discordrat | 5436af4185d5c05d8ec07213f940cb8a3506fa9a0621b45ebf38583e37165977

Analysis

max time kernel
25s
max time network
1196s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
30-06-2024 18:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Discord rat.exe
Size

79KB
MD5

4a825505953f3f758e1da9bab73df39e
SHA1

ee7226735ea2d358d8628e037f35d38fc799ef50
SHA256

5436af4185d5c05d8ec07213f940cb8a3506fa9a0621b45ebf38583e37165977
SHA512

43120fc749ee67d7b8371aa921ee9a7b3769cbc63db06c0dd5cadfa7a83aeeb51e3a54ac4e8c0738cc58b22bcef0d8c5198b753626955371823d11a54d0d12a9
SSDEEP

1536:UeycDpiiSoH8ovTpPFl+ktd2+6CHpHKcGiNPAeN+cvy1kml4KSYHbC/EuYDbbqik:rycDpiiSoH8ovTpFl+ktd2+6CHpHKcGw

Score

10^/10

discordrat bootkit evasion execution persistence privilege_escalation rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI1Njk1OTk3MzkyMjA1MDA0OA.GGLfYW.bDrMZAIyeTVgyJMSqQFO2gDeB0CtQKGKri6ACU
server_id
1256666099580403734

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of NtCreateUserProcessOtherParentProcess 21 IoCs

Processes:

Discord rat.exe

description	pid	process	target process
PID 3544 created 616	3544	Discord rat.exe	winlogon.exe
PID 3544 created 616	3544	Discord rat.exe	winlogon.exe
PID 3544 created 616	3544	Discord rat.exe	winlogon.exe
PID 3544 created 616	3544	Discord rat.exe	winlogon.exe
PID 3544 created 616	3544	Discord rat.exe	winlogon.exe
PID 3544 created 616	3544	Discord rat.exe	winlogon.exe
PID 3544 created 616	3544	Discord rat.exe	winlogon.exe
PID 3544 created 616	3544	Discord rat.exe	winlogon.exe
PID 3544 created 616	3544	Discord rat.exe	winlogon.exe
PID 3544 created 616	3544	Discord rat.exe	winlogon.exe
PID 3544 created 616	3544	Discord rat.exe	winlogon.exe
PID 3544 created 616	3544	Discord rat.exe	winlogon.exe
PID 3544 created 616	3544	Discord rat.exe	winlogon.exe
PID 3544 created 616	3544	Discord rat.exe	winlogon.exe
PID 3544 created 616	3544	Discord rat.exe	winlogon.exe
PID 3544 created 616	3544	Discord rat.exe	winlogon.exe
PID 3544 created 616	3544	Discord rat.exe	winlogon.exe
PID 3544 created 616	3544	Discord rat.exe	winlogon.exe
PID 3544 created 616	3544	Discord rat.exe	winlogon.exe
PID 3544 created 616	3544	Discord rat.exe	winlogon.exe
PID 3544 created 616	3544	Discord rat.exe	winlogon.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 54 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	process
1344	powershell.exe
7824	powershell.exe
7156	powershell.exe
1340	powershell.exe
5292	powershell.exe
3452	powershell.exe
2252	powershell.exe
3272	powershell.exe
1064	powershell.exe
4832	powershell.exe
5512	powershell.exe
5880	powershell.exe
5708	powershell.exe
7556	powershell.exe
1960	powershell.exe
5104	powershell.exe
6140	powershell.exe
6136	powershell.exe
4324	powershell.exe
6996	powershell.exe
6652	powershell.exe
7088	powershell.exe
948	powershell.exe
4396	powershell.exe
4044	powershell.exe
3008	powershell.exe
4324	powershell.exe
7116	powershell.exe
864	powershell.exe
4484	powershell.exe
5568	powershell.exe
3484	powershell.exe
1552	powershell.exe
4260	powershell.exe
6768	powershell.exe
5708	powershell.exe
3456	powershell.exe
4732	powershell.exe
5144	powershell.exe
7012	powershell.exe
6356	powershell.exe
7712	powershell.exe
4964	powershell.exe
5856	powershell.exe
6956	powershell.exe
4708	powershell.exe
5292	powershell.exe
6548	powershell.exe
5308	powershell.exe
3516	powershell.exe
5716	powershell.exe
6400	powershell.exe
7056	powershell.exe
5360	powershell.exe

Downloads MZ/PE file

Modifies Windows Firewall 2 TTPs 50 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

NetSh.exeNetSh.exeNetSh.exeNetSh.exeNetSh.exeNetSh.exeNetSh.exeNetSh.exeNetSh.exeNetSh.exeNetSh.exeNetSh.exeNetSh.exeNetSh.exeNetSh.exeNetSh.exeNetSh.exeNetSh.exeNetSh.exeNetSh.exeNetSh.exeNetSh.exeNetSh.exeNetSh.exeNetSh.exeNetSh.exeNetSh.exeNetSh.exeNetSh.exeNetSh.exeNetSh.exeNetSh.exeNetSh.exeNetSh.exeNetSh.exeNetSh.exeNetSh.exeNetSh.exeNetSh.exeNetSh.exeNetSh.exeNetSh.exeNetSh.exeNetSh.exeNetSh.exeNetSh.exeNetSh.exeNetSh.exeNetSh.exeNetSh.exe

pid	process
1068	NetSh.exe
1908	NetSh.exe
3200	NetSh.exe
6016	NetSh.exe
4460	NetSh.exe
2884	NetSh.exe
3296	NetSh.exe
5804	NetSh.exe
3008	NetSh.exe
6748	NetSh.exe
1604	NetSh.exe
3692	NetSh.exe
3272	NetSh.exe
7012	NetSh.exe
4728	NetSh.exe
2432	NetSh.exe
6096	NetSh.exe
7140	NetSh.exe
6136	NetSh.exe
640	NetSh.exe
3888	NetSh.exe
1376	NetSh.exe
4796	NetSh.exe
3964	NetSh.exe
5764	NetSh.exe
4608	NetSh.exe
6932	NetSh.exe
7748	NetSh.exe
7632	NetSh.exe
3564	NetSh.exe
5024	NetSh.exe
6660	NetSh.exe
5264	NetSh.exe
5372	NetSh.exe
5632	NetSh.exe
1664	NetSh.exe
6576	NetSh.exe
7100	NetSh.exe
7312	NetSh.exe
4992	NetSh.exe
5932	NetSh.exe
6784	NetSh.exe
1376	NetSh.exe
6116	NetSh.exe
3288	NetSh.exe
7272	NetSh.exe
3240	NetSh.exe
5076	NetSh.exe
2360	NetSh.exe
5088	NetSh.exe

Sets service image path in registry 2 TTPs 1 IoCs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Processes:

WaaSMedicAgent.exe

description ioc process

Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\DoSvc\ImagePath = "C:\\Windows\\System32\\svchost.exe -k NetworkService -p" WaaSMedicAgent.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\DoSvc\ImagePath = "C:\\Windows\\System32\\svchost.exe -k NetworkService -p"	WaaSMedicAgent.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Discord rat.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\$77Discord rat.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Discord rat.exe"	Discord rat.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

svchost.exe

description	ioc	process
File opened (read-only)	\??\G:	svchost.exe
File opened (read-only)	\??\K:	svchost.exe
File opened (read-only)	\??\L:	svchost.exe
File opened (read-only)	\??\R:	svchost.exe
File opened (read-only)	\??\S:	svchost.exe
File opened (read-only)	\??\W:	svchost.exe
File opened (read-only)	\??\B:	svchost.exe
File opened (read-only)	\??\H:	svchost.exe
File opened (read-only)	\??\I:	svchost.exe
File opened (read-only)	\??\O:	svchost.exe
File opened (read-only)	\??\Q:	svchost.exe
File opened (read-only)	\??\U:	svchost.exe
File opened (read-only)	\??\V:	svchost.exe
File opened (read-only)	\??\J:	svchost.exe
File opened (read-only)	\??\M:	svchost.exe
File opened (read-only)	\??\P:	svchost.exe
File opened (read-only)	\??\T:	svchost.exe
File opened (read-only)	\??\Y:	svchost.exe
File opened (read-only)	\??\A:	svchost.exe
File opened (read-only)	\??\E:	svchost.exe
File opened (read-only)	\??\N:	svchost.exe
File opened (read-only)	\??\X:	svchost.exe
File opened (read-only)	\??\Z:	svchost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 44 IoCs

Web Service

T1102

Processes:

flow	ioc
117	discord.com
124	discord.com
22	discord.com
93	discord.com
95	discord.com
103	discord.com
113	discord.com
9	raw.githubusercontent.com
27	discord.com
129	discord.com
10	raw.githubusercontent.com
97	discord.com
102	discord.com
105	discord.com
114	discord.com
118	discord.com
94	discord.com
101	discord.com
109	discord.com
122	discord.com
131	discord.com
127	discord.com
21	discord.com
96	discord.com
98	discord.com
107	discord.com
112	discord.com
115	discord.com
125	discord.com
90	discord.com
104	discord.com
110	discord.com
120	discord.com
123	discord.com
121	discord.com
37	discord.com
92	discord.com
100	discord.com
106	discord.com
108	discord.com
111	discord.com
116	discord.com
126	discord.com
128	discord.com

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

wmiprvse.exe

description ioc process

File opened for modification \??\PHYSICALDRIVE0 wmiprvse.exe

description	ioc	process
File opened for modification	\??\PHYSICALDRIVE0	wmiprvse.exe

Drops file in System32 directory 7 IoCs

Processes:

svchost.exesvchost.exe

description	ioc	process
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4KernelMode.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4UserMode.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-WindowsUpdateClient%4Operational.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Scan	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work	svchost.exe

Suspicious use of SetThreadContext 21 IoCs

Processes:

Discord rat.exe

description	pid	process	target process
PID 3544 set thread context of 3216	3544	Discord rat.exe	dllhost.exe
PID 3544 set thread context of 1972	3544	Discord rat.exe	dllhost.exe
PID 3544 set thread context of 912	3544	Discord rat.exe	dllhost.exe
PID 3544 set thread context of 452	3544	Discord rat.exe	dllhost.exe
PID 3544 set thread context of 4340	3544	Discord rat.exe	dllhost.exe
PID 3544 set thread context of 4580	3544	Discord rat.exe	dllhost.exe
PID 3544 set thread context of 1068	3544	Discord rat.exe	dllhost.exe
PID 3544 set thread context of 4624	3544	Discord rat.exe	dllhost.exe
PID 3544 set thread context of 5660	3544	Discord rat.exe	dllhost.exe
PID 3544 set thread context of 5992	3544	Discord rat.exe	dllhost.exe
PID 3544 set thread context of 2908	3544	Discord rat.exe	dllhost.exe
PID 3544 set thread context of 6020	3544	Discord rat.exe	dllhost.exe
PID 3544 set thread context of 3968	3544	Discord rat.exe	dllhost.exe
PID 3544 set thread context of 5320	3544	Discord rat.exe	dllhost.exe
PID 3544 set thread context of 6004	3544	Discord rat.exe	dllhost.exe
PID 3544 set thread context of 5348	3544	Discord rat.exe	dllhost.exe
PID 3544 set thread context of 5824	3544	Discord rat.exe	dllhost.exe
PID 3544 set thread context of 5352	3544	Discord rat.exe	dllhost.exe
PID 3544 set thread context of 948	3544	Discord rat.exe	dllhost.exe
PID 3544 set thread context of 5560	3544	Discord rat.exe	dllhost.exe
PID 3544 set thread context of 2824	3544	Discord rat.exe	dllhost.exe

Drops file in Windows directory 8 IoCs

Processes:

svchost.exeTrustedInstaller.exe

description	ioc	process
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe
File created	C:\Windows\Logs\CBS\CBS.log	TrustedInstaller.exe
File opened for modification	C:\Windows\Logs\CBS\CBS.log	TrustedInstaller.exe
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 63 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

Processes:

NetSh.exeNetSh.exeNetSh.exeNetSh.exeNetSh.exeNetSh.exeNetSh.exeNetSh.exeNetSh.exeNetSh.exeNetSh.exeNetSh.exeNetSh.exeNetSh.exeNetSh.exeNetSh.exeNetSh.exeNetSh.exeNetSh.exeNetSh.exeNetSh.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

mousocoreworker.exesvchost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	mousocoreworker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	mousocoreworker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	mousocoreworker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	mousocoreworker.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	mousocoreworker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	mousocoreworker.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

mousocoreworker.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS mousocoreworker.exe
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU mousocoreworker.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	mousocoreworker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	mousocoreworker.exe

Modifies data under HKEY_USERS 56 IoCs

Processes:

WaaSMedicAgent.exemousocoreworker.exesvchost.exesvchost.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	mousocoreworker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	mousocoreworker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\SignalManager\Peek\CacheStore	mousocoreworker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{0CB4A94A-6E8C-477B-88C8-A3799FC97414}\DeviceTicket = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000f0af421aea2a774ba31c2a237022df5b000000000200000000001066000000010000200000009b5aaaf4c2699e04b6104c3323c13e28a1d625be0326e75eca49789c3b638e90000000000e8000000002000020000000d2f6e7dcedf42008588ed71503ba8802b217e10b6a23fa997525a39c6e3e45b1b0030000b34bf029e9251e039e5ccb194cc41a942adfcf2471cdcb7b68f43257af60c39da7373189565816927df33b925a6d3b7e79f95b3838cfccdacd68e7cf96612d87d73323191a46c583670e56528ff365aa1ef328cbff0b98dbd57bd14c77d33cb9a0535418deb6b4b39355563cbf9f5ab5ff1a0410188dc9cbb31d5b18318cd880ff7b5ae4d192471f824b8653d31bc84950d99e8c09e94eac815f5ce7a10cbe311d2006abe665e4bf936544024bdb50ab382079e39bd7fefa5378c0c87c83472951de4c739fc0ee314b6f03decd240feadf557bd025e134495e692d0b873e74d6a3766f4c43b959689f7bb392877e96a2e78559574fbdffb586d8b18309c132d9ad7235572f8294867796f5ea977dada078d2ac1ea589e13f236c4be4168347495760f412e4e1bdaf77f6475323b63a9407fb5bc19eec977304c06f551395d579eb828f4e506941851a0f5fd1b97acdbf512d044c4d673bf868caff6f469b29b6a40758c5b779d3df49db31dd1f207906f7e13449407e45e617f47dcd327184f447ece351028d07baf7a8ca65d3b607bc1014d99ed65fe9f1d6036a283144492520f9ee825d166b2c3bf6b8b3b40b80a9ed9e52f4c1e952c6c0dc4d5f4fd65600fa60b4dd26d8d2d50570c0a0b5ea8fde3497c8e217d89c8788f428d347ececec5adb20125981b169dfcf9d5306d7a0dc22e665edebc8c54aecb28ef1394c1a2ced343b5222d66509338761617a42dfbebe7b0040d2fbf1972235290be744f15a154b76db742e4a3cbe5b13680ec180aef4fae10cd388f8607d32f0a874fd0c51c25de7c150ee2d154099083a2d5396959d0e2092f736bd6df6c00ae16bd48914c0254dc463ebb591f1715eddd03081917bd9c12d1ed14d70d49df72a7111f18c31c790e24607fb06ec9c3e2a482f64bfcfdfddc4fb4a852c633e08150e0ed45e7521216d4cefc63e62078491eed1bbda6dc2105dc1acb263346e9dd924f00114ce1c5ff9b4844811954feaeaec4ba0eef2d4831a23cfc257268a562fef65c2bbc0ba7eadcc513538cb07e2ecf2a45b80f1e9fdfb901881f1a06c94bad0757d24e0659fb9c3d2742da9e591bc2249a78993eaa4b7950e072807ce101384da54168010171fa860992b1545948c3da16664bda952d0ed4439b4338818555e4d312505a31d205886c055a9b93bb6e6969a0cbe1238395abc169c658944dab44db827cc1affb4488ec6b125caf12755cc7f1fa6fef2d54e5f817476eff07f4a43671442653df3a666bab1940916897026d99e253de4a37fc745ee92e015b995213759c048beb8fce062e50639f7aadc98607a4000000081e3f598d35ce48e5f0482f9950642b4d81099e838ff88a2d108d4a261a88580a4fd67179d8b3aa6d399c911f574953cc811bd035564259a31b998b637ad06ae	mousocoreworker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	mousocoreworker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	WaaSMedicAgent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{0CB4A94A-6E8C-477B-88C8-A3799FC97414}\DeviceId = "001800108A6A1C65"	mousocoreworker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Property\001800108A6A1C65 = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000f0af421aea2a774ba31c2a237022df5b000000000200000000001066000000010000200000005747f94e370b44160bff11d9a25e18818b2cc073921ec43ab428f0780c20042b000000000e8000000002000020000000de4b037168e8ee5fceea0823340038bbead15cda163f4c39c965008f56505779800000009077e18388bc6f7a04ff1d0db0a245d62a513f8369c65e344a3d0a2ae2fcf258989c7cb40013af5d27332b5632e3954c7bfdc689c0a8339e865f340a572a575989c7d5d986379b9b2f5b10b68621bb08dfd968d5e8ab83173041b2b2f6e6b400eb383d9e089460968298295327f55d50ab6baff4a6749c22ee73778626c0b9e740000000694f2b88ffc2cc417c01c92680e722444b672e4e3abae8c94bef01b0dc43d85c1d12bdf055c691f06fbaee7e8e3f8333d060c6da5ca51e5e308252dc7a6d69d5	mousocoreworker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	mousocoreworker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\ExtendedProperties\LID = "001800108A6A1C65"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\SignalManager\Peek	mousocoreworker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{0CB4A94A-6E8C-477B-88C8-A3799FC97414}	mousocoreworker.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{0CB4A94A-6E8C-477B-88C8-A3799FC97414}\ApplicationFlags = "1"	mousocoreworker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\SignalManager	mousocoreworker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Property	mousocoreworker.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Discord rat.exedllhost.exepowershell.exedllhost.exedllhost.exedllhost.exedllhost.exedllhost.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedllhost.exedllhost.exe

pid	process
3544	Discord rat.exe
3216	dllhost.exe
3216	dllhost.exe
1344	powershell.exe
3544	Discord rat.exe
1972	dllhost.exe
1972	dllhost.exe
3544	Discord rat.exe
912	dllhost.exe
912	dllhost.exe
3544	Discord rat.exe
3544	Discord rat.exe
452	dllhost.exe
452	dllhost.exe
1344	powershell.exe
1344	powershell.exe
912	dllhost.exe
912	dllhost.exe
3544	Discord rat.exe
3544	Discord rat.exe
4340	dllhost.exe
4340	dllhost.exe
3544	Discord rat.exe
4580	dllhost.exe
4580	dllhost.exe
4396	powershell.exe
4396	powershell.exe
948	powershell.exe
948	powershell.exe
912	dllhost.exe
912	dllhost.exe
1344	powershell.exe
912	dllhost.exe
912	dllhost.exe
912	dllhost.exe
912	dllhost.exe
1340	powershell.exe
1340	powershell.exe
948	powershell.exe
4484	powershell.exe
4484	powershell.exe
912	dllhost.exe
912	dllhost.exe
4396	powershell.exe
2252	powershell.exe
2252	powershell.exe
912	dllhost.exe
912	dllhost.exe
4396	powershell.exe
912	dllhost.exe
912	dllhost.exe
4340	dllhost.exe
4340	dllhost.exe
3544	Discord rat.exe
3544	Discord rat.exe
1068	dllhost.exe
1068	dllhost.exe
4340	dllhost.exe
4340	dllhost.exe
3544	Discord rat.exe
1340	powershell.exe
948	powershell.exe
4624	dllhost.exe
4624	dllhost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Discord rat.exedllhost.exepowershell.exedllhost.exedllhost.exedllhost.exepowershell.exedllhost.exedllhost.exepowershell.exepowershell.exepowershell.exepowershell.exedllhost.exedllhost.exepowershell.exepowershell.exedllhost.exepowershell.exedllhost.exedllhost.exepowershell.exepowershell.exesvchost.exesvchost.exe

description	pid	process
Token: SeDebugPrivilege	3544	Discord rat.exe
Token: SeDebugPrivilege	3544	Discord rat.exe
Token: SeDebugPrivilege	3544	Discord rat.exe
Token: SeDebugPrivilege	3216	dllhost.exe
Token: SeDebugPrivilege	1344	powershell.exe
Token: SeDebugPrivilege	3544	Discord rat.exe
Token: SeDebugPrivilege	3544	Discord rat.exe
Token: SeDebugPrivilege	1972	dllhost.exe
Token: SeDebugPrivilege	3544	Discord rat.exe
Token: SeDebugPrivilege	3544	Discord rat.exe
Token: SeDebugPrivilege	912	dllhost.exe
Token: SeDebugPrivilege	3544	Discord rat.exe
Token: SeDebugPrivilege	3544	Discord rat.exe
Token: SeDebugPrivilege	452	dllhost.exe
Token: SeDebugPrivilege	3544	Discord rat.exe
Token: SeDebugPrivilege	948	powershell.exe
Token: SeDebugPrivilege	3544	Discord rat.exe
Token: SeDebugPrivilege	4340	dllhost.exe
Token: SeDebugPrivilege	3544	Discord rat.exe
Token: SeDebugPrivilege	3544	Discord rat.exe
Token: SeDebugPrivilege	4580	dllhost.exe
Token: SeDebugPrivilege	4396	powershell.exe
Token: SeDebugPrivilege	1340	powershell.exe
Token: SeDebugPrivilege	4484	powershell.exe
Token: SeDebugPrivilege	2252	powershell.exe
Token: SeDebugPrivilege	3544	Discord rat.exe
Token: SeDebugPrivilege	3544	Discord rat.exe
Token: SeDebugPrivilege	1068	dllhost.exe
Token: SeDebugPrivilege	3544	Discord rat.exe
Token: SeDebugPrivilege	3544	Discord rat.exe
Token: SeDebugPrivilege	4624	dllhost.exe
Token: SeDebugPrivilege	4044	powershell.exe
Token: SeDebugPrivilege	5104	powershell.exe
Token: SeDebugPrivilege	3544	Discord rat.exe
Token: SeDebugPrivilege	3544	Discord rat.exe
Token: SeDebugPrivilege	5660	dllhost.exe
Token: SeDebugPrivilege	5716	powershell.exe
Token: SeDebugPrivilege	3544	Discord rat.exe
Token: SeDebugPrivilege	3544	Discord rat.exe
Token: SeDebugPrivilege	5992	dllhost.exe
Token: SeDebugPrivilege	3544	Discord rat.exe
Token: SeDebugPrivilege	3544	Discord rat.exe
Token: SeDebugPrivilege	2908	dllhost.exe
Token: SeDebugPrivilege	3272	powershell.exe
Token: SeDebugPrivilege	6140	powershell.exe
Token: SeShutdownPrivilege	5988	svchost.exe
Token: SeCreatePagefilePrivilege	5988	svchost.exe
Token: SeShutdownPrivilege	5988	svchost.exe
Token: SeCreatePagefilePrivilege	5988	svchost.exe
Token: SeShutdownPrivilege	5988	svchost.exe
Token: SeCreatePagefilePrivilege	5988	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2176	svchost.exe
Token: SeIncreaseQuotaPrivilege	2176	svchost.exe
Token: SeSecurityPrivilege	2176	svchost.exe
Token: SeTakeOwnershipPrivilege	2176	svchost.exe
Token: SeLoadDriverPrivilege	2176	svchost.exe
Token: SeBackupPrivilege	2176	svchost.exe
Token: SeRestorePrivilege	2176	svchost.exe
Token: SeShutdownPrivilege	2176	svchost.exe
Token: SeSystemEnvironmentPrivilege	2176	svchost.exe
Token: SeManageVolumePrivilege	2176	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2176	svchost.exe
Token: SeIncreaseQuotaPrivilege	2176	svchost.exe
Token: SeSecurityPrivilege	2176	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Discord rat.exe

description	pid	process	target process
PID 3544 wrote to memory of 3216	3544	Discord rat.exe	dllhost.exe
PID 3544 wrote to memory of 3216	3544	Discord rat.exe	dllhost.exe
PID 3544 wrote to memory of 3216	3544	Discord rat.exe	dllhost.exe
PID 3544 wrote to memory of 3216	3544	Discord rat.exe	dllhost.exe
PID 3544 wrote to memory of 3216	3544	Discord rat.exe	dllhost.exe
PID 3544 wrote to memory of 3216	3544	Discord rat.exe	dllhost.exe
PID 3544 wrote to memory of 3216	3544	Discord rat.exe	dllhost.exe
PID 3544 wrote to memory of 3216	3544	Discord rat.exe	dllhost.exe
PID 3544 wrote to memory of 3216	3544	Discord rat.exe	dllhost.exe
PID 3544 wrote to memory of 3216	3544	Discord rat.exe	dllhost.exe
PID 3544 wrote to memory of 3216	3544	Discord rat.exe	dllhost.exe
PID 3544 wrote to memory of 1344	3544	Discord rat.exe	powershell.exe
PID 3544 wrote to memory of 1344	3544	Discord rat.exe	powershell.exe
PID 3544 wrote to memory of 3148	3544	Discord rat.exe	cmd.exe
PID 3544 wrote to memory of 3148	3544	Discord rat.exe	cmd.exe
PID 3544 wrote to memory of 1068	3544	Discord rat.exe	dllhost.exe
PID 3544 wrote to memory of 1068	3544	Discord rat.exe	dllhost.exe
PID 3544 wrote to memory of 1972	3544	Discord rat.exe	dllhost.exe
PID 3544 wrote to memory of 1972	3544	Discord rat.exe	dllhost.exe
PID 3544 wrote to memory of 1972	3544	Discord rat.exe	dllhost.exe
PID 3544 wrote to memory of 1972	3544	Discord rat.exe	dllhost.exe
PID 3544 wrote to memory of 1972	3544	Discord rat.exe	dllhost.exe
PID 3544 wrote to memory of 1972	3544	Discord rat.exe	dllhost.exe
PID 3544 wrote to memory of 1972	3544	Discord rat.exe	dllhost.exe
PID 3544 wrote to memory of 1972	3544	Discord rat.exe	dllhost.exe
PID 3544 wrote to memory of 1972	3544	Discord rat.exe	dllhost.exe
PID 3544 wrote to memory of 1972	3544	Discord rat.exe	dllhost.exe
PID 3544 wrote to memory of 1972	3544	Discord rat.exe	dllhost.exe
PID 3544 wrote to memory of 4396	3544	Discord rat.exe	powershell.exe
PID 3544 wrote to memory of 4396	3544	Discord rat.exe	powershell.exe
PID 3544 wrote to memory of 684	3544	Discord rat.exe	cmd.exe
PID 3544 wrote to memory of 684	3544	Discord rat.exe	cmd.exe
PID 3544 wrote to memory of 3008	3544	Discord rat.exe	NetSh.exe
PID 3544 wrote to memory of 3008	3544	Discord rat.exe	NetSh.exe
PID 3544 wrote to memory of 912	3544	Discord rat.exe	dllhost.exe
PID 3544 wrote to memory of 912	3544	Discord rat.exe	dllhost.exe
PID 3544 wrote to memory of 912	3544	Discord rat.exe	dllhost.exe
PID 3544 wrote to memory of 912	3544	Discord rat.exe	dllhost.exe
PID 3544 wrote to memory of 912	3544	Discord rat.exe	dllhost.exe
PID 3544 wrote to memory of 912	3544	Discord rat.exe	dllhost.exe
PID 3544 wrote to memory of 912	3544	Discord rat.exe	dllhost.exe
PID 3544 wrote to memory of 912	3544	Discord rat.exe	dllhost.exe
PID 3544 wrote to memory of 912	3544	Discord rat.exe	dllhost.exe
PID 3544 wrote to memory of 912	3544	Discord rat.exe	dllhost.exe
PID 3544 wrote to memory of 912	3544	Discord rat.exe	dllhost.exe
PID 3544 wrote to memory of 948	3544	Discord rat.exe	powershell.exe
PID 3544 wrote to memory of 948	3544	Discord rat.exe	powershell.exe
PID 3544 wrote to memory of 4484	3544	Discord rat.exe	cmd.exe
PID 3544 wrote to memory of 4484	3544	Discord rat.exe	cmd.exe
PID 3544 wrote to memory of 3564	3544	Discord rat.exe	NetSh.exe
PID 3544 wrote to memory of 3564	3544	Discord rat.exe	NetSh.exe
PID 3544 wrote to memory of 452	3544	Discord rat.exe	dllhost.exe
PID 3544 wrote to memory of 452	3544	Discord rat.exe	dllhost.exe
PID 3544 wrote to memory of 452	3544	Discord rat.exe	dllhost.exe
PID 3544 wrote to memory of 452	3544	Discord rat.exe	dllhost.exe
PID 3544 wrote to memory of 452	3544	Discord rat.exe	dllhost.exe
PID 3544 wrote to memory of 452	3544	Discord rat.exe	dllhost.exe
PID 3544 wrote to memory of 452	3544	Discord rat.exe	dllhost.exe
PID 3544 wrote to memory of 452	3544	Discord rat.exe	dllhost.exe
PID 3544 wrote to memory of 452	3544	Discord rat.exe	dllhost.exe
PID 3544 wrote to memory of 452	3544	Discord rat.exe	dllhost.exe
PID 3544 wrote to memory of 452	3544	Discord rat.exe	dllhost.exe
PID 3544 wrote to memory of 1340	3544	Discord rat.exe	powershell.exe
PID 3544 wrote to memory of 1340	3544	Discord rat.exe	powershell.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:616

C:\Windows\system32\dwm.exe
"dwm.exe"
2⤵
PID:388

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{b2c3120d-370e-4396-8ab9-a7b08f7bd9e4}
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3216

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{5ba1372c-159a-4bd7-a9d7-5248920bd668}
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1972

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{de403d6f-b592-4f14-ac25-232a36263ab7}
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:912

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{100d1262-3ff9-419b-b79b-72271e5f59f6}
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:452

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{21639f9a-1988-4ea9-8520-f3db160af89b}
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4340

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{1a8155ee-2b6c-4bd0-85ad-bf9343c008b2}
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4580

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{60dae277-616e-4890-8e11-c896bc2192a9}
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1068

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{5028fa0b-30b8-4bc1-9564-8b097da5d719}
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4624

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{e2de2402-7a3d-4dbb-84d8-f319eea6916e}
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:5660

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{0a273f42-0341-40ea-8180-9e925074858e}
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:5992

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{d86f331f-9e92-4d94-862e-8b9175a27552}
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2908

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{425f0b8e-ae8e-4e6a-827b-1f6a7455879c}
2⤵
PID:6020

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{e9e2c5a1-698a-47b1-a4a9-ff14c7c2c7a5}
2⤵
PID:3968

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{306217ca-0361-45c4-a808-751015d232b3}
2⤵
PID:5320

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{bb3af821-f9d4-44e0-933a-2b8704604f73}
2⤵
PID:6004

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{99ddc761-991e-489b-9be3-69ca56efa190}
2⤵
PID:5348

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{ce54d3cc-91f4-4d78-a3b9-9119cc1434d8}
2⤵
PID:5824

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{0f236a3d-0648-442d-b0c7-2fcae5330de5}
2⤵
PID:5352

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{16c4f18d-8721-43a4-8e0d-4bb19707ea9f}
2⤵
PID:948

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{0fbf851a-aaa5-48b4-9760-740b8ea17444}
2⤵
PID:5560

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{003d6dab-1914-4e0a-9e56-1361eccd6fc3}
2⤵
PID:2824

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{be793e53-cdd8-48ca-8f27-922cce12edfb}
2⤵
PID:5684

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{8873cab5-c391-4d09-bd7d-f8e2e0663eb9}
2⤵
PID:5784

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{ce61453e-5320-44e2-8ec6-d030a6a2f825}
2⤵
PID:4652

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{de7c2445-9fa8-4826-868e-97b7761e3782}
2⤵
PID:2332

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{b9b57b2a-27f5-4bb5-94ec-facb468c9d9b}
2⤵
PID:6032

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{5d67c547-4ac3-46ac-a81e-edd15cf3b62c}
2⤵
PID:6096

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{65bf38cc-106f-4601-9d68-17d2e7fcc40e}
2⤵
PID:3784

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{33c4a920-90e5-4f08-acb5-b721d336af6e}
2⤵
PID:7104

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{8cd14e17-86e4-422b-a874-bce5e6e4ce54}
2⤵
PID:6972

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{517acc8d-0279-490f-a8e3-1b3597e8eb8c}
2⤵
PID:5592

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{1bffadeb-349a-4b00-ba9c-25e9e9d97a93}
2⤵
PID:5520

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{c89f6ee6-cbf3-483c-9466-146901ec1a1f}
2⤵
PID:2244

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{551af477-9c8c-4f27-bc4e-945a9e8d44c6}
2⤵
PID:4968

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{b9079463-3569-4098-91fd-b937814c9f3e}
2⤵
PID:6472

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{025ab8ab-1716-4275-b5e2-6621482729c5}
2⤵
PID:6548

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{191d60e3-5075-473d-80e8-ebd874a2a2da}
2⤵
PID:5852

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{376d56ce-eef4-4cca-bc49-a175f2172d9c}
2⤵
PID:6968

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{9ab6043a-3a9e-47f0-910a-f02b41989878}
2⤵
PID:6628

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{f0dbb18e-02de-4f96-947a-726c0efa56c2}
2⤵
PID:4372

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{4ccada4b-f945-4a72-b703-69d8c0f6b961}
2⤵
PID:1592

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{748c45f4-0fc0-4eef-a839-9a5bcbb2a7d1}
2⤵
PID:4000

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{e500bfa3-d7aa-41d2-997d-84712dcefbe5}
2⤵
PID:5740

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{13e0d711-dee1-41f3-a481-7fb16d59feaf}
2⤵
PID:7220

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{05fc15f3-af94-4321-af3e-9e0c7280e249}
2⤵
PID:7856

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{62ccefee-af32-4926-914a-efa9342415ce}
2⤵
PID:3932

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{832a4ed2-7421-4622-8829-dd829c67e6a1}
2⤵
PID:6940

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{6eb7fdeb-e973-4f06-905d-c90252dfb7fe}
2⤵
PID:4120

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{a1cad974-92ea-46a1-af05-9c704e8b6ee1}
2⤵
PID:3332

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{987d8856-447b-473a-b0ea-3bfbbe3b9370}
2⤵
PID:6192

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{987d8856-447b-473a-b0ea-3bfbbe3b9370}
2⤵
PID:7472

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{825491e4-62ad-4b78-8358-0d406d95f794}
2⤵
PID:7668

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{825491e4-62ad-4b78-8358-0d406d95f794}
2⤵
PID:8036

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{e8396ce1-e7e5-4dcd-9345-f4eb90028ab1}
2⤵
PID:6140

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{9439b844-6614-4515-aa02-e2a8e95c82ba}
2⤵
PID:4132

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{ab2f049d-3633-40fb-ba8a-6c86c3340035}
2⤵
PID:624

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{c0914fae-db72-409f-ac99-e874808fb7e3}
2⤵
PID:4492

C:\Windows\system32\dwm.exe
"dwm.exe"
2⤵
PID:6712

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{b3f9d89f-2c22-455a-b047-c8b8429d308d}
2⤵
PID:3312

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{5806bdc8-7842-4bb1-aaa8-41ddcd43681a}
2⤵
PID:864

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{0903911b-e99c-4424-9f98-6fa76d708602}
2⤵
PID:6240

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{07d5fb90-d5c5-4a93-959a-415e80c54963}
2⤵
PID:1112

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{aa6e7901-b7ad-442a-a994-26438a55a428}
2⤵
PID:5872

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{aa6e7901-b7ad-442a-a994-26438a55a428}
2⤵
PID:3224

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{1fe36f0e-e294-4e1e-ab41-c22900a34bfe}
2⤵
PID:5764

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{1fe36f0e-e294-4e1e-ab41-c22900a34bfe}
2⤵
PID:6788

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:396

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1044

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1084

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1116

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1152

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
2⤵
PID:2760

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Drops file in System32 directory
PID:1232

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1316

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1416

C:\Windows\system32\sihost.exe
sihost.exe
2⤵
PID:2528

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1492

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1532

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1652

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1688

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1724

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1780

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1808

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1924

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1948

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1964

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2036

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2052

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2176

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2196

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2224

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2452

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2704

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:2768

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
- Enumerates connected drives
PID:2788

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2812

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2848

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2868

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:3160

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3412

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3524

C:\Users\Admin\AppData\Local\Temp\Discord rat.exe
"C:\Users\Admin\AppData\Local\Temp\Discord rat.exe"
2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3544

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command Add-MpPreference -ExclusionPath "C:\"
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1344

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:3696

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Microsoft Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
3⤵
PID:3148

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:4488

C:\Windows\SYSTEM32\NetSh.exe
"NetSh.exe" Advfirewall set allprofiles state off
3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:1068

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:3604

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command Add-MpPreference -ExclusionPath "C:\"
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4396

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:1992

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Microsoft Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
3⤵
PID:684

C:\Windows\SYSTEM32\NetSh.exe
"NetSh.exe" Advfirewall set allprofiles state off
3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:3008

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:1708

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command Add-MpPreference -ExclusionPath "C:\"
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:948

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:4004

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Microsoft Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
3⤵
PID:4484

C:\Windows\SYSTEM32\NetSh.exe
"NetSh.exe" Advfirewall set allprofiles state off
3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:3564

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:2008

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command Add-MpPreference -ExclusionPath "C:\"
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1340

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:3484

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Microsoft Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
3⤵
PID:3208

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:2380

C:\Windows\SYSTEM32\NetSh.exe
"NetSh.exe" Advfirewall set allprofiles state off
3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:1604

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:1112

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command Add-MpPreference -ExclusionPath "C:\"
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4484

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:5072

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Microsoft Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
3⤵
PID:684

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:2796

C:\Windows\SYSTEM32\NetSh.exe
"NetSh.exe" Advfirewall set allprofiles state off
3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:1908

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:4028

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command Add-MpPreference -ExclusionPath "C:\"
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2252

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:872

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Microsoft Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
3⤵
PID:1920

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:2716

C:\Windows\SYSTEM32\NetSh.exe
"NetSh.exe" Advfirewall set allprofiles state off
3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:4728

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:3516

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command Add-MpPreference -ExclusionPath "C:\"
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:4044

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:3612

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Microsoft Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
3⤵
PID:5656

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:5160

C:\Windows\SYSTEM32\NetSh.exe
"NetSh.exe" Advfirewall set allprofiles state off
3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:5024

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:3712

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command Add-MpPreference -ExclusionPath "C:\"
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:5104

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:224

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Microsoft Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
3⤵
PID:2556

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:5260

C:\Windows\SYSTEM32\NetSh.exe
"NetSh.exe" Advfirewall set allprofiles state off
3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:4460

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:3908

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command Add-MpPreference -ExclusionPath "C:\"
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:5716

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:1632

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Microsoft Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
3⤵
PID:3852

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:5532

C:\Windows\SYSTEM32\NetSh.exe
"NetSh.exe" Advfirewall set allprofiles state off
3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:1376

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:5528

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command Add-MpPreference -ExclusionPath "C:\"
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:3272

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:4180

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Microsoft Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
3⤵
PID:5676

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:5876

C:\Windows\SYSTEM32\NetSh.exe
"NetSh.exe" Advfirewall set allprofiles state off
3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:1664

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:5344

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command Add-MpPreference -ExclusionPath "C:\"
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:6140

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Microsoft Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
3⤵
PID:5996

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:5240

C:\Windows\SYSTEM32\NetSh.exe
"NetSh.exe" Advfirewall set allprofiles state off
3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:5264

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:2068

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command Add-MpPreference -ExclusionPath "C:\"
3⤵
- Command and Scripting Interpreter: PowerShell
PID:5708

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:5456

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Microsoft Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
3⤵
PID:1920

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:5224

C:\Windows\SYSTEM32\NetSh.exe
"NetSh.exe" Advfirewall set allprofiles state off
3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2432

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:1664

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command Add-MpPreference -ExclusionPath "C:\"
3⤵
- Command and Scripting Interpreter: PowerShell
PID:3008

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Microsoft Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
3⤵
PID:5264

C:\Windows\SYSTEM32\NetSh.exe
"NetSh.exe" Advfirewall set allprofiles state off
3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:6016

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command Add-MpPreference -ExclusionPath "C:\"
3⤵
- Command and Scripting Interpreter: PowerShell
PID:3456

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:5104

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Microsoft Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
3⤵
PID:5156

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:5916

C:\Windows\SYSTEM32\NetSh.exe
"NetSh.exe" Advfirewall set allprofiles state off
3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:640

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:1008

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command Add-MpPreference -ExclusionPath "C:\"
3⤵
- Command and Scripting Interpreter: PowerShell
PID:1064

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:5800

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Microsoft Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
3⤵
PID:5616

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:2404

C:\Windows\SYSTEM32\NetSh.exe
"NetSh.exe" Advfirewall set allprofiles state off
3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:3888

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:4996

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command Add-MpPreference -ExclusionPath "C:\"
3⤵
- Command and Scripting Interpreter: PowerShell
PID:4964

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:5384

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Microsoft Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
3⤵
PID:5748

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:5156

C:\Windows\SYSTEM32\NetSh.exe
"NetSh.exe" Advfirewall set allprofiles state off
3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:1376

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command Add-MpPreference -ExclusionPath "C:\"
3⤵
- Command and Scripting Interpreter: PowerShell
PID:3484

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:5512

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Microsoft Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
3⤵
PID:5844

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:1372

C:\Windows\SYSTEM32\NetSh.exe
"NetSh.exe" Advfirewall set allprofiles state off
3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:6096

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:5496

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command Add-MpPreference -ExclusionPath "C:\"
3⤵
- Command and Scripting Interpreter: PowerShell
PID:5308

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:2380

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Microsoft Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
3⤵
PID:5972

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:3924

C:\Windows\SYSTEM32\NetSh.exe
"NetSh.exe" Advfirewall set allprofiles state off
3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:5372

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:1148

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command Add-MpPreference -ExclusionPath "C:\"
3⤵
- Command and Scripting Interpreter: PowerShell
PID:5708

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Microsoft Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
3⤵
PID:3252

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:6040

C:\Windows\SYSTEM32\NetSh.exe
"NetSh.exe" Advfirewall set allprofiles state off
3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2884

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:3592

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command Add-MpPreference -ExclusionPath "C:\"
3⤵
- Command and Scripting Interpreter: PowerShell
PID:4732

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:5892

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Microsoft Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
3⤵
PID:5948

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:6100

C:\Windows\SYSTEM32\NetSh.exe
"NetSh.exe" Advfirewall set allprofiles state off
3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:3692

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:5444

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command Add-MpPreference -ExclusionPath "C:\"
3⤵
- Command and Scripting Interpreter: PowerShell
PID:5568

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:996

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Microsoft Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
3⤵
PID:5552

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:5212

C:\Windows\SYSTEM32\NetSh.exe
"NetSh.exe" Advfirewall set allprofiles state off
3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:3296

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:5612

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command Add-MpPreference -ExclusionPath "C:\"
3⤵
- Command and Scripting Interpreter: PowerShell
PID:5292

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Microsoft Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
3⤵
PID:4840

C:\Windows\SYSTEM32\NetSh.exe
"NetSh.exe" Advfirewall set allprofiles state off
3⤵
- Modifies Windows Firewall
PID:4796

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command Add-MpPreference -ExclusionPath "C:\"
3⤵
- Command and Scripting Interpreter: PowerShell
PID:5144

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Microsoft Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
3⤵
PID:4880

C:\Windows\SYSTEM32\NetSh.exe
"NetSh.exe" Advfirewall set allprofiles state off
3⤵
- Modifies Windows Firewall
PID:3200

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command Add-MpPreference -ExclusionPath "C:\"
3⤵
- Command and Scripting Interpreter: PowerShell
PID:6136

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Microsoft Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
3⤵
PID:4620

C:\Windows\SYSTEM32\NetSh.exe
"NetSh.exe" Advfirewall set allprofiles state off
3⤵
- Modifies Windows Firewall
PID:3240

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command Add-MpPreference -ExclusionPath "C:\"
3⤵
- Command and Scripting Interpreter: PowerShell
PID:5292

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Microsoft Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
3⤵
PID:5584

C:\Windows\SYSTEM32\NetSh.exe
"NetSh.exe" Advfirewall set allprofiles state off
3⤵
- Modifies Windows Firewall
PID:3964

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command Add-MpPreference -ExclusionPath "C:\"
3⤵
- Command and Scripting Interpreter: PowerShell
PID:4324

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Microsoft Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
3⤵
PID:2780

C:\Windows\SYSTEM32\NetSh.exe
"NetSh.exe" Advfirewall set allprofiles state off
3⤵
- Modifies Windows Firewall
PID:5764

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command Add-MpPreference -ExclusionPath "C:\"
3⤵
- Command and Scripting Interpreter: PowerShell
PID:5856

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Microsoft Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
3⤵
PID:4344

C:\Windows\SYSTEM32\NetSh.exe
"NetSh.exe" Advfirewall set allprofiles state off
3⤵
- Modifies Windows Firewall
PID:6116

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command Add-MpPreference -ExclusionPath "C:\"
3⤵
- Command and Scripting Interpreter: PowerShell
PID:4324

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Microsoft Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
3⤵
PID:4932

C:\Windows\SYSTEM32\NetSh.exe
"NetSh.exe" Advfirewall set allprofiles state off
3⤵
- Modifies Windows Firewall
PID:3272

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command Add-MpPreference -ExclusionPath "C:\"
3⤵
- Command and Scripting Interpreter: PowerShell
PID:7116

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Microsoft Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
3⤵
PID:7128

C:\Windows\SYSTEM32\NetSh.exe
"NetSh.exe" Advfirewall set allprofiles state off
3⤵
- Modifies Windows Firewall
PID:7140

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command Add-MpPreference -ExclusionPath "C:\"
3⤵
- Command and Scripting Interpreter: PowerShell
PID:6996

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Microsoft Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
3⤵
PID:7004

C:\Windows\SYSTEM32\NetSh.exe
"NetSh.exe" Advfirewall set allprofiles state off
3⤵
- Modifies Windows Firewall
PID:7012

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command Add-MpPreference -ExclusionPath "C:\"
3⤵
- Command and Scripting Interpreter: PowerShell
PID:6400

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Microsoft Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
3⤵
PID:6516

C:\Windows\SYSTEM32\NetSh.exe
"NetSh.exe" Advfirewall set allprofiles state off
3⤵
- Modifies Windows Firewall
PID:6576

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command Add-MpPreference -ExclusionPath "C:\"
3⤵
- Command and Scripting Interpreter: PowerShell
PID:6548

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Microsoft Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
3⤵
PID:6228

C:\Windows\SYSTEM32\NetSh.exe
"NetSh.exe" Advfirewall set allprofiles state off
3⤵
- Modifies Windows Firewall
PID:5632

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command Add-MpPreference -ExclusionPath "C:\"
3⤵
- Command and Scripting Interpreter: PowerShell
PID:7012

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Microsoft Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
3⤵
PID:6092

C:\Windows\SYSTEM32\NetSh.exe
"NetSh.exe" Advfirewall set allprofiles state off
3⤵
- Modifies Windows Firewall
PID:6660

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command Add-MpPreference -ExclusionPath "C:\"
3⤵
- Command and Scripting Interpreter: PowerShell
PID:1552

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Microsoft Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
3⤵
PID:4592

C:\Windows\SYSTEM32\NetSh.exe
"NetSh.exe" Advfirewall set allprofiles state off
3⤵
- Modifies Windows Firewall
PID:5076

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command Add-MpPreference -ExclusionPath "C:\"
3⤵
- Command and Scripting Interpreter: PowerShell
PID:4832

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Microsoft Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
3⤵
PID:5708

C:\Windows\SYSTEM32\NetSh.exe
"NetSh.exe" Advfirewall set allprofiles state off
3⤵
- Modifies Windows Firewall
PID:5804

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command Add-MpPreference -ExclusionPath "C:\"
3⤵
- Command and Scripting Interpreter: PowerShell
PID:6652

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Microsoft Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
3⤵
PID:6720

C:\Windows\SYSTEM32\NetSh.exe
"NetSh.exe" Advfirewall set allprofiles state off
3⤵
- Modifies Windows Firewall
PID:6748

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command Add-MpPreference -ExclusionPath "C:\"
3⤵
- Command and Scripting Interpreter: PowerShell
PID:1960

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Microsoft Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
3⤵
PID:3936

C:\Windows\SYSTEM32\NetSh.exe
"NetSh.exe" Advfirewall set allprofiles state off
3⤵
- Modifies Windows Firewall
PID:5932

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command Add-MpPreference -ExclusionPath "C:\"
3⤵
- Command and Scripting Interpreter: PowerShell
PID:3452

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Microsoft Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
3⤵
PID:5204

C:\Windows\SYSTEM32\NetSh.exe
"NetSh.exe" Advfirewall set allprofiles state off
3⤵
- Modifies Windows Firewall
PID:4608

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command Add-MpPreference -ExclusionPath "C:\"
3⤵
- Command and Scripting Interpreter: PowerShell
PID:7056

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Microsoft Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
3⤵
PID:6296

C:\Windows\SYSTEM32\NetSh.exe
"NetSh.exe" Advfirewall set allprofiles state off
3⤵
- Modifies Windows Firewall
PID:2360

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command Add-MpPreference -ExclusionPath "C:\"
3⤵
- Command and Scripting Interpreter: PowerShell
PID:864

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Microsoft Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
3⤵
PID:6028

C:\Windows\SYSTEM32\NetSh.exe
"NetSh.exe" Advfirewall set allprofiles state off
3⤵
- Modifies Windows Firewall
PID:7100

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command Add-MpPreference -ExclusionPath "C:\"
3⤵
- Command and Scripting Interpreter: PowerShell
PID:6768

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Microsoft Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
3⤵
PID:3988

C:\Windows\SYSTEM32\NetSh.exe
"NetSh.exe" Advfirewall set allprofiles state off
3⤵
- Modifies Windows Firewall
PID:6136

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command Add-MpPreference -ExclusionPath "C:\"
3⤵
- Command and Scripting Interpreter: PowerShell
PID:7088

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Microsoft Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
3⤵
PID:5732

C:\Windows\SYSTEM32\NetSh.exe
"NetSh.exe" Advfirewall set allprofiles state off
3⤵
- Modifies Windows Firewall
PID:3288

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command Add-MpPreference -ExclusionPath "C:\"
3⤵
- Command and Scripting Interpreter: PowerShell
PID:5512

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Microsoft Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
3⤵
PID:2672

C:\Windows\SYSTEM32\NetSh.exe
"NetSh.exe" Advfirewall set allprofiles state off
3⤵
- Modifies Windows Firewall
PID:5088

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command Add-MpPreference -ExclusionPath "C:\"
3⤵
- Command and Scripting Interpreter: PowerShell
PID:3516

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Microsoft Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
3⤵
PID:6264

C:\Windows\SYSTEM32\NetSh.exe
"NetSh.exe" Advfirewall set allprofiles state off
3⤵
- Modifies Windows Firewall
PID:7272

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command Add-MpPreference -ExclusionPath "C:\"
3⤵
- Command and Scripting Interpreter: PowerShell
PID:7824

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Microsoft Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
3⤵
PID:5280

C:\Windows\SYSTEM32\NetSh.exe
"NetSh.exe" Advfirewall set allprofiles state off
3⤵
- Modifies Windows Firewall
PID:6932

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command Add-MpPreference -ExclusionPath "C:\"
3⤵
- Command and Scripting Interpreter: PowerShell
PID:5360

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Microsoft Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
3⤵
PID:7576

C:\Windows\SYSTEM32\NetSh.exe
"NetSh.exe" Advfirewall set allprofiles state off
3⤵
- Modifies Windows Firewall
PID:7312

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command Add-MpPreference -ExclusionPath "C:\"
3⤵
- Command and Scripting Interpreter: PowerShell
PID:7156

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Microsoft Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
3⤵
PID:4936

C:\Windows\SYSTEM32\NetSh.exe
"NetSh.exe" Advfirewall set allprofiles state off
3⤵
- Modifies Windows Firewall
PID:7632

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command Add-MpPreference -ExclusionPath "C:\"
3⤵
- Command and Scripting Interpreter: PowerShell
PID:6356

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Microsoft Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
3⤵
PID:7352

C:\Windows\SYSTEM32\NetSh.exe
"NetSh.exe" Advfirewall set allprofiles state off
3⤵
- Modifies Windows Firewall
PID:6784

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command Add-MpPreference -ExclusionPath "C:\"
3⤵
- Command and Scripting Interpreter: PowerShell
PID:7556

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Microsoft Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
3⤵
PID:4796

C:\Windows\SYSTEM32\NetSh.exe
"NetSh.exe" Advfirewall set allprofiles state off
3⤵
- Modifies Windows Firewall
PID:7748

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command Add-MpPreference -ExclusionPath "C:\"
3⤵
- Command and Scripting Interpreter: PowerShell
PID:5880

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command Add-MpPreference -ExclusionPath "C:\"
3⤵
- Command and Scripting Interpreter: PowerShell
PID:4260

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command Add-MpPreference -ExclusionPath "C:\"
3⤵
- Command and Scripting Interpreter: PowerShell
PID:6956

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command Add-MpPreference -ExclusionPath "C:\"
3⤵
- Command and Scripting Interpreter: PowerShell
PID:7712

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command Add-MpPreference -ExclusionPath "C:\"
3⤵
- Command and Scripting Interpreter: PowerShell
PID:4708

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Microsoft Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
3⤵
PID:4692

C:\Windows\SYSTEM32\NetSh.exe
"NetSh.exe" Advfirewall set allprofiles state off
3⤵
- Modifies Windows Firewall
PID:4992

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3644

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3820

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3976

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3532

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:4516

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:4596

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
- Modifies data under HKEY_USERS
PID:4804

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4176

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:4888

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:4892

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:1796

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2212

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:2628

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:3936

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:1108

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4268

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe 261ec0526bfcb61325556476ed91ab50 sxjgawHGc0qPumap7YkhNg.0.1.0.0.0
1⤵
- Sets service image path in registry
- Modifies data under HKEY_USERS
PID:5400

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
2⤵
PID:5592

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5988

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
- Writes to the Master Boot Record (MBR)
PID:1644

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
- Drops file in Windows directory
PID:4532

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
- Checks processor information in registry
PID:5200

C:\Windows\System32\mousocoreworker.exe
C:\Windows\System32\mousocoreworker.exe -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
PID:4044

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:5612

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

Modify Registry

Pre-OS Boot

Bootkit

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
21adbd292f2db92800738ededdfa0652

SHA1
56b9919e0a66eac36706140c14669510a25e309f

SHA256
0f6ef6bf1a711ae224c6ea7c677d9f431aa69b05b39542e4c314fd23449d4f9f

SHA512
6bc4b88b26a20e1639cf98bbdc73bfbf2a50ff9f5d54af2203236f852448291425b534e3a297f32d478e06c092f40e8a999db629b5158399ebf5af8941e06287

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
74d28e5a1f9b23ef6d9e0b7b24a3b529

SHA1
947b26f2b0057b23e037149cddd5bde0363a4fc8

SHA256
3db8e45fd5730f2eaca6d4168a09c397c36e4f64a52f7627ba5de2a74a83ebe4

SHA512
fd0a2260efb0fc1b0b36e3ff5d0759db1c721de365b0a9e06408e85876a491f2d689c49f15d8e2db6197af4775551ed9caee1beb98e16da4ce5ae21468f719cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
e3b6cc0fbea08a0831f0026a696db8b8

SHA1
4e32202d4700061cfd80d55e42798131c9f530d4

SHA256
3284cae7b82be99d93064390ba071ba4321f3f24dd21515b37b2ca9f31b2e8d5

SHA512
6a06856f360b48c8bc8a15ffb8d7a6604ec357bcb1d0fad5d71a2cb876929a7b67eb40ba4493998ab1bbae8cb71212e124276f27d5c138a135041c27a41a0b7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
0860c26612d1c7724dc38a3b0f2ac286

SHA1
69ce2e5fc055299e57b8eeb43498d27b2ed88dcf

SHA256
33e17666b8fea146fc1bf39a95fef2ae6bddb3f2f775ed316932ca03879b94a0

SHA512
266259a5be34c98d03f300f06c5040e67b9e7aa2879b0989750b080675bb37effef6a9f63edabce2a0c44f261d399e57bab31d2640fd5ec964b411adb1f127a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
66ef556b9561758fde53c5245713759f

SHA1
9b0763aafdb60f160f4153639d41ef00db3459ba

SHA256
c0d2b10e56cf13c85c1059cdf7563ad207dd188133082d955aa7d085c88a1e05

SHA512
96fdedf3f5cc6d20c73161f100bcea34449c4601311fe9089e6bf6757e8a8dec51efa5b692fcf7143def2b23552d0146a3a882bc97a82938e1d3d6c253ce4446

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
9c740b7699e2363ac4ecdf496520ca35

SHA1
aa8691a8c56500d82c5fc8c35209bc6fe50ab1d9

SHA256
be96c91b62ba9ba7072ab89e66543328c9e4395150f9dbe8067332d94a3ecc61

SHA512
8885683f96353582eb871209e766e7eba1a72a2837ce27ea298b7b5b169621d1fa3fce25346b6bfd258b52642644234da9559d4e765a2023a5a5fc1f544cc7af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
34f595487e6bfd1d11c7de88ee50356a

SHA1
4caad088c15766cc0fa1f42009260e9a02f953bb

SHA256
0f9a4b52e01cb051052228a55d0515911b7ef5a8db3cf925528c746df511424d

SHA512
10976c5deaf9fac449e703e852c3b08d099f430de2d7c7b8e2525c35d63e28b890e5aab63feff9b20bca0aaf9f35a3ba411aee3fbeee9ea59f90ed25bd617a0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
8f54fcbf06be014541525a999ee5363f

SHA1
e5c80e5da07e8e14d3eb43bca2d85c397e86a009

SHA256
fd8d2444da376e7a4df910a30edbc7ea606e08ba0f8ce83bb980b4e4a519f14c

SHA512
01643cd5a0b2eb4a5e2dceb2887cebc20e50cb65db767115f56dedb34f05ab83961b18423a18300ce5b27082b9f4c1826180b94181e6c66cef85a77c01c8660d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
ba169f4dcbbf147fe78ef0061a95e83b

SHA1
92a571a6eef49fff666e0f62a3545bcd1cdcda67

SHA256
5ef1421e19fde4bc03cd825dd7d6c0e7863f85fd8f0aa4a4d4f8d555dc7606d1

SHA512
8d2e5e552210dcda684682538bc964fdd8a8ff5b24cc2cc8af813729f0202191f98eb42d38d2355df17ae620fe401aad6ceaedaed3b112fdacd32485a3a0c07c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
a7cc007980e419d553568a106210549a

SHA1
c03099706b75071f36c3962fcc60a22f197711e0

SHA256
a5735921fc72189c8bf577f3911486cf031708dc8d6bc764fe3e593c0a053165

SHA512
b9aaf29403c467daef80a1ae87478afc33b78f4e1ca16189557011bb83cf9b3e29a0f85c69fa209c45201fb28baca47d31756eee07b79c6312c506e8370f7666

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
47605a4dda32c9dff09a9ca441417339

SHA1
4f68c895c35b0dc36257fc8251e70b968c560b62

SHA256
e6254c2bc9846a76a4567ab91b6eae76e937307ff9301b65d577ffe6e15fe40a

SHA512
b6823b6e794a2fe3e4c4ecfb3f0d61a54821de7feb4f9e3e7fd463e7fbb5e6848f59865b487dafebeac431e4f4db81ef56836d94cac67da39852c566ed34a885

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
d079b2f414515e7536eab8def3f59752

SHA1
90cb03125d60dd194a44fe960df655d4a6268d10

SHA256
f21e430cda6fdfc4fa1d51eadaea666e9e6aa92898fda11c9f3d54de02dee94a

SHA512
022c5772b8203082037c7b4c433183f7593f126bc9138f512b5890211953fcd5d995bf05af905d0d597f5f84426dc072fa4964b5b76237856a18dc22bdec9eb9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
eb1ad317bd25b55b2bbdce8a28a74a94

SHA1
98a3978be4d10d62e7411946474579ee5bdc5ea6

SHA256
9e94e7c9ac6134ee30e79498558aa1a5a1ac79a643666c3f8922eed215dd3a98

SHA512
d011f266c0240d84470c0f9577cd9e4927309bd19bb38570ca9704ed8e1d159f9bea982a59d3eefef72ce7a10bd81208b82e88ef57c7af587f7437a89769adc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
07a771c4f31f62b2d04e2befaa36dce7

SHA1
662952ede6c1acbb575e8149a5ac2f08edade811

SHA256
a2df2570980e1123d9af8e12a27a82d3a4d332f0e7dd44e4e225743207c099b3

SHA512
9e339a2d0bfaf5bbe5252f69061652c5880fe1233930830ca7190a65516366e05129907b1656a6790c0093ad82ac73ddee6738d0b78ecb1e3d888f467b889fe9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
4178a021dab6578724f63a6a72b9b13b

SHA1
8e5d61c21edaafe4e2257ebe53f9b37b723838b7

SHA256
347338241585c510bb1fafae13447879318610ca4d844b0e73089957911d77fe

SHA512
0f49991948129415c2a02298072055d4de521e4a8cb9ae887bb2096683668fcb491b99d58fd6e239463a5ac981d756c4b2827cb52c1e1253b9cb114095e140c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
ef647504cf229a16d02de14a16241b90

SHA1
81480caca469857eb93c75d494828b81e124fda0

SHA256
47002672443e80410e55a0b6d683573ac27d70d803b57ee3c2818d1008669710

SHA512
a6d8c08c708eee6f7e700880ce79d2ba7cd0acbe8529d96e18f3e90ea1f3cf33fd801dd6eba6017cdd02769e968c48278c090c1deeac710124f79423cd862ee1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
465286a9b31a4fa4831f9d3a2925c88e

SHA1
4ba832802f83872ff47a59ace1057bceb38a1955

SHA256
24522f12ccd8284ed705803f2c1a3b12ba7d675d300fed443ca9eb55fead55fb

SHA512
84e4d5f00257670fea86e4397f3b814174609daf24488a82c4ce726f81b5891561a8c56d4053c76a8bc27318685d482dae5e15ba28c1cd14049c15bd552f95f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
67668db6b58b27a901b0f39b4ecc4860

SHA1
53d610904acc243780be1f91773475bfa7cfd6ee

SHA256
1c7238f064efd555bf174b09b470b5c4126da5681efc8a8889e139a74f472ed4

SHA512
9cdb241e1e66da3cc2fa7d749d888f30d4c88e9e7f705ebb5b346dc6e831eae96503d2269f560099f67a25c91a67d9b2cbf414d6c5d4aeed5fd2506e1f89af41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
6f3b96b24f06e2d37a46e43e8b784f56

SHA1
7be6702c5867f359e913eeeecdd5b76698589295

SHA256
8e386afeed28e1d282d9a0294dd2e9402dcb807f7c77aca8426314c20057e720

SHA512
d760999531a77a9adf2b4dc019ce3b43ac3a8cad825398b3a09818afe8deaa177d37219a26dd8a432c00c9cff7858efc43cae2375edc996bb0136c92c39c9dfb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
8bbea1769144a7333ccbd7fe7efe4ad3

SHA1
58c9504c32a9cfe6524c489b4728a4f53b47e0f5

SHA256
f13b4909ba4edb76ad49838203ec861f3298ea69e5c1240e457c4fe985503ba4

SHA512
9a2ac62f2ec7e9e3689b05b1dbdac701aad90067a733a2d73e61c262f338af794e33b8face5834325e3a6494c795db7c43e27843fa71ddaa3b22e7c9bad34e45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
429f1f3b703555e17cbef77aa030b674

SHA1
bd1a75e1d543791d0cd8ef5fb7c20671c8ee0b21

SHA256
532a6dd53f71c37e970033e3d0fa9a66a69d16eb64f76b9854503f2827bde37e

SHA512
4389db767af055f848153c480ab2be66b46004a1d96787f2b4c2e8fa4ba1d09bc3c3e43d6ef6959375a219be223e91b87260beacdbcd59be9d054f16085aaaa8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
c1b0a9f26c3e1786191e94e419f1fbf9

SHA1
7f3492f4ec2d93e164f43fe2606b53edcffd8926

SHA256
796649641966f606d7217bb94c5c0a6194eef518815dacc86feacdd78d3c1113

SHA512
fa0290d77372c26a2f14cb9b0002c222bc757ce7ad02516b884c59a1108f42eb4c76884f9edb6c7149f7c3fac917eda99b72a3b1d72b7e118a1d5a73cadd15a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
5f21b0b249682d7eb5abeb19e451ea5a

SHA1
16a6b361e6583da6e0610e74336ecf8ac8947020

SHA256
3dc25ed38bbcaa3ba6c970c574608e2dc7dcddb634f2bf98284f191ae89681fc

SHA512
1d2431f230ba49d3458dd5bb41180c69c29fda922c6e6512a475c6d8cad9ff6d29063e0157118cc6b1586193184ac7e4c9850cfac741ed08bc1acf6931db9f1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
e25058a5d8ac6b42d8c7c9883c598303

SHA1
bd9e6194a36a959772fc020f905244900ffc3d57

SHA256
9f6fe2203df58ba90b512b436fd74f5eeb4f39f4f9f54a41e882fc54e5f35d51

SHA512
0146f2d1298acf189005217784e952d6e99bf7c8bf24ae9e9af1a2ca3d881dca39f19f3ecd06c7d0ad919bc929edaf6e97e0ab2d7f71733b9422527c594ea0c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
ecceac16628651c18879d836acfcb062

SHA1
420502b3e5220a01586c59504e94aa1ee11982c9

SHA256
58238de09a8817ed9f894ed8e5bf06a897fd08e0b0bd77e508d37b2598edd2a9

SHA512
be3c7cb529cafb00f58790a6f8b35c4ff6db9f7f43a507d2218fd80cebc88413e46f71b1bc35b8afcc36b68f9409c946470d1e74a4fe225400eeb6f3f898f5b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
a2c8179aaa149c0b9791b73ce44c04d1

SHA1
703361b0d43ec7f669304e7c0ffbbfdeb1e484ff

SHA256
c1d30342a40a2b6e7553da30ceb85754d33820f6fbb3bbbed1ceb30d6390de4a

SHA512
2e201dd457d055baad86f68c15bcc7beb48d6dc2ffc10db7f304eb93f697e7b45991cbde857d25da2c9c60c23f3e13df8b5ed5809c1753737a23096e296cc9e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache\V01.chk
Filesize
8KB

MD5
ff42837b80bba504952b3bdabddc7e85

SHA1
73645b6a13afa83569653dfb02b4c068c067e9b8

SHA256
23a376e02b0d56c754525ae0084e095a741a1d5fef51608e01aefc0964d900ec

SHA512
44586cd322a96fe2dcaa657adaeb5f5fe9425ec5e635fa33f0c19b244bc3e55abf20f1fc454e1d285b8ed2f6f8b318143e6fd784c4f1976de9dd106328868f95

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ru5e5kjq.b53.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\Logs\CBS\CBS.log
Filesize
1KB

MD5
052b3e220c916537c46ea0470e9eda9b

SHA1
7423ef3b05e4970cf9d243c810a0f494287e2fa0

SHA256
f0bf7d20e5f212a2b62a0ff54b274a4806cd9d67a78c63c5adbaaadb97fd2e67

SHA512
5268897aac4c15ac80179069efb5ec2620a42e3393e6f7a008030b8bdf8585811deffca3a4def4aa53b690183f3f7056f450f6a86b156b5e34c5f6cffc64c5ed

Download Submit
C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work
Filesize
2KB

MD5
8abf2d6067c6f3191a015f84aa9b6efe

SHA1
98f2b0a5cdb13cd3d82dc17bd43741bf0b3496f7

SHA256
ee18bd3259f220c41062abcbe71a421da3e910df11b9f86308a16cdc3a66fbea

SHA512
c2d686a6373efcff583c1ef50c144c59addb8b9c4857ccd8565cd8be3c94b0ac0273945167eb04ebd40dfb0351e4b66cffe4c4e478fb7733714630a11f765b63

Download Submit
C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work
Filesize
2KB

MD5
f313c5b4f95605026428425586317353

SHA1
06be66fa06e1cffc54459c38d3d258f46669d01a

SHA256
129d0b993cd3858af5b7e87fdf74d8e59e6f2110184b5c905df8f5f6f2c39d8b

SHA512
b87a829c86eff1d10e1590b18a9909f05101a535e5f4cef914a4192956eb35a8bfef614c9f95d53783d77571687f3eb3c4e8ee2f24d23ad24e0976d8266b8890

Download Submit
C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work
Filesize
2KB

MD5
ceb7caa4e9c4b8d760dbf7e9e5ca44c5

SHA1
a3879621f9493414d497ea6d70fbf17e283d5c08

SHA256
98c054088df4957e8d6361fd2539c219bcf35f8a524aad8f5d1a95f218e990e9

SHA512
1eddfbf4cb62d3c5b4755a371316304aaeabb00f01bad03fb4f925a98a2f0824f613537d86deddd648a74d694dc13ed5183e761fdc1ec92589f6fa28beb7fbff

Download Submit
C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work
Filesize
2KB

MD5
7d612892b20e70250dbd00d0cdd4f09b

SHA1
63251cfa4e5d6cbf6fb14f6d8a7407dbe763d3f5

SHA256
727c9e7b91e144e453d5b32e18f12508ee84dabe71bc852941d9c9b4923f9e02

SHA512
f8d481f3300947d49ce5ab988a9d4e3154746afccc97081cbed1135ffb24fc107203d485dda2d5d714e74e752c614d8cfd16781ea93450fe782ffae3f77066d1

Download Submit
C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work
Filesize
2KB

MD5
1e8e2076314d54dd72e7ee09ff8a52ab

SHA1
5fd0a67671430f66237f483eef39ff599b892272

SHA256
55f203d6b40a39a6beba9dd3a2cb9034284f49578009835dd4f0f8e1db6ebe2f

SHA512
5b0c97284923c4619d9c00cba20ce1c6d65d1826abe664c390b04283f7a663256b4a6efe51f794cb5ec82ccea80307729addde841469da8d041cbcfd94feb0f6

Download Submit
C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work
Filesize
2KB

MD5
0b990e24f1e839462c0ac35fef1d119e

SHA1
9e17905f8f68f9ce0a2024d57b537aa8b39c6708

SHA256
a1106ed0845cd438e074344e0fe296dc10ee121a0179e09398eaaea2357c614a

SHA512
c65ba42fc0a2cb0b70888beb8ca334f7d5a8eaf954a5ef7adaecbcb4ce8d61b34858dfd9560954f95f59b4d8110a79ceaa39088b6a0caf8b42ceda41b46ec4a4

Download Submit
memory/388-57-0x000002217A500000-0x000002217A52A000-memory.dmp

Filesize
168KB

Download
memory/388-58-0x00007FFBDADF0000-0x00007FFBDAE00000-memory.dmp

Filesize
64KB

Download
memory/396-64-0x0000013747C60000-0x0000013747C8A000-memory.dmp

Filesize
168KB

Download
memory/396-65-0x00007FFBDADF0000-0x00007FFBDAE00000-memory.dmp

Filesize
64KB

Download
memory/452-43-0x00007FFC1AD70000-0x00007FFC1AF65000-memory.dmp

Filesize
2.0MB

Download
memory/452-44-0x00007FFC1AC70000-0x00007FFC1AD2E000-memory.dmp

Filesize
760KB

Download
memory/452-42-0x0000000140000000-0x0000000140040000-memory.dmp

Filesize
256KB

Download
memory/616-48-0x000001A394EB0000-0x000001A394EDA000-memory.dmp

Filesize
168KB

Download
memory/616-47-0x000001A394E80000-0x000001A394EA3000-memory.dmp

Filesize
140KB

Download
memory/616-49-0x00007FFBDADF0000-0x00007FFBDAE00000-memory.dmp

Filesize
64KB

Download
memory/676-53-0x00007FFBDADF0000-0x00007FFBDAE00000-memory.dmp

Filesize
64KB

Download
memory/676-52-0x000001365FDA0000-0x000001365FDCA000-memory.dmp

Filesize
168KB

Download
memory/912-35-0x0000000140000000-0x0000000140040000-memory.dmp

Filesize
256KB

Download
memory/912-37-0x00007FFC1AC70000-0x00007FFC1AD2E000-memory.dmp

Filesize
760KB

Download
memory/912-45-0x0000000140000000-0x0000000140040000-memory.dmp

Filesize
256KB

Download
memory/912-36-0x00007FFC1AD70000-0x00007FFC1AF65000-memory.dmp

Filesize
2.0MB

Download
memory/952-61-0x00007FFBDADF0000-0x00007FFBDAE00000-memory.dmp

Filesize
64KB

Download
memory/952-60-0x0000020AC1D00000-0x0000020AC1D2A000-memory.dmp

Filesize
168KB

Download
memory/1044-72-0x000002852CBA0000-0x000002852CBCA000-memory.dmp

Filesize
168KB

Download
memory/1044-73-0x00007FFBDADF0000-0x00007FFBDAE00000-memory.dmp

Filesize
64KB

Download
memory/1084-75-0x0000028767520000-0x000002876754A000-memory.dmp

Filesize
168KB

Download
memory/1084-76-0x00007FFBDADF0000-0x00007FFBDAE00000-memory.dmp

Filesize
64KB

Download
memory/1116-78-0x000001DEA74E0000-0x000001DEA750A000-memory.dmp

Filesize
168KB

Download
memory/1116-79-0x00007FFBDADF0000-0x00007FFBDAE00000-memory.dmp

Filesize
64KB

Download
memory/1152-81-0x00000255869D0000-0x00000255869FA000-memory.dmp

Filesize
168KB

Download
memory/1152-82-0x00007FFBDADF0000-0x00007FFBDAE00000-memory.dmp

Filesize
64KB

Download
memory/1344-40-0x00007FFBFCCF0000-0x00007FFBFD7B1000-memory.dmp

Filesize
10.8MB

Download
memory/1344-496-0x00007FFBFCCF0000-0x00007FFBFD7B1000-memory.dmp

Filesize
10.8MB

Download
memory/1344-26-0x00007FFBFCCF0000-0x00007FFBFD7B1000-memory.dmp

Filesize
10.8MB

Download
memory/1344-14-0x00007FFBFCCF3000-0x00007FFBFCCF5000-memory.dmp

Filesize
8KB

Download
memory/1344-15-0x000001AEAFA70000-0x000001AEAFA92000-memory.dmp

Filesize
136KB

Download
memory/1972-33-0x00007FFC1AC70000-0x00007FFC1AD2E000-memory.dmp

Filesize
760KB

Download
memory/1972-29-0x0000000140000000-0x0000000140040000-memory.dmp

Filesize
256KB

Download
memory/1972-31-0x00007FFC1AD70000-0x00007FFC1AF65000-memory.dmp

Filesize
2.0MB

Download
memory/3216-12-0x00007FFC1AC70000-0x00007FFC1AD2E000-memory.dmp

Filesize
760KB

Download
memory/3216-8-0x0000000140000000-0x0000000140040000-memory.dmp

Filesize
256KB

Download
memory/3216-13-0x0000000140000000-0x0000000140040000-memory.dmp

Filesize
256KB

Download
memory/3216-11-0x00007FFC1AD70000-0x00007FFC1AF65000-memory.dmp

Filesize
2.0MB

Download
memory/3216-10-0x0000000140000000-0x0000000140040000-memory.dmp

Filesize
256KB

Download
memory/3216-9-0x0000000140000000-0x0000000140040000-memory.dmp

Filesize
256KB

Download
memory/3544-25-0x00007FFC1AD70000-0x00007FFC1AF65000-memory.dmp

Filesize
2.0MB

Download
memory/3544-6-0x00007FFC1AD70000-0x00007FFC1AF65000-memory.dmp

Filesize
2.0MB

Download
memory/3544-1-0x000001FF3B000000-0x000001FF3B018000-memory.dmp

Filesize
96KB

Download
memory/3544-38-0x00007FFC1AD70000-0x00007FFC1AF65000-memory.dmp

Filesize
2.0MB

Download
memory/3544-3636-0x00007FFBFCCF0000-0x00007FFBFD7B1000-memory.dmp

Filesize
10.8MB

Download
memory/3544-3635-0x00007FFBFCCF3000-0x00007FFBFCCF5000-memory.dmp

Filesize
8KB

Download
memory/3544-27-0x00007FFC1AC70000-0x00007FFC1AD2E000-memory.dmp

Filesize
760KB

Download
memory/3544-30-0x00007FFC1AD70000-0x00007FFC1AF65000-memory.dmp

Filesize
2.0MB

Download
memory/3544-4-0x000001FF55DC0000-0x000001FF562E8000-memory.dmp

Filesize
5.2MB

Download
memory/3544-5-0x000001FF55430000-0x000001FF5546E000-memory.dmp

Filesize
248KB

Download
memory/3544-7-0x00007FFC1AC70000-0x00007FFC1AD2E000-memory.dmp

Filesize
760KB

Download
memory/3544-3-0x00007FFBFCCF0000-0x00007FFBFD7B1000-memory.dmp

Filesize
10.8MB

Download
memory/3544-2-0x000001FF555C0000-0x000001FF55782000-memory.dmp

Filesize
1.8MB

Download
memory/3544-0-0x00007FFBFCCF3000-0x00007FFBFCCF5000-memory.dmp

Filesize
8KB

Download