dcrat | 5f44a568a45580bb598b8a5a81ca26e74e3cea5b78689ed715ab0c8848673541

Analysis

max time kernel
72s
max time network
152s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25-01-2023 16:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

inject_fortniteV3.0.exe
Size

3.1MB
MD5

20442abc1fd9cf9d34a54aed6ec06a1f
SHA1

b623b106f07257bc7187428b48769b5df89ffccb
SHA256

5f44a568a45580bb598b8a5a81ca26e74e3cea5b78689ed715ab0c8848673541
SHA512

a63349720b7c98ca5a1e9f4138ded365fd971210608ab5666a3870107509d5b68cf90e945996d0a346352c7204b8cdf872d4c3ec283368a8ae96425eb995254e
SSDEEP

49152:AbA3i4CGZQFM1jq6t6aHad355B8MzzgGa0RBAreWjDu/dHnZGxIGcAXI21I9S:AbCZQFMRq6pM3bcjCBibDqHIxIGWXU

Score

10^/10

dcrat evasion infostealer persistence rat spyware stealer trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Modifies WinLogon for persistence 2 TTPs 17 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

hyperAgentCommon.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\taskhost.exe\""	hyperAgentCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\taskhost.exe\", \"C:\\Program Files (x86)\\Common Files\\System\\Ole DB\\taskhost.exe\", \"C:\\Recovery\\c11c4da2-1a8a-11ed-8505-e0b24281b398\\WmiPrvSE.exe\", \"C:\\Program Files\\Microsoft Office\\Office14\\1033\\taskhost.exe\", \"C:\\Users\\Admin\\AppData\\Roaming\\Mozilla\\Firefox\\Pending Pings\\csrss.exe\", \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\conhost.exe\", \"C:\\Program Files\\Windows Journal\\it-IT\\services.exe\", \"C:\\Program Files\\Internet Explorer\\de-DE\\lsm.exe\", \"C:\\Users\\Public\\Desktop\\WMIADAP.exe\", \"C:\\Recovery\\c11c4da2-1a8a-11ed-8505-e0b24281b398\\lsass.exe\", \"C:\\Recovery\\c11c4da2-1a8a-11ed-8505-e0b24281b398\\WMIADAP.exe\", \"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\1033\\wininit.exe\""	hyperAgentCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\taskhost.exe\", \"C:\\Program Files (x86)\\Common Files\\System\\Ole DB\\taskhost.exe\""	hyperAgentCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\taskhost.exe\", \"C:\\Program Files (x86)\\Common Files\\System\\Ole DB\\taskhost.exe\", \"C:\\Recovery\\c11c4da2-1a8a-11ed-8505-e0b24281b398\\WmiPrvSE.exe\", \"C:\\Program Files\\Microsoft Office\\Office14\\1033\\taskhost.exe\", \"C:\\Users\\Admin\\AppData\\Roaming\\Mozilla\\Firefox\\Pending Pings\\csrss.exe\""	hyperAgentCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\taskhost.exe\", \"C:\\Program Files (x86)\\Common Files\\System\\Ole DB\\taskhost.exe\", \"C:\\Recovery\\c11c4da2-1a8a-11ed-8505-e0b24281b398\\WmiPrvSE.exe\", \"C:\\Program Files\\Microsoft Office\\Office14\\1033\\taskhost.exe\", \"C:\\Users\\Admin\\AppData\\Roaming\\Mozilla\\Firefox\\Pending Pings\\csrss.exe\", \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\conhost.exe\", \"C:\\Program Files\\Windows Journal\\it-IT\\services.exe\", \"C:\\Program Files\\Internet Explorer\\de-DE\\lsm.exe\", \"C:\\Users\\Public\\Desktop\\WMIADAP.exe\", \"C:\\Recovery\\c11c4da2-1a8a-11ed-8505-e0b24281b398\\lsass.exe\", \"C:\\Recovery\\c11c4da2-1a8a-11ed-8505-e0b24281b398\\WMIADAP.exe\", \"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\1033\\wininit.exe\", \"C:\\Recovery\\c11c4da2-1a8a-11ed-8505-e0b24281b398\\csrss.exe\""	hyperAgentCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\taskhost.exe\", \"C:\\Program Files (x86)\\Common Files\\System\\Ole DB\\taskhost.exe\", \"C:\\Recovery\\c11c4da2-1a8a-11ed-8505-e0b24281b398\\WmiPrvSE.exe\", \"C:\\Program Files\\Microsoft Office\\Office14\\1033\\taskhost.exe\", \"C:\\Users\\Admin\\AppData\\Roaming\\Mozilla\\Firefox\\Pending Pings\\csrss.exe\", \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\conhost.exe\", \"C:\\Program Files\\Windows Journal\\it-IT\\services.exe\", \"C:\\Program Files\\Internet Explorer\\de-DE\\lsm.exe\", \"C:\\Users\\Public\\Desktop\\WMIADAP.exe\", \"C:\\Recovery\\c11c4da2-1a8a-11ed-8505-e0b24281b398\\lsass.exe\", \"C:\\Recovery\\c11c4da2-1a8a-11ed-8505-e0b24281b398\\WMIADAP.exe\", \"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\1033\\wininit.exe\", \"C:\\Recovery\\c11c4da2-1a8a-11ed-8505-e0b24281b398\\csrss.exe\", \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\lsm.exe\", \"C:\\Program Files\\Internet Explorer\\it-IT\\csrss.exe\", \"C:\\Windows\\Cursors\\winlogon.exe\""	hyperAgentCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\taskhost.exe\", \"C:\\Program Files (x86)\\Common Files\\System\\Ole DB\\taskhost.exe\", \"C:\\Recovery\\c11c4da2-1a8a-11ed-8505-e0b24281b398\\WmiPrvSE.exe\", \"C:\\Program Files\\Microsoft Office\\Office14\\1033\\taskhost.exe\", \"C:\\Users\\Admin\\AppData\\Roaming\\Mozilla\\Firefox\\Pending Pings\\csrss.exe\", \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\conhost.exe\", \"C:\\Program Files\\Windows Journal\\it-IT\\services.exe\", \"C:\\Program Files\\Internet Explorer\\de-DE\\lsm.exe\", \"C:\\Users\\Public\\Desktop\\WMIADAP.exe\", \"C:\\Recovery\\c11c4da2-1a8a-11ed-8505-e0b24281b398\\lsass.exe\", \"C:\\Recovery\\c11c4da2-1a8a-11ed-8505-e0b24281b398\\WMIADAP.exe\", \"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\1033\\wininit.exe\", \"C:\\Recovery\\c11c4da2-1a8a-11ed-8505-e0b24281b398\\csrss.exe\", \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\lsm.exe\", \"C:\\Program Files\\Internet Explorer\\it-IT\\csrss.exe\", \"C:\\Windows\\Cursors\\winlogon.exe\", \"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\spoolsv.exe\""	hyperAgentCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\taskhost.exe\", \"C:\\Program Files (x86)\\Common Files\\System\\Ole DB\\taskhost.exe\", \"C:\\Recovery\\c11c4da2-1a8a-11ed-8505-e0b24281b398\\WmiPrvSE.exe\""	hyperAgentCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\taskhost.exe\", \"C:\\Program Files (x86)\\Common Files\\System\\Ole DB\\taskhost.exe\", \"C:\\Recovery\\c11c4da2-1a8a-11ed-8505-e0b24281b398\\WmiPrvSE.exe\", \"C:\\Program Files\\Microsoft Office\\Office14\\1033\\taskhost.exe\""	hyperAgentCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\taskhost.exe\", \"C:\\Program Files (x86)\\Common Files\\System\\Ole DB\\taskhost.exe\", \"C:\\Recovery\\c11c4da2-1a8a-11ed-8505-e0b24281b398\\WmiPrvSE.exe\", \"C:\\Program Files\\Microsoft Office\\Office14\\1033\\taskhost.exe\", \"C:\\Users\\Admin\\AppData\\Roaming\\Mozilla\\Firefox\\Pending Pings\\csrss.exe\", \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\conhost.exe\", \"C:\\Program Files\\Windows Journal\\it-IT\\services.exe\""	hyperAgentCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\taskhost.exe\", \"C:\\Program Files (x86)\\Common Files\\System\\Ole DB\\taskhost.exe\", \"C:\\Recovery\\c11c4da2-1a8a-11ed-8505-e0b24281b398\\WmiPrvSE.exe\", \"C:\\Program Files\\Microsoft Office\\Office14\\1033\\taskhost.exe\", \"C:\\Users\\Admin\\AppData\\Roaming\\Mozilla\\Firefox\\Pending Pings\\csrss.exe\", \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\conhost.exe\", \"C:\\Program Files\\Windows Journal\\it-IT\\services.exe\", \"C:\\Program Files\\Internet Explorer\\de-DE\\lsm.exe\""	hyperAgentCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\taskhost.exe\", \"C:\\Program Files (x86)\\Common Files\\System\\Ole DB\\taskhost.exe\", \"C:\\Recovery\\c11c4da2-1a8a-11ed-8505-e0b24281b398\\WmiPrvSE.exe\", \"C:\\Program Files\\Microsoft Office\\Office14\\1033\\taskhost.exe\", \"C:\\Users\\Admin\\AppData\\Roaming\\Mozilla\\Firefox\\Pending Pings\\csrss.exe\", \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\conhost.exe\", \"C:\\Program Files\\Windows Journal\\it-IT\\services.exe\", \"C:\\Program Files\\Internet Explorer\\de-DE\\lsm.exe\", \"C:\\Users\\Public\\Desktop\\WMIADAP.exe\", \"C:\\Recovery\\c11c4da2-1a8a-11ed-8505-e0b24281b398\\lsass.exe\""	hyperAgentCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\taskhost.exe\", \"C:\\Program Files (x86)\\Common Files\\System\\Ole DB\\taskhost.exe\", \"C:\\Recovery\\c11c4da2-1a8a-11ed-8505-e0b24281b398\\WmiPrvSE.exe\", \"C:\\Program Files\\Microsoft Office\\Office14\\1033\\taskhost.exe\", \"C:\\Users\\Admin\\AppData\\Roaming\\Mozilla\\Firefox\\Pending Pings\\csrss.exe\", \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\conhost.exe\", \"C:\\Program Files\\Windows Journal\\it-IT\\services.exe\", \"C:\\Program Files\\Internet Explorer\\de-DE\\lsm.exe\", \"C:\\Users\\Public\\Desktop\\WMIADAP.exe\", \"C:\\Recovery\\c11c4da2-1a8a-11ed-8505-e0b24281b398\\lsass.exe\", \"C:\\Recovery\\c11c4da2-1a8a-11ed-8505-e0b24281b398\\WMIADAP.exe\", \"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\1033\\wininit.exe\", \"C:\\Recovery\\c11c4da2-1a8a-11ed-8505-e0b24281b398\\csrss.exe\", \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\lsm.exe\""	hyperAgentCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\taskhost.exe\", \"C:\\Program Files (x86)\\Common Files\\System\\Ole DB\\taskhost.exe\", \"C:\\Recovery\\c11c4da2-1a8a-11ed-8505-e0b24281b398\\WmiPrvSE.exe\", \"C:\\Program Files\\Microsoft Office\\Office14\\1033\\taskhost.exe\", \"C:\\Users\\Admin\\AppData\\Roaming\\Mozilla\\Firefox\\Pending Pings\\csrss.exe\", \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\conhost.exe\""	hyperAgentCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\taskhost.exe\", \"C:\\Program Files (x86)\\Common Files\\System\\Ole DB\\taskhost.exe\", \"C:\\Recovery\\c11c4da2-1a8a-11ed-8505-e0b24281b398\\WmiPrvSE.exe\", \"C:\\Program Files\\Microsoft Office\\Office14\\1033\\taskhost.exe\", \"C:\\Users\\Admin\\AppData\\Roaming\\Mozilla\\Firefox\\Pending Pings\\csrss.exe\", \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\conhost.exe\", \"C:\\Program Files\\Windows Journal\\it-IT\\services.exe\", \"C:\\Program Files\\Internet Explorer\\de-DE\\lsm.exe\", \"C:\\Users\\Public\\Desktop\\WMIADAP.exe\""	hyperAgentCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\taskhost.exe\", \"C:\\Program Files (x86)\\Common Files\\System\\Ole DB\\taskhost.exe\", \"C:\\Recovery\\c11c4da2-1a8a-11ed-8505-e0b24281b398\\WmiPrvSE.exe\", \"C:\\Program Files\\Microsoft Office\\Office14\\1033\\taskhost.exe\", \"C:\\Users\\Admin\\AppData\\Roaming\\Mozilla\\Firefox\\Pending Pings\\csrss.exe\", \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\conhost.exe\", \"C:\\Program Files\\Windows Journal\\it-IT\\services.exe\", \"C:\\Program Files\\Internet Explorer\\de-DE\\lsm.exe\", \"C:\\Users\\Public\\Desktop\\WMIADAP.exe\", \"C:\\Recovery\\c11c4da2-1a8a-11ed-8505-e0b24281b398\\lsass.exe\", \"C:\\Recovery\\c11c4da2-1a8a-11ed-8505-e0b24281b398\\WMIADAP.exe\""	hyperAgentCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\taskhost.exe\", \"C:\\Program Files (x86)\\Common Files\\System\\Ole DB\\taskhost.exe\", \"C:\\Recovery\\c11c4da2-1a8a-11ed-8505-e0b24281b398\\WmiPrvSE.exe\", \"C:\\Program Files\\Microsoft Office\\Office14\\1033\\taskhost.exe\", \"C:\\Users\\Admin\\AppData\\Roaming\\Mozilla\\Firefox\\Pending Pings\\csrss.exe\", \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\conhost.exe\", \"C:\\Program Files\\Windows Journal\\it-IT\\services.exe\", \"C:\\Program Files\\Internet Explorer\\de-DE\\lsm.exe\", \"C:\\Users\\Public\\Desktop\\WMIADAP.exe\", \"C:\\Recovery\\c11c4da2-1a8a-11ed-8505-e0b24281b398\\lsass.exe\", \"C:\\Recovery\\c11c4da2-1a8a-11ed-8505-e0b24281b398\\WMIADAP.exe\", \"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\1033\\wininit.exe\", \"C:\\Recovery\\c11c4da2-1a8a-11ed-8505-e0b24281b398\\csrss.exe\", \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\lsm.exe\", \"C:\\Program Files\\Internet Explorer\\it-IT\\csrss.exe\""	hyperAgentCommon.exe

Process spawned unexpected child process 51 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	304	1264	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	748	1264	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1684	1264	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1388	1264	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1112	1264	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1384	1264	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	552	1264	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1752	1264	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1620	1264	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1852	1264	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1392	1264	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1300	1264	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1980	1264	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1336	1264	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	940	1264	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1832	1264	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	664	1264	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1724	1264	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1492	1264	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	672	1264	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	812	1264	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1516	1264	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	944	1264	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1564	1264	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	304	1264	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1412	1264	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	884	1264	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1520	1264	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1076	1264	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	592	1264	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1036	1264	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	952	1264	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1252	1264	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1300	1264	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1112	1264	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1372	1264	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	296	1264	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	520	1264	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1684	1264	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1492	1264	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1832	1264	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	980	1264	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	552	1264	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1388	1264	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1688	1264	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	276	1264	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1592	1264	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1344	1264	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1600	1264	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	536	1264	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1556	1264	schtasks.exe

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

services.exehyperAgentCommon.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	hyperAgentCommon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	hyperAgentCommon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	hyperAgentCommon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe

DCRat payload 8 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
\comFont\hyperAgentCommon.exe	dcrat
\comFont\hyperAgentCommon.exe	dcrat
C:\comFont\hyperAgentCommon.exe	dcrat
C:\comFont\hyperAgentCommon.exe	dcrat
behavioral1/memory/1000-68-0x00000000008C0000-0x0000000000B70000-memory.dmp	dcrat
C:\Program Files\Windows Journal\it-IT\services.exe	dcrat
C:\Program Files\Windows Journal\it-IT\services.exe	dcrat
behavioral1/memory/2212-88-0x0000000000270000-0x0000000000520000-memory.dmp	dcrat

Disables Task Manager via registry modification
evasion
Executes dropped EXE 2 IoCs

Processes:

hyperAgentCommon.exeservices.exe

pid process

1000 hyperAgentCommon.exe
2212 services.exe
Loads dropped DLL 2 IoCs

Processes:

cmd.exe

pid process

1376 cmd.exe
1376 cmd.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

pid	process
1376	cmd.exe
1376	cmd.exe

Adds Run key to start application 2 TTPs 34 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

hyperAgentCommon.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WMIADAP = "\"C:\\Users\\Public\\Desktop\\WMIADAP.exe\""	hyperAgentCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Recovery\\c11c4da2-1a8a-11ed-8505-e0b24281b398\\lsass.exe\""	hyperAgentCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\Admin\\AppData\\Roaming\\Mozilla\\Firefox\\Pending Pings\\csrss.exe\""	hyperAgentCommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\conhost.exe\""	hyperAgentCommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Program Files\\Internet Explorer\\de-DE\\lsm.exe\""	hyperAgentCommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Recovery\\c11c4da2-1a8a-11ed-8505-e0b24281b398\\lsass.exe\""	hyperAgentCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WMIADAP = "\"C:\\Recovery\\c11c4da2-1a8a-11ed-8505-e0b24281b398\\WMIADAP.exe\""	hyperAgentCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Recovery\\c11c4da2-1a8a-11ed-8505-e0b24281b398\\csrss.exe\""	hyperAgentCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files\\Internet Explorer\\it-IT\\csrss.exe\""	hyperAgentCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Windows\\Cursors\\winlogon.exe\""	hyperAgentCommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\spoolsv.exe\""	hyperAgentCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\spoolsv.exe\""	hyperAgentCommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Recovery\\c11c4da2-1a8a-11ed-8505-e0b24281b398\\WmiPrvSE.exe\""	hyperAgentCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\taskhost.exe\""	hyperAgentCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\Program Files (x86)\\Common Files\\System\\Ole DB\\taskhost.exe\""	hyperAgentCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\Program Files\\Microsoft Office\\Office14\\1033\\taskhost.exe\""	hyperAgentCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\conhost.exe\""	hyperAgentCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Program Files\\Windows Journal\\it-IT\\services.exe\""	hyperAgentCommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\1033\\wininit.exe\""	hyperAgentCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\lsm.exe\""	hyperAgentCommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\Program Files (x86)\\Common Files\\System\\Ole DB\\taskhost.exe\""	hyperAgentCommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\Program Files\\Microsoft Office\\Office14\\1033\\taskhost.exe\""	hyperAgentCommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\WMIADAP = "\"C:\\Users\\Public\\Desktop\\WMIADAP.exe\""	hyperAgentCommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\WMIADAP = "\"C:\\Recovery\\c11c4da2-1a8a-11ed-8505-e0b24281b398\\WMIADAP.exe\""	hyperAgentCommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Recovery\\c11c4da2-1a8a-11ed-8505-e0b24281b398\\csrss.exe\""	hyperAgentCommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\lsm.exe\""	hyperAgentCommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Windows\\Cursors\\winlogon.exe\""	hyperAgentCommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\taskhost.exe\""	hyperAgentCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Program Files\\Internet Explorer\\de-DE\\lsm.exe\""	hyperAgentCommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\Admin\\AppData\\Roaming\\Mozilla\\Firefox\\Pending Pings\\csrss.exe\""	hyperAgentCommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Program Files\\Windows Journal\\it-IT\\services.exe\""	hyperAgentCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Recovery\\c11c4da2-1a8a-11ed-8505-e0b24281b398\\WmiPrvSE.exe\""	hyperAgentCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\1033\\wininit.exe\""	hyperAgentCommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files\\Internet Explorer\\it-IT\\csrss.exe\""	hyperAgentCommon.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

hyperAgentCommon.exeservices.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	hyperAgentCommon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	hyperAgentCommon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe

Drops file in Program Files directory 12 IoCs

Processes:

hyperAgentCommon.exe

description	ioc	process
File created	C:\Program Files\Windows Journal\it-IT\c5b4cb5e9653cc	hyperAgentCommon.exe
File created	C:\Program Files\Internet Explorer\de-DE\lsm.exe	hyperAgentCommon.exe
File created	C:\Program Files\Internet Explorer\de-DE\101b941d020240	hyperAgentCommon.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\1033\56085415360792	hyperAgentCommon.exe
File created	C:\Program Files (x86)\Common Files\System\Ole DB\taskhost.exe	hyperAgentCommon.exe
File created	C:\Program Files (x86)\Common Files\System\Ole DB\b75386f1303e64	hyperAgentCommon.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\taskhost.exe	hyperAgentCommon.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\b75386f1303e64	hyperAgentCommon.exe
File created	C:\Program Files\Internet Explorer\it-IT\csrss.exe	hyperAgentCommon.exe
File created	C:\Program Files\Internet Explorer\it-IT\886983d96e3d3e	hyperAgentCommon.exe
File created	C:\Program Files\Windows Journal\it-IT\services.exe	hyperAgentCommon.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\1033\wininit.exe	hyperAgentCommon.exe

Drops file in Windows directory 2 IoCs

Processes:

hyperAgentCommon.exe

description	ioc	process
File created	C:\Windows\Cursors\winlogon.exe	hyperAgentCommon.exe
File created	C:\Windows\Cursors\cc11b995f2a76d	hyperAgentCommon.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 51 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

pid	process
812	schtasks.exe
884	schtasks.exe
1076	schtasks.exe
1036	schtasks.exe
1372	schtasks.exe
1852	schtasks.exe
1980	schtasks.exe
1832	schtasks.exe
520	schtasks.exe
1564	schtasks.exe
304	schtasks.exe
592	schtasks.exe
296	schtasks.exe
552	schtasks.exe
1392	schtasks.exe
1724	schtasks.exe
944	schtasks.exe
1688	schtasks.exe
1344	schtasks.exe
1556	schtasks.exe
1832	schtasks.exe
1300	schtasks.exe
664	schtasks.exe
672	schtasks.exe
952	schtasks.exe
1252	schtasks.exe
1112	schtasks.exe
552	schtasks.exe
1620	schtasks.exe
1684	schtasks.exe
980	schtasks.exe
276	schtasks.exe
304	schtasks.exe
1388	schtasks.exe
1336	schtasks.exe
1600	schtasks.exe
1516	schtasks.exe
1412	schtasks.exe
1492	schtasks.exe
1492	schtasks.exe
1520	schtasks.exe
1300	schtasks.exe
748	schtasks.exe
1684	schtasks.exe
1752	schtasks.exe
1388	schtasks.exe
1592	schtasks.exe
536	schtasks.exe
1384	schtasks.exe
940	schtasks.exe
1112	schtasks.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

2184 reg.exe

pid	process
2184	reg.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

Processes:

hyperAgentCommon.exeservices.exe

pid	process
1000	hyperAgentCommon.exe
1000	hyperAgentCommon.exe
1000	hyperAgentCommon.exe
1000	hyperAgentCommon.exe
1000	hyperAgentCommon.exe
1000	hyperAgentCommon.exe
1000	hyperAgentCommon.exe
1000	hyperAgentCommon.exe
1000	hyperAgentCommon.exe
2212	services.exe
2212	services.exe
2212	services.exe
2212	services.exe
2212	services.exe
2212	services.exe
2212	services.exe
2212	services.exe
2212	services.exe
2212	services.exe
2212	services.exe
2212	services.exe
2212	services.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

hyperAgentCommon.exeservices.exe

description pid process

Token: SeDebugPrivilege 1000 hyperAgentCommon.exe
Token: SeDebugPrivilege 2212 services.exe

description	pid	process
Token: SeDebugPrivilege	1000	hyperAgentCommon.exe
Token: SeDebugPrivilege	2212	services.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

inject_fortniteV3.0.exeWScript.execmd.exehyperAgentCommon.execmd.exe

description	pid	process	target process
PID 2036 wrote to memory of 884	2036	inject_fortniteV3.0.exe	WScript.exe
PID 2036 wrote to memory of 884	2036	inject_fortniteV3.0.exe	WScript.exe
PID 2036 wrote to memory of 884	2036	inject_fortniteV3.0.exe	WScript.exe
PID 2036 wrote to memory of 884	2036	inject_fortniteV3.0.exe	WScript.exe
PID 2036 wrote to memory of 1536	2036	inject_fortniteV3.0.exe	WScript.exe
PID 2036 wrote to memory of 1536	2036	inject_fortniteV3.0.exe	WScript.exe
PID 2036 wrote to memory of 1536	2036	inject_fortniteV3.0.exe	WScript.exe
PID 2036 wrote to memory of 1536	2036	inject_fortniteV3.0.exe	WScript.exe
PID 884 wrote to memory of 1376	884	WScript.exe	cmd.exe
PID 884 wrote to memory of 1376	884	WScript.exe	cmd.exe
PID 884 wrote to memory of 1376	884	WScript.exe	cmd.exe
PID 884 wrote to memory of 1376	884	WScript.exe	cmd.exe
PID 1376 wrote to memory of 1000	1376	cmd.exe	hyperAgentCommon.exe
PID 1376 wrote to memory of 1000	1376	cmd.exe	hyperAgentCommon.exe
PID 1376 wrote to memory of 1000	1376	cmd.exe	hyperAgentCommon.exe
PID 1376 wrote to memory of 1000	1376	cmd.exe	hyperAgentCommon.exe
PID 1000 wrote to memory of 2084	1000	hyperAgentCommon.exe	cmd.exe
PID 1000 wrote to memory of 2084	1000	hyperAgentCommon.exe	cmd.exe
PID 1000 wrote to memory of 2084	1000	hyperAgentCommon.exe	cmd.exe
PID 2084 wrote to memory of 2164	2084	cmd.exe	w32tm.exe
PID 2084 wrote to memory of 2164	2084	cmd.exe	w32tm.exe
PID 2084 wrote to memory of 2164	2084	cmd.exe	w32tm.exe
PID 1376 wrote to memory of 2184	1376	cmd.exe	reg.exe
PID 1376 wrote to memory of 2184	1376	cmd.exe	reg.exe
PID 1376 wrote to memory of 2184	1376	cmd.exe	reg.exe
PID 1376 wrote to memory of 2184	1376	cmd.exe	reg.exe
PID 2084 wrote to memory of 2212	2084	cmd.exe	services.exe
PID 2084 wrote to memory of 2212	2084	cmd.exe	services.exe
PID 2084 wrote to memory of 2212	2084	cmd.exe	services.exe

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

Processes:

hyperAgentCommon.exeservices.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	hyperAgentCommon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	hyperAgentCommon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	hyperAgentCommon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	services.exe

C:\Users\Admin\AppData\Local\Temp\inject_fortniteV3.0.exe
"C:\Users\Admin\AppData\Local\Temp\inject_fortniteV3.0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2036

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\comFont\MTGYlSdhuDKs8XfONjnFlP.vbe"
2⤵
- Suspicious use of WriteProcessMemory
PID:884

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\comFont\E1o0vS.bat" "
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1376

C:\comFont\hyperAgentCommon.exe
"C:\comFont\hyperAgentCommon.exe"
4⤵
- Modifies WinLogon for persistence
- UAC bypass
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1000

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\rvqRRv9Vr0.bat"
5⤵
- Suspicious use of WriteProcessMemory
PID:2084

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
6⤵
PID:2164

C:\Program Files\Windows Journal\it-IT\services.exe
"C:\Program Files\Windows Journal\it-IT\services.exe"
6⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:2212

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
4⤵
- Modifies registry key
PID:2184

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\comFont\file.vbs"
2⤵
PID:1536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Common Files\System\Ole DB\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\System\Ole DB\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Common Files\System\Ole DB\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 6 /tr "'C:\Recovery\c11c4da2-1a8a-11ed-8505-e0b24281b398\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Recovery\c11c4da2-1a8a-11ed-8505-e0b24281b398\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 11 /tr "'C:\Recovery\c11c4da2-1a8a-11ed-8505-e0b24281b398\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 9 /tr "'C:\Program Files\Microsoft Office\Office14\1033\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\Office14\1033\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 9 /tr "'C:\Program Files\Microsoft Office\Office14\1033\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Pending Pings\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Pending Pings\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Pending Pings\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Journal\it-IT\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Windows Journal\it-IT\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Journal\it-IT\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 7 /tr "'C:\Program Files\Internet Explorer\de-DE\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\de-DE\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 10 /tr "'C:\Program Files\Internet Explorer\de-DE\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 10 /tr "'C:\Users\Public\Desktop\WMIADAP.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\Users\Public\Desktop\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Desktop\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Recovery\c11c4da2-1a8a-11ed-8505-e0b24281b398\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\c11c4da2-1a8a-11ed-8505-e0b24281b398\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Recovery\c11c4da2-1a8a-11ed-8505-e0b24281b398\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 10 /tr "'C:\Recovery\c11c4da2-1a8a-11ed-8505-e0b24281b398\WMIADAP.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\Recovery\c11c4da2-1a8a-11ed-8505-e0b24281b398\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 13 /tr "'C:\Recovery\c11c4da2-1a8a-11ed-8505-e0b24281b398\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\1033\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\1033\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\1033\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Recovery\c11c4da2-1a8a-11ed-8505-e0b24281b398\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\c11c4da2-1a8a-11ed-8505-e0b24281b398\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Recovery\c11c4da2-1a8a-11ed-8505-e0b24281b398\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Program Files\Internet Explorer\it-IT\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\it-IT\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Program Files\Internet Explorer\it-IT\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Windows\Cursors\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\Cursors\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Windows\Cursors\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1556

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Winlogon Helper DLL

T1004

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Bypass User Account Control

T1088

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Windows Journal\it-IT\services.exe
Filesize
2.7MB

MD5
31d0bae6b505d3a01522e082bd4e66bc

SHA1
5df1a2ec9e16b207c1da1cbd79878fd58682c381

SHA256
b60658d2dd8c986ef67cdd249cc9638214ce9fe78c7de8a76011c35f5569b24c

SHA512
cb6fda5bb453d9a0987222fbe38f1852b7423a196690d1dacf7b1d53cd36b2e7d1c780db9cb195d4c8d09bc5d1f11d4d3c32a8c7a1579e5b1a62e24c0c7145fd

Download Submit
C:\Program Files\Windows Journal\it-IT\services.exe
Filesize
2.7MB

MD5
31d0bae6b505d3a01522e082bd4e66bc

SHA1
5df1a2ec9e16b207c1da1cbd79878fd58682c381

SHA256
b60658d2dd8c986ef67cdd249cc9638214ce9fe78c7de8a76011c35f5569b24c

SHA512
cb6fda5bb453d9a0987222fbe38f1852b7423a196690d1dacf7b1d53cd36b2e7d1c780db9cb195d4c8d09bc5d1f11d4d3c32a8c7a1579e5b1a62e24c0c7145fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\rvqRRv9Vr0.bat
Filesize
216B

MD5
4da2be501347f9848701950dbefdef59

SHA1
02587f5da8b41788ba33593080275cf5180c347a

SHA256
c0b95b27b61cf03921e8abb26b6cfad35d865de54b80ba0b2a4a3b249906c4c1

SHA512
ea64e39cec3323a6cc5b6b9e676a7b6ee040f7a37e8e810f0fc2eaa2fc1b6c191f15642877e1f640542aa80fe40f0d8ce93637d5d5a812c520011f1e1d4b3c46

Download Submit
C:\comFont\E1o0vS.bat
Filesize
145B

MD5
55297b61af195c9d7dfb6a792f4efea8

SHA1
95a2077282be37258d2d9f46494214ef8c5a84de

SHA256
7b4520bd2ad33a7ea82f904a77c709a3fd4e9f80d4a027862d412108d05174e9

SHA512
5aefee445ebf19e885ce72d5e55ada4ead4bf07f5b9e648844248fe79c96df7fc3137f013f43680642b777906f65b01ac0a18c1f222b11720c8ee32602018254

Download Submit
C:\comFont\MTGYlSdhuDKs8XfONjnFlP.vbe
Filesize
190B

MD5
dfbdf30a0582237ed21b02f950e89d4d

SHA1
c9afa656cd126e8fca8b51aebe169a38934c6cba

SHA256
be770bef82038bc3c7b49f04e1598017c3a841a464f133393e90804acc1995d8

SHA512
d683b7baa8a913b80ce5f9ec313fd9399ceadb9acc1da232c277ed80716dac3558aec6d4258bb5804484a32273690c482c9d0367e352355dc139485ff46b61d0

Download Submit
C:\comFont\file.vbs
Filesize
34B

MD5
677cc4360477c72cb0ce00406a949c61

SHA1
b679e8c3427f6c5fc47c8ac46cd0e56c9424de05

SHA256
f1cccb5ae4aa51d293bd3c7d2a1a04cb7847d22c5db8e05ac64e9a6d7455aa0b

SHA512
7cfe2cc92f9e659f0a15a295624d611b3363bd01eb5bcf9bc7681ea9b70b0564d192d570d294657c8dc2c93497fa3b4526c975a9bf35d69617c31d9936573c6a

Download Submit
C:\comFont\hyperAgentCommon.exe
Filesize
2.7MB

MD5
31d0bae6b505d3a01522e082bd4e66bc

SHA1
5df1a2ec9e16b207c1da1cbd79878fd58682c381

SHA256
b60658d2dd8c986ef67cdd249cc9638214ce9fe78c7de8a76011c35f5569b24c

SHA512
cb6fda5bb453d9a0987222fbe38f1852b7423a196690d1dacf7b1d53cd36b2e7d1c780db9cb195d4c8d09bc5d1f11d4d3c32a8c7a1579e5b1a62e24c0c7145fd

Download Submit
C:\comFont\hyperAgentCommon.exe
Filesize
2.7MB

MD5
31d0bae6b505d3a01522e082bd4e66bc

SHA1
5df1a2ec9e16b207c1da1cbd79878fd58682c381

SHA256
b60658d2dd8c986ef67cdd249cc9638214ce9fe78c7de8a76011c35f5569b24c

SHA512
cb6fda5bb453d9a0987222fbe38f1852b7423a196690d1dacf7b1d53cd36b2e7d1c780db9cb195d4c8d09bc5d1f11d4d3c32a8c7a1579e5b1a62e24c0c7145fd

Download Submit
\comFont\hyperAgentCommon.exe
Filesize
2.7MB

MD5
31d0bae6b505d3a01522e082bd4e66bc

SHA1
5df1a2ec9e16b207c1da1cbd79878fd58682c381

SHA256
b60658d2dd8c986ef67cdd249cc9638214ce9fe78c7de8a76011c35f5569b24c

SHA512
cb6fda5bb453d9a0987222fbe38f1852b7423a196690d1dacf7b1d53cd36b2e7d1c780db9cb195d4c8d09bc5d1f11d4d3c32a8c7a1579e5b1a62e24c0c7145fd

Download Submit
\comFont\hyperAgentCommon.exe
Filesize
2.7MB

MD5
31d0bae6b505d3a01522e082bd4e66bc

SHA1
5df1a2ec9e16b207c1da1cbd79878fd58682c381

SHA256
b60658d2dd8c986ef67cdd249cc9638214ce9fe78c7de8a76011c35f5569b24c

SHA512
cb6fda5bb453d9a0987222fbe38f1852b7423a196690d1dacf7b1d53cd36b2e7d1c780db9cb195d4c8d09bc5d1f11d4d3c32a8c7a1579e5b1a62e24c0c7145fd

Download Submit
memory/884-55-0x0000000000000000-mapping.dmp

Download
memory/1000-72-0x00000000005A0000-0x00000000005B0000-memory.dmp

Filesize
64KB

Download
memory/1000-78-0x0000000000820000-0x000000000082E000-memory.dmp

Filesize
56KB

Download
memory/1000-69-0x0000000000550000-0x000000000056C000-memory.dmp

Filesize
112KB

Download
memory/1000-70-0x0000000000570000-0x0000000000586000-memory.dmp

Filesize
88KB

Download
memory/1000-71-0x00000000002C0000-0x00000000002D2000-memory.dmp

Filesize
72KB

Download
memory/1000-66-0x0000000000000000-mapping.dmp

Download
memory/1000-73-0x0000000000590000-0x000000000059A000-memory.dmp

Filesize
40KB

Download
memory/1000-74-0x0000000002100000-0x0000000002156000-memory.dmp

Filesize
344KB

Download
memory/1000-75-0x00000000005B0000-0x00000000005BC000-memory.dmp

Filesize
48KB

Download
memory/1000-76-0x00000000005D0000-0x00000000005E2000-memory.dmp

Filesize
72KB

Download
memory/1000-77-0x0000000000810000-0x000000000081E000-memory.dmp

Filesize
56KB

Download
memory/1000-68-0x00000000008C0000-0x0000000000B70000-memory.dmp

Filesize
2.7MB

Download
memory/1000-79-0x0000000000830000-0x0000000000838000-memory.dmp

Filesize
32KB

Download
memory/1000-80-0x0000000002150000-0x000000000215C000-memory.dmp

Filesize
48KB

Download
memory/1376-62-0x0000000000000000-mapping.dmp

Download
memory/1536-56-0x0000000000000000-mapping.dmp

Download
memory/2036-54-0x0000000075521000-0x0000000075523000-memory.dmp

Filesize
8KB

Download
memory/2084-81-0x0000000000000000-mapping.dmp

Download
memory/2164-83-0x0000000000000000-mapping.dmp

Download
memory/2184-84-0x0000000000000000-mapping.dmp

Download
memory/2212-86-0x0000000000000000-mapping.dmp

Download
memory/2212-88-0x0000000000270000-0x0000000000520000-memory.dmp

Filesize
2.7MB

Download
memory/2212-89-0x0000000000520000-0x0000000000532000-memory.dmp

Filesize
72KB

Download