powershell.exe
Token: SeDebugPrivilege	4984	powershell.exe
Token: SeDebugPrivilege	5028	powershell.exe
Token: SeDebugPrivilege	5040	powershell.exe
Token: SeDebugPrivilege	4968	powershell.exe
Token: SeDebugPrivilege	1840	powershell.exe
Token: SeDebugPrivilege	4940	powershell.exe
Token: SeDebugPrivilege	2324	powershell.exe
Token: SeDebugPrivilege	5060	powershell.exe
Token: SeDebugPrivilege	4644	powershell.exe
Token: SeDebugPrivilege	5004	explorer.exe
Token: SeDebugPrivilege	832	explorer.exe
Token: SeDebugPrivilege	864	explorer.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 3624	2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe	149
PID 2348 wrote to memory of 3624	2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe	149
PID 2348 wrote to memory of 4968	2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe	150
PID 2348 wrote to memory of 4968	2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe	150
PID 2348 wrote to memory of 4984	2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe	151
PID 2348 wrote to memory of 4984	2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe	151
PID 2348 wrote to memory of 4364	2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe	152
PID 2348 wrote to memory of 4364	2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe	152
PID 2348 wrote to memory of 3364	2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe	154
PID 2348 wrote to memory of 3364	2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe	154
PID 2348 wrote to memory of 2324	2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe	155
PID 2348 wrote to memory of 2324	2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe	155
PID 2348 wrote to memory of 4940	2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe	156
PID 2348 wrote to memory of 4940	2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe	156
PID 2348 wrote to memory of 5500	2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe	158
PID 2348 wrote to memory of 5500	2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe	158
PID 2348 wrote to memory of 5060	2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe	159
PID 2348 wrote to memory of 5060	2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe	159
PID 2348 wrote to memory of 5028	2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe	160
PID 2348 wrote to memory of 5028	2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe	160
PID 2348 wrote to memory of 5040	2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe	161
PID 2348 wrote to memory of 5040	2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe	161
PID 2348 wrote to memory of 1840	2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe	162
PID 2348 wrote to memory of 1840	2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe	162
PID 2348 wrote to memory of 4644	2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe	163
PID 2348 wrote to memory of 4644	2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe	163
PID 2348 wrote to memory of 5004	2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe	176
PID 2348 wrote to memory of 5004	2348	ab89f9e5fc235d4e0bf6b72be96e777b.exe	176
PID 5004 wrote to memory of 5864	5004	explorer.exe	178
PID 5004 wrote to memory of 5864	5004	explorer.exe	178
PID 5004 wrote to memory of 1268	5004	explorer.exe	179
PID 5004 wrote to memory of 1268	5004	explorer.exe	179
PID 5864 wrote to memory of 832	5864	WScript.exe	183
PID 5864 wrote to memory of 832	5864	WScript.exe	183
PID 832 wrote to memory of 3288	832	explorer.exe	184
PID 832 wrote to memory of 3288	832	explorer.exe	184
PID 832 wrote to memory of 3752	832	explorer.exe	185
PID 832 wrote to memory of 3752	832	explorer.exe	185
PID 3288 wrote to memory of 864	3288	WScript.exe	187
PID 3288 wrote to memory of 864	3288	WScript.exe	187
PID 864 wrote to memory of 312	864	explorer.exe	193
PID 864 wrote to memory of 312	864	explorer.exe	193
PID 864 wrote to memory of 2960	864	explorer.exe	194
PID 864 wrote to memory of 2960	864	explorer.exe	194

System policy modification 1 TTPs 12 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	ab89f9e5fc235d4e0bf6b72be96e777b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ab89f9e5fc235d4e0bf6b72be96e777b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	ab89f9e5fc235d4e0bf6b72be96e777b.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\ab89f9e5fc235d4e0bf6b72be96e777b.exe
"C:\Users\Admin\AppData\Local\Temp\ab89f9e5fc235d4e0bf6b72be96e777b.exe"
1⤵
- UAC bypass
- Drops file in Drivers directory
- Checks computer location settings
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2348
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3624
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/87efddaf44110a3d80760c508da79ad7/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4984
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4364
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ebea8a0c5b7ebb8dc5b60da7/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3364
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2324
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4940
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:5500
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:5060
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:5028
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:5040
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1840
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4644
- C:\Recovery\WindowsRE\explorer.exe
  "C:\Recovery\WindowsRE\explorer.exe"
  2⤵
  - UAC bypass
  - Checks computer location settings
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:5004
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\90e9445a-ce15-4227-a389-2573b178bd6b.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5864
  - - C:\Recovery\WindowsRE\explorer.exe
      C:\Recovery\WindowsRE\explorer.exe
      4⤵
      UAC bypass
      Checks computer location settings
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:832
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d3e30a7a-2c65-47e2-9db9-3d1412e6450c.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3288
      - C:\Recovery\WindowsRE\explorer.exe
        
        C:\Recovery\WindowsRE\explorer.exe
        6⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:864
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0e5911fd-8475-4c07-a800-a042eeb43a73.vbs"
        7⤵
        
        PID:312
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ec98e4c8-05ed-41e6-beb8-10d63f0d8136.vbs"
        7⤵
        
        PID:2960
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6e4fff4d-114c-48de-a9e4-7b2a4bade180.vbs"
        5⤵
        
        PID:3752
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\21653861-9ecb-4d1e-b120-b9dc8753fa59.vbs"
    3⤵
    PID:1268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 8 /tr "'C:\Program Files\edge_BITS_4752_384041223\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Program Files\edge_BITS_4752_384041223\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 7 /tr "'C:\Program Files\edge_BITS_4752_384041223\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 9 /tr "'C:\87efddaf44110a3d80760c508da79ad7\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\87efddaf44110a3d80760c508da79ad7\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 7 /tr "'C:\87efddaf44110a3d80760c508da79ad7\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\87efddaf44110a3d80760c508da79ad7\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\87efddaf44110a3d80760c508da79ad7\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\87efddaf44110a3d80760c508da79ad7\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\87efddaf44110a3d80760c508da79ad7\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\87efddaf44110a3d80760c508da79ad7\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\87efddaf44110a3d80760c508da79ad7\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ab89f9e5fc235d4e0bf6b72be96e777ba" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\ab89f9e5fc235d4e0bf6b72be96e777b.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ab89f9e5fc235d4e0bf6b72be96e777b" /sc ONLOGON /tr "'C:\Users\All Users\ab89f9e5fc235d4e0bf6b72be96e777b.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ab89f9e5fc235d4e0bf6b72be96e777ba" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\ab89f9e5fc235d4e0bf6b72be96e777b.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 8 /tr "'C:\Program Files\WindowsPowerShell\Modules\PackageManagement\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\Modules\PackageManagement\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 11 /tr "'C:\Program Files\WindowsPowerShell\Modules\PackageManagement\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\87efddaf44110a3d80760c508da79ad7\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\87efddaf44110a3d80760c508da79ad7\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\87efddaf44110a3d80760c508da79ad7\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\ebea8a0c5b7ebb8dc5b60da7\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\ebea8a0c5b7ebb8dc5b60da7\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\ebea8a0c5b7ebb8dc5b60da7\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Users\Public\Videos\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Public\Videos\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Users\Public\Videos\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Users\Default\Cookies\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Default\Cookies\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Users\Default\Cookies\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Windows\Media\Landscape\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\Media\Landscape\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Windows\Media\Landscape\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\87efddaf44110a3d80760c508da79ad7\explorer.exe

Filesize
5.9MB

MD5
64ddca8132b7423e67d2e873fc7c60e4

SHA1
85d28d4a9bdb452cca422cc31bad44c39cb5278a

SHA256
32a1f9b71d032111de3286820313ef2f960dc4f34fc8610e592db1512741ff13

SHA512
6099f181f13afdd7ce9bd25586166e605819ffe0536e2f3632188b413ec4a3832ca2cb5058cb1b09898cee7a545299f4eff61109f07868e4181ef6aba81d4b12

Download Submit
C:\87efddaf44110a3d80760c508da79ad7\smss.exe

Filesize
5.9MB

MD5
ab89f9e5fc235d4e0bf6b72be96e777b

SHA1
c714d6e77c07fa5c3f5ba33f5696e1c537db4a24

SHA256
a51a0a522e7881f8eafb519d98f0560f0aa4ec99cea8d9766d018de6fa6085ca

SHA512
7f1b46016e1af5bdb80ec16f5936c076fcb17785f5e03df23c11f203b533419f4919d3aa41f160c586a674b6e71c86b1e3552c1c46e667be002634622326dc94

Download Submit
C:\87efddaf44110a3d80760c508da79ad7\smss.exe

Filesize
5.9MB

MD5
6454738aba25d8b7990399f202284460

SHA1
4f7610931a37fb5b9eb5654f31ddc5433943a36f

SHA256
74ec47d9ef0e54e15cda6118f0eb8dc5abce8ea47a0db452889f0a4d3a012294

SHA512
cc31336b9fcba022ea626ad2ac1dd3bc7ead7bf2f0d45d8708cfbc38f8c7e8e5636bbc9394313982310c546cd163d4214cf4ebd03e8757e3daafa5753ec21347

Download Submit
C:\Program Files (x86)\Windows NT\Accessories\en-US\fontdrvhost.exe

Filesize
5.9MB

MD5
a3da5b412df3f17479613106d745b617

SHA1
54244f14a8916a0c78f49e246ce686a6b4f25fc3

SHA256
590e2ded233d9ed196222889eee6d652d5ab8dee75cda0174eb66f18476eb2cc

SHA512
05a2052a0200fe1514c7f076a72c85643e640045d5f8436057a2584bf2d03707a4563611830a00a0ad78da61cbdab0db1cf6b6efc08e0256742174173cfc28cf

Download Submit
C:\Program Files\WindowsPowerShell\Modules\PackageManagement\SppExtComObj.exe

Filesize
5.9MB

MD5
4b32f4c39253cd7311c2af9012d5e2fa

SHA1
fcf78fdf89a0d871aa565134aaff5d87bab0c268

SHA256
f300a3b6bda4ec60a4770f35cbd55a10710cfa749164f998a6716cfebef4b42b

SHA512
f368df4df66b00db6d396f5272646a07eaf40decd37c0019589e432b4f3eda873331e3f2c8726a210c2509585f24072bdc1425fc56baac5bd6df37c3ca8faa73

Download Submit
C:\Recovery\WindowsRE\TextInputHost.exe

Filesize
5.9MB

MD5
ec6cba6089f2539a7cc3b1b137ec6824

SHA1
3a883fed8bf036f894a8d450ba3e9010ddf3f6a1

SHA256
e3ed388726aa351bda2b1db1cac6884334362307bd322476ae2347afb6b274b4

SHA512
571eea198c6148015770b9ed237721cff9d715135e75fe6ef35ae6094b2544d2e94c3df2ce0b9b64c2b7e46596346a7b26a706e82ed54228d8b8ab0855709760

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\explorer.exe.log

Filesize
1KB

MD5
229da4b4256a6a948830de7ee5f9b298

SHA1
8118b8ddc115689ca9dc2fe8c244350333c5ba8b

SHA256
3d63b4a66e80ed97a8d74ea9dee7645942aafbd4abf1b31afed1027e5967fe11

SHA512
3a4ec8f720000a32bb1555b32db13236a73bb6e654e35b4de8bdb0fc0de535584bc08ebe25c7066324e86faa33e8f571a11cc4e5ef00be78e2993e228f615224

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d2e14ffaec8328ef6b85925ed5fc2c9b

SHA1
f42699edcf4fea12a6f3301141f996c2b8ecaf5d

SHA256
a75bb133d71f078fb9d5fa46ae46b5d23bfaacd382b0dadb4da59567f6749ccd

SHA512
335a0c6e8a6b1620b5644962c7deb43cef5e5ecb7f4d84816671cac12bd42d2fd6311e1c6ebe9c3a9bf5bc49c170760ba42d7045a74a38ec0963badacd72beff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
4ee21a21f8b414c5a89db56be6641dd5

SHA1
2403dc36f95bcc4536ac61057a9ce76e11b470f9

SHA256
49cd0e958905a47f71f38c2211bacb5607f7903ae593a6e7f8156a1bab364d71

SHA512
996352f4281526569825fbbf6de92fd01b724ebe3dff34516df65c9986cff7cc9ebdba5b3068808740087441508a0678e44bce158f9f998431b441b5d31aa7aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
c63980b62b932c2336743babc337af85

SHA1
0ef001498596b702a9fd8944795d7ccb7aac5333

SHA256
59df6f476d34b7f08f279482dea01d2331665c987406de593ebcfd4bcbe73665

SHA512
71dab1d77cdefe2b22c6fd787dedf6c5296f05d450878d550ea9cd1f30fc575c6a234a1f798bb53815715f7f2d3db456358c1173f605f1eeabf41d921e94d067

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3fe089fecc1a7897c40a12707d788ca9

SHA1
97f8ab9020333729ec191b3dbd044c57227b84fc

SHA256
70d80df3a3a68fa45dd114205f58cc05df07e22940ec0f0f6172abfccf671e7c

SHA512
4e4feebea709ed3bbfd82ed507d04566593e9cb7bb02ca1056d8ecb6cbcd3b5118be5dee4ee80bf158565a009c05b217bd4c885fb1e01c7d61f5e3d430c940cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
dc05a4f71923730b4eed5cb63f86aeed

SHA1
798199489ad94c55021a92ec812b320ed90b5711

SHA256
557afa6640a2b8ba319b55ac8d6b4b79e8e4bcda916870baa5f74dc9bd937650

SHA512
fe0bfd9ffdfebf5c10320e0701a3dad1da28b826395154ba95f53ea76b2e68a3e6504e539b504aa24a276877ebdbfd1e3fc6c1a2763bb80d17bc69471388656b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e0078bc2219e520ee1d62e54060a457a

SHA1
a0e9bb02e3ee7c6eb3c8f6ff43b91eadff5d4140

SHA256
b75060b74dbcc80d09dc2edc05b47459f88ad048c6fad56544bb0dca56ac2f42

SHA512
874051d5887e0db3d39096c0a3d19ce7ca0deb63f22d37f1cd877b64784af076f6e243cbcb7dd0fb6e8c9393b5e713c80057dc73ae39d7ae6f8d28fdcb3161d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
c926b492b1d39d04f6e9656ec7f5877d

SHA1
c2cb3c49c5aa9b0616a7ddb11c9a1453855b352a

SHA256
b0beda1f817ee65a341d4792f15dbd70be363835d7ebc3af6302b771295bc907

SHA512
df815fe9c34f85a90c3692534993955ca3c6f57a317f46bd9366152993c5918cd6f376678f9957ae43317bb7f1f5ba65ae175dce8f5e9735749263214e1fe74e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
aaf0080989fabad865a080216418fbf2

SHA1
935075309ff07f95b5c2ff643661fef989526e15

SHA256
86e6ca8dc0b47aadbc45bbb2a31b758ec729e69998ababdb1a4350924621de9c

SHA512
21721722c94447b4f0d20f03856ea1171c774eb59a8fd239809480ead6c5b7c5a3e43d1e79dfd1bd1dbdadb65269595e9376b3053c1bd6a54bac91e04536e676

Download Submit
C:\Users\Admin\AppData\Local\Temp\0e5911fd-8475-4c07-a800-a042eeb43a73.vbs

Filesize
709B

MD5
32a5a4914653e1532a5b5a31267c3607

SHA1
a4b392f72717911d60e099efe77379688a1740c2

SHA256
a103175b10c2465c0b1eb907f20220e6699e2288b5a51fefd521b6a8c5e61c08

SHA512
35e57a78ec79029c26066476b32e99516ba4e142f2788379bec27be34f2e4ae92f5721d4397bcb76e335c9cbc2e042203863b3eecb62896e8bbb44e8d595f9a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\21653861-9ecb-4d1e-b120-b9dc8753fa59.vbs

Filesize
486B

MD5
3bf20cb4e5ae5735687750163034e552

SHA1
b9b5f9e5ec4e2a018fb794f8cd535c695425dbcc

SHA256
c78bae0a5fa11f6c2a0b1e40b14d1119e2289d6ca6a4844654ea0f213b2c24ff

SHA512
700497cbe86dd6a8ce5a10a5525a1e9d2d36ee62e25577b047524f8e0783963ab9c8fa9ef86db1ef2f0a366d96e3fffb49cabf8e35f690004390876f3fb6a967

Download Submit
C:\Users\Admin\AppData\Local\Temp\90e9445a-ce15-4227-a389-2573b178bd6b.vbs

Filesize
710B

MD5
1f6ac86bd2a778d8c8f695322469c59a

SHA1
2c3b08048a4ede6fd4cb807bbd9e4a131489803f

SHA256
a60ab550618dd607f5a9c3804ad7b46336b8f21bbab7dbdcf2cc1b0b6abb39b1

SHA512
38d33d6568d0343e939c8e115755b5518db3d3ef10963abd8d74b276c14864a3a9352d50acc096a074a7377da3e69479215d3dd9d0f5e5397f6d057da6dc58be

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_b1spfghu.qcw.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\d3e30a7a-2c65-47e2-9db9-3d1412e6450c.vbs

Filesize
709B

MD5
b848a200b3f2039cda21f5977ce950fd

SHA1
1fde12eb7b8b45ad64051a7c2780e048a326dbf7

SHA256
ef64e313a1dbb1ca8d254a08efc238bc2730f4af7248935d520feda52bd8156c

SHA512
7768b88fb12124172aa4e37b59a8e3ce63be60726f96dd840fc7369228bf54a3d285e2f212a7737744dd12f6f3b53da05adffd509333d4a669453074230d40df

Download Submit
C:\Users\Public\Videos\RCXA70A.tmp

Filesize
5.9MB

MD5
3afc364c023a8a075f4d508bf5f05eba

SHA1
da4c48ae3e5f410845fabfcdf2f45cc37d781d7b

SHA256
c6ea02a8aa66566e2c705802fd1077e04de9ef9b10e1b60fcbf0ee1d07dd59db

SHA512
938da9de9e8708053c63464f4ddad79dc108b0b893beb6ed7bba03f90d60be07514e421b398f6798e9b2f9ca164ba4de0ea6a0980354b649da21066138e4e706

Download Submit
memory/832-495-0x000000001B880000-0x000000001B892000-memory.dmp

Filesize
72KB

Download
memory/864-508-0x000000001B970000-0x000000001B982000-memory.dmp

Filesize
72KB

Download
memory/2324-324-0x0000020D4A080000-0x0000020D4A0A2000-memory.dmp

Filesize
136KB

Download
memory/2348-17-0x000000001C1C0000-0x000000001C1CA000-memory.dmp

Filesize
40KB

Download
memory/2348-187-0x00007FFB2BF03000-0x00007FFB2BF05000-memory.dmp

Filesize
8KB

Download
memory/2348-28-0x000000001DB60000-0x000000001DB68000-memory.dmp

Filesize
32KB

Download
memory/2348-29-0x000000001DB70000-0x000000001DB7C000-memory.dmp

Filesize
48KB

Download
memory/2348-30-0x000000001DB80000-0x000000001DB8C000-memory.dmp

Filesize
48KB

Download
memory/2348-31-0x000000001DE10000-0x000000001DE18000-memory.dmp

Filesize
32KB

Download
memory/2348-32-0x000000001DB90000-0x000000001DB9C000-memory.dmp

Filesize
48KB

Download
memory/2348-33-0x000000001DBA0000-0x000000001DBAA000-memory.dmp

Filesize
40KB

Download
memory/2348-35-0x000000001DBC0000-0x000000001DBC8000-memory.dmp

Filesize
32KB

Download
memory/2348-36-0x000000001DBD0000-0x000000001DBDE000-memory.dmp

Filesize
56KB

Download
memory/2348-40-0x000000001DE30000-0x000000001DE3A000-memory.dmp

Filesize
40KB

Download
memory/2348-39-0x000000001DE20000-0x000000001DE28000-memory.dmp

Filesize
32KB

Download
memory/2348-38-0x000000001DBF0000-0x000000001DBFC000-memory.dmp

Filesize
48KB

Download
memory/2348-37-0x000000001DBE0000-0x000000001DBE8000-memory.dmp

Filesize
32KB

Download
memory/2348-34-0x000000001DBB0000-0x000000001DBBE000-memory.dmp

Filesize
56KB

Download
memory/2348-41-0x000000001DE40000-0x000000001DE4C000-memory.dmp

Filesize
48KB

Download
memory/2348-25-0x000000001E140000-0x000000001E668000-memory.dmp

Filesize
5.2MB

Download
memory/2348-26-0x000000001DB40000-0x000000001DB4C000-memory.dmp

Filesize
48KB

Download
memory/2348-20-0x000000001DAF0000-0x000000001DAF8000-memory.dmp

Filesize
32KB

Download
memory/2348-21-0x000000001DC00000-0x000000001DC0C000-memory.dmp

Filesize
48KB

Download
memory/2348-24-0x000000001DB10000-0x000000001DB22000-memory.dmp

Filesize
72KB

Download
memory/2348-27-0x000000001DB50000-0x000000001DB5C000-memory.dmp

Filesize
48KB

Download
memory/2348-22-0x000000001DB00000-0x000000001DB08000-memory.dmp

Filesize
32KB

Download
memory/2348-225-0x00007FFB2BF00000-0x00007FFB2C9C1000-memory.dmp

Filesize
10.8MB

Download
memory/2348-19-0x000000001C1D0000-0x000000001C1DC000-memory.dmp

Filesize
48KB

Download
memory/2348-18-0x000000001DAA0000-0x000000001DAF6000-memory.dmp

Filesize
344KB

Download
memory/2348-0-0x00007FFB2BF03000-0x00007FFB2BF05000-memory.dmp

Filesize
8KB

Download
memory/2348-453-0x00007FFB2BF00000-0x00007FFB2C9C1000-memory.dmp

Filesize
10.8MB

Download
memory/2348-15-0x000000001C140000-0x000000001C148000-memory.dmp

Filesize
32KB

Download
memory/2348-16-0x000000001C150000-0x000000001C160000-memory.dmp

Filesize
64KB

Download
memory/2348-14-0x000000001C160000-0x000000001C16C000-memory.dmp

Filesize
48KB

Download
memory/2348-13-0x000000001C130000-0x000000001C142000-memory.dmp

Filesize
72KB

Download
memory/2348-11-0x0000000003820000-0x0000000003836000-memory.dmp

Filesize
88KB

Download
memory/2348-12-0x000000001C120000-0x000000001C128000-memory.dmp

Filesize
32KB

Download
memory/2348-9-0x0000000003800000-0x0000000003808000-memory.dmp

Filesize
32KB

Download
memory/2348-10-0x0000000003810000-0x0000000003820000-memory.dmp

Filesize
64KB

Download
memory/2348-8-0x000000001C170000-0x000000001C1C0000-memory.dmp

Filesize
320KB

Download
memory/2348-6-0x00000000037D0000-0x00000000037D8000-memory.dmp

Filesize
32KB

Download
memory/2348-7-0x00000000037E0000-0x00000000037FC000-memory.dmp

Filesize
112KB

Download
memory/2348-5-0x0000000003660000-0x000000000366E000-memory.dmp

Filesize
56KB

Download
memory/2348-4-0x0000000003650000-0x000000000365E000-memory.dmp

Filesize
56KB

Download
memory/2348-3-0x00007FFB2BF00000-0x00007FFB2C9C1000-memory.dmp

Filesize
10.8MB

Download
memory/2348-2-0x00000000035C0000-0x00000000035C1000-memory.dmp

Filesize
4KB

Download
memory/2348-1-0x0000000000B90000-0x0000000001488000-memory.dmp

Filesize
9.0MB

Download