dcrat | 43681f957ede15414bd4c98880946147a148b7878392bc3e1f60d2974c230047

Analysis

max time kernel
146s
max time network
146s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
20-12-2024 13:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NeverLose Loader.exe
Size

2.8MB
MD5

a35bacaf176f367bd51ed22782dc5519
SHA1

99fdd147469d0392fc2a8fcc714206a70c3961db
SHA256

9fc8c881c65e76927632323529b5186fb552d22fa4b52b6ac82165728aa02f9f
SHA512

b33b4452cccd762eead94b90244e2aaefa9f5fcca45dba761d5e28a28a2bbc3ef201b2e1f187df6e66949fb501f1edb31f7d9634dfa7dd17bb7050142a31b51a
SSDEEP

49152:tBUnRxbHAr0MmN6vm2H0MvnoxhRb4q3WO/PVdxfgz6:n2RxbHyfH0MvnonRbZ5Vd5o6

Score

10^/10

dcrat discovery infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Application Data\\lsass.exe\", \"C:\\Recovery\\3a99bb82-4e15-11ef-8354-cae67966b5f6\\wininit.exe\", \"C:\\Program Files (x86)\\Common Files\\Adobe AIR\\Versions\\1.0\\dwm.exe\""	hyperBlockServerSavesSession.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Application Data\\lsass.exe\", \"C:\\Recovery\\3a99bb82-4e15-11ef-8354-cae67966b5f6\\wininit.exe\", \"C:\\Program Files (x86)\\Common Files\\Adobe AIR\\Versions\\1.0\\dwm.exe\", \"C:\\Windows\\AppCompat\\smss.exe\""	hyperBlockServerSavesSession.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Application Data\\lsass.exe\", \"C:\\Recovery\\3a99bb82-4e15-11ef-8354-cae67966b5f6\\wininit.exe\", \"C:\\Program Files (x86)\\Common Files\\Adobe AIR\\Versions\\1.0\\dwm.exe\", \"C:\\Windows\\AppCompat\\smss.exe\", \"C:\\Users\\Default\\Links\\hyperBlockServerSavesSession.exe\""	hyperBlockServerSavesSession.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Application Data\\lsass.exe\", \"C:\\Recovery\\3a99bb82-4e15-11ef-8354-cae67966b5f6\\wininit.exe\", \"C:\\Program Files (x86)\\Common Files\\Adobe AIR\\Versions\\1.0\\dwm.exe\", \"C:\\Windows\\AppCompat\\smss.exe\", \"C:\\Users\\Default\\Links\\hyperBlockServerSavesSession.exe\", \"C:\\agentsavesSessioncrt\\hyperBlockServerSavesSession.exe\""	hyperBlockServerSavesSession.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Application Data\\lsass.exe\""	hyperBlockServerSavesSession.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Application Data\\lsass.exe\", \"C:\\Recovery\\3a99bb82-4e15-11ef-8354-cae67966b5f6\\wininit.exe\""	hyperBlockServerSavesSession.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2696	2688	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2328	2688	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1992	2688	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2004	2688	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1872	2688	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2032	2688	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	272	2688	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2620	2688	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1404	2688	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	844	2688	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1628	2688	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2168	2688	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2316	2688	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2264	2688	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2584	2688	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1476	2688	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1380	2688	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3068	2688	schtasks.exe	35

Executes dropped EXE 13 IoCs

pid	Process
2844	hyperBlockServerSavesSession.exe
2940	smss.exe
760	smss.exe
2320	smss.exe
2196	smss.exe
2484	smss.exe
2920	smss.exe
1664	smss.exe
2088	smss.exe
1124	smss.exe
1076	smss.exe
980	smss.exe
828	smss.exe

Loads dropped DLL 2 IoCs

pid	Process
2504	cmd.exe
2504	cmd.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Users\\All Users\\Application Data\\lsass.exe\""	hyperBlockServerSavesSession.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Recovery\\3a99bb82-4e15-11ef-8354-cae67966b5f6\\wininit.exe\""	hyperBlockServerSavesSession.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files (x86)\\Common Files\\Adobe AIR\\Versions\\1.0\\dwm.exe\""	hyperBlockServerSavesSession.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files (x86)\\Common Files\\Adobe AIR\\Versions\\1.0\\dwm.exe\""	hyperBlockServerSavesSession.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Windows\\AppCompat\\smss.exe\""	hyperBlockServerSavesSession.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Windows\\AppCompat\\smss.exe\""	hyperBlockServerSavesSession.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\hyperBlockServerSavesSession = "\"C:\\Users\\Default\\Links\\hyperBlockServerSavesSession.exe\""	hyperBlockServerSavesSession.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\hyperBlockServerSavesSession = "\"C:\\agentsavesSessioncrt\\hyperBlockServerSavesSession.exe\""	hyperBlockServerSavesSession.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Users\\All Users\\Application Data\\lsass.exe\""	hyperBlockServerSavesSession.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Recovery\\3a99bb82-4e15-11ef-8354-cae67966b5f6\\wininit.exe\""	hyperBlockServerSavesSession.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hyperBlockServerSavesSession = "\"C:\\Users\\Default\\Links\\hyperBlockServerSavesSession.exe\""	hyperBlockServerSavesSession.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hyperBlockServerSavesSession = "\"C:\\agentsavesSessioncrt\\hyperBlockServerSavesSession.exe\""	hyperBlockServerSavesSession.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSC9A4AF5B266746ECAE8581F06A0563E.TMP	csc.exe
File created	\??\c:\Windows\System32\qrosn9.exe	csc.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\6cb0b6c459d5d3	hyperBlockServerSavesSession.exe
File created	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\dwm.exe	hyperBlockServerSavesSession.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\AppCompat\smss.exe	hyperBlockServerSavesSession.exe
File created	C:\Windows\AppCompat\69ddcba757bf72	hyperBlockServerSavesSession.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NeverLose Loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 5 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2724	PING.EXE
1788	PING.EXE
856	PING.EXE
1244	PING.EXE
556	PING.EXE

Runs ping.exe 1 TTPs 5 IoCs

Remote System Discovery

T1018

pid	Process
1244	PING.EXE
556	PING.EXE
2724	PING.EXE
1788	PING.EXE
856	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2620	schtasks.exe
1404	schtasks.exe
844	schtasks.exe
2696	schtasks.exe
2316	schtasks.exe
2264	schtasks.exe
2584	schtasks.exe
1476	schtasks.exe
2004	schtasks.exe
1628	schtasks.exe
2168	schtasks.exe
1380	schtasks.exe
3068	schtasks.exe
2328	schtasks.exe
1992	schtasks.exe
1872	schtasks.exe
2032	schtasks.exe
272	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2844	hyperBlockServerSavesSession.exe
2844	hyperBlockServerSavesSession.exe
2844	hyperBlockServerSavesSession.exe
2844	hyperBlockServerSavesSession.exe
2844	hyperBlockServerSavesSession.exe
2844	hyperBlockServerSavesSession.exe
2844	hyperBlockServerSavesSession.exe
2844	hyperBlockServerSavesSession.exe
2844	hyperBlockServerSavesSession.exe
2844	hyperBlockServerSavesSession.exe
2844	hyperBlockServerSavesSession.exe
2844	hyperBlockServerSavesSession.exe
2844	hyperBlockServerSavesSession.exe
2844	hyperBlockServerSavesSession.exe
2844	hyperBlockServerSavesSession.exe
2844	hyperBlockServerSavesSession.exe
2844	hyperBlockServerSavesSession.exe
2844	hyperBlockServerSavesSession.exe
2844	hyperBlockServerSavesSession.exe
2844	hyperBlockServerSavesSession.exe
2844	hyperBlockServerSavesSession.exe
2844	hyperBlockServerSavesSession.exe
2844	hyperBlockServerSavesSession.exe
2844	hyperBlockServerSavesSession.exe
2844	hyperBlockServerSavesSession.exe
2844	hyperBlockServerSavesSession.exe
2844	hyperBlockServerSavesSession.exe
2844	hyperBlockServerSavesSession.exe
2844	hyperBlockServerSavesSession.exe
2844	hyperBlockServerSavesSession.exe
2844	hyperBlockServerSavesSession.exe
2844	hyperBlockServerSavesSession.exe
2844	hyperBlockServerSavesSession.exe
2844	hyperBlockServerSavesSession.exe
2844	hyperBlockServerSavesSession.exe
2844	hyperBlockServerSavesSession.exe
2844	hyperBlockServerSavesSession.exe
2844	hyperBlockServerSavesSession.exe
2844	hyperBlockServerSavesSession.exe
2844	hyperBlockServerSavesSession.exe
2844	hyperBlockServerSavesSession.exe
2844	hyperBlockServerSavesSession.exe
2844	hyperBlockServerSavesSession.exe
2844	hyperBlockServerSavesSession.exe
2844	hyperBlockServerSavesSession.exe
2844	hyperBlockServerSavesSession.exe
2844	hyperBlockServerSavesSession.exe
2844	hyperBlockServerSavesSession.exe
2844	hyperBlockServerSavesSession.exe
2844	hyperBlockServerSavesSession.exe
2844	hyperBlockServerSavesSession.exe
2844	hyperBlockServerSavesSession.exe
2844	hyperBlockServerSavesSession.exe
2844	hyperBlockServerSavesSession.exe
2844	hyperBlockServerSavesSession.exe
2844	hyperBlockServerSavesSession.exe
2844	hyperBlockServerSavesSession.exe
2844	hyperBlockServerSavesSession.exe
2844	hyperBlockServerSavesSession.exe
2844	hyperBlockServerSavesSession.exe
2844	hyperBlockServerSavesSession.exe
2844	hyperBlockServerSavesSession.exe
2844	hyperBlockServerSavesSession.exe
2844	hyperBlockServerSavesSession.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	2844	hyperBlockServerSavesSession.exe
Token: SeDebugPrivilege	2940	smss.exe
Token: SeDebugPrivilege	760	smss.exe
Token: SeDebugPrivilege	2320	smss.exe
Token: SeDebugPrivilege	2196	smss.exe
Token: SeDebugPrivilege	2484	smss.exe
Token: SeDebugPrivilege	2920	smss.exe
Token: SeDebugPrivilege	1664	smss.exe
Token: SeDebugPrivilege	2088	smss.exe
Token: SeDebugPrivilege	1124	smss.exe
Token: SeDebugPrivilege	1076	smss.exe
Token: SeDebugPrivilege	980	smss.exe
Token: SeDebugPrivilege	828	smss.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 2000	2500	NeverLose Loader.exe	30
PID 2500 wrote to memory of 2000	2500	NeverLose Loader.exe	30
PID 2500 wrote to memory of 2000	2500	NeverLose Loader.exe	30
PID 2500 wrote to memory of 2000	2500	NeverLose Loader.exe	30
PID 2000 wrote to memory of 2504	2000	WScript.exe	32
PID 2000 wrote to memory of 2504	2000	WScript.exe	32
PID 2000 wrote to memory of 2504	2000	WScript.exe	32
PID 2000 wrote to memory of 2504	2000	WScript.exe	32
PID 2504 wrote to memory of 2844	2504	cmd.exe	34
PID 2504 wrote to memory of 2844	2504	cmd.exe	34
PID 2504 wrote to memory of 2844	2504	cmd.exe	34
PID 2504 wrote to memory of 2844	2504	cmd.exe	34
PID 2844 wrote to memory of 1912	2844	hyperBlockServerSavesSession.exe	39
PID 2844 wrote to memory of 1912	2844	hyperBlockServerSavesSession.exe	39
PID 2844 wrote to memory of 1912	2844	hyperBlockServerSavesSession.exe	39
PID 1912 wrote to memory of 1412	1912	csc.exe	41
PID 1912 wrote to memory of 1412	1912	csc.exe	41
PID 1912 wrote to memory of 1412	1912	csc.exe	41
PID 2844 wrote to memory of 1532	2844	hyperBlockServerSavesSession.exe	57
PID 2844 wrote to memory of 1532	2844	hyperBlockServerSavesSession.exe	57
PID 2844 wrote to memory of 1532	2844	hyperBlockServerSavesSession.exe	57
PID 1532 wrote to memory of 2180	1532	cmd.exe	59
PID 1532 wrote to memory of 2180	1532	cmd.exe	59
PID 1532 wrote to memory of 2180	1532	cmd.exe	59
PID 1532 wrote to memory of 1728	1532	cmd.exe	60
PID 1532 wrote to memory of 1728	1532	cmd.exe	60
PID 1532 wrote to memory of 1728	1532	cmd.exe	60
PID 1532 wrote to memory of 2940	1532	cmd.exe	61
PID 1532 wrote to memory of 2940	1532	cmd.exe	61
PID 1532 wrote to memory of 2940	1532	cmd.exe	61
PID 2940 wrote to memory of 1536	2940	smss.exe	62
PID 2940 wrote to memory of 1536	2940	smss.exe	62
PID 2940 wrote to memory of 1536	2940	smss.exe	62
PID 1536 wrote to memory of 2100	1536	cmd.exe	64
PID 1536 wrote to memory of 2100	1536	cmd.exe	64
PID 1536 wrote to memory of 2100	1536	cmd.exe	64
PID 1536 wrote to memory of 920	1536	cmd.exe	65
PID 1536 wrote to memory of 920	1536	cmd.exe	65
PID 1536 wrote to memory of 920	1536	cmd.exe	65
PID 1536 wrote to memory of 760	1536	cmd.exe	66
PID 1536 wrote to memory of 760	1536	cmd.exe	66
PID 1536 wrote to memory of 760	1536	cmd.exe	66
PID 760 wrote to memory of 2268	760	smss.exe	67
PID 760 wrote to memory of 2268	760	smss.exe	67
PID 760 wrote to memory of 2268	760	smss.exe	67
PID 2268 wrote to memory of 880	2268	cmd.exe	69
PID 2268 wrote to memory of 880	2268	cmd.exe	69
PID 2268 wrote to memory of 880	2268	cmd.exe	69
PID 2268 wrote to memory of 1788	2268	cmd.exe	70
PID 2268 wrote to memory of 1788	2268	cmd.exe	70
PID 2268 wrote to memory of 1788	2268	cmd.exe	70
PID 2268 wrote to memory of 2320	2268	cmd.exe	71
PID 2268 wrote to memory of 2320	2268	cmd.exe	71
PID 2268 wrote to memory of 2320	2268	cmd.exe	71
PID 2320 wrote to memory of 1976	2320	smss.exe	72
PID 2320 wrote to memory of 1976	2320	smss.exe	72
PID 2320 wrote to memory of 1976	2320	smss.exe	72
PID 1976 wrote to memory of 2172	1976	cmd.exe	74
PID 1976 wrote to memory of 2172	1976	cmd.exe	74
PID 1976 wrote to memory of 2172	1976	cmd.exe	74
PID 1976 wrote to memory of 292	1976	cmd.exe	75
PID 1976 wrote to memory of 292	1976	cmd.exe	75
PID 1976 wrote to memory of 292	1976	cmd.exe	75
PID 1976 wrote to memory of 2196	1976	cmd.exe	76

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\NeverLose Loader.exe
"C:\Users\Admin\AppData\Local\Temp\NeverLose Loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\agentsavesSessioncrt\wvAy3g2cwUA0WlAR67rDwx6ilqeJ3huGsrpLtUKpTSpXZqeLmD5jcZq.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2000
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\agentsavesSessioncrt\fqPjTa5dmPVCKdRywzd7JYZCOwyT6TkVbtC1AmfVOodlKWVPvDa.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2504
  - - C:\agentsavesSessioncrt\hyperBlockServerSavesSession.exe
      "C:\agentsavesSessioncrt/hyperBlockServerSavesSession.exe"
      4⤵
      Modifies WinLogon for persistence
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2844
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3qaqp503\3qaqp503.cmdline"
        5⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1912
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1C09.tmp" "c:\Windows\System32\CSC9A4AF5B266746ECAE8581F06A0563E.TMP"
        6⤵
        
        PID:1412
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\e8jcz5MCL9.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1532
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:2180
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:1728
      - C:\Windows\AppCompat\smss.exe
        
        "C:\Windows\AppCompat\smss.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2940
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\yWxYzFHQ21.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1536
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:2100
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:920
        
        C:\Windows\AppCompat\smss.exe
        
        "C:\Windows\AppCompat\smss.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:760
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5AOAfIZos6.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:2268
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:880
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1788
        
        C:\Windows\AppCompat\smss.exe
        
        "C:\Windows\AppCompat\smss.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2320
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\TAB96jcSpT.bat"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:1976
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:2172
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:292
        
        C:\Windows\AppCompat\smss.exe
        
        "C:\Windows\AppCompat\smss.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2196
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\B5GxaJWFI4.bat"
        13⤵
        
        PID:1988
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:3020
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:2764
        
        C:\Windows\AppCompat\smss.exe
        
        "C:\Windows\AppCompat\smss.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2484
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\R3sykWUIoO.bat"
        15⤵
        
        PID:2164
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:1888
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:1992
        
        C:\Windows\AppCompat\smss.exe
        
        "C:\Windows\AppCompat\smss.exe"
        16⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2920
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\AzylF6O5Hz.bat"
        17⤵
        
        PID:2968
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:272
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:856
        
        C:\Windows\AppCompat\smss.exe
        
        "C:\Windows\AppCompat\smss.exe"
        18⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1664
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\1kLxRzFJtF.bat"
        19⤵
        
        PID:1860
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:1628
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:2080
        
        C:\Windows\AppCompat\smss.exe
        
        "C:\Windows\AppCompat\smss.exe"
        20⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2088
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\dpubRuS73Q.bat"
        21⤵
        
        PID:820
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:2656
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:2756
        
        C:\Windows\AppCompat\smss.exe
        
        "C:\Windows\AppCompat\smss.exe"
        22⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1124
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\7p8ySQy6iH.bat"
        23⤵
        
        PID:1808
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:1248
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        24⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1244
        
        C:\Windows\AppCompat\smss.exe
        
        "C:\Windows\AppCompat\smss.exe"
        24⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1076
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\KvMN3vAFGm.bat"
        25⤵
        
        PID:2828
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        26⤵
        
        PID:968
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:1492
        
        C:\Windows\AppCompat\smss.exe
        
        "C:\Windows\AppCompat\smss.exe"
        26⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:980
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Ye8GjO9RaC.bat"
        27⤵
        
        PID:2240
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        28⤵
        
        PID:2268
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        28⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:556
        
        C:\Windows\AppCompat\smss.exe
        
        "C:\Windows\AppCompat\smss.exe"
        28⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:828
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HY3kVmQ00V.bat"
        29⤵
        
        PID:292
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        30⤵
        
        PID:1804
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        30⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Application Data\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\All Users\Application Data\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\Application Data\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Windows\AppCompat\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\AppCompat\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Windows\AppCompat\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "hyperBlockServerSavesSessionh" /sc MINUTE /mo 12 /tr "'C:\Users\Default\Links\hyperBlockServerSavesSession.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "hyperBlockServerSavesSession" /sc ONLOGON /tr "'C:\Users\Default\Links\hyperBlockServerSavesSession.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "hyperBlockServerSavesSessionh" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Links\hyperBlockServerSavesSession.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "hyperBlockServerSavesSessionh" /sc MINUTE /mo 9 /tr "'C:\agentsavesSessioncrt\hyperBlockServerSavesSession.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "hyperBlockServerSavesSession" /sc ONLOGON /tr "'C:\agentsavesSessioncrt\hyperBlockServerSavesSession.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "hyperBlockServerSavesSessionh" /sc MINUTE /mo 10 /tr "'C:\agentsavesSessioncrt\hyperBlockServerSavesSession.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1kLxRzFJtF.bat

Filesize
205B

MD5
c5b3183294980d62a777050be6702102

SHA1
eea7dc5fe0bddf74285b27c8ddd22a64bc9268bc

SHA256
31f1b4f8e0deec0e5a769dec9de2e6ffde7213ffde2eeea0d49fb02b784c3f5e

SHA512
4b189cf17690b2d0b806d5ba5306b362c812304a7e5c70bc19a1e4436fc42cb9fdb7e36f665af5982bd6694406e95cfb2d508252b8f36516ea3c7dbd5046bf6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\5AOAfIZos6.bat

Filesize
157B

MD5
79329f590db9354067040598f5125d4d

SHA1
76870ffa251331cd3502359e072a43de1efdf487

SHA256
f8df829c55588c10aa7bfed19d3a5cfbc78ffb1d63fd13a4d5b24470c6f6c389

SHA512
07a1744e17034ba6b4657e352aa8e7efd3bfb3bffda4d9867f445535c439dab6c24500a99cb9db724632fe596edec6ca85485ceaed23791ab09cad0b9780cd50

Download Submit
C:\Users\Admin\AppData\Local\Temp\7p8ySQy6iH.bat

Filesize
157B

MD5
a792e5614afc3e0d94ab79e149c15c99

SHA1
aed6f4c6bd16d99de116c381b142dc83997adf1c

SHA256
a655eccc9384995977303db244fc4c04feff924a3eb7083bc7a1a4980325be33

SHA512
ef0db177e0ff5b9fc4022acc3439c7e67556d4d3a8dbd0bee781f7c2a3925b6fd8bcccbf22beb3711aee1198831e41b582abe7b6aff46e826773c9a934e4bb03

Download Submit
C:\Users\Admin\AppData\Local\Temp\AzylF6O5Hz.bat

Filesize
157B

MD5
def7bb85bcd2a1c4181d41f9326a2ddb

SHA1
eec1bf1459e0cd4f01dbcb1c08127795f0f867d8

SHA256
427cc712f288924729842f6456987e261d7cdc84b35f81b9d582eccc181d43bc

SHA512
cf2df91cf5d9dff8a4c9f7a3e092a834b7361e79086648ebfd6d323f98d1cd33b589245395ce3e5b7b5fa711894ddfd658be4588609a07a36321f247fbe73fcc

Download Submit
C:\Users\Admin\AppData\Local\Temp\B5GxaJWFI4.bat

Filesize
205B

MD5
43ebe2edc12809048ac96e9ec576c717

SHA1
b0df6c8a2b44b5649404430b343b3e0ce8acc17b

SHA256
78bb8c9658a8085b78c743e66bf8257e1e0e7c15cdfff9159f6f97d825e384bd

SHA512
4d49ae398b2985d90bddc2f95f94114613ddb1925e6a1c0977f0367826d97e9cd42d361bb363a0af3ca2fe52e0eb32331759e39056101fd289fdaccb89565b00

Download Submit
C:\Users\Admin\AppData\Local\Temp\HY3kVmQ00V.bat

Filesize
157B

MD5
dfccc1cf432e83efa9aad76b9f0fdf14

SHA1
73eb469c9fd46f6b655bdf209a9137cbbdb9d965

SHA256
ae15908f3d7d21eeeb828bede61b4c375ab1f073d7fb1627b9b5969a405111d0

SHA512
e072c74af7d652afd2987e8d1869b146ed332acc91c6aba5e040e0a2887ed07c6477bef03dc965e53f8c94df8d4d52c9059cc807a47afa654310cffc491d87cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\KvMN3vAFGm.bat

Filesize
205B

MD5
66a9fbafdd40aba3af673f5246f20485

SHA1
2a3504a19d7d7598d274ee2ace06ec3cc5e28330

SHA256
0076db361babf7b05342a393d9b02af3f444f27cf28cd25759b962aa7613f1e5

SHA512
f3a95253030cfac507ef3ef641195c182956cd491fdef23df9ec37f028c97cacb788cfa897db6555555138fec026c7b94bd0d34aa3ba123b3ab89570410beb3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\R3sykWUIoO.bat

Filesize
205B

MD5
6719f236d32de5b2a1c730e9b43273b6

SHA1
d93eea87647a7a5963544a0bb012075599d27e61

SHA256
49f3865dbff9590d79ec8618c7beba6d790534d19b55e3207d50fe1c14343518

SHA512
91d2fcbdcda82061c9b12585137fe4f25ee3a404b0f61778a9ed155677fa0e574fc37220128c23f9c1d50d6dba90681a203601631357be46791ec2fbd8c9758c

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES1C09.tmp

Filesize
1KB

MD5
2d287aff3ec49f2c4201c2e85e8b71c6

SHA1
bcb2ef04825c14aaba0c1394d0349ebff2e2648e

SHA256
5058947a333712160eb2339763ffb27027b8e3b5c2ea4c8b032f6c4e5e7072b0

SHA512
62f14b30f74a348f7494c5dfdac1ef3b15c395bf31292afc073bed2a19347f63950eae60639dc33a20b5cc0db464690d626569e2083e18b54bde7e6c8d836eb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\TAB96jcSpT.bat

Filesize
205B

MD5
c7e911a29f6daeacedb2687e7e523d07

SHA1
5e24d4a8d0ecedfe0d45508037df300658c6f842

SHA256
2f8c951ba90334124f2acb4cc92bad105b0221f2f71385374d066b38f8b98a0e

SHA512
b816ad461c6b7bac74251f850a7b14c31e961d9fb727576d30134f560cd9ab0f8b2d4a2084f979191f01226ec604b5fdd77eb176143f709882153795452e884d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ye8GjO9RaC.bat

Filesize
157B

MD5
5775865b7270427cfb707009cecf0e45

SHA1
2d514dfdc2b318557b6946e54fc5f6e520d0d333

SHA256
c1a4f8739b628c3db61a8b6f9f28b34966abf2549427df251cbb09e6af4e56da

SHA512
d1c2fabc167f3ec9daf64b51678239b9cc940b9c853deaa21c3975d4aec7bee24b286a7fd794c19780140ef0dc6aeb892f0ae3fed1f1eab46554d58b63370a38

Download Submit
C:\Users\Admin\AppData\Local\Temp\dpubRuS73Q.bat

Filesize
205B

MD5
1085c9593a1dbc717942f7e073e75528

SHA1
c34f4b900bb784e755208ef9119cb0f7c589a6c4

SHA256
137ac8d94783e4f2c896c5ab4ae3d0373d505523ecbd6aab68bc3d3c5ef1184b

SHA512
ade71627f722ad4e9a51d2ec2e87c76d83945cd23d46dbba9d28382bcf0f08b3c1b6fe996564605c62691c850da23b69babf69585c0c2ed23b6f4c814166f792

Download Submit
C:\Users\Admin\AppData\Local\Temp\e8jcz5MCL9.bat

Filesize
205B

MD5
c49483e9789f7fc72bb20279089a297b

SHA1
0e225f483bbfeb6945c1d7e80c4d6d50e9cf9e65

SHA256
55bc48333f06d927e69fd7fd6b10afd2e1cdaa003566bc360fddd4bad44efb1b

SHA512
81356452ae9cb4618e1fd97e8a5c4ee036f2facb4048c1e5e470994c179fce61318ca285b6040d2fef83cc09fa6e444de1f0baacb43b06458ad66bca895854cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\yWxYzFHQ21.bat

Filesize
205B

MD5
f78f49ede56170f21b6165476a315fc0

SHA1
06e4f58fa3109ab012f9284bff97d2ea9c019f87

SHA256
d4e6ba7d4eef3ff6aa7cd45ba0e8e1e5b6659990119cb2045aab23c4f0d76c27

SHA512
dafa7fe04bab033927fbb6cd63280f96ae71b202243edf1a189e8f342d350a7cf92162e47cbebf4ede8dc1d6a4463668e69edf059d118b674ec7481a9fb51d81

Download Submit
C:\agentsavesSessioncrt\fqPjTa5dmPVCKdRywzd7JYZCOwyT6TkVbtC1AmfVOodlKWVPvDa.bat

Filesize
103B

MD5
ebe4c21126c470353bc85eac1cef774a

SHA1
ee65d9ffab4a9d4781feb71d087a946bd64476cb

SHA256
27dc735359b7b713506b5a2dbacbbdb43d296f0cc4f11f374b59d605ec4f64e0

SHA512
67b2b033fb58cd3df39a1b7741d14729ef092d21c142c0a06611eed6479000ca29595496624b8d2acf43041ef8332e4cb66923d10b9b6a29dc29e9e007885f13

Download Submit
C:\agentsavesSessioncrt\hyperBlockServerSavesSession.exe

Filesize
2.3MB

MD5
22a0f7e0137b38061bcea6990ea2b3d8

SHA1
65b9d717a7a53df2bd8c58351510033e771cfd02

SHA256
ad7b5a48b29168ac72ab4d887e21021c3c63d4320de8b0b88ae8d295c98a051e

SHA512
192acb8169f883ece3af2c83eacef49bc6fa465bbe943b3716af785e8bb4bc959fe7e6457b14bb5474adba6fd5f18fc9e30bf2a1a63b5147d0dca5e52681ae25

Download Submit
C:\agentsavesSessioncrt\wvAy3g2cwUA0WlAR67rDwx6ilqeJ3huGsrpLtUKpTSpXZqeLmD5jcZq.vbe

Filesize
250B

MD5
a0513e519e74038b3105c6da2ab0d334

SHA1
6c5f7f413c19c0f7c2584e706a60d08c27823e36

SHA256
3ed9c9074b5448cb4fdc13904739407317f5e083eda10b4ab6145888ffa12033

SHA512
222c2107dcfc29a0e0a05a5378ac38a564c175868d9a9428de4610cff53b35c16dee575e4d63eb427ad23bcaec7a8649167b4918aaf18e78bf7329a6c2e3b877

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\3qaqp503\3qaqp503.0.cs

Filesize
377B

MD5
fb5db10a64e826af57117c8e32ad2fa5

SHA1
9f957b8119bf257e9b52f3ad3cc86dd9245fdcb7

SHA256
ae7e3c66deda11ac46eac3dcd381405fc511d5ead8ff46ef624d7910c1be6fa8

SHA512
0574f699d914b57703bcd6c09e73a3dba7dde78777446b4e293e87aa3e69948703e221782769a3033425f50a5a1a41cdafed47e3f8b4d0dae8539eee087706bf

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\3qaqp503\3qaqp503.cmdline

Filesize
235B

MD5
bc9387b9ab65b624fd1fa4becadf2f00

SHA1
182ca79f85b900bf400517e7d5723a10d736b623

SHA256
35592022a020ce3a850d25d5fd752f1e0a78cc93017ebe3714b57b2d09196448

SHA512
bcae24feed1796cdc232609779c6d93dd397e3a80ea8b9958f3647ea45d940dfbf6315eec2aabef6a427aeab3978724e5d7b2e5c3d1a2644339abd4ea7bcf2d2

Download Submit
\??\c:\Windows\System32\CSC9A4AF5B266746ECAE8581F06A0563E.TMP

Filesize
1KB

MD5
332eb1c3dc41d312a6495d9ea0a81166

SHA1
1d5c1b68be781b14620d9e98183506f8651f4afd

SHA256
bab20fa8251fcee3c944e76bdc082850ae4a32fd2eff761fec3bc445f58d11f2

SHA512
2c5ae1de2d4cb7f1e1540b455f7876eb1f494cda57bfb8e78a81aa01f3f453c5488b986cd170d6dc96bf684874c54257bfd0335a78764cc3fa43fe310a0cf440

Download Submit
memory/980-183-0x0000000000FB0000-0x00000000011F8000-memory.dmp

Filesize
2.3MB

Download
memory/1076-170-0x0000000000BB0000-0x0000000000DF8000-memory.dmp

Filesize
2.3MB

Download
memory/1124-157-0x0000000000B00000-0x0000000000D48000-memory.dmp

Filesize
2.3MB

Download
memory/1664-131-0x0000000000AE0000-0x0000000000D28000-memory.dmp

Filesize
2.3MB

Download
memory/2484-105-0x00000000013A0000-0x00000000015E8000-memory.dmp

Filesize
2.3MB

Download
memory/2844-25-0x0000000000640000-0x000000000064C000-memory.dmp

Filesize
48KB

Download
memory/2844-23-0x00000000005B0000-0x00000000005C0000-memory.dmp

Filesize
64KB

Download
memory/2844-21-0x000000001AD90000-0x000000001ADEA000-memory.dmp

Filesize
360KB

Download
memory/2844-19-0x0000000002190000-0x00000000021A8000-memory.dmp

Filesize
96KB

Download
memory/2844-17-0x0000000002170000-0x000000000218C000-memory.dmp

Filesize
112KB

Download
memory/2844-15-0x00000000005A0000-0x00000000005AE000-memory.dmp

Filesize
56KB

Download
memory/2844-13-0x0000000000B20000-0x0000000000D68000-memory.dmp

Filesize
2.3MB

Download
memory/2920-118-0x0000000000190000-0x00000000003D8000-memory.dmp

Filesize
2.3MB

Download
memory/2940-56-0x0000000001230000-0x0000000001478000-memory.dmp

Filesize
2.3MB

Download