zgrat | c252cbd5898c1d562170a12c1e2262ad101616ec0583cb647c01a5e3d1568fef

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12-05-2024 17:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

BlastedCracked.exe
Size

3.6MB
MD5

efa8a9b8529959e7384cce67f59420d8
SHA1

54159f633070d03a71ed6d5e1d9e40f2893510fe
SHA256

c252cbd5898c1d562170a12c1e2262ad101616ec0583cb647c01a5e3d1568fef
SHA512

7a97920a93a05d076ea6ddade8dbe82553b69d89c0a3d86fb11627193753bf12a85975ff01ccf84bcb9b030a38d4e0d7c3957d08a2ad11831601e80f24fd5aef
SSDEEP

98304:1syC4u5x0b8dF6eaeSjBeKxATO7IiiOra+Hc8:7C4u5x0wn6eaeSdyTO4Ora+Hc8

Score

10^/10

zgrat persistence rat

Malware Config

Signatures

Detect ZGRat V1 3 IoCs

resource	yara_rule
behavioral2/files/0x00080000000232a4-6.dat	family_zgrat_v1
behavioral2/files/0x000800000002343f-36.dat	family_zgrat_v1
behavioral2/memory/916-38-0x0000000000700000-0x0000000000A8E000-memory.dmp	family_zgrat_v1

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Microsoft\\Registry.exe\""	surrogatesessionsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Microsoft\\Registry.exe\", \"C:\\ProviderSession\\sihost.exe\""	surrogatesessionsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Microsoft\\Registry.exe\", \"C:\\ProviderSession\\sihost.exe\", \"C:\\Recovery\\WindowsRE\\sppsvc.exe\""	surrogatesessionsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Microsoft\\Registry.exe\", \"C:\\ProviderSession\\sihost.exe\", \"C:\\Recovery\\WindowsRE\\sppsvc.exe\", \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_32\\sppsvc.exe\""	surrogatesessionsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Microsoft\\Registry.exe\", \"C:\\ProviderSession\\sihost.exe\", \"C:\\Recovery\\WindowsRE\\sppsvc.exe\", \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_32\\sppsvc.exe\", \"C:\\Program Files (x86)\\Google\\Temp\\winlogon.exe\""	surrogatesessionsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Microsoft\\Registry.exe\", \"C:\\ProviderSession\\sihost.exe\", \"C:\\Recovery\\WindowsRE\\sppsvc.exe\", \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_32\\sppsvc.exe\", \"C:\\Program Files (x86)\\Google\\Temp\\winlogon.exe\", \"C:\\ProviderSession\\surrogatesessionsvc.exe\""	surrogatesessionsvc.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4532	3584	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4072	3584	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5076	3584	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3376	3584	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3156	3584	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3940	3584	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1736	3584	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5040	3584	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	968	3584	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2864	3584	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2024	3584	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4596	3584	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4200	3584	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1808	3584	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	548	3584	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4204	3584	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4840	3584	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1868	3584	schtasks.exe	94

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Checks computer location settings 2 TTPs 14 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	BlastedCracked.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	Cracker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	surrogatesessionsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	winlogon.exe

Executes dropped EXE 13 IoCs

pid	Process
2376	Cracker.exe
1408	BlastedCrack.exe
916	surrogatesessionsvc.exe
1996	winlogon.exe
1000	winlogon.exe
1480	winlogon.exe
3580	winlogon.exe
4616	winlogon.exe
3936	winlogon.exe
1180	winlogon.exe
1480	winlogon.exe
4316	winlogon.exe
1204	winlogon.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\ProviderSession\\sihost.exe\""	surrogatesessionsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Recovery\\WindowsRE\\sppsvc.exe\""	surrogatesessionsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Program Files (x86)\\Google\\Temp\\winlogon.exe\""	surrogatesessionsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\surrogatesessionsvc = "\"C:\\ProviderSession\\surrogatesessionsvc.exe\""	surrogatesessionsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Users\\All Users\\Microsoft\\Registry.exe\""	surrogatesessionsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\ProviderSession\\sihost.exe\""	surrogatesessionsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Recovery\\WindowsRE\\sppsvc.exe\""	surrogatesessionsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Windows\\Microsoft.NET\\assembly\\GAC_32\\sppsvc.exe\""	surrogatesessionsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Windows\\Microsoft.NET\\assembly\\GAC_32\\sppsvc.exe\""	surrogatesessionsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Program Files (x86)\\Google\\Temp\\winlogon.exe\""	surrogatesessionsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\surrogatesessionsvc = "\"C:\\ProviderSession\\surrogatesessionsvc.exe\""	surrogatesessionsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Users\\All Users\\Microsoft\\Registry.exe\""	surrogatesessionsvc.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSC190B833CA20412BA27A44BBDF15DD8D.TMP	csc.exe
File created	\??\c:\Windows\System32\iehhk_.exe	csc.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Google\Temp\winlogon.exe	surrogatesessionsvc.exe
File created	C:\Program Files (x86)\Google\Temp\cc11b995f2a76d	surrogatesessionsvc.exe
File created	C:\Program Files (x86)\Google\Temp\winlogon.exe	surrogatesessionsvc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\sppsvc.exe	surrogatesessionsvc.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\0a1fd5f707cd16	surrogatesessionsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3940	schtasks.exe
968	schtasks.exe
2024	schtasks.exe
4596	schtasks.exe
4200	schtasks.exe
4204	schtasks.exe
4532	schtasks.exe
5076	schtasks.exe
1736	schtasks.exe
5040	schtasks.exe
4072	schtasks.exe
3376	schtasks.exe
3156	schtasks.exe
2864	schtasks.exe
1808	schtasks.exe
548	schtasks.exe
1868	schtasks.exe
4840	schtasks.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings	Cracker.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings	surrogatesessionsvc.exe

Runs ping.exe 1 TTPs 8 IoCs

Remote System Discovery

T1018

pid	Process
4588	PING.EXE
2400	PING.EXE
4540	PING.EXE
1468	PING.EXE
1072	PING.EXE
976	PING.EXE
4056	PING.EXE
4140	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	916	surrogatesessionsvc.exe
Token: SeDebugPrivilege	1996	winlogon.exe
Token: SeDebugPrivilege	1000	winlogon.exe
Token: SeDebugPrivilege	1480	winlogon.exe
Token: SeDebugPrivilege	3580	winlogon.exe
Token: SeDebugPrivilege	4616	winlogon.exe
Token: SeDebugPrivilege	3936	winlogon.exe
Token: SeDebugPrivilege	1180	winlogon.exe
Token: SeDebugPrivilege	1480	winlogon.exe
Token: SeDebugPrivilege	4316	winlogon.exe
Token: SeDebugPrivilege	1204	winlogon.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 740 wrote to memory of 2376	740	BlastedCracked.exe	82
PID 740 wrote to memory of 2376	740	BlastedCracked.exe	82
PID 740 wrote to memory of 2376	740	BlastedCracked.exe	82
PID 740 wrote to memory of 1408	740	BlastedCracked.exe	85
PID 740 wrote to memory of 1408	740	BlastedCracked.exe	85
PID 740 wrote to memory of 1408	740	BlastedCracked.exe	85
PID 2376 wrote to memory of 4328	2376	Cracker.exe	86
PID 2376 wrote to memory of 4328	2376	Cracker.exe	86
PID 2376 wrote to memory of 4328	2376	Cracker.exe	86
PID 4328 wrote to memory of 1240	4328	WScript.exe	91
PID 4328 wrote to memory of 1240	4328	WScript.exe	91
PID 4328 wrote to memory of 1240	4328	WScript.exe	91
PID 1240 wrote to memory of 916	1240	cmd.exe	93
PID 1240 wrote to memory of 916	1240	cmd.exe	93
PID 916 wrote to memory of 3832	916	surrogatesessionsvc.exe	98
PID 916 wrote to memory of 3832	916	surrogatesessionsvc.exe	98
PID 3832 wrote to memory of 4012	3832	csc.exe	100
PID 3832 wrote to memory of 4012	3832	csc.exe	100
PID 916 wrote to memory of 4112	916	surrogatesessionsvc.exe	117
PID 916 wrote to memory of 4112	916	surrogatesessionsvc.exe	117
PID 4112 wrote to memory of 3252	4112	cmd.exe	119
PID 4112 wrote to memory of 3252	4112	cmd.exe	119
PID 4112 wrote to memory of 4588	4112	cmd.exe	120
PID 4112 wrote to memory of 4588	4112	cmd.exe	120
PID 4112 wrote to memory of 1996	4112	cmd.exe	121
PID 4112 wrote to memory of 1996	4112	cmd.exe	121
PID 1996 wrote to memory of 4340	1996	winlogon.exe	123
PID 1996 wrote to memory of 4340	1996	winlogon.exe	123
PID 4340 wrote to memory of 3080	4340	cmd.exe	125
PID 4340 wrote to memory of 3080	4340	cmd.exe	125
PID 4340 wrote to memory of 2400	4340	cmd.exe	126
PID 4340 wrote to memory of 2400	4340	cmd.exe	126
PID 4340 wrote to memory of 1000	4340	cmd.exe	127
PID 4340 wrote to memory of 1000	4340	cmd.exe	127
PID 1000 wrote to memory of 4072	1000	winlogon.exe	128
PID 1000 wrote to memory of 4072	1000	winlogon.exe	128
PID 4072 wrote to memory of 1328	4072	cmd.exe	130
PID 4072 wrote to memory of 1328	4072	cmd.exe	130
PID 4072 wrote to memory of 4540	4072	cmd.exe	131
PID 4072 wrote to memory of 4540	4072	cmd.exe	131
PID 4072 wrote to memory of 1480	4072	cmd.exe	132
PID 4072 wrote to memory of 1480	4072	cmd.exe	132
PID 1480 wrote to memory of 4840	1480	winlogon.exe	133
PID 1480 wrote to memory of 4840	1480	winlogon.exe	133
PID 4840 wrote to memory of 1536	4840	cmd.exe	135
PID 4840 wrote to memory of 1536	4840	cmd.exe	135
PID 4840 wrote to memory of 1468	4840	cmd.exe	136
PID 4840 wrote to memory of 1468	4840	cmd.exe	136
PID 4840 wrote to memory of 3580	4840	cmd.exe	137
PID 4840 wrote to memory of 3580	4840	cmd.exe	137
PID 3580 wrote to memory of 1436	3580	winlogon.exe	138
PID 3580 wrote to memory of 1436	3580	winlogon.exe	138
PID 1436 wrote to memory of 2084	1436	cmd.exe	140
PID 1436 wrote to memory of 2084	1436	cmd.exe	140
PID 1436 wrote to memory of 1072	1436	cmd.exe	141
PID 1436 wrote to memory of 1072	1436	cmd.exe	141
PID 1436 wrote to memory of 4616	1436	cmd.exe	142
PID 1436 wrote to memory of 4616	1436	cmd.exe	142
PID 4616 wrote to memory of 2476	4616	winlogon.exe	143
PID 4616 wrote to memory of 2476	4616	winlogon.exe	143
PID 2476 wrote to memory of 1108	2476	cmd.exe	145
PID 2476 wrote to memory of 1108	2476	cmd.exe	145
PID 2476 wrote to memory of 976	2476	cmd.exe	146
PID 2476 wrote to memory of 976	2476	cmd.exe	146

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\BlastedCracked.exe
"C:\Users\Admin\AppData\Local\Temp\BlastedCracked.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:740
- C:\Users\Admin\AppData\Local\Temp\Cracker.exe
  "C:\Users\Admin\AppData\Local\Temp\Cracker.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2376
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\ProviderSession\bsSZWUX62rbs.vbe"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:4328
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\ProviderSession\zpmu3ESIavPlU5h4gyS3YPEo2FY3dCgO4x55.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1240
    - - C:\ProviderSession\surrogatesessionsvc.exe
        
        "C:\ProviderSession/surrogatesessionsvc.exe"
        5⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        Drops file in Windows directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:916
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\khqzhh5s\khqzhh5s.cmdline"
        6⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3832
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBBDE.tmp" "c:\Windows\System32\CSC190B833CA20412BA27A44BBDF15DD8D.TMP"
        7⤵
        
        PID:4012
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\fnmu8oM0U5.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4112
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:3252
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        7⤵
        Runs ping.exe
        
        PID:4588
        
        C:\Program Files (x86)\Google\Temp\winlogon.exe
        
        "C:\Program Files (x86)\Google\Temp\winlogon.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1996
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\7iP34BoyNV.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:4340
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        9⤵
        
        PID:3080
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        9⤵
        Runs ping.exe
        
        PID:2400
        
        C:\Program Files (x86)\Google\Temp\winlogon.exe
        
        "C:\Program Files (x86)\Google\Temp\winlogon.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1000
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ge8uHQboyx.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:4072
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        11⤵
        
        PID:1328
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        11⤵
        Runs ping.exe
        
        PID:4540
        
        C:\Program Files (x86)\Google\Temp\winlogon.exe
        
        "C:\Program Files (x86)\Google\Temp\winlogon.exe"
        11⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1480
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\mpHYiEZ4vY.bat"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:4840
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        13⤵
        
        PID:1536
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        13⤵
        Runs ping.exe
        
        PID:1468
        
        C:\Program Files (x86)\Google\Temp\winlogon.exe
        
        "C:\Program Files (x86)\Google\Temp\winlogon.exe"
        13⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3580
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\FT8q7RDVDe.bat"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:1436
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        15⤵
        
        PID:2084
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        15⤵
        Runs ping.exe
        
        PID:1072
        
        C:\Program Files (x86)\Google\Temp\winlogon.exe
        
        "C:\Program Files (x86)\Google\Temp\winlogon.exe"
        15⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4616
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\va0LlUybli.bat"
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:2476
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        17⤵
        
        PID:1108
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        17⤵
        Runs ping.exe
        
        PID:976
        
        C:\Program Files (x86)\Google\Temp\winlogon.exe
        
        "C:\Program Files (x86)\Google\Temp\winlogon.exe"
        17⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3936
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8xEBZwnpYP.bat"
        18⤵
        
        PID:3652
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        19⤵
        
        PID:4724
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:4064
        
        C:\Program Files (x86)\Google\Temp\winlogon.exe
        
        "C:\Program Files (x86)\Google\Temp\winlogon.exe"
        19⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:1180
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ahsqPXjhJl.bat"
        20⤵
        
        PID:4464
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        21⤵
        
        PID:3856
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:516
        
        C:\Program Files (x86)\Google\Temp\winlogon.exe
        
        "C:\Program Files (x86)\Google\Temp\winlogon.exe"
        21⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:1480
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6UZvaQo7Ba.bat"
        22⤵
        
        PID:1176
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        23⤵
        
        PID:400
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        23⤵
        Runs ping.exe
        
        PID:4056
        
        C:\Program Files (x86)\Google\Temp\winlogon.exe
        
        "C:\Program Files (x86)\Google\Temp\winlogon.exe"
        23⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4316
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\40vfctpQnk.bat"
        24⤵
        
        PID:4776
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        25⤵
        
        PID:5016
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:3680
        
        C:\Program Files (x86)\Google\Temp\winlogon.exe
        
        "C:\Program Files (x86)\Google\Temp\winlogon.exe"
        25⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:1204
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9cbgcnWXuE.bat"
        26⤵
        
        PID:2412
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        27⤵
        
        PID:1776
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        27⤵
        Runs ping.exe
        
        PID:4140
- C:\Users\Admin\AppData\Local\Temp\BlastedCrack.exe
  "C:\Users\Admin\AppData\Local\Temp\BlastedCrack.exe"
  2⤵
  - Executes dropped EXE
  PID:1408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\Microsoft\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Users\All Users\Microsoft\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Microsoft\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 5 /tr "'C:\ProviderSession\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\ProviderSession\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 14 /tr "'C:\ProviderSession\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Windows\Microsoft.NET\assembly\GAC_32\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\Microsoft.NET\assembly\GAC_32\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\Windows\Microsoft.NET\assembly\GAC_32\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Google\Temp\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Temp\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Google\Temp\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "surrogatesessionsvcs" /sc MINUTE /mo 10 /tr "'C:\ProviderSession\surrogatesessionsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "surrogatesessionsvc" /sc ONLOGON /tr "'C:\ProviderSession\surrogatesessionsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "surrogatesessionsvcs" /sc MINUTE /mo 11 /tr "'C:\ProviderSession\surrogatesessionsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProviderSession\bsSZWUX62rbs.vbe

Filesize
230B

MD5
c59360784e5ae0db16c6e319cc53bf8d

SHA1
7e7b6afc92d466512f383f01d24d3fc0ba5d249d

SHA256
4edef9b23ac770fb41a5dec471ddf37d3d1c5dc868999b79358bbdd34523b7c1

SHA512
8a3fcbcc366567b11444bcc033dbf4597c33ab3230c9f6d603bb60fb2b9ee746271e4f6b332109973eb54a9247569feac76691dcc2602a9727e960e78f0968ff

Download Submit
C:\ProviderSession\surrogatesessionsvc.exe

Filesize
3.5MB

MD5
5a75e59d28b7b443280c733ebd3c22cf

SHA1
8d4781c8cf4a42ec9f6d5a57633eaf0e589dd11b

SHA256
651072ebbd54a10b843d35b050186915e876b513d09d3cdbf864e4277f5ebb6a

SHA512
4674881eb1923cbe19456d6b7822153213dd2a914a7f66f9898ea6ab8569e42f09b7702c0eabbcdb7182c4b37afa2b9d0edfa92b53e68ef9c213c0ee7903f2fc

Download Submit
C:\ProviderSession\zpmu3ESIavPlU5h4gyS3YPEo2FY3dCgO4x55.bat

Filesize
74B

MD5
bdd66a5a523ff5c2d0546fdefcfde8aa

SHA1
76eb5ea9114693dc22b4241732fe5dd6b25037bb

SHA256
222da2e8abc8fe3b8acb5c84f61f635078fc7237816126348e600f458506398c

SHA512
b79c03ffb10bfdc16268a6872e4b9b522366b9d7edca992212c315133ce920768a0726595b65c0aa4878d25b143e65c42ec271863e9be8ad726dfe63062a6e3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\winlogon.exe.log

Filesize
1KB

MD5
8ee01a9d8d8d1ecf515b687bf5e354ca

SHA1
c3b943dce30e425ae34e6737c7d5c3cdd92f79c5

SHA256
c45f52a36b283b46aae313b5a4fcbfbfb67b3c5ac4ee3ecd921087ddadb691a1

SHA512
6cb43253ddb3d2e5bdedcf76bc299e91ce970c6ccc53a2d9df7ba621435a6a704ce3990bdf59d939e513e609bab3daf8f110c1cca8485e1a9fe8536a67d41dda

Download Submit
C:\Users\Admin\AppData\Local\Temp\40vfctpQnk.bat

Filesize
223B

MD5
88a593a87d2116610fafc1b600bb9729

SHA1
757d69e900e083cf4b27229e139404953c80fef7

SHA256
4a758cd17c9fbdb6ef11b351c9c7cc2384706df17f598fd3980b48a5fa73fa41

SHA512
36c91aaddb0d24a00f0cc11028ba2dbfae1fbfecacd93f3e41306bb638d62892eec6e6bbdba4f6b34842b163fe2d72aa62196cdec9549f0d1a82192944790c9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\6UZvaQo7Ba.bat

Filesize
175B

MD5
2cba35fdf482626aebb830c96e0714dc

SHA1
97e51b27c7d289af7fe88cfde116d0642b3227f9

SHA256
1e36a296b1d798cccbe1a5f73643cba7576b82ab81fe83c6e92008ae9439d564

SHA512
eba39e5ee2dbb1d4cad1ddd821eafa677c43489840d3edbc86ecfba3c07d6d65c9b07cfa2f482ec5f73cf7a2d168cf473d87955c78dc9a7a8e8516b6b765f987

Download Submit
C:\Users\Admin\AppData\Local\Temp\7iP34BoyNV.bat

Filesize
175B

MD5
268740a5e0a01d272f8295f4a34427db

SHA1
b39e172b7dd826a326b6201d11cc120b3e5487d8

SHA256
32aecbcc6f164005acb658eb1707f108332507d1c73e696d67baa45b482b1982

SHA512
5c90aa5e97ffca2e796063ef8ecc1df6a010c68a43f77704bf589c41d0e719d800788cde5f6d59b5a59234a3aafc05c05fd83141852452af3ae019e8810d4d51

Download Submit
C:\Users\Admin\AppData\Local\Temp\8xEBZwnpYP.bat

Filesize
223B

MD5
bd08c821bd3b5ec52af29f31f2c1aba4

SHA1
a21422be68cf8d3e1d91024fcc0ed3813c6a360f

SHA256
a18305c6652762fc0c6a706ed790fcdbe29b7cdbdd660cb6e46ff135f75029d9

SHA512
98b0e01c549a531baa38d92b3bbea4404bd6a77db2bb55fa69fc5cea2f46f44ea8ad20f757d6838fbb28e2971ad2dab61e8063b6c60899560f7e14c5392e3a27

Download Submit
C:\Users\Admin\AppData\Local\Temp\9cbgcnWXuE.bat

Filesize
175B

MD5
2cc7ad6ad4efdc51280faf31bb5cac26

SHA1
80364ba4c9ab7bec09b969b8da078ad5c1967fa2

SHA256
c3524fa1f9abc58a3306d5fa4f8b42df9e2907a302b0d27ebac4b080920843ba

SHA512
6582fdf36b40be9fba83c09d99eba8ea0d1c324d423cbfe35140b3ec71e7e74936c5494cffb5222cb5956df5e59b28624c2db65687da90c167b13726ea4cf1b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\BlastedCrack.exe

Filesize
17KB

MD5
21f525dd782bb2ccf33e2f3ec6c85660

SHA1
5bc5763dd316385d5feab0274b24ac7cbb2790a0

SHA256
ea2e948a4c0224a15195153a0aa10600047d04aa634a19fd388c26810db6847e

SHA512
0f56a381db55c17f570aaccfa46ab17900e563a0307bb232b61b17cebf305dbe7b762ad722daa239e71dfedc024df076806cdf9b4702d009457a6b054a753c0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cracker.exe

Filesize
4.0MB

MD5
2b7ed32dc61c861ffd3e9e35a208aafe

SHA1
307dcf28a2b397e8b22a3f31290bb30045853787

SHA256
568030e4ac1923f3d261c5bb137481c2db277a30957db6fef76b60381f75051b

SHA512
a1550f037c74ffee99ca0db21fcc46e06f24394c88c8b3b9171de97dc8eb7f5aa74eb4c3185b9956c529430da5511c901a5488c54b7370d7758476e31dfe254d

Download Submit
C:\Users\Admin\AppData\Local\Temp\FT8q7RDVDe.bat

Filesize
175B

MD5
3bf9382fc8674e44a793f05b7aef4ca7

SHA1
40721fa81d229e3e6c079e92e38717ad759f0ba1

SHA256
5ab4ff35308d0106f2d8c17db7564e88c0d7571ef0f89575f084a7bb8f9459aa

SHA512
59f9b9d299af9c32225e4d132a0a5b8cd0fab698dc2195e182880d1d6949b1c0686edaeb83cbb81a280a9c17930244d29194d00a1fbc85c1afaa052541a1447b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESBBDE.tmp

Filesize
1KB

MD5
d6785ac3566bbea2ec6156e5a071e3ab

SHA1
803f9160950419e00b8a8ca2962138dddb2651a6

SHA256
01f51c479f5541b0e02008ca8a04a8d93ed2dc8a9e1d4b4fce7c384c8a2e5b54

SHA512
89ee6750097e9e3d1acd059c2127892b5197d485a7c44e480dc7e793fb3c2f2464c62b5d4ca3a0f2f3190d522d446c792a060a85c5e92091ef30891d4e239301

Download Submit
C:\Users\Admin\AppData\Local\Temp\ahsqPXjhJl.bat

Filesize
223B

MD5
e51f68e9265f9c5b75de0116b871c7b9

SHA1
6ed75b54ff22fcc2fe37e960c705db1121fc2f32

SHA256
d206e6fcd7115eaa3ea540d75dde04c1c9e88feefd033ad035f0fadfca350575

SHA512
77136bb9ed7714bdf73eb758cfc7121bb8a6e4911487d867c88e9bbc88e509ca27ce9f32ff1bcb0ed1d2d0357f0dc09e7f5d17110822ec0e6dd9f1ee66c713dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\fnmu8oM0U5.bat

Filesize
175B

MD5
d05667eee4034c26eb90ffa7a61e7d58

SHA1
afb0146eb6be106f0e04288b456735a6052d6f4f

SHA256
52d9377f53d6e050daaf8a75ea041fbf62321ff27b673c5af85d1e319f941a9f

SHA512
77a816d5068bb293c4a9fe85f2155a323bb2c69b5c128845278f29625616adf35425df275134f9a710b9b4edff17421da814fcc109a1f34cd7bc06ef5ad25695

Download Submit
C:\Users\Admin\AppData\Local\Temp\ge8uHQboyx.bat

Filesize
175B

MD5
5c254302b49ba631191d747264e4f783

SHA1
26dd680e84bcf9a4b510596301e1c69cb509fad5

SHA256
a096a47902b33db7d3a238068618b25eacc8eaeb4166975b35c947c2001cf57c

SHA512
475fb54df19157f35aecda9c55ded3f360f434b9bd895a387bdfd5b458b876b4c080e79f58a8f229c8d14a53796061bc8fc5b5a86d7892a3343367c8fdfbadf4

Download Submit
C:\Users\Admin\AppData\Local\Temp\mpHYiEZ4vY.bat

Filesize
175B

MD5
d3b3aa8ce477dfbefca45e3e6b985a6e

SHA1
550adf19e17e2f95942d0a5329b2d8e04faef8cf

SHA256
6e08d5d4a34149731a5231efed23e818204a987c15b6b03e19a27fc57d3c854a

SHA512
49ed7dfc4530e8e03297665f456e5cd6e3dfe1b923c6abc29bf02f32af640cfdb524a2a203954afcb72873bf631e876501747e4b6717017dd021ef4aed730a04

Download Submit
C:\Users\Admin\AppData\Local\Temp\va0LlUybli.bat

Filesize
175B

MD5
bc92101c9cc3fa0adf62ecabd206c775

SHA1
a837875e51515fa16d4e450426c12d30631c4a4a

SHA256
bc6cd3b17a48010dd8262163e9291ce39246a3d07c5650529ef48ae74e0857c3

SHA512
a7b029fd7ef06f4d7528fd9ceed57e3b61ab01cfa7b15be8f65aee4ba5523b74d232ef848f2b69d49f16df453efb73a2a1b4f7887e9022347355400f2604e48e

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\khqzhh5s\khqzhh5s.0.cs

Filesize
373B

MD5
cf4e321f1d65268885b2c9b43b34f886

SHA1
f4e65948a0c403f0036ac9357578cd388a0a1df4

SHA256
0da606dc68f598afda91ef5645434f9ded7297142952c694ca972da1c1b97bba

SHA512
25b2f28277120ab25969bfee974da15b97966b1abddd21607b7b22731bdc3d06b3ef57478e9083c0798b6a1ba8bd5886df77539cba9be04e09a3e0bba9840798

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\khqzhh5s\khqzhh5s.cmdline

Filesize
235B

MD5
9de92ecc594e539e65b9c70cb9514764

SHA1
348b16e4437468acddeaa24efea7e30d64d86662

SHA256
686d60d4477351686e5da1ddc83a4ef670e4c46a6b477e5a874a7ab16c810933

SHA512
e156a66e71aac01b35148fb250f88049ac085ecc557902dc80930c393d3cc6588745da6f3e1bbea2d2a4eeac6402601bf869deb930df21b296db7a5938fb4750

Download Submit
\??\c:\Windows\System32\CSC190B833CA20412BA27A44BBDF15DD8D.TMP

Filesize
1KB

MD5
6c8d705f12e071558058fc19e815fe28

SHA1
25c4f0b2bfaff4f8264f6cc36185e4b148c0e0b7

SHA256
9e6e446a2e264c8af311438fc1e8b4456c3b56aa4836ff9448f4385e6b77ca5d

SHA512
9195980872a010dc9c6d7012cd8b6f195dda94b50b19aa2024295e13651af6c9e89e0778d2f2e337ba84bafeb7d6cb5a2fc5ac0e4a94eee1d924ddb177e3e955

Download Submit
memory/916-114-0x000000001C750000-0x000000001C81D000-memory.dmp

Filesize
820KB

Download
memory/916-57-0x000000001BBE0000-0x000000001BBF2000-memory.dmp

Filesize
72KB

Download
memory/916-63-0x000000001BC20000-0x000000001BC32000-memory.dmp

Filesize
72KB

Download
memory/916-64-0x000000001C170000-0x000000001C698000-memory.dmp

Filesize
5.2MB

Download
memory/916-66-0x000000001BB70000-0x000000001BB7E000-memory.dmp

Filesize
56KB

Download
memory/916-68-0x000000001BB80000-0x000000001BB90000-memory.dmp

Filesize
64KB

Download
memory/916-70-0x000000001BC40000-0x000000001BC50000-memory.dmp

Filesize
64KB

Download
memory/916-72-0x000000001BCB0000-0x000000001BD0A000-memory.dmp

Filesize
360KB

Download
memory/916-74-0x000000001BC50000-0x000000001BC5E000-memory.dmp

Filesize
56KB

Download
memory/916-76-0x000000001BC60000-0x000000001BC70000-memory.dmp

Filesize
64KB

Download
memory/916-78-0x000000001BC70000-0x000000001BC7E000-memory.dmp

Filesize
56KB

Download
memory/916-80-0x000000001BF10000-0x000000001BF28000-memory.dmp

Filesize
96KB

Download
memory/916-82-0x000000001BC80000-0x000000001BC8C000-memory.dmp

Filesize
48KB

Download
memory/916-84-0x000000001BF80000-0x000000001BFCE000-memory.dmp

Filesize
312KB

Download
memory/916-59-0x000000001BB60000-0x000000001BB70000-memory.dmp

Filesize
64KB

Download
memory/916-42-0x000000001B640000-0x000000001B64E000-memory.dmp

Filesize
56KB

Download
memory/916-55-0x000000001B7F0000-0x000000001B7FE000-memory.dmp

Filesize
56KB

Download
memory/916-53-0x000000001B7E0000-0x000000001B7F0000-memory.dmp

Filesize
64KB

Download
memory/916-51-0x000000001B6A0000-0x000000001B6B0000-memory.dmp

Filesize
64KB

Download
memory/916-113-0x000000001C6A0000-0x000000001C749000-memory.dmp

Filesize
676KB

Download
memory/916-49-0x000000001BB40000-0x000000001BB58000-memory.dmp

Filesize
96KB

Download
memory/916-61-0x000000001BC00000-0x000000001BC16000-memory.dmp

Filesize
88KB

Download
memory/916-38-0x0000000000700000-0x0000000000A8E000-memory.dmp

Filesize
3.6MB

Download
memory/916-40-0x000000001B810000-0x000000001B836000-memory.dmp

Filesize
152KB

Download
memory/916-47-0x000000001B690000-0x000000001B6A0000-memory.dmp

Filesize
64KB

Download
memory/916-45-0x000000001BB90000-0x000000001BBE0000-memory.dmp

Filesize
320KB

Download
memory/916-44-0x000000001B6B0000-0x000000001B6CC000-memory.dmp

Filesize
112KB

Download
memory/1000-179-0x000000001B8A0000-0x000000001B96D000-memory.dmp

Filesize
820KB

Download
memory/1000-180-0x000000001B650000-0x000000001B658000-memory.dmp

Filesize
32KB

Download
memory/1000-178-0x000000001B7F0000-0x000000001B899000-memory.dmp

Filesize
676KB

Download
memory/1180-335-0x000000001B950000-0x000000001B958000-memory.dmp

Filesize
32KB

Download
memory/1180-333-0x000000001BAE0000-0x000000001BB89000-memory.dmp

Filesize
676KB

Download
memory/1180-334-0x000000001BB90000-0x000000001BC5D000-memory.dmp

Filesize
820KB

Download
memory/1204-426-0x000000001C140000-0x000000001C1E9000-memory.dmp

Filesize
676KB

Download
memory/1204-428-0x000000001BFA0000-0x000000001BFA8000-memory.dmp

Filesize
32KB

Download
memory/1204-427-0x000000001C940000-0x000000001CA0D000-memory.dmp

Filesize
820KB

Download
memory/1408-33-0x0000000005430000-0x000000000543A000-memory.dmp

Filesize
40KB

Download
memory/1408-21-0x000000007295E000-0x000000007295F000-memory.dmp

Filesize
4KB

Download
memory/1408-28-0x0000000000B50000-0x0000000000B5A000-memory.dmp

Filesize
40KB

Download
memory/1408-30-0x0000000005960000-0x0000000005F04000-memory.dmp

Filesize
5.6MB

Download
memory/1408-31-0x0000000005450000-0x00000000054E2000-memory.dmp

Filesize
584KB

Download
memory/1480-364-0x000000001B7D0000-0x000000001B879000-memory.dmp

Filesize
676KB

Download
memory/1480-365-0x000000001B880000-0x000000001B94D000-memory.dmp

Filesize
820KB

Download
memory/1480-210-0x000000001C810000-0x000000001C8DD000-memory.dmp

Filesize
820KB

Download
memory/1480-209-0x000000001C760000-0x000000001C809000-memory.dmp

Filesize
676KB

Download
memory/1480-211-0x000000001C5D0000-0x000000001C5D8000-memory.dmp

Filesize
32KB

Download
memory/1480-366-0x000000001B640000-0x000000001B648000-memory.dmp

Filesize
32KB

Download
memory/1996-147-0x000000001CB60000-0x000000001CC2D000-memory.dmp

Filesize
820KB

Download
memory/1996-148-0x000000001C3E0000-0x000000001C3E8000-memory.dmp

Filesize
32KB

Download
memory/1996-146-0x000000001C580000-0x000000001C629000-memory.dmp

Filesize
676KB

Download
memory/3580-241-0x000000001CF10000-0x000000001CFDD000-memory.dmp

Filesize
820KB

Download
memory/3580-240-0x000000001C930000-0x000000001C9D9000-memory.dmp

Filesize
676KB

Download
memory/3580-242-0x000000001C590000-0x000000001C598000-memory.dmp

Filesize
32KB

Download
memory/3936-304-0x000000001C4A0000-0x000000001C4A8000-memory.dmp

Filesize
32KB

Download
memory/3936-302-0x000000001C630000-0x000000001C6D9000-memory.dmp

Filesize
676KB

Download
memory/3936-303-0x000000001C6E0000-0x000000001C7AD000-memory.dmp

Filesize
820KB

Download
memory/4316-397-0x000000001C100000-0x000000001C108000-memory.dmp

Filesize
32KB

Download
memory/4316-395-0x000000001C4A0000-0x000000001C549000-memory.dmp

Filesize
676KB

Download
memory/4316-396-0x000000001CA80000-0x000000001CB4D000-memory.dmp

Filesize
820KB

Download
memory/4616-273-0x000000001C120000-0x000000001C128000-memory.dmp

Filesize
32KB

Download
memory/4616-271-0x000000001C2C0000-0x000000001C369000-memory.dmp

Filesize
676KB

Download
memory/4616-272-0x000000001C370000-0x000000001C43D000-memory.dmp

Filesize
820KB

Download