400c24bdb9b7dabfcd9a8a2f137550f338014d833d169c6e6f4252910fb95feb

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 06:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a31ba0b291554684b4a097371669bc4c.exe
Size

1.9MB
MD5

a31ba0b291554684b4a097371669bc4c
SHA1

0a5034d116b71c1a99879ef632962026b5b774aa
SHA256

0bfce2cf34dbbf853a1171acf4ac9e2802d3e67285222bcf8d43dffec50b6593
SHA512

8d8c96ad82f63aa8f7f3345d3905f5eff42cc3d8b50822036e128b9f886777cf475962161c3c308ee4867b05a5ef05b52d68be3e317b6a9505029c4f03547c67
SSDEEP

24576:0z4T3bMX0/0ZqSEaa3OVFu8VQTo8Ia29MSVyAXmFPf87ptY60/YYhdbh7JRj:0OMX0/08SVYTcxMXPxthD

Score

10^/10

defense_evasion execution trojan

Malware Config

Signatures

Process spawned unexpected child process 39 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2880	2808	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2744	2808	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2600	2808	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2556	2808	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2904	2808	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2388	2808	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1932	2808	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2848	2808	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3000	2808	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2908	2808	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	952	2808	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1096	2808	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	680	2808	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1512	2808	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2136	2808	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2076	2808	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1732	2808	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1576	2808	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	864	2808	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2020	2808	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2196	2808	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	528	2808	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2968	2808	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1048	2808	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2080	2808	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2316	2808	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1884	2808	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	604	2808	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2232	2808	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2992	2808	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2668	2808	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1388	2808	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1012	2808	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2676	2808	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2620	2808	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2960	2808	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2876	2808	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3016	2808	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2804	2808	schtasks.exe	30

UAC bypass 3 TTPs 24 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a31ba0b291554684b4a097371669bc4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a31ba0b291554684b4a097371669bc4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	a31ba0b291554684b4a097371669bc4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	a31ba0b291554684b4a097371669bc4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a31ba0b291554684b4a097371669bc4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	a31ba0b291554684b4a097371669bc4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	a31ba0b291554684b4a097371669bc4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	a31ba0b291554684b4a097371669bc4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	a31ba0b291554684b4a097371669bc4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a31ba0b291554684b4a097371669bc4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	a31ba0b291554684b4a097371669bc4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	a31ba0b291554684b4a097371669bc4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a31ba0b291554684b4a097371669bc4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	a31ba0b291554684b4a097371669bc4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	a31ba0b291554684b4a097371669bc4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	a31ba0b291554684b4a097371669bc4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	a31ba0b291554684b4a097371669bc4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	a31ba0b291554684b4a097371669bc4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	a31ba0b291554684b4a097371669bc4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a31ba0b291554684b4a097371669bc4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a31ba0b291554684b4a097371669bc4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	a31ba0b291554684b4a097371669bc4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a31ba0b291554684b4a097371669bc4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	a31ba0b291554684b4a097371669bc4c.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 14 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2100	powershell.exe
624	powershell.exe
980	powershell.exe
1972	powershell.exe
1404	powershell.exe
2720	powershell.exe
2880	powershell.exe
1132	powershell.exe
676	powershell.exe
324	powershell.exe
1604	powershell.exe
2320	powershell.exe
2252	powershell.exe
1768	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	a31ba0b291554684b4a097371669bc4c.exe

Executes dropped EXE 7 IoCs

pid	Process
2424	a31ba0b291554684b4a097371669bc4c.exe
1920	a31ba0b291554684b4a097371669bc4c.exe
2320	a31ba0b291554684b4a097371669bc4c.exe
896	a31ba0b291554684b4a097371669bc4c.exe
876	a31ba0b291554684b4a097371669bc4c.exe
2344	a31ba0b291554684b4a097371669bc4c.exe
1972	a31ba0b291554684b4a097371669bc4c.exe

Checks whether UAC is enabled 1 TTPs 16 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a31ba0b291554684b4a097371669bc4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a31ba0b291554684b4a097371669bc4c.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	a31ba0b291554684b4a097371669bc4c.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	a31ba0b291554684b4a097371669bc4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a31ba0b291554684b4a097371669bc4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a31ba0b291554684b4a097371669bc4c.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	a31ba0b291554684b4a097371669bc4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a31ba0b291554684b4a097371669bc4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a31ba0b291554684b4a097371669bc4c.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	a31ba0b291554684b4a097371669bc4c.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	a31ba0b291554684b4a097371669bc4c.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	a31ba0b291554684b4a097371669bc4c.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	a31ba0b291554684b4a097371669bc4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a31ba0b291554684b4a097371669bc4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a31ba0b291554684b4a097371669bc4c.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	a31ba0b291554684b4a097371669bc4c.exe

Drops file in Program Files directory 20 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\c5b4cb5e9653cc	a31ba0b291554684b4a097371669bc4c.exe
File created	C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\886983d96e3d3e	a31ba0b291554684b4a097371669bc4c.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\it-IT\RCXAA77.tmp	a31ba0b291554684b4a097371669bc4c.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\it-IT\RCXAA78.tmp	a31ba0b291554684b4a097371669bc4c.exe
File opened for modification	C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\RCXACEA.tmp	a31ba0b291554684b4a097371669bc4c.exe
File created	C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\csrss.exe	a31ba0b291554684b4a097371669bc4c.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\RCXA468.tmp	a31ba0b291554684b4a097371669bc4c.exe
File opened for modification	C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\RCXAC7B.tmp	a31ba0b291554684b4a097371669bc4c.exe
File opened for modification	C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\csrss.exe	a31ba0b291554684b4a097371669bc4c.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\sppsvc.exe	a31ba0b291554684b4a097371669bc4c.exe
File created	C:\Program Files (x86)\Windows Defender\it-IT\b75386f1303e64	a31ba0b291554684b4a097371669bc4c.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\RCX97FD.tmp	a31ba0b291554684b4a097371669bc4c.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\RCXA469.tmp	a31ba0b291554684b4a097371669bc4c.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\sppsvc.exe	a31ba0b291554684b4a097371669bc4c.exe
File created	C:\Program Files (x86)\Windows Defender\it-IT\taskhost.exe	a31ba0b291554684b4a097371669bc4c.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\RCX97FE.tmp	a31ba0b291554684b4a097371669bc4c.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\it-IT\taskhost.exe	a31ba0b291554684b4a097371669bc4c.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\services.exe	a31ba0b291554684b4a097371669bc4c.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\0a1fd5f707cd16	a31ba0b291554684b4a097371669bc4c.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\services.exe	a31ba0b291554684b4a097371669bc4c.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File created	C:\Windows\AppPatch\de-DE\a31ba0b291554684b4a097371669bc4c.exe	a31ba0b291554684b4a097371669bc4c.exe
File created	C:\Windows\AppPatch\de-DE\f0167ac62f7e98	a31ba0b291554684b4a097371669bc4c.exe
File opened for modification	C:\Windows\DigitalLocker\a31ba0b291554684b4a097371669bc4c.exe	a31ba0b291554684b4a097371669bc4c.exe
File created	C:\Windows\DigitalLocker\a31ba0b291554684b4a097371669bc4c.exe	a31ba0b291554684b4a097371669bc4c.exe
File created	C:\Windows\Globalization\smss.exe	a31ba0b291554684b4a097371669bc4c.exe
File opened for modification	C:\Windows\AppPatch\de-DE\RCX9C18.tmp	a31ba0b291554684b4a097371669bc4c.exe
File opened for modification	C:\Windows\AppPatch\de-DE\a31ba0b291554684b4a097371669bc4c.exe	a31ba0b291554684b4a097371669bc4c.exe
File opened for modification	C:\Windows\DigitalLocker\RCX9E1B.tmp	a31ba0b291554684b4a097371669bc4c.exe
File opened for modification	C:\Windows\DigitalLocker\RCX9E4B.tmp	a31ba0b291554684b4a097371669bc4c.exe
File opened for modification	C:\Windows\Globalization\smss.exe	a31ba0b291554684b4a097371669bc4c.exe
File created	C:\Windows\Globalization\69ddcba757bf72	a31ba0b291554684b4a097371669bc4c.exe
File opened for modification	C:\Windows\AppPatch\de-DE\RCX9C17.tmp	a31ba0b291554684b4a097371669bc4c.exe
File opened for modification	C:\Windows\Globalization\RCXA263.tmp	a31ba0b291554684b4a097371669bc4c.exe
File opened for modification	C:\Windows\Globalization\RCXA264.tmp	a31ba0b291554684b4a097371669bc4c.exe
File created	C:\Windows\DigitalLocker\f0167ac62f7e98	a31ba0b291554684b4a097371669bc4c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 39 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2668	schtasks.exe
2316	schtasks.exe
1884	schtasks.exe
604	schtasks.exe
1012	schtasks.exe
2960	schtasks.exe
2876	schtasks.exe
2744	schtasks.exe
952	schtasks.exe
528	schtasks.exe
2968	schtasks.exe
2992	schtasks.exe
864	schtasks.exe
2020	schtasks.exe
1048	schtasks.exe
1388	schtasks.exe
2620	schtasks.exe
680	schtasks.exe
2848	schtasks.exe
2600	schtasks.exe
2908	schtasks.exe
1096	schtasks.exe
2232	schtasks.exe
1512	schtasks.exe
2076	schtasks.exe
1576	schtasks.exe
2676	schtasks.exe
2804	schtasks.exe
2904	schtasks.exe
2196	schtasks.exe
2080	schtasks.exe
3016	schtasks.exe
1732	schtasks.exe
2880	schtasks.exe
2556	schtasks.exe
2388	schtasks.exe
1932	schtasks.exe
3000	schtasks.exe
2136	schtasks.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
1192	a31ba0b291554684b4a097371669bc4c.exe
1192	a31ba0b291554684b4a097371669bc4c.exe
1192	a31ba0b291554684b4a097371669bc4c.exe
1192	a31ba0b291554684b4a097371669bc4c.exe
1192	a31ba0b291554684b4a097371669bc4c.exe
1192	a31ba0b291554684b4a097371669bc4c.exe
1192	a31ba0b291554684b4a097371669bc4c.exe
2720	powershell.exe
2252	powershell.exe
1132	powershell.exe
1768	powershell.exe
1404	powershell.exe
2320	powershell.exe
1972	powershell.exe
324	powershell.exe
624	powershell.exe
2100	powershell.exe
676	powershell.exe
2880	powershell.exe
980	powershell.exe
1604	powershell.exe
2424	a31ba0b291554684b4a097371669bc4c.exe
1920	a31ba0b291554684b4a097371669bc4c.exe
2320	a31ba0b291554684b4a097371669bc4c.exe
896	a31ba0b291554684b4a097371669bc4c.exe
876	a31ba0b291554684b4a097371669bc4c.exe
2344	a31ba0b291554684b4a097371669bc4c.exe
1972	a31ba0b291554684b4a097371669bc4c.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	1192	a31ba0b291554684b4a097371669bc4c.exe
Token: SeDebugPrivilege	2720	powershell.exe
Token: SeDebugPrivilege	2252	powershell.exe
Token: SeDebugPrivilege	1132	powershell.exe
Token: SeDebugPrivilege	1768	powershell.exe
Token: SeDebugPrivilege	1404	powershell.exe
Token: SeDebugPrivilege	2320	powershell.exe
Token: SeDebugPrivilege	1972	powershell.exe
Token: SeDebugPrivilege	324	powershell.exe
Token: SeDebugPrivilege	624	powershell.exe
Token: SeDebugPrivilege	2100	powershell.exe
Token: SeDebugPrivilege	676	powershell.exe
Token: SeDebugPrivilege	2880	powershell.exe
Token: SeDebugPrivilege	980	powershell.exe
Token: SeDebugPrivilege	1604	powershell.exe
Token: SeDebugPrivilege	2424	a31ba0b291554684b4a097371669bc4c.exe
Token: SeDebugPrivilege	1920	a31ba0b291554684b4a097371669bc4c.exe
Token: SeDebugPrivilege	2320	a31ba0b291554684b4a097371669bc4c.exe
Token: SeDebugPrivilege	896	a31ba0b291554684b4a097371669bc4c.exe
Token: SeDebugPrivilege	876	a31ba0b291554684b4a097371669bc4c.exe
Token: SeDebugPrivilege	2344	a31ba0b291554684b4a097371669bc4c.exe
Token: SeDebugPrivilege	1972	a31ba0b291554684b4a097371669bc4c.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1192 wrote to memory of 1768	1192	a31ba0b291554684b4a097371669bc4c.exe	70
PID 1192 wrote to memory of 1768	1192	a31ba0b291554684b4a097371669bc4c.exe	70
PID 1192 wrote to memory of 1768	1192	a31ba0b291554684b4a097371669bc4c.exe	70
PID 1192 wrote to memory of 1132	1192	a31ba0b291554684b4a097371669bc4c.exe	71
PID 1192 wrote to memory of 1132	1192	a31ba0b291554684b4a097371669bc4c.exe	71
PID 1192 wrote to memory of 1132	1192	a31ba0b291554684b4a097371669bc4c.exe	71
PID 1192 wrote to memory of 2252	1192	a31ba0b291554684b4a097371669bc4c.exe	73
PID 1192 wrote to memory of 2252	1192	a31ba0b291554684b4a097371669bc4c.exe	73
PID 1192 wrote to memory of 2252	1192	a31ba0b291554684b4a097371669bc4c.exe	73
PID 1192 wrote to memory of 2880	1192	a31ba0b291554684b4a097371669bc4c.exe	74
PID 1192 wrote to memory of 2880	1192	a31ba0b291554684b4a097371669bc4c.exe	74
PID 1192 wrote to memory of 2880	1192	a31ba0b291554684b4a097371669bc4c.exe	74
PID 1192 wrote to memory of 2720	1192	a31ba0b291554684b4a097371669bc4c.exe	76
PID 1192 wrote to memory of 2720	1192	a31ba0b291554684b4a097371669bc4c.exe	76
PID 1192 wrote to memory of 2720	1192	a31ba0b291554684b4a097371669bc4c.exe	76
PID 1192 wrote to memory of 2320	1192	a31ba0b291554684b4a097371669bc4c.exe	105
PID 1192 wrote to memory of 2320	1192	a31ba0b291554684b4a097371669bc4c.exe	105
PID 1192 wrote to memory of 2320	1192	a31ba0b291554684b4a097371669bc4c.exe	105
PID 1192 wrote to memory of 1604	1192	a31ba0b291554684b4a097371669bc4c.exe	79
PID 1192 wrote to memory of 1604	1192	a31ba0b291554684b4a097371669bc4c.exe	79
PID 1192 wrote to memory of 1604	1192	a31ba0b291554684b4a097371669bc4c.exe	79
PID 1192 wrote to memory of 676	1192	a31ba0b291554684b4a097371669bc4c.exe	81
PID 1192 wrote to memory of 676	1192	a31ba0b291554684b4a097371669bc4c.exe	81
PID 1192 wrote to memory of 676	1192	a31ba0b291554684b4a097371669bc4c.exe	81
PID 1192 wrote to memory of 1404	1192	a31ba0b291554684b4a097371669bc4c.exe	82
PID 1192 wrote to memory of 1404	1192	a31ba0b291554684b4a097371669bc4c.exe	82
PID 1192 wrote to memory of 1404	1192	a31ba0b291554684b4a097371669bc4c.exe	82
PID 1192 wrote to memory of 1972	1192	a31ba0b291554684b4a097371669bc4c.exe	84
PID 1192 wrote to memory of 1972	1192	a31ba0b291554684b4a097371669bc4c.exe	84
PID 1192 wrote to memory of 1972	1192	a31ba0b291554684b4a097371669bc4c.exe	84
PID 1192 wrote to memory of 980	1192	a31ba0b291554684b4a097371669bc4c.exe	85
PID 1192 wrote to memory of 980	1192	a31ba0b291554684b4a097371669bc4c.exe	85
PID 1192 wrote to memory of 980	1192	a31ba0b291554684b4a097371669bc4c.exe	85
PID 1192 wrote to memory of 624	1192	a31ba0b291554684b4a097371669bc4c.exe	87
PID 1192 wrote to memory of 624	1192	a31ba0b291554684b4a097371669bc4c.exe	87
PID 1192 wrote to memory of 624	1192	a31ba0b291554684b4a097371669bc4c.exe	87
PID 1192 wrote to memory of 324	1192	a31ba0b291554684b4a097371669bc4c.exe	88
PID 1192 wrote to memory of 324	1192	a31ba0b291554684b4a097371669bc4c.exe	88
PID 1192 wrote to memory of 324	1192	a31ba0b291554684b4a097371669bc4c.exe	88
PID 1192 wrote to memory of 2100	1192	a31ba0b291554684b4a097371669bc4c.exe	89
PID 1192 wrote to memory of 2100	1192	a31ba0b291554684b4a097371669bc4c.exe	89
PID 1192 wrote to memory of 2100	1192	a31ba0b291554684b4a097371669bc4c.exe	89
PID 1192 wrote to memory of 2424	1192	a31ba0b291554684b4a097371669bc4c.exe	98
PID 1192 wrote to memory of 2424	1192	a31ba0b291554684b4a097371669bc4c.exe	98
PID 1192 wrote to memory of 2424	1192	a31ba0b291554684b4a097371669bc4c.exe	98
PID 2424 wrote to memory of 2744	2424	a31ba0b291554684b4a097371669bc4c.exe	99
PID 2424 wrote to memory of 2744	2424	a31ba0b291554684b4a097371669bc4c.exe	99
PID 2424 wrote to memory of 2744	2424	a31ba0b291554684b4a097371669bc4c.exe	99
PID 2424 wrote to memory of 2316	2424	a31ba0b291554684b4a097371669bc4c.exe	100
PID 2424 wrote to memory of 2316	2424	a31ba0b291554684b4a097371669bc4c.exe	100
PID 2424 wrote to memory of 2316	2424	a31ba0b291554684b4a097371669bc4c.exe	100
PID 2744 wrote to memory of 1920	2744	WScript.exe	102
PID 2744 wrote to memory of 1920	2744	WScript.exe	102
PID 2744 wrote to memory of 1920	2744	WScript.exe	102
PID 1920 wrote to memory of 1992	1920	a31ba0b291554684b4a097371669bc4c.exe	103
PID 1920 wrote to memory of 1992	1920	a31ba0b291554684b4a097371669bc4c.exe	103
PID 1920 wrote to memory of 1992	1920	a31ba0b291554684b4a097371669bc4c.exe	103
PID 1920 wrote to memory of 684	1920	a31ba0b291554684b4a097371669bc4c.exe	104
PID 1920 wrote to memory of 684	1920	a31ba0b291554684b4a097371669bc4c.exe	104
PID 1920 wrote to memory of 684	1920	a31ba0b291554684b4a097371669bc4c.exe	104
PID 1992 wrote to memory of 2320	1992	WScript.exe	105
PID 1992 wrote to memory of 2320	1992	WScript.exe	105
PID 1992 wrote to memory of 2320	1992	WScript.exe	105
PID 2320 wrote to memory of 2276	2320	a31ba0b291554684b4a097371669bc4c.exe	106

System policy modification 1 TTPs 24 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	a31ba0b291554684b4a097371669bc4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a31ba0b291554684b4a097371669bc4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	a31ba0b291554684b4a097371669bc4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	a31ba0b291554684b4a097371669bc4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a31ba0b291554684b4a097371669bc4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a31ba0b291554684b4a097371669bc4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	a31ba0b291554684b4a097371669bc4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	a31ba0b291554684b4a097371669bc4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	a31ba0b291554684b4a097371669bc4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	a31ba0b291554684b4a097371669bc4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a31ba0b291554684b4a097371669bc4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	a31ba0b291554684b4a097371669bc4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	a31ba0b291554684b4a097371669bc4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	a31ba0b291554684b4a097371669bc4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a31ba0b291554684b4a097371669bc4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	a31ba0b291554684b4a097371669bc4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	a31ba0b291554684b4a097371669bc4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	a31ba0b291554684b4a097371669bc4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a31ba0b291554684b4a097371669bc4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	a31ba0b291554684b4a097371669bc4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a31ba0b291554684b4a097371669bc4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a31ba0b291554684b4a097371669bc4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	a31ba0b291554684b4a097371669bc4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	a31ba0b291554684b4a097371669bc4c.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\a31ba0b291554684b4a097371669bc4c.exe
"C:\Users\Admin\AppData\Local\Temp\a31ba0b291554684b4a097371669bc4c.exe"
1⤵
- UAC bypass
- Drops file in Drivers directory
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1192
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\a31ba0b291554684b4a097371669bc4c.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1768
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Photo Viewer\sppsvc.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1132
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\csrss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2252
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\AppPatch\de-DE\a31ba0b291554684b4a097371669bc4c.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2880
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\DigitalLocker\a31ba0b291554684b4a097371669bc4c.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2720
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\lsass.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2320
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Globalization\smss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1604
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Reference Assemblies\Microsoft\services.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:676
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\OSPPSVC.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1404
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\SendTo\a31ba0b291554684b4a097371669bc4c.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1972
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Defender\it-IT\taskhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:980
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\csrss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:624
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\wininit.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:324
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\csrss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2100
- C:\Windows\AppPatch\de-DE\a31ba0b291554684b4a097371669bc4c.exe
  "C:\Windows\AppPatch\de-DE\a31ba0b291554684b4a097371669bc4c.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2424
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3b11c6d8-761e-45cc-9a97-bf39977b7d6c.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2744
  - - C:\Windows\AppPatch\de-DE\a31ba0b291554684b4a097371669bc4c.exe
      C:\Windows\AppPatch\de-DE\a31ba0b291554684b4a097371669bc4c.exe
      4⤵
      UAC bypass
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:1920
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ae6d3b62-d323-452f-9788-f3541f1aafd5.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1992
      - C:\Windows\AppPatch\de-DE\a31ba0b291554684b4a097371669bc4c.exe
        
        C:\Windows\AppPatch\de-DE\a31ba0b291554684b4a097371669bc4c.exe
        6⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2320
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\eeb605bd-9372-4e50-9d9d-6dcd5ff924c1.vbs"
        7⤵
        
        PID:2276
        
        C:\Windows\AppPatch\de-DE\a31ba0b291554684b4a097371669bc4c.exe
        
        C:\Windows\AppPatch\de-DE\a31ba0b291554684b4a097371669bc4c.exe
        8⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:896
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7ade3b8d-de11-4aa1-8eba-b11b0619a1e4.vbs"
        9⤵
        
        PID:1636
        
        C:\Windows\AppPatch\de-DE\a31ba0b291554684b4a097371669bc4c.exe
        
        C:\Windows\AppPatch\de-DE\a31ba0b291554684b4a097371669bc4c.exe
        10⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:876
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2f5260ba-f943-4616-92e9-494fc1871c05.vbs"
        11⤵
        
        PID:328
        
        C:\Windows\AppPatch\de-DE\a31ba0b291554684b4a097371669bc4c.exe
        
        C:\Windows\AppPatch\de-DE\a31ba0b291554684b4a097371669bc4c.exe
        12⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2344
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\86fc4522-d836-4517-9cbf-2e506d1c88a1.vbs"
        13⤵
        
        PID:2064
        
        C:\Windows\AppPatch\de-DE\a31ba0b291554684b4a097371669bc4c.exe
        
        C:\Windows\AppPatch\de-DE\a31ba0b291554684b4a097371669bc4c.exe
        14⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1972
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\893f25d4-41f0-46b2-a6f3-519a0a6449bb.vbs"
        15⤵
        
        PID:1840
        
        C:\Windows\AppPatch\de-DE\a31ba0b291554684b4a097371669bc4c.exe
        
        C:\Windows\AppPatch\de-DE\a31ba0b291554684b4a097371669bc4c.exe
        16⤵
        
        PID:2644
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\45ec9ab7-a5b8-4b65-a2f9-e6c4ab84d7f2.vbs"
        15⤵
        
        PID:2352
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7e8da815-a6e3-4a24-a1dd-a771345ef5b5.vbs"
        13⤵
        
        PID:1832
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\25d54b14-6442-4e34-b64c-21d1fb7c37c6.vbs"
        11⤵
        
        PID:1776
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a839871d-10e2-48c1-8c6b-cfaccb7c5ec2.vbs"
        9⤵
        
        PID:1192
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f3008413-16df-4f13-8f57-19e51cea850e.vbs"
        7⤵
        
        PID:3036
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\36b950a9-53f1-4314-92eb-92cb4746d2ed.vbs"
        5⤵
        
        PID:684
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c98a91b7-da69-4a02-8a49-4b37741a22fc.vbs"
    3⤵
    PID:2316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Photo Viewer\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Photo Viewer\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "a31ba0b291554684b4a097371669bc4ca" /sc MINUTE /mo 14 /tr "'C:\Windows\AppPatch\de-DE\a31ba0b291554684b4a097371669bc4c.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "a31ba0b291554684b4a097371669bc4c" /sc ONLOGON /tr "'C:\Windows\AppPatch\de-DE\a31ba0b291554684b4a097371669bc4c.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "a31ba0b291554684b4a097371669bc4ca" /sc MINUTE /mo 6 /tr "'C:\Windows\AppPatch\de-DE\a31ba0b291554684b4a097371669bc4c.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "a31ba0b291554684b4a097371669bc4ca" /sc MINUTE /mo 11 /tr "'C:\Windows\DigitalLocker\a31ba0b291554684b4a097371669bc4c.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "a31ba0b291554684b4a097371669bc4c" /sc ONLOGON /tr "'C:\Windows\DigitalLocker\a31ba0b291554684b4a097371669bc4c.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "a31ba0b291554684b4a097371669bc4ca" /sc MINUTE /mo 12 /tr "'C:\Windows\DigitalLocker\a31ba0b291554684b4a097371669bc4c.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\MSOCache\All Users\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Windows\Globalization\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\Globalization\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Windows\Globalization\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 10 /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 14 /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "a31ba0b291554684b4a097371669bc4ca" /sc MINUTE /mo 10 /tr "'C:\Users\Default\SendTo\a31ba0b291554684b4a097371669bc4c.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "a31ba0b291554684b4a097371669bc4c" /sc ONLOGON /tr "'C:\Users\Default\SendTo\a31ba0b291554684b4a097371669bc4c.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "a31ba0b291554684b4a097371669bc4ca" /sc MINUTE /mo 14 /tr "'C:\Users\Default\SendTo\a31ba0b291554684b4a097371669bc4c.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Defender\it-IT\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\it-IT\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Defender\it-IT\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\lsass.exe

Filesize
1.9MB

MD5
a31ba0b291554684b4a097371669bc4c

SHA1
0a5034d116b71c1a99879ef632962026b5b774aa

SHA256
0bfce2cf34dbbf853a1171acf4ac9e2802d3e67285222bcf8d43dffec50b6593

SHA512
8d8c96ad82f63aa8f7f3345d3905f5eff42cc3d8b50822036e128b9f886777cf475962161c3c308ee4867b05a5ef05b52d68be3e317b6a9505029c4f03547c67

Download Submit
C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\csrss.exe

Filesize
1.9MB

MD5
abf2c7e004ab22238ef78cb86dedb033

SHA1
6bdfbfe9e21f99d2ba51d92c62a5402d5cc8b39c

SHA256
d92cee1bf9648f5367b71375700a57164eff224aa44a1984d70ebfdb665970c3

SHA512
89442b8d554b75cc84b2842aa713a582eb51eb8a6791ad2465fc198e030630d046814ac4119bb39363240d05600069d9ea3a6c5b701c92bbb5e3aae47a496d19

Download Submit
C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\wininit.exe

Filesize
1.9MB

MD5
d57a319ed48c91f3349d42cbb86e7121

SHA1
075005eed8e25bc290023f0f0518991e0340a95c

SHA256
b11f337f64f5e1a856dbb9cc9955080bd4e1cd234ad795eb4ba5fa02f085bd27

SHA512
c43c2e8a30dccc30f1e96f47d7cf2b344a6af77a18e434375e85456bf98dbca382fb19c7959405a0c7e9b2bd61ca82578064a947c30193bc584aada9abedcabc

Download Submit
C:\Users\Admin\AppData\Local\Temp\2f5260ba-f943-4616-92e9-494fc1871c05.vbs

Filesize
737B

MD5
87b961e6454d716fe205192f878a17d3

SHA1
538df56c032712b565b961ef009e0749defd96a9

SHA256
3a0c3dd6b3fadc04c0dcc65b79e28f916b1359f9327c2ece7bf6d2dd21e7a3e2

SHA512
5a246220c9cf92355216e35a63e50da992e3edebd01a30fbda42e1982414143e9fa6697cca14ce587580d48d3622213e5284ed42be6bda64784e5d81629680d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\3b11c6d8-761e-45cc-9a97-bf39977b7d6c.vbs

Filesize
738B

MD5
617154d117f6ee0819527fbdeb06186c

SHA1
4fa0cfd26a055c9e7f4f7bc672df289b6ed4ade1

SHA256
39ad1967b4a34416cebf4d01c8903993cdccde9fc7ab10a7601136ca56f49437

SHA512
4b4b6fcf97ec0a9d010b13eb9d47149b887e6ed3aa538e22519532e1b8da3bd1644ec2a78d06bbe32192f788addb73fd31a51806d29e93a1b91becb32d25bd24

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ade3b8d-de11-4aa1-8eba-b11b0619a1e4.vbs

Filesize
737B

MD5
08faa5c42b7b9db2d6c479ce79e5e63c

SHA1
6c16d5e8e2ee2fb0e84a9800242610228bafb21a

SHA256
541da454a8c7729633d3b522465ebc604a977029bd16b207c844e818c1cd0883

SHA512
1f82bf3f14b79a93938a04759888d5c452c4058a3b5e19c2b951181ea3e0fa4766bdc561b1e4c78e535f3be29f6c6928a2d93cc7bbe0487c99797a271f10e545

Download Submit
C:\Users\Admin\AppData\Local\Temp\86fc4522-d836-4517-9cbf-2e506d1c88a1.vbs

Filesize
738B

MD5
57fbc9d5e38215c3994c7868c2ddb685

SHA1
d73bacf21cbf6c809fb07e515ce94a78ebd5961e

SHA256
54b4fd8908e2506fb8676dcdcb2b2f779f7f8d08dcc8944995dcf4cffadacf5f

SHA512
55d09d6c9ea2223295396562bdc0e0034d341e2b826682ce1bc279188a4ce8cecf6c02cd4f467dca42c5a5d6051d4b1bb4206352978706037ba92dc59565471e

Download Submit
C:\Users\Admin\AppData\Local\Temp\893f25d4-41f0-46b2-a6f3-519a0a6449bb.vbs

Filesize
738B

MD5
81914fbb202fe0549d177239229bdfa2

SHA1
7a4eade13c6a8dfcf7e513d9d9badd9981a9e87f

SHA256
3f2371fcb0287ff4b274038b0d366b962272c3557c7104337f0502b64017d137

SHA512
cd4f017050a775136ead9dde8e5040b10d9e5086b675646804e7645d81b606cf57fafa878c6619339b5f49e838255b1caa28c7db86e8dfdb5ccb39a8688b07dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\ae6d3b62-d323-452f-9788-f3541f1aafd5.vbs

Filesize
738B

MD5
97f446e482c6325d04a43a587bc9802d

SHA1
7a623482fb09b5fd8b0ab728b2fba28e29dd5465

SHA256
0d8a99df041832b9b42b3dcab1a9df9283d676adc19b1694c49006e5a8a90919

SHA512
dada30d47672159efbafcaba93045cab4e28022171aea27aa8aea99a27afda60b050495f01c9ca1e85aa7fbfdf79f562025dc16ceec8130312f45ae8cca39e4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\c98a91b7-da69-4a02-8a49-4b37741a22fc.vbs

Filesize
514B

MD5
9801cb3dd217c2fcd1c92a9bc4b3cf43

SHA1
63c84783ab8126a6d19cdb7614ee51dcf5cc8818

SHA256
adf020bd92557df32eb6e2d4d9d1e09a8efbac64483c2053db7f53d1dd77440d

SHA512
b9450db1b97cbbaa7019d194cb3ae5165852048773c85722fa2251c31df56b122229389e3bfa3e60a20cf51bbd0f24ee89f731a150e12caec233edd38fc2ffeb

Download Submit
C:\Users\Admin\AppData\Local\Temp\eeb605bd-9372-4e50-9d9d-6dcd5ff924c1.vbs

Filesize
738B

MD5
72fb621f72d240b1ccad5833e92887ce

SHA1
6f74f6b1340e6975464e4312a1e8b881620b8d74

SHA256
4f07bc49410e040d854a046e18f64dae5987e8d8f12a11a97fdfaac26a2907db

SHA512
b77c94e42d916fd2cd996a5d2b678216a48c73b6097cde9247832d806accecd286c81dadba963ce018fdd6db73887a40cf033ad7170fe83b54afafcc1cb171b0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
413acd96f25f9c60e04834bfa3980bf1

SHA1
10d81542e50add1a579ebb8c0766800c85b5e8a2

SHA256
3a4df99b84d280d379b9e8ba12457f59ef0f88c39af96ecc08abf735d05a63b5

SHA512
7935902d4710fedbfe6e980ab461ef9e3d4aa291aa0a8547397ef8d90d0ae66c0835345a4da43355ecb5c89db5f9fd5f482c7e145575daf882ec31a18b877f17

Download Submit
memory/876-332-0x0000000001390000-0x000000000157A000-memory.dmp

Filesize
1.9MB

Download
memory/876-333-0x00000000005C0000-0x00000000005D2000-memory.dmp

Filesize
72KB

Download
memory/896-320-0x0000000000290000-0x000000000047A000-memory.dmp

Filesize
1.9MB

Download
memory/1192-7-0x0000000000540000-0x000000000054A000-memory.dmp

Filesize
40KB

Download
memory/1192-18-0x0000000000F60000-0x0000000000F6C000-memory.dmp

Filesize
48KB

Download
memory/1192-14-0x0000000000E20000-0x0000000000E2A000-memory.dmp

Filesize
40KB

Download
memory/1192-13-0x0000000000DF0000-0x0000000000DFC000-memory.dmp

Filesize
48KB

Download
memory/1192-6-0x0000000000520000-0x0000000000536000-memory.dmp

Filesize
88KB

Download
memory/1192-2-0x000007FEF6260000-0x000007FEF6C4C000-memory.dmp

Filesize
9.9MB

Download
memory/1192-203-0x000007FEF6263000-0x000007FEF6264000-memory.dmp

Filesize
4KB

Download
memory/1192-5-0x0000000000510000-0x0000000000520000-memory.dmp

Filesize
64KB

Download
memory/1192-17-0x0000000000F50000-0x0000000000F5C000-memory.dmp

Filesize
48KB

Download
memory/1192-16-0x0000000000F40000-0x0000000000F48000-memory.dmp

Filesize
32KB

Download
memory/1192-15-0x0000000000F30000-0x0000000000F3E000-memory.dmp

Filesize
56KB

Download
memory/1192-248-0x000007FEF6260000-0x000007FEF6C4C000-memory.dmp

Filesize
9.9MB

Download
memory/1192-1-0x0000000000F70000-0x000000000115A000-memory.dmp

Filesize
1.9MB

Download
memory/1192-9-0x0000000000550000-0x000000000055C000-memory.dmp

Filesize
48KB

Download
memory/1192-10-0x0000000000AE0000-0x0000000000AE8000-memory.dmp

Filesize
32KB

Download
memory/1192-0-0x000007FEF6263000-0x000007FEF6264000-memory.dmp

Filesize
4KB

Download
memory/1192-12-0x0000000000BC0000-0x0000000000BD2000-memory.dmp

Filesize
72KB

Download
memory/1192-8-0x0000000000B70000-0x0000000000BC6000-memory.dmp

Filesize
344KB

Download
memory/1192-3-0x0000000000260000-0x000000000027C000-memory.dmp

Filesize
112KB

Download
memory/1192-4-0x0000000000500000-0x0000000000508000-memory.dmp

Filesize
32KB

Download
memory/1920-297-0x0000000000AA0000-0x0000000000AF6000-memory.dmp

Filesize
344KB

Download
memory/1920-296-0x0000000000F50000-0x000000000113A000-memory.dmp

Filesize
1.9MB

Download
memory/2252-232-0x000000001B800000-0x000000001BAE2000-memory.dmp

Filesize
2.9MB

Download
memory/2252-233-0x0000000001E10000-0x0000000001E18000-memory.dmp

Filesize
32KB

Download
memory/2424-284-0x0000000000A90000-0x0000000000AE6000-memory.dmp

Filesize
344KB

Download
memory/2424-285-0x0000000000B60000-0x0000000000B72000-memory.dmp

Filesize
72KB

Download
memory/2424-231-0x0000000000BC0000-0x0000000000DAA000-memory.dmp

Filesize
1.9MB

Download