dcrat | ebb63a7970ae2ca874bb92352e3aef098a8db5d181c30ed20a071b2c5fa6994a

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26-03-2024 01:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7803d28b1cfcb0c4f3a63515fea88508357e02dc2ee982f7ff1f0c2f40af3649.exe
Size

3.3MB
MD5

1d6590415fa189e9c982e883dc3bcdde
SHA1

8261a5718af6eb9ebee4e822e5bd0138f7915dc3
SHA256

7803d28b1cfcb0c4f3a63515fea88508357e02dc2ee982f7ff1f0c2f40af3649
SHA512

304611cfa8c130dde5e4de5282d3d92a555b85d50889ea097dec9908d619c7d36ec28886c64aa0364d631c289d9bbf509c0ea0aeb7887c92fd91ee3d7834d07e
SSDEEP

98304:oZ1HRsp8NbXaaIptoNMrF4NOgmwCof84h:oZVIaIpeOrmNOTwCol

Score

10^/10

dcrat umbral evasion infostealer rat stealer trojan

Malware Config

Extracted

Family

umbral

https://discord.com/api/webhooks/1219193245557325834/Pny7ckgnLuo9kv28SEntCevPyhBWlY4AfJu4MogOozH9-s-mNnQ7UZJcF1RdHsmmAwgC

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Detect Umbral payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0009000000023214-29.dat	family_umbral
behavioral2/memory/2888-31-0x0000013016080000-0x00000130160C0000-memory.dmp	family_umbral

Process spawned unexpected child process 45 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3936	920	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2056	920	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4252	920	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3476	920	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4340	920	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1376	920	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	60	920	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2888	920	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3788	920	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1956	920	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4336	920	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3908	920	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3804	920	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	688	920	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	924	920	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4316	920	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1120	920	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	656	920	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2160	920	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4392	920	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4264	920	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2868	920	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3956	920	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2916	920	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	816	920	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4304	920	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1944	920	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4360	920	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4820	920	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1924	920	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4412	920	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	888	920	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2796	920	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2580	920	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3900	920	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2232	920	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2672	920	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4228	920	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3460	920	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4928	920	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2524	920	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1260	920	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1984	920	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1528	920	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4384	920	schtasks.exe	95

UAC bypass 3 TTPs 45 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	hyperInto.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	hyperInto.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	hyperInto.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral

DCRat payload 8 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x000900000002321b-53.dat	dcrat
behavioral2/files/0x0007000000023223-78.dat	dcrat
behavioral2/files/0x0007000000023223-77.dat	dcrat
behavioral2/memory/2060-79-0x00000000001E0000-0x000000000054A000-memory.dmp	dcrat
behavioral2/files/0x000700000002322a-121.dat	dcrat
behavioral2/files/0x0007000000023226-158.dat	dcrat
behavioral2/files/0x0007000000023226-159.dat	dcrat
behavioral2/files/0x0007000000023226-300.dat	dcrat

Blocklisted process makes network request 1 IoCs

flow	pid	Process
37	2888	Saransk.exe

Checks computer location settings 2 TTPs 18 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	7803d28b1cfcb0c4f3a63515fea88508357e02dc2ee982f7ff1f0c2f40af3649.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	sysmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	sysmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	sysmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	sysmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	sysmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	sysmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	sysmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	sysmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	sysmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	sysmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	sysmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	sysmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	Injector.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	hyperInto.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	sysmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	sysmon.exe

Executes dropped EXE 17 IoCs

pid	Process
2888	Saransk.exe
924	Injector.exe
2060	hyperInto.exe
3736	sysmon.exe
1152	sysmon.exe
3680	sysmon.exe
1732	sysmon.exe
2972	sysmon.exe
1988	sysmon.exe
4688	sysmon.exe
3836	sysmon.exe
4068	sysmon.exe
4840	sysmon.exe
884	sysmon.exe
1800	sysmon.exe
1872	sysmon.exe
4252	sysmon.exe

Checks whether UAC is enabled 1 TTPs 30 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sysmon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	hyperInto.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sysmon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sysmon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sysmon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sysmon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sysmon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sysmon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	hyperInto.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sysmon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sysmon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sysmon.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
27	ip-api.com

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Security\BrowserCore\spoolsv.exe	hyperInto.exe
File created	C:\Program Files\Windows Security\BrowserCore\f3b6ecef712a24	hyperInto.exe
File created	C:\Program Files\Windows Defender\de-DE\ee2ad38f3d4382	hyperInto.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\sysmon.exe	hyperInto.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\121e5b5079f7c0	hyperInto.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\HoloAssets\sysmon.exe	hyperInto.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Acrobat\winlogon.exe	hyperInto.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Acrobat\cc11b995f2a76d	hyperInto.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\sysmon.exe	hyperInto.exe
File created	C:\Program Files\Windows Defender\es-ES\RuntimeBroker.exe	hyperInto.exe
File created	C:\Program Files\Windows Defender\es-ES\9e8d7a4ca61bd9	hyperInto.exe
File created	C:\Program Files\Windows Defender\de-DE\Registry.exe	hyperInto.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\uk-UA\55b276f4edf653	hyperInto.exe
File created	C:\Windows\PrintDialog\pris\cmd.exe	hyperInto.exe
File created	C:\Windows\PrintDialog\pris\ebf1f9fa8afd6d	hyperInto.exe
File created	C:\Windows\Media\Quirky\upfc.exe	hyperInto.exe
File created	C:\Windows\Media\Quirky\ea1d8f6d871115	hyperInto.exe
File created	C:\Windows\uk-UA\StartMenuExperienceHost.exe	hyperInto.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 45 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4252	schtasks.exe
1376	schtasks.exe
2916	schtasks.exe
4336	schtasks.exe
656	schtasks.exe
2868	schtasks.exe
4304	schtasks.exe
2232	schtasks.exe
4928	schtasks.exe
1528	schtasks.exe
3936	schtasks.exe
2056	schtasks.exe
1944	schtasks.exe
4412	schtasks.exe
3900	schtasks.exe
2524	schtasks.exe
3476	schtasks.exe
3908	schtasks.exe
924	schtasks.exe
2160	schtasks.exe
3956	schtasks.exe
816	schtasks.exe
2580	schtasks.exe
4340	schtasks.exe
4360	schtasks.exe
4820	schtasks.exe
888	schtasks.exe
3460	schtasks.exe
1260	schtasks.exe
1984	schtasks.exe
2888	schtasks.exe
3804	schtasks.exe
688	schtasks.exe
4392	schtasks.exe
4264	schtasks.exe
4228	schtasks.exe
1120	schtasks.exe
2672	schtasks.exe
4384	schtasks.exe
60	schtasks.exe
3788	schtasks.exe
1956	schtasks.exe
4316	schtasks.exe
1924	schtasks.exe
2796	schtasks.exe

Modifies registry class 16 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings	sysmon.exe
Key created	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings	sysmon.exe
Key created	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings	sysmon.exe
Key created	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings	Injector.exe
Key created	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings	hyperInto.exe
Key created	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings	sysmon.exe
Key created	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings	sysmon.exe
Key created	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings	sysmon.exe
Key created	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings	sysmon.exe
Key created	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings	sysmon.exe
Key created	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings	sysmon.exe
Key created	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings	sysmon.exe
Key created	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings	sysmon.exe
Key created	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings	sysmon.exe
Key created	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings	sysmon.exe
Key created	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings	sysmon.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4364	powershell.exe
4364	powershell.exe
2904	powershell.exe
2904	powershell.exe
2904	powershell.exe
2060	hyperInto.exe
2060	hyperInto.exe
2060	hyperInto.exe
2060	hyperInto.exe
2060	hyperInto.exe
2060	hyperInto.exe
2060	hyperInto.exe
2060	hyperInto.exe
2060	hyperInto.exe
2060	hyperInto.exe
2060	hyperInto.exe
2060	hyperInto.exe
2060	hyperInto.exe
2060	hyperInto.exe
3736	sysmon.exe
3736	sysmon.exe
3736	sysmon.exe
3736	sysmon.exe
3736	sysmon.exe
3736	sysmon.exe
3736	sysmon.exe
3736	sysmon.exe
3736	sysmon.exe
3736	sysmon.exe
3736	sysmon.exe
3736	sysmon.exe
3736	sysmon.exe
3736	sysmon.exe
3736	sysmon.exe
3736	sysmon.exe
3736	sysmon.exe
3736	sysmon.exe
3736	sysmon.exe
3736	sysmon.exe
3736	sysmon.exe
3736	sysmon.exe
3736	sysmon.exe
3736	sysmon.exe
3736	sysmon.exe
3736	sysmon.exe
3736	sysmon.exe
3736	sysmon.exe
3736	sysmon.exe
1152	sysmon.exe
1152	sysmon.exe
1152	sysmon.exe
1152	sysmon.exe
1152	sysmon.exe
1152	sysmon.exe
1152	sysmon.exe
1152	sysmon.exe
1152	sysmon.exe
1152	sysmon.exe
1152	sysmon.exe
1152	sysmon.exe
1152	sysmon.exe
1152	sysmon.exe
1152	sysmon.exe
1152	sysmon.exe

Suspicious use of AdjustPrivilegeToken 60 IoCs

description	pid	Process
Token: SeDebugPrivilege	3768	7803d28b1cfcb0c4f3a63515fea88508357e02dc2ee982f7ff1f0c2f40af3649.exe
Token: SeDebugPrivilege	4364	powershell.exe
Token: SeDebugPrivilege	2904	powershell.exe
Token: SeDebugPrivilege	2888	Saransk.exe
Token: SeIncreaseQuotaPrivilege	1984	wmic.exe
Token: SeSecurityPrivilege	1984	wmic.exe
Token: SeTakeOwnershipPrivilege	1984	wmic.exe
Token: SeLoadDriverPrivilege	1984	wmic.exe
Token: SeSystemProfilePrivilege	1984	wmic.exe
Token: SeSystemtimePrivilege	1984	wmic.exe
Token: SeProfSingleProcessPrivilege	1984	wmic.exe
Token: SeIncBasePriorityPrivilege	1984	wmic.exe
Token: SeCreatePagefilePrivilege	1984	wmic.exe
Token: SeBackupPrivilege	1984	wmic.exe
Token: SeRestorePrivilege	1984	wmic.exe
Token: SeShutdownPrivilege	1984	wmic.exe
Token: SeDebugPrivilege	1984	wmic.exe
Token: SeSystemEnvironmentPrivilege	1984	wmic.exe
Token: SeRemoteShutdownPrivilege	1984	wmic.exe
Token: SeUndockPrivilege	1984	wmic.exe
Token: SeManageVolumePrivilege	1984	wmic.exe
Token: 33	1984	wmic.exe
Token: 34	1984	wmic.exe
Token: 35	1984	wmic.exe
Token: 36	1984	wmic.exe
Token: SeIncreaseQuotaPrivilege	1984	wmic.exe
Token: SeSecurityPrivilege	1984	wmic.exe
Token: SeTakeOwnershipPrivilege	1984	wmic.exe
Token: SeLoadDriverPrivilege	1984	wmic.exe
Token: SeSystemProfilePrivilege	1984	wmic.exe
Token: SeSystemtimePrivilege	1984	wmic.exe
Token: SeProfSingleProcessPrivilege	1984	wmic.exe
Token: SeIncBasePriorityPrivilege	1984	wmic.exe
Token: SeCreatePagefilePrivilege	1984	wmic.exe
Token: SeBackupPrivilege	1984	wmic.exe
Token: SeRestorePrivilege	1984	wmic.exe
Token: SeShutdownPrivilege	1984	wmic.exe
Token: SeDebugPrivilege	1984	wmic.exe
Token: SeSystemEnvironmentPrivilege	1984	wmic.exe
Token: SeRemoteShutdownPrivilege	1984	wmic.exe
Token: SeUndockPrivilege	1984	wmic.exe
Token: SeManageVolumePrivilege	1984	wmic.exe
Token: 33	1984	wmic.exe
Token: 34	1984	wmic.exe
Token: 35	1984	wmic.exe
Token: 36	1984	wmic.exe
Token: SeDebugPrivilege	2060	hyperInto.exe
Token: SeDebugPrivilege	3736	sysmon.exe
Token: SeDebugPrivilege	1152	sysmon.exe
Token: SeDebugPrivilege	3680	sysmon.exe
Token: SeDebugPrivilege	1732	sysmon.exe
Token: SeDebugPrivilege	2972	sysmon.exe
Token: SeDebugPrivilege	1988	sysmon.exe
Token: SeDebugPrivilege	4688	sysmon.exe
Token: SeDebugPrivilege	3836	sysmon.exe
Token: SeDebugPrivilege	4068	sysmon.exe
Token: SeDebugPrivilege	4840	sysmon.exe
Token: SeDebugPrivilege	884	sysmon.exe
Token: SeDebugPrivilege	1872	sysmon.exe
Token: SeDebugPrivilege	4252	sysmon.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3768 wrote to memory of 4364	3768	7803d28b1cfcb0c4f3a63515fea88508357e02dc2ee982f7ff1f0c2f40af3649.exe	96
PID 3768 wrote to memory of 4364	3768	7803d28b1cfcb0c4f3a63515fea88508357e02dc2ee982f7ff1f0c2f40af3649.exe	96
PID 3768 wrote to memory of 2888	3768	7803d28b1cfcb0c4f3a63515fea88508357e02dc2ee982f7ff1f0c2f40af3649.exe	131
PID 3768 wrote to memory of 2888	3768	7803d28b1cfcb0c4f3a63515fea88508357e02dc2ee982f7ff1f0c2f40af3649.exe	131
PID 3768 wrote to memory of 2904	3768	7803d28b1cfcb0c4f3a63515fea88508357e02dc2ee982f7ff1f0c2f40af3649.exe	102
PID 3768 wrote to memory of 2904	3768	7803d28b1cfcb0c4f3a63515fea88508357e02dc2ee982f7ff1f0c2f40af3649.exe	102
PID 2888 wrote to memory of 1984	2888	Saransk.exe	122
PID 2888 wrote to memory of 1984	2888	Saransk.exe	122
PID 3768 wrote to memory of 924	3768	7803d28b1cfcb0c4f3a63515fea88508357e02dc2ee982f7ff1f0c2f40af3649.exe	136
PID 3768 wrote to memory of 924	3768	7803d28b1cfcb0c4f3a63515fea88508357e02dc2ee982f7ff1f0c2f40af3649.exe	136
PID 3768 wrote to memory of 924	3768	7803d28b1cfcb0c4f3a63515fea88508357e02dc2ee982f7ff1f0c2f40af3649.exe	136
PID 924 wrote to memory of 3588	924	Injector.exe	109
PID 924 wrote to memory of 3588	924	Injector.exe	109
PID 924 wrote to memory of 3588	924	Injector.exe	109
PID 924 wrote to memory of 4240	924	Injector.exe	110
PID 924 wrote to memory of 4240	924	Injector.exe	110
PID 924 wrote to memory of 4240	924	Injector.exe	110
PID 3588 wrote to memory of 4896	3588	WScript.exe	111
PID 3588 wrote to memory of 4896	3588	WScript.exe	111
PID 3588 wrote to memory of 4896	3588	WScript.exe	111
PID 4896 wrote to memory of 2060	4896	cmd.exe	113
PID 4896 wrote to memory of 2060	4896	cmd.exe	113
PID 2060 wrote to memory of 1860	2060	hyperInto.exe	160
PID 2060 wrote to memory of 1860	2060	hyperInto.exe	160
PID 1860 wrote to memory of 1984	1860	cmd.exe	122
PID 1860 wrote to memory of 1984	1860	cmd.exe	122
PID 1860 wrote to memory of 3736	1860	cmd.exe	165
PID 1860 wrote to memory of 3736	1860	cmd.exe	165
PID 3736 wrote to memory of 1248	3736	sysmon.exe	166
PID 3736 wrote to memory of 1248	3736	sysmon.exe	166
PID 3736 wrote to memory of 2612	3736	sysmon.exe	167
PID 3736 wrote to memory of 2612	3736	sysmon.exe	167
PID 1248 wrote to memory of 1152	1248	WScript.exe	168
PID 1248 wrote to memory of 1152	1248	WScript.exe	168
PID 1152 wrote to memory of 1744	1152	sysmon.exe	169
PID 1152 wrote to memory of 1744	1152	sysmon.exe	169
PID 1152 wrote to memory of 1976	1152	sysmon.exe	170
PID 1152 wrote to memory of 1976	1152	sysmon.exe	170
PID 1744 wrote to memory of 3680	1744	WScript.exe	171
PID 1744 wrote to memory of 3680	1744	WScript.exe	171
PID 3680 wrote to memory of 4408	3680	sysmon.exe	175
PID 3680 wrote to memory of 4408	3680	sysmon.exe	175
PID 3680 wrote to memory of 1724	3680	sysmon.exe	176
PID 3680 wrote to memory of 1724	3680	sysmon.exe	176
PID 4408 wrote to memory of 1732	4408	WScript.exe	177
PID 4408 wrote to memory of 1732	4408	WScript.exe	177
PID 1732 wrote to memory of 4052	1732	sysmon.exe	178
PID 1732 wrote to memory of 4052	1732	sysmon.exe	178
PID 1732 wrote to memory of 1432	1732	sysmon.exe	179
PID 1732 wrote to memory of 1432	1732	sysmon.exe	179
PID 4052 wrote to memory of 2972	4052	WScript.exe	180
PID 4052 wrote to memory of 2972	4052	WScript.exe	180
PID 2972 wrote to memory of 816	2972	sysmon.exe	181
PID 2972 wrote to memory of 816	2972	sysmon.exe	181
PID 2972 wrote to memory of 4972	2972	sysmon.exe	182
PID 2972 wrote to memory of 4972	2972	sysmon.exe	182
PID 816 wrote to memory of 1988	816	WScript.exe	184
PID 816 wrote to memory of 1988	816	WScript.exe	184
PID 1988 wrote to memory of 532	1988	sysmon.exe	185
PID 1988 wrote to memory of 532	1988	sysmon.exe	185
PID 1988 wrote to memory of 1160	1988	sysmon.exe	186
PID 1988 wrote to memory of 1160	1988	sysmon.exe	186
PID 532 wrote to memory of 4688	532	WScript.exe	187
PID 532 wrote to memory of 4688	532	WScript.exe	187

System policy modification 1 TTPs 45 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	hyperInto.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	hyperInto.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	hyperInto.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\7803d28b1cfcb0c4f3a63515fea88508357e02dc2ee982f7ff1f0c2f40af3649.exe
"C:\Users\Admin\AppData\Local\Temp\7803d28b1cfcb0c4f3a63515fea88508357e02dc2ee982f7ff1f0c2f40af3649.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3768
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Saransk.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4364
- C:\Users\Admin\AppData\Local\Temp\Saransk.exe
  "C:\Users\Admin\AppData\Local\Temp\Saransk.exe"
  2⤵
  - Blocklisted process makes network request
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2888
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1984
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Injector.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2904
- C:\Users\Admin\AppData\Local\Temp\Injector.exe
  "C:\Users\Admin\AppData\Local\Temp\Injector.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:924
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Chainnet\8f9Z3.vbe"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:3588
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Chainnet\oniRrs8nIuzVsaH8sYiTK.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4896
    - - C:\Chainnet\hyperInto.exe
        
        "C:\Chainnet\hyperInto.exe"
        5⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Drops file in Program Files directory
        Drops file in Windows directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2060
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\UEiHGLQwOy.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1860
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:1984
        
        C:\Program Files (x86)\Windows Sidebar\Gadgets\sysmon.exe
        
        "C:\Program Files (x86)\Windows Sidebar\Gadgets\sysmon.exe"
        7⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:3736
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a3a6815f-e9bc-40dd-b24b-16053caee7f4.vbs"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:1248
        
        C:\Program Files (x86)\Windows Sidebar\Gadgets\sysmon.exe
        
        "C:\Program Files (x86)\Windows Sidebar\Gadgets\sysmon.exe"
        9⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1152
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a5ab1021-7e54-440f-b1c1-19bf6ae44f3d.vbs"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:1744
        
        C:\Program Files (x86)\Windows Sidebar\Gadgets\sysmon.exe
        
        "C:\Program Files (x86)\Windows Sidebar\Gadgets\sysmon.exe"
        11⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:3680
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c3bab190-de99-45cb-af9d-f40b69f6f6f6.vbs"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:4408
        
        C:\Program Files (x86)\Windows Sidebar\Gadgets\sysmon.exe
        
        "C:\Program Files (x86)\Windows Sidebar\Gadgets\sysmon.exe"
        13⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1732
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\381ec769-6112-4bf5-81ac-c323fb975929.vbs"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:4052
        
        C:\Program Files (x86)\Windows Sidebar\Gadgets\sysmon.exe
        
        "C:\Program Files (x86)\Windows Sidebar\Gadgets\sysmon.exe"
        15⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2972
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c04f02b6-e914-4e02-9a41-f2117b491ac9.vbs"
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:816
        
        C:\Program Files (x86)\Windows Sidebar\Gadgets\sysmon.exe
        
        "C:\Program Files (x86)\Windows Sidebar\Gadgets\sysmon.exe"
        17⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1988
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\67404d91-8dcd-4feb-9055-857de0821b1d.vbs"
        18⤵
        Suspicious use of WriteProcessMemory
        
        PID:532
        
        C:\Program Files (x86)\Windows Sidebar\Gadgets\sysmon.exe
        
        "C:\Program Files (x86)\Windows Sidebar\Gadgets\sysmon.exe"
        19⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4688
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e01f9198-b15d-4c4e-bd2c-bb775b4b49d7.vbs"
        20⤵
        
        PID:4644
        
        C:\Program Files (x86)\Windows Sidebar\Gadgets\sysmon.exe
        
        "C:\Program Files (x86)\Windows Sidebar\Gadgets\sysmon.exe"
        21⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3836
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ab88f1cc-e606-491b-b4e5-6a43b9940e08.vbs"
        22⤵
        
        PID:2096
        
        C:\Program Files (x86)\Windows Sidebar\Gadgets\sysmon.exe
        
        "C:\Program Files (x86)\Windows Sidebar\Gadgets\sysmon.exe"
        23⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4068
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3262af31-ede3-49c0-a791-5de3574908c3.vbs"
        24⤵
        
        PID:1144
        
        C:\Program Files (x86)\Windows Sidebar\Gadgets\sysmon.exe
        
        "C:\Program Files (x86)\Windows Sidebar\Gadgets\sysmon.exe"
        25⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4840
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5dcbe35c-15e2-40cf-aef0-4a0db72d477e.vbs"
        26⤵
        
        PID:1788
        
        C:\Program Files (x86)\Windows Sidebar\Gadgets\sysmon.exe
        
        "C:\Program Files (x86)\Windows Sidebar\Gadgets\sysmon.exe"
        27⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:884
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\11ac3b59-4315-4be0-86fd-51744bf0bd7c.vbs"
        28⤵
        
        PID:2568
        
        C:\Program Files (x86)\Windows Sidebar\Gadgets\sysmon.exe
        
        "C:\Program Files (x86)\Windows Sidebar\Gadgets\sysmon.exe"
        29⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        System policy modification
        
        PID:1800
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fa41bc39-db54-4360-b43f-649b28dff9d6.vbs"
        30⤵
        
        PID:2504
        
        C:\Program Files (x86)\Windows Sidebar\Gadgets\sysmon.exe
        
        "C:\Program Files (x86)\Windows Sidebar\Gadgets\sysmon.exe"
        31⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1872
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d807a613-f9e3-4790-8998-dc86d2d8ece3.vbs"
        32⤵
        
        PID:4796
        
        C:\Program Files (x86)\Windows Sidebar\Gadgets\sysmon.exe
        
        "C:\Program Files (x86)\Windows Sidebar\Gadgets\sysmon.exe"
        33⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4252
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bbc1deab-6d55-4f73-b298-a0f3a1a5435a.vbs"
        34⤵
        
        PID:336
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\80f8eb04-ee16-43ce-84ab-40dcd1281813.vbs"
        34⤵
        
        PID:4672
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f5105e81-7f08-4321-a0e5-0bd7abe7bf51.vbs"
        32⤵
        
        PID:2060
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\67fd576c-0d86-4ab9-bbf3-3e20c4b4d13f.vbs"
        30⤵
        
        PID:4980
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5ce969c4-1bcd-4f7e-b2eb-01d43caeccc6.vbs"
        28⤵
        
        PID:3956
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\641aebe9-3bb0-4d9c-be97-a7129cb78055.vbs"
        26⤵
        
        PID:4496
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9bd1afce-b368-4328-be7d-8642a4954317.vbs"
        24⤵
        
        PID:720
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\64c2ff7e-1386-4d15-8858-06b6ae7adc17.vbs"
        22⤵
        
        PID:4344
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d8415df6-d154-4df3-9c3d-542cfb45f0d6.vbs"
        20⤵
        
        PID:5000
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\04034702-5fa1-4d18-a9b9-843aa88ebcb2.vbs"
        18⤵
        
        PID:1160
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4ea41581-dadb-4ef6-b103-61e9138a4b41.vbs"
        16⤵
        
        PID:4972
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\62c12524-6b4d-47ea-9fc8-b9e39908d38c.vbs"
        14⤵
        
        PID:1432
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\030e5cb9-6028-4cd1-8f9e-6221007a92b4.vbs"
        12⤵
        
        PID:1724
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cd340eb3-d39b-4f5f-93be-a81027de50b2.vbs"
        10⤵
        
        PID:1976
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7933744a-0d18-4a4a-856a-4b20f7a7e4b6.vbs"
        8⤵
        
        PID:2612
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Chainnet\file.vbs"
    3⤵
    PID:4240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 13 /tr "'C:\Chainnet\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Chainnet\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 5 /tr "'C:\Chainnet\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Defender\es-ES\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\es-ES\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Defender\es-ES\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\AppData\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\Admin\AppData\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\AppData\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Common Files\Adobe\Acrobat\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Adobe\Acrobat\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Common Files\Adobe\Acrobat\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:60

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 8 /tr "'C:\Windows\Media\Quirky\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Windows\Media\Quirky\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 7 /tr "'C:\Windows\Media\Quirky\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Chainnet\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Chainnet\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Chainnet\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Security\BrowserCore\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Windows Security\BrowserCore\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Security\BrowserCore\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 14 /tr "'C:\odt\WaaSMedicAgent.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgent" /sc ONLOGON /tr "'C:\odt\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 5 /tr "'C:\odt\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Defender\de-DE\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\de-DE\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Defender\de-DE\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Chainnet\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Chainnet\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Chainnet\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 11 /tr "'C:\odt\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\odt\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 7 /tr "'C:\odt\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 5 /tr "'C:\Windows\uk-UA\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Windows\uk-UA\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 12 /tr "'C:\Windows\uk-UA\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 8 /tr "'C:\Windows\PrintDialog\pris\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Windows\PrintDialog\pris\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 13 /tr "'C:\Windows\PrintDialog\pris\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Chainnet\8f9Z3.vbe

Filesize
206B

MD5
b3080903ab3740f3f1346f2f61834c2b

SHA1
a5b37c9ea7a58c9194de44382d75dc4863d3d5b7

SHA256
505642ffc3c57426bb6575eb3ac48ea1f3e303fa5b34ea6ccd3fe2f7021619a1

SHA512
a33ace44bf4936bb2747586d590d762da473840179d9553d0b213f12f11a2d10713fb6bb5637058a40bf0b12f710dfe07930476d8ea5765f0dba816389f9e419

Download Submit
C:\Chainnet\backgroundTaskHost.exe

Filesize
3.4MB

MD5
d63861446161da73423a6378ab06af5e

SHA1
8d3116fa2ac5d4e7fb9684498f69edf3e976f977

SHA256
c46e261e262516989fb8205f6e939b13fc19326f936229f024b41b9d4956f8bd

SHA512
7bf3f16a5c455dbf902284ba581097b7ecdefcfb9df55053c868f4ae84e9097b4fb6214c9896cc344ea65979516b20df8e35d19c97de79d52ee27fb86e61eb88

Download Submit
C:\Chainnet\file.vbs

Filesize
34B

MD5
677cc4360477c72cb0ce00406a949c61

SHA1
b679e8c3427f6c5fc47c8ac46cd0e56c9424de05

SHA256
f1cccb5ae4aa51d293bd3c7d2a1a04cb7847d22c5db8e05ac64e9a6d7455aa0b

SHA512
7cfe2cc92f9e659f0a15a295624d611b3363bd01eb5bcf9bc7681ea9b70b0564d192d570d294657c8dc2c93497fa3b4526c975a9bf35d69617c31d9936573c6a

Download Submit
C:\Chainnet\hyperInto.exe

Filesize
2.7MB

MD5
a7ae60d2cbf4ac3ac2d03ba648b5df36

SHA1
f88e80af139107d193351099cd7ef0030812deae

SHA256
21168d9d6e22fc0ed2fd6ce715725c543babaddc29124495b8a5c554f8a95412

SHA512
227042db19298ae6d2c7ae0d2954f9ab4f6e8590739def91d8879919adc99eebec305a63dd0634e1d058e14586c0af7288bfaaafc6852bda27f72fc47bda3df6

Download Submit
C:\Chainnet\hyperInto.exe

Filesize
2.1MB

MD5
02aba8a0005cdfdc3c77811e714110cd

SHA1
cf28ec5bf878524e1ba5bccfef7e21a635c5c7e8

SHA256
38b98e856304c84b59cf81b746944b0d4977ca380e0a07919706ca706add9f5a

SHA512
0363cd666311fa7bee15cf2deb1d054decf4f3c33d3a2289c26cf097bbf69eb514246077a01db1a9e703358791f85e1da5df94c5c87222d05445d8571eff6001

Download Submit
C:\Chainnet\oniRrs8nIuzVsaH8sYiTK.bat

Filesize
27B

MD5
94db4d897ca54289c945a06574084128

SHA1
d4168950c994dacea1402a9570a4735350b86c10

SHA256
a759a78b129faaa486102e6486d595070e7c923bf4159ae7b8eb78fec3c2a461

SHA512
2548059003c4bff60dbe0e9aa5c097bac130ecb7bae7896b83f577bb2aa0e3c1b356545ebc92e3487ef937026c96ef48d2df750b31f0acea9166bfb9342cd28a

Download Submit
C:\Program Files (x86)\Windows Sidebar\Gadgets\sysmon.exe

Filesize
2.5MB

MD5
ac66a649203a68e95f88a862ea8addb0

SHA1
3f648227d32f9225889275fd5d699d4c53c6a7bd

SHA256
35642eb652de90d8e7ec77b570ff8a64b4f5be3051261fade7b0a61f3e4e5ad9

SHA512
2bfaba9a758ca4557103335d011686c1b566098ee343e2407641242499f5cfab0bdf605e95108e5433a3e2ee8c1cd19218114ba2cf2ccc3adab16a72c33c7269

Download Submit
C:\Program Files (x86)\Windows Sidebar\Gadgets\sysmon.exe

Filesize
2.0MB

MD5
3e1bfaa8a58d382bcc005652b29879ae

SHA1
5caac9966ac9b9af7719a17adbf4777ee21377d1

SHA256
aa83314101a8dfece421da3ee9d3eb446989d19bd268053fa97a780744b52eb8

SHA512
6f4a5e7ca58e28e3d485cfb290eb923cc8089dac3f2e45b898498704dc0a2e9c1da69b81b350362d40bef61a65b71a9e988d9d6a620c7f2c7afe2a6ff173ac01

Download Submit
C:\Program Files (x86)\Windows Sidebar\Gadgets\sysmon.exe

Filesize
1.1MB

MD5
8fec55f8dbe09e9d9c3eb78ba5311cf1

SHA1
4ffe40fe68d2a279bfce9c7e4e3c460f4dcc64f4

SHA256
2cdb6434706507b242848035471b09d0a6e1b31bd9d6c42cb3749772f0349e8d

SHA512
e93a4a9b57c69e52cbb3773ac31b1bfa746fd3dc47b6bb56b008663bdb194e832047eb4c346f24aee36f78fe480d8ab4d20ac916c5834632d16acfe52d544560

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\sysmon.exe.log

Filesize
1KB

MD5
49b64127208271d8f797256057d0b006

SHA1
b99bd7e2b4e9ed24de47fb3341ea67660b84cca1

SHA256
2a5d403a2e649d8eceef8f785eeb0f6d33888ec6bbf251b3c347e34cb32b1e77

SHA512
f7c728923c893dc9bc88ad2159e0abcda41e1b40ff7e7756e6252d135ed238a2248a2662b3392449836dd1b0b580f0c866cc33e409527484fe4602e3d3f10e3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d3e9c29fe44e90aae6ed30ccf799ca8

SHA1
c7974ef72264bbdf13a2793ccf1aed11bc565dce

SHA256
2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

SHA512
60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

Download Submit
C:\Users\Admin\AppData\Local\Temp\11ac3b59-4315-4be0-86fd-51744bf0bd7c.vbs

Filesize
732B

MD5
9284dbfba37daabdb3892a093fc40b69

SHA1
4f9e7c3fc818f32b24f27cb78f51e38c92ec2a62

SHA256
25f1e4c4c94479d860a646fb164c6b5581ed7073fa881f67b569aa6f87df1650

SHA512
9eb4dc5907e7fbf4edfb4d95a9246a83e7806c97490a4db07b962868c99a2c90096903354be9ddce1530e69b8920190418fc70f4da3c2451fe424bc338b93b95

Download Submit
C:\Users\Admin\AppData\Local\Temp\3262af31-ede3-49c0-a791-5de3574908c3.vbs

Filesize
733B

MD5
945bf3a6506978d55e5406fb5c3772f8

SHA1
7c67485ec9111b53613efa7c248cb9de9feb6c3d

SHA256
a941075c170b3b6be9f7b74cb7425c361fc71983bd93c4fee4995a85b9475675

SHA512
661a171de3828e897ea08728b6727f486e9597db0d7f64be0c698800b1f2be9ece5c9c8ae26dadfc4d5948fe5d36bca31a32c649417971963e0ab3d91371142a

Download Submit
C:\Users\Admin\AppData\Local\Temp\381ec769-6112-4bf5-81ac-c323fb975929.vbs

Filesize
733B

MD5
0dbb246041b2db0140b1292723008703

SHA1
6bf621c0c7bfd1f185fc8b6d2d7ccd0171fbf4f1

SHA256
e85566131dc3e0f929e5dfc211adc3cc1b6277ec71c464e5fc994cbc0ae37d95

SHA512
55e9a8db535c4ff1e124f0992ca2caa7687b10a5ce4c59cbfa3ac66b2522435a93ae213172df6b3dd7d8d20ba897ee3ef530eacb12ab72fce95c6029cfada3ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\5dcbe35c-15e2-40cf-aef0-4a0db72d477e.vbs

Filesize
733B

MD5
aebec4ae8a9f97d9bce2089254884ab8

SHA1
b8286906c03199945325ef8075dcafcacad24eda

SHA256
6a8c754c678b0655e60a2652b87d4ada3ea74ebae640c9692987bf0f51febef8

SHA512
31e3b0eb106ca60d205214e3dc8c0f51ddcb6448967706d6bbcb113fc8e78be0b8da5fad9c8b51f828cc6ed78adc360d7e3e30946c0e1f4369f3fa866cbb3c79

Download Submit
C:\Users\Admin\AppData\Local\Temp\67404d91-8dcd-4feb-9055-857de0821b1d.vbs

Filesize
733B

MD5
a4c93f39c86be094b86d8ef3332cba69

SHA1
89068c0507199c3a61f2625f389fca23d5e41f32

SHA256
fdc086b691ed06d81884ab1271e5997aa547a5afa822d0c4ade40601225eb6e3

SHA512
ec252b214d8796749f61fe0f1f408b56b046202b4ab5dab1f6d777017d6c4b7e5de7248f168cf99bf8e50089050638e78aa518dcaf55a16472df597222cea477

Download Submit
C:\Users\Admin\AppData\Local\Temp\7933744a-0d18-4a4a-856a-4b20f7a7e4b6.vbs

Filesize
509B

MD5
87b492336f048b32f6114d896084b0c3

SHA1
2b8f5235125b29370e88f6f162e0f5f86600a22f

SHA256
8fee0e618b1871b5794d378c0dec1b2381ba038122c15a13c85a3901a440c747

SHA512
05659c409534e50a80d90aa4f525517fe64c90ad97e183dd4113b7257a25592b5414f903109d078d26730a4375b411e530afc0d444f7e8ecb8548a7205963cff

Download Submit
C:\Users\Admin\AppData\Local\Temp\Injector.exe

Filesize
3.7MB

MD5
323e22b442e4d4f9930c5b65f6d1028c

SHA1
7dadf78756dd00c68d5094a59dc7bcccf3c8346d

SHA256
eaedca12a90cf9afa1d7e42358571269e726ccd5a5c96b6d98c7b242f08e9e00

SHA512
2da37cfe8005ed1e299ad6c3e676abeafd6160b47bb9888d1cbdcb7a82e7955feedb4286ee6dfbe64a1b62814ff1af11a718074854d2699a4a2975d4fbfd5b2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Saransk.exe

Filesize
227KB

MD5
05c183f8c0d871d6081f1ea4096805e4

SHA1
4a05aba815c8471fca4fcc9a789683385b0c24ca

SHA256
eff59569967501a5e21ff3f8be9cc487e30d23e1538aeb121f9ab0955c308849

SHA512
ef35359087662c4213f667c49182ab794fbb28dfe2a5b9e1fad5729e516b1ef08c2d7230a84e4808b693832d7b4ad43530377886cd2c993407a7fe38333ad347

Download Submit
C:\Users\Admin\AppData\Local\Temp\UEiHGLQwOy.bat

Filesize
222B

MD5
c34b5d65a8a54fb597adb4cf3d06d8b0

SHA1
84a257e31c5717471b29ad76cfaae30198aaf8e6

SHA256
3142e487cb0cd66b0753fce5c555ad4ce7cd3df3345be71beba3c875cc3a5eab

SHA512
9c8203a1ec6a1bf139e5a20377021eace52865601da2a553159cf8584821b33b45f38f0a1c414d281592db8be18cc585e595aa348d0f32805e486c5791e671ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_akfn1n0f.x0e.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\a3a6815f-e9bc-40dd-b24b-16053caee7f4.vbs

Filesize
733B

MD5
799ab0567ee22124eef57482985f6a32

SHA1
dd05434eae0facc5ea5baec50135493b869bad26

SHA256
1107bb48883c5915f61e18bc1ddcf5b1e4d41eea752abc8791455fe4130ab8cf

SHA512
26a9b906911f16aace544210677437b0e3054fd4a75ea22ef64d5338c81949b2b769863f6e4e36de46cfa3c05dba24acb48a063aacb01725e80e1cff68fe0c54

Download Submit
C:\Users\Admin\AppData\Local\Temp\a5ab1021-7e54-440f-b1c1-19bf6ae44f3d.vbs

Filesize
733B

MD5
0dbf5b39774ad4d5fcda79a252b9d0cd

SHA1
713986b0aa46ecdb271280bec95f77c84056d58d

SHA256
4ed096af89480279a43426f7e7861f9e6ba4ffcd8f26ed39fc0f84053b7bbc8d

SHA512
b4fd4a679eb24bbaebb0073184d444c0ff2c292ddffe96f9473247c63b61dae57cc58c5b5b21fbc685f4ea38f4284e9e122afceeef6a0ad762fa805adde4110a

Download Submit
C:\Users\Admin\AppData\Local\Temp\ab88f1cc-e606-491b-b4e5-6a43b9940e08.vbs

Filesize
733B

MD5
d3fdc9d5d2af906852ee0284f3cb74e0

SHA1
69ea7d3a08aa4e6c2573bbcde23ad402b791236c

SHA256
08e9ef91d3815f0ed30868055763341a76ebed45a3520e50ef87d1f8482058de

SHA512
b762fe4f45994cc347cb882892ce07079fc2ab3687a7d852b3954430ca9bfb5b7e304b310748afb8ae0da85ce941a9ee40949077a5fa0dc99c9e2ac6599fde52

Download Submit
C:\Users\Admin\AppData\Local\Temp\c04f02b6-e914-4e02-9a41-f2117b491ac9.vbs

Filesize
733B

MD5
ebd9e595cd4c171da889e88694ed8615

SHA1
95d46928743d8cac322b56f2042cbdb9de7bfb7b

SHA256
d8419ef4dae98c6a70c01d194730c2d58a12ad5c2a995858af712829ace45f34

SHA512
489387e4568e7cc860b1de4697e33bfea304d1d6fa9e6093c6eb188b16c8d1a1bcec1f348c213e633ff9cfe433f34652d4817afa90bb752e7b2496c75103ec3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\c3bab190-de99-45cb-af9d-f40b69f6f6f6.vbs

Filesize
733B

MD5
368f7eedd0bf3424bceb5a0624592eeb

SHA1
fe04dc93a73ef4515be6a958e09150b07e713d1d

SHA256
121631ee9c7bfab3933c996ef3d7eb9aa4ecf21473ccdacf5da5e833b91c8acb

SHA512
965aa094c8b3af34b53ceedcadede6d8819fad8aef1bdd373d3f11a30aacdc5928fb9c1ad802c560b15279d405b96f52fab44b0382ad31641e55ef2522203059

Download Submit
C:\Users\Admin\AppData\Local\Temp\d807a613-f9e3-4790-8998-dc86d2d8ece3.vbs

Filesize
733B

MD5
85d5993791942f426a44380d3564f795

SHA1
2b3ab8a3a910d3b332a0087513b606159f16a327

SHA256
8e8de08695196e8b1724303fbc4effd00ee18199eea902bba591ff092d017a30

SHA512
10beeaf4d4a3e1f0874de678d70ed2046b534534855c84d882ad8c9e54588a6c3a3a7644a67f70ecaf5fd5274e7aa02edc4f69d03357ed606271ded0e656fd34

Download Submit
C:\Users\Admin\AppData\Local\Temp\e01f9198-b15d-4c4e-bd2c-bb775b4b49d7.vbs

Filesize
733B

MD5
b19f224a6a82baefa9db43c474cdf209

SHA1
de589b8e8deff7fd9a61013b07f9c7461fe2ea31

SHA256
9ce8e17fd296c28cd0f867bba1a74542775d36394342e1cfc2c2ef3c0336edb2

SHA512
9e4687f69d9e38543afc10d9f9f1a51b60987c2ec5b7b638d1215044cf9eb140a0eb36704b21977f9aa1013d9851b6676920fe2fb5ee3fe48b0b0736ed0480b1

Download Submit
memory/1152-176-0x00007FFB49D40000-0x00007FFB4A801000-memory.dmp

Filesize
10.8MB

Download
memory/1152-177-0x0000000003080000-0x0000000003090000-memory.dmp

Filesize
64KB

Download
memory/1152-178-0x00000000030D0000-0x00000000030E2000-memory.dmp

Filesize
72KB

Download
memory/2060-82-0x0000000002660000-0x000000000266E000-memory.dmp

Filesize
56KB

Download
memory/2060-112-0x000000001BCE0000-0x000000001BCE8000-memory.dmp

Filesize
32KB

Download
memory/2060-104-0x000000001BA70000-0x000000001BA7C000-memory.dmp

Filesize
48KB

Download
memory/2060-92-0x000000001B160000-0x000000001B16C000-memory.dmp

Filesize
48KB

Download
memory/2060-90-0x000000001B0D0000-0x000000001B0D8000-memory.dmp

Filesize
32KB

Download
memory/2060-94-0x000000001B150000-0x000000001B160000-memory.dmp

Filesize
64KB

Download
memory/2060-95-0x000000001B170000-0x000000001B17A000-memory.dmp

Filesize
40KB

Download
memory/2060-93-0x000000001B130000-0x000000001B138000-memory.dmp

Filesize
32KB

Download
memory/2060-96-0x000000001B290000-0x000000001B2E6000-memory.dmp

Filesize
344KB

Download
memory/2060-89-0x000000001B0B0000-0x000000001B0C6000-memory.dmp

Filesize
88KB

Download
memory/2060-87-0x000000001B090000-0x000000001B098000-memory.dmp

Filesize
32KB

Download
memory/2060-100-0x000000001B310000-0x000000001B318000-memory.dmp

Filesize
32KB

Download
memory/2060-101-0x000000001B320000-0x000000001B332000-memory.dmp

Filesize
72KB

Download
memory/2060-99-0x000000001B300000-0x000000001B30C000-memory.dmp

Filesize
48KB

Download
memory/2060-98-0x000000001B2F0000-0x000000001B2F8000-memory.dmp

Filesize
32KB

Download
memory/2060-97-0x000000001B2E0000-0x000000001B2EC000-memory.dmp

Filesize
48KB

Download
memory/2060-84-0x0000000002680000-0x0000000002688000-memory.dmp

Filesize
32KB

Download
memory/2060-86-0x000000001B0E0000-0x000000001B130000-memory.dmp

Filesize
320KB

Download
memory/2060-91-0x000000001B140000-0x000000001B152000-memory.dmp

Filesize
72KB

Download
memory/2060-85-0x0000000002690000-0x00000000026AC000-memory.dmp

Filesize
112KB

Download
memory/2060-105-0x000000001BA80000-0x000000001BA88000-memory.dmp

Filesize
32KB

Download
memory/2060-103-0x000000001B330000-0x000000001B33C000-memory.dmp

Filesize
48KB

Download
memory/2060-108-0x000000001BD20000-0x000000001BD28000-memory.dmp

Filesize
32KB

Download
memory/2060-109-0x000000001BCB0000-0x000000001BCBC000-memory.dmp

Filesize
48KB

Download
memory/2060-107-0x000000001BAA0000-0x000000001BAAC000-memory.dmp

Filesize
48KB

Download
memory/2060-118-0x000000001BD40000-0x000000001BD4C000-memory.dmp

Filesize
48KB

Download
memory/2060-117-0x000000001BE40000-0x000000001BE4A000-memory.dmp

Filesize
40KB

Download
memory/2060-116-0x000000001BD30000-0x000000001BD38000-memory.dmp

Filesize
32KB

Download
memory/2060-115-0x000000001BD10000-0x000000001BD1C000-memory.dmp

Filesize
48KB

Download
memory/2060-114-0x000000001BD00000-0x000000001BD08000-memory.dmp

Filesize
32KB

Download
memory/2060-113-0x000000001BCF0000-0x000000001BCFE000-memory.dmp

Filesize
56KB

Download
memory/2060-88-0x000000001B0A0000-0x000000001B0B0000-memory.dmp

Filesize
64KB

Download
memory/2060-111-0x000000001BCD0000-0x000000001BCDE000-memory.dmp

Filesize
56KB

Download
memory/2060-110-0x000000001BCC0000-0x000000001BCCA000-memory.dmp

Filesize
40KB

Download
memory/2060-102-0x000000001BFA0000-0x000000001C4C8000-memory.dmp

Filesize
5.2MB

Download
memory/2060-83-0x0000000002670000-0x000000000267E000-memory.dmp

Filesize
56KB

Download
memory/2060-156-0x00007FFB49FB0000-0x00007FFB4AA71000-memory.dmp

Filesize
10.8MB

Download
memory/2060-106-0x000000001BA90000-0x000000001BA9C000-memory.dmp

Filesize
48KB

Download
memory/2060-80-0x00007FFB49FB0000-0x00007FFB4AA71000-memory.dmp

Filesize
10.8MB

Download
memory/2060-79-0x00000000001E0000-0x000000000054A000-memory.dmp

Filesize
3.4MB

Download
memory/2060-81-0x000000001B340000-0x000000001B350000-memory.dmp

Filesize
64KB

Download
memory/2888-31-0x0000013016080000-0x00000130160C0000-memory.dmp

Filesize
256KB

Download
memory/2888-33-0x00007FFB4A060000-0x00007FFB4AB21000-memory.dmp

Filesize
10.8MB

Download
memory/2888-59-0x00007FFB4A060000-0x00007FFB4AB21000-memory.dmp

Filesize
10.8MB

Download
memory/2904-48-0x00007FFB4A060000-0x00007FFB4AB21000-memory.dmp

Filesize
10.8MB

Download
memory/2904-40-0x00000256FABC0000-0x00000256FABD0000-memory.dmp

Filesize
64KB

Download
memory/2904-39-0x00000256FABC0000-0x00000256FABD0000-memory.dmp

Filesize
64KB

Download
memory/2904-46-0x00007FFB4A060000-0x00007FFB4AB21000-memory.dmp

Filesize
10.8MB

Download
memory/3736-161-0x0000000000B80000-0x0000000000B90000-memory.dmp

Filesize
64KB

Download
memory/3736-173-0x00007FFB49D40000-0x00007FFB4A801000-memory.dmp

Filesize
10.8MB

Download
memory/3736-160-0x00007FFB49D40000-0x00007FFB4A801000-memory.dmp

Filesize
10.8MB

Download
memory/3736-162-0x000000001B050000-0x000000001B062000-memory.dmp

Filesize
72KB

Download
memory/3768-0-0x0000000000CC0000-0x000000000100A000-memory.dmp

Filesize
3.3MB

Download
memory/3768-1-0x00007FFB4A060000-0x00007FFB4AB21000-memory.dmp

Filesize
10.8MB

Download
memory/3768-60-0x00007FFB4A060000-0x00007FFB4AB21000-memory.dmp

Filesize
10.8MB

Download
memory/3768-2-0x000000001BC90000-0x000000001BCA0000-memory.dmp

Filesize
64KB

Download
memory/4364-15-0x0000020680010000-0x0000020680032000-memory.dmp

Filesize
136KB

Download
memory/4364-5-0x0000020601BA0000-0x0000020601BB0000-memory.dmp

Filesize
64KB

Download
memory/4364-4-0x0000020601BA0000-0x0000020601BB0000-memory.dmp

Filesize
64KB

Download
memory/4364-3-0x00007FFB4A060000-0x00007FFB4AB21000-memory.dmp

Filesize
10.8MB

Download
memory/4364-18-0x00007FFB4A060000-0x00007FFB4AB21000-memory.dmp

Filesize
10.8MB

Download