dcrat | ebb63a7970ae2ca874bb92352e3aef098a8db5d181c30ed20a071b2c5fa6994a

Analysis

max time kernel
150s
max time network
139s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
26-03-2024 01:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7803d28b1cfcb0c4f3a63515fea88508357e02dc2ee982f7ff1f0c2f40af3649.exe
Size

3.3MB
MD5

1d6590415fa189e9c982e883dc3bcdde
SHA1

8261a5718af6eb9ebee4e822e5bd0138f7915dc3
SHA256

7803d28b1cfcb0c4f3a63515fea88508357e02dc2ee982f7ff1f0c2f40af3649
SHA512

304611cfa8c130dde5e4de5282d3d92a555b85d50889ea097dec9908d619c7d36ec28886c64aa0364d631c289d9bbf509c0ea0aeb7887c92fd91ee3d7834d07e
SSDEEP

98304:oZ1HRsp8NbXaaIptoNMrF4NOgmwCof84h:oZVIaIpeOrmNOTwCol

Score

10^/10

dcrat umbral evasion infostealer rat stealer trojan

Malware Config

Extracted

Family

umbral

https://discord.com/api/webhooks/1219193245557325834/Pny7ckgnLuo9kv28SEntCevPyhBWlY4AfJu4MogOozH9-s-mNnQ7UZJcF1RdHsmmAwgC

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Detect Umbral payload 2 IoCs

resource	yara_rule
behavioral1/files/0x001800000000558a-20.dat	family_umbral
behavioral1/memory/2516-22-0x00000000012C0000-0x0000000001300000-memory.dmp	family_umbral

Process spawned unexpected child process 30 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2932	2508	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1512	2508	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1932	2508	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	952	2508	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1784	2508	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2360	2508	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2356	2508	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	904	2508	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2084	2508	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1528	2508	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2948	2508	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2688	2508	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	820	2508	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2652	2508	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2568	2508	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2244	2508	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2556	2508	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2192	2508	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2484	2508	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1936	2508	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	284	2508	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1632	2508	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	292	2508	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	784	2508	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1284	2508	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2088	2508	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	900	2508	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1128	2508	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1716	2508	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1300	2508	schtasks.exe	28

UAC bypass 3 TTPs 33 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	hyperInto.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	hyperInto.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	hyperInto.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral

DCRat payload 13 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x000c0000000144e0-45.dat	dcrat
behavioral1/files/0x000c0000000144e0-44.dat	dcrat
behavioral1/files/0x000c0000000144e0-46.dat	dcrat
behavioral1/files/0x00070000000153c7-63.dat	dcrat
behavioral1/files/0x00070000000153c7-62.dat	dcrat
behavioral1/files/0x00070000000153c7-64.dat	dcrat
behavioral1/files/0x00070000000153c7-65.dat	dcrat
behavioral1/memory/1028-66-0x00000000010A0000-0x000000000140A000-memory.dmp	dcrat
behavioral1/files/0x0006000000015ce3-131.dat	dcrat
behavioral1/files/0x0006000000015ce3-130.dat	dcrat
behavioral1/files/0x0006000000015d24-109.dat	dcrat
behavioral1/files/0x0006000000015ce3-147.dat	dcrat
behavioral1/files/0x0007000000016ce4-154.dat	dcrat

Executes dropped EXE 13 IoCs

pid	Process
2516	Saransk.exe
2504	Injector.exe
1028	hyperInto.exe
304	lsm.exe
2076	lsm.exe
1228	lsm.exe
784	lsm.exe
2300	lsm.exe
1928	lsm.exe
1304	lsm.exe
1560	lsm.exe
1640	lsm.exe
1976	lsm.exe

Loads dropped DLL 2 IoCs

pid	Process
1468	cmd.exe
1468	cmd.exe

Checks whether UAC is enabled 1 TTPs 22 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	hyperInto.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	hyperInto.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\conhost.exe	hyperInto.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\088424020bedd6	hyperInto.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\886983d96e3d3e	hyperInto.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\en-US\56085415360792	hyperInto.exe
File created	C:\Program Files (x86)\Microsoft.NET\RedistList\explorer.exe	hyperInto.exe
File created	C:\Program Files (x86)\Microsoft.NET\RedistList\7a0fd90576e088	hyperInto.exe
File created	C:\Program Files\Windows Mail\fr-FR\csrss.exe	hyperInto.exe
File created	C:\Program Files\Windows Mail\fr-FR\886983d96e3d3e	hyperInto.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\WmiPrvSE.exe	hyperInto.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\24dbde2999530e	hyperInto.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\csrss.exe	hyperInto.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\en-US\wininit.exe	hyperInto.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 30 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1784	schtasks.exe
1128	schtasks.exe
952	schtasks.exe
2356	schtasks.exe
2244	schtasks.exe
1284	schtasks.exe
1512	schtasks.exe
2556	schtasks.exe
2088	schtasks.exe
1300	schtasks.exe
2084	schtasks.exe
820	schtasks.exe
2932	schtasks.exe
2484	schtasks.exe
900	schtasks.exe
2652	schtasks.exe
2688	schtasks.exe
784	schtasks.exe
904	schtasks.exe
2360	schtasks.exe
1528	schtasks.exe
2948	schtasks.exe
2192	schtasks.exe
1632	schtasks.exe
1716	schtasks.exe
1932	schtasks.exe
1936	schtasks.exe
284	schtasks.exe
292	schtasks.exe
2568	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2248	powershell.exe
2404	powershell.exe
1028	hyperInto.exe
1028	hyperInto.exe
1028	hyperInto.exe
1028	hyperInto.exe
1028	hyperInto.exe
1028	hyperInto.exe
1028	hyperInto.exe
1028	hyperInto.exe
1028	hyperInto.exe
304	lsm.exe
304	lsm.exe
304	lsm.exe
304	lsm.exe
304	lsm.exe
304	lsm.exe
304	lsm.exe
304	lsm.exe
304	lsm.exe
304	lsm.exe
304	lsm.exe
304	lsm.exe
304	lsm.exe
304	lsm.exe
304	lsm.exe
304	lsm.exe
304	lsm.exe
304	lsm.exe
304	lsm.exe
304	lsm.exe
304	lsm.exe
304	lsm.exe
304	lsm.exe
304	lsm.exe
304	lsm.exe
304	lsm.exe
304	lsm.exe
304	lsm.exe
304	lsm.exe
304	lsm.exe
304	lsm.exe
304	lsm.exe
304	lsm.exe
304	lsm.exe
304	lsm.exe
2076	lsm.exe
2076	lsm.exe
2076	lsm.exe
2076	lsm.exe
2076	lsm.exe
2076	lsm.exe
2076	lsm.exe
2076	lsm.exe
2076	lsm.exe
2076	lsm.exe
2076	lsm.exe
2076	lsm.exe
2076	lsm.exe
2076	lsm.exe
2076	lsm.exe
2076	lsm.exe
2076	lsm.exe
2076	lsm.exe

Suspicious use of AdjustPrivilegeToken 55 IoCs

description	pid	Process
Token: SeDebugPrivilege	2592	7803d28b1cfcb0c4f3a63515fea88508357e02dc2ee982f7ff1f0c2f40af3649.exe
Token: SeDebugPrivilege	2248	powershell.exe
Token: SeDebugPrivilege	2404	powershell.exe
Token: SeDebugPrivilege	2516	Saransk.exe
Token: SeDebugPrivilege	1028	hyperInto.exe
Token: SeIncreaseQuotaPrivilege	472	wmic.exe
Token: SeSecurityPrivilege	472	wmic.exe
Token: SeTakeOwnershipPrivilege	472	wmic.exe
Token: SeLoadDriverPrivilege	472	wmic.exe
Token: SeSystemProfilePrivilege	472	wmic.exe
Token: SeSystemtimePrivilege	472	wmic.exe
Token: SeProfSingleProcessPrivilege	472	wmic.exe
Token: SeIncBasePriorityPrivilege	472	wmic.exe
Token: SeCreatePagefilePrivilege	472	wmic.exe
Token: SeBackupPrivilege	472	wmic.exe
Token: SeRestorePrivilege	472	wmic.exe
Token: SeShutdownPrivilege	472	wmic.exe
Token: SeDebugPrivilege	472	wmic.exe
Token: SeSystemEnvironmentPrivilege	472	wmic.exe
Token: SeRemoteShutdownPrivilege	472	wmic.exe
Token: SeUndockPrivilege	472	wmic.exe
Token: SeManageVolumePrivilege	472	wmic.exe
Token: 33	472	wmic.exe
Token: 34	472	wmic.exe
Token: 35	472	wmic.exe
Token: SeIncreaseQuotaPrivilege	472	wmic.exe
Token: SeSecurityPrivilege	472	wmic.exe
Token: SeTakeOwnershipPrivilege	472	wmic.exe
Token: SeLoadDriverPrivilege	472	wmic.exe
Token: SeSystemProfilePrivilege	472	wmic.exe
Token: SeSystemtimePrivilege	472	wmic.exe
Token: SeProfSingleProcessPrivilege	472	wmic.exe
Token: SeIncBasePriorityPrivilege	472	wmic.exe
Token: SeCreatePagefilePrivilege	472	wmic.exe
Token: SeBackupPrivilege	472	wmic.exe
Token: SeRestorePrivilege	472	wmic.exe
Token: SeShutdownPrivilege	472	wmic.exe
Token: SeDebugPrivilege	472	wmic.exe
Token: SeSystemEnvironmentPrivilege	472	wmic.exe
Token: SeRemoteShutdownPrivilege	472	wmic.exe
Token: SeUndockPrivilege	472	wmic.exe
Token: SeManageVolumePrivilege	472	wmic.exe
Token: 33	472	wmic.exe
Token: 34	472	wmic.exe
Token: 35	472	wmic.exe
Token: SeDebugPrivilege	304	lsm.exe
Token: SeDebugPrivilege	2076	lsm.exe
Token: SeDebugPrivilege	1228	lsm.exe
Token: SeDebugPrivilege	784	lsm.exe
Token: SeDebugPrivilege	2300	lsm.exe
Token: SeDebugPrivilege	1928	lsm.exe
Token: SeDebugPrivilege	1304	lsm.exe
Token: SeDebugPrivilege	1560	lsm.exe
Token: SeDebugPrivilege	1640	lsm.exe
Token: SeDebugPrivilege	1976	lsm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2592 wrote to memory of 2248	2592	7803d28b1cfcb0c4f3a63515fea88508357e02dc2ee982f7ff1f0c2f40af3649.exe	29
PID 2592 wrote to memory of 2248	2592	7803d28b1cfcb0c4f3a63515fea88508357e02dc2ee982f7ff1f0c2f40af3649.exe	29
PID 2592 wrote to memory of 2248	2592	7803d28b1cfcb0c4f3a63515fea88508357e02dc2ee982f7ff1f0c2f40af3649.exe	29
PID 2592 wrote to memory of 2516	2592	7803d28b1cfcb0c4f3a63515fea88508357e02dc2ee982f7ff1f0c2f40af3649.exe	31
PID 2592 wrote to memory of 2516	2592	7803d28b1cfcb0c4f3a63515fea88508357e02dc2ee982f7ff1f0c2f40af3649.exe	31
PID 2592 wrote to memory of 2516	2592	7803d28b1cfcb0c4f3a63515fea88508357e02dc2ee982f7ff1f0c2f40af3649.exe	31
PID 2592 wrote to memory of 2404	2592	7803d28b1cfcb0c4f3a63515fea88508357e02dc2ee982f7ff1f0c2f40af3649.exe	32
PID 2592 wrote to memory of 2404	2592	7803d28b1cfcb0c4f3a63515fea88508357e02dc2ee982f7ff1f0c2f40af3649.exe	32
PID 2592 wrote to memory of 2404	2592	7803d28b1cfcb0c4f3a63515fea88508357e02dc2ee982f7ff1f0c2f40af3649.exe	32
PID 2592 wrote to memory of 2504	2592	7803d28b1cfcb0c4f3a63515fea88508357e02dc2ee982f7ff1f0c2f40af3649.exe	34
PID 2592 wrote to memory of 2504	2592	7803d28b1cfcb0c4f3a63515fea88508357e02dc2ee982f7ff1f0c2f40af3649.exe	34
PID 2592 wrote to memory of 2504	2592	7803d28b1cfcb0c4f3a63515fea88508357e02dc2ee982f7ff1f0c2f40af3649.exe	34
PID 2592 wrote to memory of 2504	2592	7803d28b1cfcb0c4f3a63515fea88508357e02dc2ee982f7ff1f0c2f40af3649.exe	34
PID 2504 wrote to memory of 2120	2504	Injector.exe	35
PID 2504 wrote to memory of 2120	2504	Injector.exe	35
PID 2504 wrote to memory of 2120	2504	Injector.exe	35
PID 2504 wrote to memory of 2120	2504	Injector.exe	35
PID 2504 wrote to memory of 2340	2504	Injector.exe	36
PID 2504 wrote to memory of 2340	2504	Injector.exe	36
PID 2504 wrote to memory of 2340	2504	Injector.exe	36
PID 2504 wrote to memory of 2340	2504	Injector.exe	36
PID 2120 wrote to memory of 1468	2120	WScript.exe	37
PID 2120 wrote to memory of 1468	2120	WScript.exe	37
PID 2120 wrote to memory of 1468	2120	WScript.exe	37
PID 2120 wrote to memory of 1468	2120	WScript.exe	37
PID 1468 wrote to memory of 1028	1468	cmd.exe	39
PID 1468 wrote to memory of 1028	1468	cmd.exe	39
PID 1468 wrote to memory of 1028	1468	cmd.exe	39
PID 1468 wrote to memory of 1028	1468	cmd.exe	39
PID 2516 wrote to memory of 472	2516	Saransk.exe	40
PID 2516 wrote to memory of 472	2516	Saransk.exe	40
PID 2516 wrote to memory of 472	2516	Saransk.exe	40
PID 1028 wrote to memory of 304	1028	hyperInto.exe	72
PID 1028 wrote to memory of 304	1028	hyperInto.exe	72
PID 1028 wrote to memory of 304	1028	hyperInto.exe	72
PID 304 wrote to memory of 1592	304	lsm.exe	73
PID 304 wrote to memory of 1592	304	lsm.exe	73
PID 304 wrote to memory of 1592	304	lsm.exe	73
PID 304 wrote to memory of 2772	304	lsm.exe	74
PID 304 wrote to memory of 2772	304	lsm.exe	74
PID 304 wrote to memory of 2772	304	lsm.exe	74
PID 1592 wrote to memory of 2076	1592	WScript.exe	75
PID 1592 wrote to memory of 2076	1592	WScript.exe	75
PID 1592 wrote to memory of 2076	1592	WScript.exe	75
PID 2076 wrote to memory of 488	2076	lsm.exe	76
PID 2076 wrote to memory of 488	2076	lsm.exe	76
PID 2076 wrote to memory of 488	2076	lsm.exe	76
PID 2076 wrote to memory of 1988	2076	lsm.exe	77
PID 2076 wrote to memory of 1988	2076	lsm.exe	77
PID 2076 wrote to memory of 1988	2076	lsm.exe	77
PID 488 wrote to memory of 1228	488	WScript.exe	78
PID 488 wrote to memory of 1228	488	WScript.exe	78
PID 488 wrote to memory of 1228	488	WScript.exe	78
PID 1228 wrote to memory of 1940	1228	lsm.exe	79
PID 1228 wrote to memory of 1940	1228	lsm.exe	79
PID 1228 wrote to memory of 1940	1228	lsm.exe	79
PID 1228 wrote to memory of 292	1228	lsm.exe	80
PID 1228 wrote to memory of 292	1228	lsm.exe	80
PID 1228 wrote to memory of 292	1228	lsm.exe	80
PID 1940 wrote to memory of 784	1940	WScript.exe	83
PID 1940 wrote to memory of 784	1940	WScript.exe	83
PID 1940 wrote to memory of 784	1940	WScript.exe	83
PID 784 wrote to memory of 2832	784	lsm.exe	84
PID 784 wrote to memory of 2832	784	lsm.exe	84

System policy modification 1 TTPs 33 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	hyperInto.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	hyperInto.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	hyperInto.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\7803d28b1cfcb0c4f3a63515fea88508357e02dc2ee982f7ff1f0c2f40af3649.exe
"C:\Users\Admin\AppData\Local\Temp\7803d28b1cfcb0c4f3a63515fea88508357e02dc2ee982f7ff1f0c2f40af3649.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2592
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Saransk.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2248
- C:\Users\Admin\AppData\Local\Temp\Saransk.exe
  "C:\Users\Admin\AppData\Local\Temp\Saransk.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2516
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:472
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Injector.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2404
- C:\Users\Admin\AppData\Local\Temp\Injector.exe
  "C:\Users\Admin\AppData\Local\Temp\Injector.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2504
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Chainnet\8f9Z3.vbe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2120
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Chainnet\oniRrs8nIuzVsaH8sYiTK.bat" "
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1468
    - - C:\Chainnet\hyperInto.exe
        
        "C:\Chainnet\hyperInto.exe"
        5⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1028
      - C:\Users\Admin\Music\lsm.exe
        
        "C:\Users\Admin\Music\lsm.exe"
        6⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:304
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\930e8dce-99b2-4747-9a85-983e471c2a43.vbs"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1592
        
        C:\Users\Admin\Music\lsm.exe
        
        C:\Users\Admin\Music\lsm.exe
        8⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2076
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d08556fb-3f36-4c81-a8ef-f2e81dab8652.vbs"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:488
        
        C:\Users\Admin\Music\lsm.exe
        
        C:\Users\Admin\Music\lsm.exe
        10⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1228
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e41e2278-00ff-4f55-94c2-4ebb64f37def.vbs"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:1940
        
        C:\Users\Admin\Music\lsm.exe
        
        C:\Users\Admin\Music\lsm.exe
        12⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:784
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5aa4632f-8949-407b-ae17-b823947732b8.vbs"
        13⤵
        
        PID:2832
        
        C:\Users\Admin\Music\lsm.exe
        
        C:\Users\Admin\Music\lsm.exe
        14⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2300
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5f564f3d-3bf0-4f52-b984-97cd3a7576dd.vbs"
        15⤵
        
        PID:2140
        
        C:\Users\Admin\Music\lsm.exe
        
        C:\Users\Admin\Music\lsm.exe
        16⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1928
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\610df3b3-103b-4e0b-a6a6-94e6d0d94bdc.vbs"
        17⤵
        
        PID:2828
        
        C:\Users\Admin\Music\lsm.exe
        
        C:\Users\Admin\Music\lsm.exe
        18⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1304
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c0b9fb87-d6db-42f6-afdb-43375df171ff.vbs"
        19⤵
        
        PID:2740
        
        C:\Users\Admin\Music\lsm.exe
        
        C:\Users\Admin\Music\lsm.exe
        20⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1560
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3f42b443-f5b5-4a9e-a847-83471f9ab449.vbs"
        21⤵
        
        PID:2236
        
        C:\Users\Admin\Music\lsm.exe
        
        C:\Users\Admin\Music\lsm.exe
        22⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1640
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\54885348-644d-4674-b6bf-b2c5523f93ae.vbs"
        23⤵
        
        PID:1008
        
        C:\Users\Admin\Music\lsm.exe
        
        C:\Users\Admin\Music\lsm.exe
        24⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1976
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\70899a1c-c353-457b-9091-ba8661a2e4ca.vbs"
        25⤵
        
        PID:2480
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\223aca6d-4e8c-41a2-b6b2-256112adc7ef.vbs"
        25⤵
        
        PID:1016
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\046a50bc-e53f-4e60-8208-e94f66808753.vbs"
        23⤵
        
        PID:1456
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1185d0b9-a3a9-4953-ad96-822af775c92f.vbs"
        21⤵
        
        PID:604
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5e6b907f-cc57-4a4a-8ba2-21d5a327c854.vbs"
        19⤵
        
        PID:2156
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\88de2347-257c-4c1c-93f0-f12d21c4bb81.vbs"
        17⤵
        
        PID:1968
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\32353a98-e839-41b3-aad5-59a9a5ef5033.vbs"
        15⤵
        
        PID:2232
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2078dc2a-c952-47ce-8c39-6782d1067cbc.vbs"
        13⤵
        
        PID:2912
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f053f44c-aac6-4891-8497-2a1bade979ad.vbs"
        11⤵
        
        PID:292
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1107f8ce-bae8-4856-806c-bf118d4e266e.vbs"
        9⤵
        
        PID:1988
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ffa507d6-a9e4-46e6-93a7-0a209e469266.vbs"
        7⤵
        
        PID:2772
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Chainnet\file.vbs"
    3⤵
    PID:2340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\Music\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Users\Admin\Music\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\Music\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Chainnet\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Chainnet\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Chainnet\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Mail\fr-FR\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\fr-FR\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Mail\fr-FR\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Chainnet\8f9Z3.vbe

Filesize
206B

MD5
b3080903ab3740f3f1346f2f61834c2b

SHA1
a5b37c9ea7a58c9194de44382d75dc4863d3d5b7

SHA256
505642ffc3c57426bb6575eb3ac48ea1f3e303fa5b34ea6ccd3fe2f7021619a1

SHA512
a33ace44bf4936bb2747586d590d762da473840179d9553d0b213f12f11a2d10713fb6bb5637058a40bf0b12f710dfe07930476d8ea5765f0dba816389f9e419

Download Submit
C:\Chainnet\file.vbs

Filesize
34B

MD5
677cc4360477c72cb0ce00406a949c61

SHA1
b679e8c3427f6c5fc47c8ac46cd0e56c9424de05

SHA256
f1cccb5ae4aa51d293bd3c7d2a1a04cb7847d22c5db8e05ac64e9a6d7455aa0b

SHA512
7cfe2cc92f9e659f0a15a295624d611b3363bd01eb5bcf9bc7681ea9b70b0564d192d570d294657c8dc2c93497fa3b4526c975a9bf35d69617c31d9936573c6a

Download Submit
C:\Chainnet\hyperInto.exe

Filesize
527KB

MD5
371b9c7881c4620393f37e6a19379098

SHA1
7da8c08d0c523751d434dd5b647f5a8d769dea54

SHA256
d538a856190bb8a40c01ddaa40ac4c29370eca54cf1f27e5991a7b47ea840862

SHA512
1ba610c5b8eaa132ba62eedcd8a738a796aa7d4e7a417d4edbd24e88486ba99da8411a2e60b8366b232348836a756ddbfabc0b389c713830b811bb291adeddbb

Download Submit
C:\Chainnet\hyperInto.exe

Filesize
549KB

MD5
b036b777ab6589621a1936cd30b7b11d

SHA1
2f34d8d0e3d42b569d1c15eb4c12cc5e24f63514

SHA256
918aa013a0ac0ed1f2d94c351fbd34a5f4c5444f23d16fe50cd0a04dc751d9e3

SHA512
db03bd460d00f155e79a5a6e8d9c871a1a78306cd5dffd7c1517941d93621c3e53e91f8ba53ece368789f646b6a4f4672b7d226b81502d5ffcd9bf761b7ca9e0

Download Submit
C:\Chainnet\oniRrs8nIuzVsaH8sYiTK.bat

Filesize
27B

MD5
94db4d897ca54289c945a06574084128

SHA1
d4168950c994dacea1402a9570a4735350b86c10

SHA256
a759a78b129faaa486102e6486d595070e7c923bf4159ae7b8eb78fec3c2a461

SHA512
2548059003c4bff60dbe0e9aa5c097bac130ecb7bae7896b83f577bb2aa0e3c1b356545ebc92e3487ef937026c96ef48d2df750b31f0acea9166bfb9342cd28a

Download Submit
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\explorer.exe

Filesize
2.4MB

MD5
e01d76ed38ec29801719d497808777ff

SHA1
fe7df8ba67719d56c2b1d3b3defae1a32aa860f8

SHA256
3aacfdfea63c01759c10553221a162db0a7a35fb2b0262c59415ffe604980e66

SHA512
eb6ad207d974cc628cd9ad55162fdc3fd57b9ff23cd6d2888675fb7b6903343fa99cdac4d17f607ac3e0811bd8c7596590180e6fe0b2202b0d82ed553e1c89e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\3f42b443-f5b5-4a9e-a847-83471f9ab449.vbs

Filesize
704B

MD5
07f5b20b64e15dedae90dba954937211

SHA1
beb7d52cddb80b85cb12da77d424de643fc949d8

SHA256
a11299f2ee4d0a25224031ca5280d2901b8aa0311dd184468b7a6bd44a6009fb

SHA512
94cdeb86854d94ba38fd21fe9d987d6a6836eec8f984bd19da748bf60ad0deb1a83bc5a77ff1f94e9f5a45829b16a98c2bb485d4b4d3a171ff7d3e6be8ff8e03

Download Submit
C:\Users\Admin\AppData\Local\Temp\54885348-644d-4674-b6bf-b2c5523f93ae.vbs

Filesize
704B

MD5
5ec0d64e1fbc99c25bec1e2eccacf2a6

SHA1
fcd28034d804811255ef4f8ca904820ca604985b

SHA256
205a104a207a7afb0c5efde55e98eb5c5822aaae20d659e14797d03f94e075dd

SHA512
f6d7fc636908e7db20b65ca9d5dfa4814301648faecf16c4847395423ec26cca1b27efad6e289c5a680aaf11392f0d1873520086e7e71641c82443a73b94444a

Download Submit
C:\Users\Admin\AppData\Local\Temp\5f564f3d-3bf0-4f52-b984-97cd3a7576dd.vbs

Filesize
704B

MD5
07cb19f354c46136bdb94f06b957c374

SHA1
bdbdfb009423477b689b3de9f9007259f0ad44ce

SHA256
210ca3a6c20cde6cc322cccb1f15c98a514a42b08b53e6f655aa993416358557

SHA512
1782b6bdb8f3b1c0b4a9638aaf4ee8cb123392a0fc7370dcb9b7ee4f4b63c74a164e5ac8440be332d184670c1e48a408cdd63639bd824c84982abda3c243034e

Download Submit
C:\Users\Admin\AppData\Local\Temp\610df3b3-103b-4e0b-a6a6-94e6d0d94bdc.vbs

Filesize
704B

MD5
e9cfa2dedfed9843ba726b5cabd40729

SHA1
d32248d5afc91e9b2bd4d46612dff169633c797a

SHA256
4063fa1d92adb05471703488c2ee791af5791aa37b05987c34c6fdef9f45e3c2

SHA512
13be4bc5db79dc171d4a7e2145563e21758bf700021941f8f28cbf495fee5207a35c946abd77d571f7b24edd537d076af1345d91cffe0f18d5f5524371695652

Download Submit
C:\Users\Admin\AppData\Local\Temp\70899a1c-c353-457b-9091-ba8661a2e4ca.vbs

Filesize
704B

MD5
84bbd2fa6f4021b979d5af9d02cd7c15

SHA1
2b67214f40b30d6f4538532aefae53345f1727f7

SHA256
5b825b6e6f2af0f5aff143a31d28301f5f19d0f432898765d0c066a5675979a4

SHA512
3e8a5525e99f288d39e9afde5787f0daa6054f3fc33af14108c2edcb7723b12933a7506ce1f82ed7472765d97939d58a0abebc6beae07f0df736bfa311751d17

Download Submit
C:\Users\Admin\AppData\Local\Temp\930e8dce-99b2-4747-9a85-983e471c2a43.vbs

Filesize
703B

MD5
96e5467dbe6a8d9e55b5dc2837aa7a84

SHA1
0a507de3405955c0cc542c8cf3ffd5c08e259af0

SHA256
16c0d2a9e62dd52b05adea70ef8ba20a7590ec79f465860970663fa0ca93fb96

SHA512
4b70570b057c79082b8ce062dfad4034930070bb5e41a425e831c896c4b429d69dec84994e0c5b90410c48fde1a86f18870af9623919afee4f392399539feaac

Download Submit
C:\Users\Admin\AppData\Local\Temp\Injector.exe

Filesize
1.3MB

MD5
4b4c7d88a64e7fefa21f6bf76811a20d

SHA1
9661b63fc009bc59d5ac08924aa8fc2dd2e31da4

SHA256
f1bcae94d8164edb017bee9d38df2ba6e368c7de81697c78b829f1df96ac7f23

SHA512
a03f27e56ef5c49f26304b02fffcecc55ef23fd99342f94bc90ff5e228f74faa0ac013b0657a4864106745b85f535f02a612e1123d27e0c1316bc8ecfaa87c40

Download Submit
C:\Users\Admin\AppData\Local\Temp\Injector.exe

Filesize
1.4MB

MD5
db4d7f4a57c8beec047b316e0359be04

SHA1
b4073e461af0483f4e315126955ad77bb649ee1e

SHA256
c3963ab617c381d85406ab4416560be78096d73c7b84cc658ebceb2bbca55178

SHA512
69c702bb5e4c03be1b1ad4fa03ff5d0116c7fabc1bf655e3bd62bbb1c9654d27427eb5b94b76845cb3433bf627adeb78be8ea5aacf52e8304fdbb0422e420f57

Download Submit
C:\Users\Admin\AppData\Local\Temp\Injector.exe

Filesize
1006KB

MD5
6a01085b3768e767fdfec3b4427427e1

SHA1
d23dd240adcf4f48f4895c11ea856ccf2f9a98d1

SHA256
bbd641f5ddb452f565dc7712b153d7775215679c8e559942b26a3d675448983f

SHA512
128bcb24773c70735f506066f1333dbd12a84f8fb8f7da5a78db142df265f0fd557da1b2af855766c25b2f671cbf555df1c76cc56e3d298b23217f56819b2e0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Saransk.exe

Filesize
227KB

MD5
05c183f8c0d871d6081f1ea4096805e4

SHA1
4a05aba815c8471fca4fcc9a789683385b0c24ca

SHA256
eff59569967501a5e21ff3f8be9cc487e30d23e1538aeb121f9ab0955c308849

SHA512
ef35359087662c4213f667c49182ab794fbb28dfe2a5b9e1fad5729e516b1ef08c2d7230a84e4808b693832d7b4ad43530377886cd2c993407a7fe38333ad347

Download Submit
C:\Users\Admin\AppData\Local\Temp\c0b9fb87-d6db-42f6-afdb-43375df171ff.vbs

Filesize
704B

MD5
a462855ed725d55cc86e80c488722d5e

SHA1
f8cbe2f49b2c49166718d2e0e038b0cfad89979a

SHA256
3faa82865223577c715596fe9aae67aa2f0bf3e03a1455de48ff17dea7a5f113

SHA512
6e9f636885830d60ca4f67e2bc827027962edebf38cd3827b0e82e8c3517a505f8e8cef49b12c937988ddc9bce5099d8235cf270f3d37038314461b024b0d72d

Download Submit
C:\Users\Admin\AppData\Local\Temp\d08556fb-3f36-4c81-a8ef-f2e81dab8652.vbs

Filesize
704B

MD5
0010821b5006d04f2eb256d8b6d09fbe

SHA1
066627aa4cc463aa2c3278f665ccbfd76d4c9b9e

SHA256
dec97489ba3ac490b2136b4e8c522ca1fd45a804db8397dd5b35e0088fa330a8

SHA512
a5baafa3a66b4d509300b91eea339a2c90fd2a093259d5218dd3408a013315876fe71a0047bef6821a71ac7766cc9a8b366471215441992baa9d753a20e8e099

Download Submit
C:\Users\Admin\AppData\Local\Temp\e41e2278-00ff-4f55-94c2-4ebb64f37def.vbs

Filesize
704B

MD5
c2cedca58c1c10b2c0221c8d9c00abfc

SHA1
bc78999f476f3944796d91f8e7381c9c23ecbf8e

SHA256
d0fbc722d507b67ccf301277c75e923eff885abf71755c81dae32750d2c932c8

SHA512
a4a062d30a27f373f624a4e831b4898c06af9da04c596f7d09577126e6c56f8de888e05c814b2e790c07a40949ae7c2544755aa3fe483f5e88c5f448b1bc4c63

Download Submit
C:\Users\Admin\AppData\Local\Temp\f770fd184cd701c6d62bde83d88043d6f81c1446.exe

Filesize
3.4MB

MD5
d63861446161da73423a6378ab06af5e

SHA1
8d3116fa2ac5d4e7fb9684498f69edf3e976f977

SHA256
c46e261e262516989fb8205f6e939b13fc19326f936229f024b41b9d4956f8bd

SHA512
7bf3f16a5c455dbf902284ba581097b7ecdefcfb9df55053c868f4ae84e9097b4fb6214c9896cc344ea65979516b20df8e35d19c97de79d52ee27fb86e61eb88

Download Submit
C:\Users\Admin\AppData\Local\Temp\ffa507d6-a9e4-46e6-93a7-0a209e469266.vbs

Filesize
480B

MD5
0b849eb61f42099c70c639e0444a22fc

SHA1
6bdf57e70794afc0d4333b655b61e116692b47c4

SHA256
df8773abfce140959ce461d81f8b4062080341e1bbdf497c15344701fb93e40b

SHA512
243198a9cc7c0f3559b161bfe4e575b9aee8e38af4e34942eeb5e5bb0d484541d078dad20dbd956f290ae05d2cd9d26cea825a2fa76eb9111dc59dec73494549

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
2b72988a6a4d7155f65be516ff7ca418

SHA1
cdafc3cfa4d7b1b80a9709b95ff689481507c107

SHA256
97c981f53781c6b24fa563a85653b296a92b46da1384fe43f5acbb71234b1bf8

SHA512
87cd1f74c1bf0ce311e20f6085f4f11ea67ad950c729256ed21acb43a5f10d11a2a72a90128f89707d6aabeb137655264dea44b05f1afab7abdbaeeae8e5f434

Download Submit
C:\Users\Admin\Music\lsm.exe

Filesize
939KB

MD5
ef0216de61627d741186a5c179ac18db

SHA1
1b6003d793ed0a3694887c2707dd1bb78007bd79

SHA256
e9fff7d1ddd19506c16dfa688a020fc54cfd31007b590a0a370f07c0fdff7b36

SHA512
e085a90d9c8a69a092a055cd62ffb43af5426920c2fa4cdd472d7bf1adecd3bc2075964aa68fa31afc8800d30bfc670ae70a2ebe312778ae9039e19a192155a1

Download Submit
C:\Users\Admin\Music\lsm.exe

Filesize
1.0MB

MD5
d0ab2ad3eea7f098e2dafdcde20e820d

SHA1
20c6da69679b82f922d748c622a7e72340fd654c

SHA256
6e2c404a7693db295a0a4ce5c1c653edad58b142ae6ca2b3fa1a817f72305784

SHA512
856ac10d4f5dae0b3fbd0dd81a57dcfd527687d26c0fceb94ef0693178e667e6b7ad8d9bc596f75b33f80e78ccdba3ab7a1b7900c2806f8531c5ceeccf57897d

Download Submit
C:\Users\Admin\Music\lsm.exe

Filesize
1.9MB

MD5
f330824fee943bbe2408575bc6925fc0

SHA1
d95f4abd53c2be4348fb4984fc23d4daef928f29

SHA256
3f4fecd29a90ce9d9f1025661c714e193815ad3edcb0171aa120d9b43ca9dc5d

SHA512
eed96c4c83284aa8444936b799279585146eb5b1647b70405c93b522e26675b89b7adb2afe8b34c26c11a4ed0d0216376d0fba7dea3c63c08b99ba46be504b03

Download Submit
\Chainnet\hyperInto.exe

Filesize
565KB

MD5
0e8d1afd9b1e7a77095596cfddbb7681

SHA1
15300c9029adb690343b9ded90437f52a462ab62

SHA256
25466a5cc7f08e9491f4c24c68ae33e951c64cff969d1910d17358a042a08cf1

SHA512
21d1aeea9178ed757331c2092f0acb08df2b1889cab9ce63ac6230fe41e8488abf7bb18da561f5f1fc1db05ce4ef412ba4ce8f5343dde78011691084ec00e5b0

Download Submit
\Chainnet\hyperInto.exe

Filesize
405KB

MD5
e3e0d9f98adcba2996615a822a45b124

SHA1
a31cd9856e78ac476c3fde8aca5041a03743fdce

SHA256
4b203fb53777242305224db8561469099d33b84576822d8796d1d76ed05b54d6

SHA512
57ff16be90a9321d7ffd2e365ef516deb09501ef9cd47d9d35497c3c1c9597b04e22611cbec446bd40c323826a6feff93cbcf1bbfa8d5c46bbf2e8bf236873cb

Download Submit
memory/1028-96-0x0000000000D30000-0x0000000000D3A000-memory.dmp

Filesize
40KB

Download
memory/1028-87-0x00000000005F0000-0x00000000005F8000-memory.dmp

Filesize
32KB

Download
memory/1028-90-0x0000000000CD0000-0x0000000000CDC000-memory.dmp

Filesize
48KB

Download
memory/1028-91-0x0000000000CE0000-0x0000000000CE8000-memory.dmp

Filesize
32KB

Download
memory/1028-100-0x0000000000F00000-0x0000000000F08000-memory.dmp

Filesize
32KB

Download
memory/1028-102-0x0000000000F20000-0x0000000000F28000-memory.dmp

Filesize
32KB

Download
memory/1028-103-0x0000000000FB0000-0x0000000000FBA000-memory.dmp

Filesize
40KB

Download
memory/1028-101-0x0000000000F10000-0x0000000000F1C000-memory.dmp

Filesize
48KB

Download
memory/1028-94-0x0000000000D10000-0x0000000000D18000-memory.dmp

Filesize
32KB

Download
memory/1028-98-0x0000000000EE0000-0x0000000000EE8000-memory.dmp

Filesize
32KB

Download
memory/1028-99-0x0000000000EF0000-0x0000000000EFE000-memory.dmp

Filesize
56KB

Download
memory/1028-67-0x000007FEF5A40000-0x000007FEF642C000-memory.dmp

Filesize
9.9MB

Download
memory/1028-66-0x00000000010A0000-0x000000000140A000-memory.dmp

Filesize
3.4MB

Download
memory/1028-68-0x000000001B7D0000-0x000000001B850000-memory.dmp

Filesize
512KB

Download
memory/1028-97-0x0000000000D40000-0x0000000000D4E000-memory.dmp

Filesize
56KB

Download
memory/1028-70-0x00000000002B0000-0x00000000002BE000-memory.dmp

Filesize
56KB

Download
memory/1028-71-0x00000000002C0000-0x00000000002CE000-memory.dmp

Filesize
56KB

Download
memory/1028-75-0x0000000000490000-0x00000000004A0000-memory.dmp

Filesize
64KB

Download
memory/1028-78-0x00000000004F0000-0x0000000000502000-memory.dmp

Filesize
72KB

Download
memory/1028-77-0x00000000004C0000-0x00000000004C8000-memory.dmp

Filesize
32KB

Download
memory/1028-76-0x00000000004A0000-0x00000000004B6000-memory.dmp

Filesize
88KB

Download
memory/1028-79-0x0000000000500000-0x000000000050C000-memory.dmp

Filesize
48KB

Download
memory/1028-74-0x0000000000480000-0x0000000000488000-memory.dmp

Filesize
32KB

Download
memory/1028-73-0x0000000000460000-0x000000000047C000-memory.dmp

Filesize
112KB

Download
memory/1028-72-0x00000000002D0000-0x00000000002D8000-memory.dmp

Filesize
32KB

Download
memory/1028-81-0x00000000004E0000-0x00000000004F0000-memory.dmp

Filesize
64KB

Download
memory/1028-82-0x0000000000510000-0x000000000051A000-memory.dmp

Filesize
40KB

Download
memory/1028-80-0x00000000004D0000-0x00000000004D8000-memory.dmp

Filesize
32KB

Download
memory/1028-83-0x0000000000540000-0x0000000000596000-memory.dmp

Filesize
344KB

Download
memory/1028-84-0x0000000000520000-0x000000000052C000-memory.dmp

Filesize
48KB

Download
memory/1028-88-0x0000000000600000-0x0000000000612000-memory.dmp

Filesize
72KB

Download
memory/1028-95-0x0000000000D20000-0x0000000000D2C000-memory.dmp

Filesize
48KB

Download
memory/1028-86-0x00000000005E0000-0x00000000005EC000-memory.dmp

Filesize
48KB

Download
memory/1028-85-0x00000000005D0000-0x00000000005D8000-memory.dmp

Filesize
32KB

Download
memory/1028-89-0x0000000000CC0000-0x0000000000CCC000-memory.dmp

Filesize
48KB

Download
memory/1028-93-0x0000000000D00000-0x0000000000D0C000-memory.dmp

Filesize
48KB

Download
memory/1028-92-0x0000000000CF0000-0x0000000000CFC000-memory.dmp

Filesize
48KB

Download
memory/2248-15-0x000007FEEE600000-0x000007FEEEF9D000-memory.dmp

Filesize
9.6MB

Download
memory/2248-8-0x000007FEEE600000-0x000007FEEEF9D000-memory.dmp

Filesize
9.6MB

Download
memory/2248-7-0x000000001B5B0000-0x000000001B892000-memory.dmp

Filesize
2.9MB

Download
memory/2248-10-0x0000000002690000-0x0000000002698000-memory.dmp

Filesize
32KB

Download
memory/2248-9-0x0000000002990000-0x0000000002A10000-memory.dmp

Filesize
512KB

Download
memory/2248-11-0x000007FEEE600000-0x000007FEEEF9D000-memory.dmp

Filesize
9.6MB

Download
memory/2248-12-0x0000000002990000-0x0000000002A10000-memory.dmp

Filesize
512KB

Download
memory/2248-13-0x0000000002990000-0x0000000002A10000-memory.dmp

Filesize
512KB

Download
memory/2248-14-0x0000000002990000-0x0000000002A10000-memory.dmp

Filesize
512KB

Download
memory/2404-35-0x0000000002900000-0x0000000002980000-memory.dmp

Filesize
512KB

Download
memory/2404-33-0x000007FEEDC60000-0x000007FEEE5FD000-memory.dmp

Filesize
9.6MB

Download
memory/2404-38-0x0000000002900000-0x0000000002980000-memory.dmp

Filesize
512KB

Download
memory/2404-32-0x0000000001C80000-0x0000000001C88000-memory.dmp

Filesize
32KB

Download
memory/2404-30-0x000007FEEDC60000-0x000007FEEE5FD000-memory.dmp

Filesize
9.6MB

Download
memory/2404-31-0x0000000002900000-0x0000000002980000-memory.dmp

Filesize
512KB

Download
memory/2404-29-0x000000001B570000-0x000000001B852000-memory.dmp

Filesize
2.9MB

Download
memory/2404-39-0x000007FEEDC60000-0x000007FEEE5FD000-memory.dmp

Filesize
9.6MB

Download
memory/2404-34-0x0000000002900000-0x0000000002980000-memory.dmp

Filesize
512KB

Download
memory/2516-37-0x00000000002D0000-0x0000000000350000-memory.dmp

Filesize
512KB

Download
memory/2516-23-0x000007FEF5A40000-0x000007FEF642C000-memory.dmp

Filesize
9.9MB

Download
memory/2516-22-0x00000000012C0000-0x0000000001300000-memory.dmp

Filesize
256KB

Download
memory/2516-69-0x000007FEF5A40000-0x000007FEF642C000-memory.dmp

Filesize
9.9MB

Download
memory/2592-36-0x000007FEF5A40000-0x000007FEF642C000-memory.dmp

Filesize
9.9MB

Download
memory/2592-47-0x000007FEF5A40000-0x000007FEF642C000-memory.dmp

Filesize
9.9MB

Download
memory/2592-0-0x0000000001020000-0x000000000136A000-memory.dmp

Filesize
3.3MB

Download
memory/2592-2-0x000000001BC20000-0x000000001BCA0000-memory.dmp

Filesize
512KB

Download
memory/2592-1-0x000007FEF5A40000-0x000007FEF642C000-memory.dmp

Filesize
9.9MB

Download