dcrat | a69f30c1b304b7f6c85facbbd598f1ebdfdc967488f1bf0617b3bddc3a3a4e86

Analysis

max time kernel
147s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
23-01-2025 11:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NeverLose.exe
Size

2.4MB
MD5

4a20d992a3e773d0fc70d29d27217fe5
SHA1

237ea4f9f0d167d3161ac8cba193b2e79b7cdd84
SHA256

a69f30c1b304b7f6c85facbbd598f1ebdfdc967488f1bf0617b3bddc3a3a4e86
SHA512

7bd12dbb3b051ee6b47ab734047ee06929ec5cbdda6c5be47513644257e75b10a6414e11503a7323ad3851a71c86932803e3d691e7d8f0cedb9625830ea0d270
SSDEEP

49152:tBELVoj3mruOsvEsgZpfyECvOhsX7/iEuHTClwGe:nQI0zLhpfTCWhsL/iEMUu

Score

10^/10

dcrat discovery infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Photo Viewer\\csrss.exe\", \"C:\\Windows\\Setup\\State\\unsecapp.exe\""	Msfontruntime.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Photo Viewer\\csrss.exe\", \"C:\\Windows\\Setup\\State\\unsecapp.exe\", \"C:\\agentMonitornetcommon\\dllhost.exe\""	Msfontruntime.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Photo Viewer\\csrss.exe\", \"C:\\Windows\\Setup\\State\\unsecapp.exe\", \"C:\\agentMonitornetcommon\\dllhost.exe\", \"C:\\Program Files\\WindowsPowerShell\\dllhost.exe\""	Msfontruntime.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Photo Viewer\\csrss.exe\", \"C:\\Windows\\Setup\\State\\unsecapp.exe\", \"C:\\agentMonitornetcommon\\dllhost.exe\", \"C:\\Program Files\\WindowsPowerShell\\dllhost.exe\", \"C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\winlogon.exe\""	Msfontruntime.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Photo Viewer\\csrss.exe\", \"C:\\Windows\\Setup\\State\\unsecapp.exe\", \"C:\\agentMonitornetcommon\\dllhost.exe\", \"C:\\Program Files\\WindowsPowerShell\\dllhost.exe\", \"C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\winlogon.exe\", \"C:\\agentMonitornetcommon\\Msfontruntime.exe\""	Msfontruntime.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Photo Viewer\\csrss.exe\""	Msfontruntime.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3212	4440	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2564	4440	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1080	4440	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1808	4440	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4408	4440	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4828	4440	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4472	4440	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2348	4440	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2044	4440	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2328	4440	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3888	4440	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1888	4440	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	236	4440	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1584	4440	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4324	4440	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3144	4440	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2912	4440	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3876	4440	schtasks.exe	81

Executes dropped EXE 16 IoCs

pid	Process
4924	Msfontruntime.exe
1124	dllhost.exe
1496	dllhost.exe
1768	dllhost.exe
4116	dllhost.exe
5084	dllhost.exe
3292	dllhost.exe
2044	dllhost.exe
1904	dllhost.exe
752	dllhost.exe
2016	dllhost.exe
2756	dllhost.exe
4092	dllhost.exe
1916	dllhost.exe
3332	dllhost.exe
492	dllhost.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000\Software\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\Windows\\Setup\\State\\unsecapp.exe\""	Msfontruntime.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\Windows\\Setup\\State\\unsecapp.exe\""	Msfontruntime.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\winlogon.exe\""	Msfontruntime.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000\Software\Microsoft\Windows\CurrentVersion\Run\Msfontruntime = "\"C:\\agentMonitornetcommon\\Msfontruntime.exe\""	Msfontruntime.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files\\WindowsPowerShell\\dllhost.exe\""	Msfontruntime.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000\Software\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\winlogon.exe\""	Msfontruntime.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Msfontruntime = "\"C:\\agentMonitornetcommon\\Msfontruntime.exe\""	Msfontruntime.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files\\Windows Photo Viewer\\csrss.exe\""	Msfontruntime.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files\\Windows Photo Viewer\\csrss.exe\""	Msfontruntime.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\agentMonitornetcommon\\dllhost.exe\""	Msfontruntime.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\agentMonitornetcommon\\dllhost.exe\""	Msfontruntime.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files\\WindowsPowerShell\\dllhost.exe\""	Msfontruntime.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSC98E449CB418C445C90A36BCF63C64ADD.TMP	csc.exe
File created	\??\c:\Windows\System32\j7xqt2.exe	csc.exe

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Photo Viewer\csrss.exe	Msfontruntime.exe
File created	C:\Program Files\Windows Photo Viewer\886983d96e3d3e	Msfontruntime.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\winlogon.exe	Msfontruntime.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\winlogon.exe	Msfontruntime.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\cc11b995f2a76d	Msfontruntime.exe
File created	C:\Program Files\WindowsPowerShell\dllhost.exe	Msfontruntime.exe
File created	C:\Program Files\WindowsPowerShell\5940a34987c991	Msfontruntime.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Setup\State\unsecapp.exe	Msfontruntime.exe
File created	C:\Windows\Setup\State\29c1c3cc0f7685	Msfontruntime.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NeverLose.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 10 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1172	PING.EXE
976	PING.EXE
4420	PING.EXE
3056	PING.EXE
4320	PING.EXE
652	PING.EXE
2296	PING.EXE
1476	PING.EXE
2800	PING.EXE
2312	PING.EXE

Modifies registry class 17 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings	NeverLose.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings	Msfontruntime.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings	dllhost.exe

Runs ping.exe 1 TTPs 10 IoCs

Remote System Discovery

T1018

pid	Process
976	PING.EXE
1476	PING.EXE
4420	PING.EXE
652	PING.EXE
1172	PING.EXE
2296	PING.EXE
3056	PING.EXE
2800	PING.EXE
2312	PING.EXE
4320	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1888	schtasks.exe
2912	schtasks.exe
3876	schtasks.exe
1808	schtasks.exe
2044	schtasks.exe
3888	schtasks.exe
2348	schtasks.exe
236	schtasks.exe
4324	schtasks.exe
4408	schtasks.exe
4828	schtasks.exe
4472	schtasks.exe
2328	schtasks.exe
1584	schtasks.exe
3144	schtasks.exe
3212	schtasks.exe
2564	schtasks.exe
1080	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4924	Msfontruntime.exe
4924	Msfontruntime.exe
4924	Msfontruntime.exe
4924	Msfontruntime.exe
4924	Msfontruntime.exe
4924	Msfontruntime.exe
4924	Msfontruntime.exe
4924	Msfontruntime.exe
4924	Msfontruntime.exe
4924	Msfontruntime.exe
4924	Msfontruntime.exe
4924	Msfontruntime.exe
4924	Msfontruntime.exe
4924	Msfontruntime.exe
4924	Msfontruntime.exe
4924	Msfontruntime.exe
4924	Msfontruntime.exe
4924	Msfontruntime.exe
4924	Msfontruntime.exe
4924	Msfontruntime.exe
4924	Msfontruntime.exe
4924	Msfontruntime.exe
4924	Msfontruntime.exe
4924	Msfontruntime.exe
4924	Msfontruntime.exe
4924	Msfontruntime.exe
4924	Msfontruntime.exe
4924	Msfontruntime.exe
4924	Msfontruntime.exe
4924	Msfontruntime.exe
4924	Msfontruntime.exe
4924	Msfontruntime.exe
4924	Msfontruntime.exe
4924	Msfontruntime.exe
4924	Msfontruntime.exe
4924	Msfontruntime.exe
4924	Msfontruntime.exe
4924	Msfontruntime.exe
4924	Msfontruntime.exe
4924	Msfontruntime.exe
4924	Msfontruntime.exe
4924	Msfontruntime.exe
4924	Msfontruntime.exe
4924	Msfontruntime.exe
4924	Msfontruntime.exe
4924	Msfontruntime.exe
4924	Msfontruntime.exe
4924	Msfontruntime.exe
4924	Msfontruntime.exe
4924	Msfontruntime.exe
4924	Msfontruntime.exe
4924	Msfontruntime.exe
4924	Msfontruntime.exe
4924	Msfontruntime.exe
4924	Msfontruntime.exe
4924	Msfontruntime.exe
4924	Msfontruntime.exe
4924	Msfontruntime.exe
4924	Msfontruntime.exe
4924	Msfontruntime.exe
4924	Msfontruntime.exe
4924	Msfontruntime.exe
4924	Msfontruntime.exe
4924	Msfontruntime.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	4924	Msfontruntime.exe
Token: SeDebugPrivilege	1124	dllhost.exe
Token: SeDebugPrivilege	1496	dllhost.exe
Token: SeDebugPrivilege	1768	dllhost.exe
Token: SeDebugPrivilege	4116	dllhost.exe
Token: SeDebugPrivilege	5084	dllhost.exe
Token: SeDebugPrivilege	3292	dllhost.exe
Token: SeDebugPrivilege	2044	dllhost.exe
Token: SeDebugPrivilege	1904	dllhost.exe
Token: SeDebugPrivilege	752	dllhost.exe
Token: SeDebugPrivilege	2016	dllhost.exe
Token: SeDebugPrivilege	2756	dllhost.exe
Token: SeDebugPrivilege	4092	dllhost.exe
Token: SeDebugPrivilege	1916	dllhost.exe
Token: SeDebugPrivilege	3332	dllhost.exe
Token: SeDebugPrivilege	492	dllhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3756 wrote to memory of 5064	3756	NeverLose.exe	77
PID 3756 wrote to memory of 5064	3756	NeverLose.exe	77
PID 3756 wrote to memory of 5064	3756	NeverLose.exe	77
PID 5064 wrote to memory of 4636	5064	WScript.exe	78
PID 5064 wrote to memory of 4636	5064	WScript.exe	78
PID 5064 wrote to memory of 4636	5064	WScript.exe	78
PID 4636 wrote to memory of 4924	4636	cmd.exe	80
PID 4636 wrote to memory of 4924	4636	cmd.exe	80
PID 4924 wrote to memory of 2800	4924	Msfontruntime.exe	85
PID 4924 wrote to memory of 2800	4924	Msfontruntime.exe	85
PID 2800 wrote to memory of 1864	2800	csc.exe	87
PID 2800 wrote to memory of 1864	2800	csc.exe	87
PID 4924 wrote to memory of 4088	4924	Msfontruntime.exe	103
PID 4924 wrote to memory of 4088	4924	Msfontruntime.exe	103
PID 4088 wrote to memory of 3400	4088	cmd.exe	105
PID 4088 wrote to memory of 3400	4088	cmd.exe	105
PID 4088 wrote to memory of 2312	4088	cmd.exe	106
PID 4088 wrote to memory of 2312	4088	cmd.exe	106
PID 4088 wrote to memory of 1124	4088	cmd.exe	107
PID 4088 wrote to memory of 1124	4088	cmd.exe	107
PID 1124 wrote to memory of 3724	1124	dllhost.exe	108
PID 1124 wrote to memory of 3724	1124	dllhost.exe	108
PID 3724 wrote to memory of 444	3724	cmd.exe	110
PID 3724 wrote to memory of 444	3724	cmd.exe	110
PID 3724 wrote to memory of 4320	3724	cmd.exe	111
PID 3724 wrote to memory of 4320	3724	cmd.exe	111
PID 3724 wrote to memory of 1496	3724	cmd.exe	112
PID 3724 wrote to memory of 1496	3724	cmd.exe	112
PID 1496 wrote to memory of 3552	1496	dllhost.exe	113
PID 1496 wrote to memory of 3552	1496	dllhost.exe	113
PID 3552 wrote to memory of 5104	3552	cmd.exe	115
PID 3552 wrote to memory of 5104	3552	cmd.exe	115
PID 3552 wrote to memory of 3076	3552	cmd.exe	116
PID 3552 wrote to memory of 3076	3552	cmd.exe	116
PID 3552 wrote to memory of 1768	3552	cmd.exe	117
PID 3552 wrote to memory of 1768	3552	cmd.exe	117
PID 1768 wrote to memory of 4716	1768	dllhost.exe	118
PID 1768 wrote to memory of 4716	1768	dllhost.exe	118
PID 4716 wrote to memory of 4700	4716	cmd.exe	120
PID 4716 wrote to memory of 4700	4716	cmd.exe	120
PID 4716 wrote to memory of 568	4716	cmd.exe	121
PID 4716 wrote to memory of 568	4716	cmd.exe	121
PID 4716 wrote to memory of 4116	4716	cmd.exe	122
PID 4716 wrote to memory of 4116	4716	cmd.exe	122
PID 4116 wrote to memory of 2280	4116	dllhost.exe	123
PID 4116 wrote to memory of 2280	4116	dllhost.exe	123
PID 2280 wrote to memory of 3184	2280	cmd.exe	125
PID 2280 wrote to memory of 3184	2280	cmd.exe	125
PID 2280 wrote to memory of 652	2280	cmd.exe	126
PID 2280 wrote to memory of 652	2280	cmd.exe	126
PID 2280 wrote to memory of 5084	2280	cmd.exe	127
PID 2280 wrote to memory of 5084	2280	cmd.exe	127
PID 5084 wrote to memory of 4160	5084	dllhost.exe	128
PID 5084 wrote to memory of 4160	5084	dllhost.exe	128
PID 4160 wrote to memory of 1552	4160	cmd.exe	130
PID 4160 wrote to memory of 1552	4160	cmd.exe	130
PID 4160 wrote to memory of 2296	4160	cmd.exe	131
PID 4160 wrote to memory of 2296	4160	cmd.exe	131
PID 4160 wrote to memory of 3292	4160	cmd.exe	132
PID 4160 wrote to memory of 3292	4160	cmd.exe	132
PID 3292 wrote to memory of 4708	3292	dllhost.exe	133
PID 3292 wrote to memory of 4708	3292	dllhost.exe	133
PID 4708 wrote to memory of 3592	4708	cmd.exe	135
PID 4708 wrote to memory of 3592	4708	cmd.exe	135

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\NeverLose.exe
"C:\Users\Admin\AppData\Local\Temp\NeverLose.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3756
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\agentMonitornetcommon\GBi0Q8YazuDC5WsFvOE.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5064
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\agentMonitornetcommon\g9S8CVbETtCg5QN5yxxbdptY4CtSRTw.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4636
  - - C:\agentMonitornetcommon\Msfontruntime.exe
      "C:\agentMonitornetcommon/Msfontruntime.exe"
      4⤵
      Modifies WinLogon for persistence
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4924
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\upnbfkxr\upnbfkxr.cmdline"
        5⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2800
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA345.tmp" "c:\Windows\System32\CSC98E449CB418C445C90A36BCF63C64ADD.TMP"
        6⤵
        
        PID:1864
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\QUhC0CFoRL.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4088
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:3400
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2312
      - C:\agentMonitornetcommon\dllhost.exe
        
        "C:\agentMonitornetcommon\dllhost.exe"
        6⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1124
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ylDQV2JGYe.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:3724
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:444
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4320
        
        C:\agentMonitornetcommon\dllhost.exe
        
        "C:\agentMonitornetcommon\dllhost.exe"
        8⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1496
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Q4KhmYWH96.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:3552
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:5104
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:3076
        
        C:\agentMonitornetcommon\dllhost.exe
        
        "C:\agentMonitornetcommon\dllhost.exe"
        10⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1768
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ds6v954M6h.bat"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:4716
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:4700
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:568
        
        C:\agentMonitornetcommon\dllhost.exe
        
        "C:\agentMonitornetcommon\dllhost.exe"
        12⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4116
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ZAbXgo5nXx.bat"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:2280
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:3184
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:652
        
        C:\agentMonitornetcommon\dllhost.exe
        
        "C:\agentMonitornetcommon\dllhost.exe"
        14⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5084
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\fLkB8c43UX.bat"
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:4160
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:1552
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2296
        
        C:\agentMonitornetcommon\dllhost.exe
        
        "C:\agentMonitornetcommon\dllhost.exe"
        16⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3292
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8ybTWoiUnd.bat"
        17⤵
        Suspicious use of WriteProcessMemory
        
        PID:4708
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:3592
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1172
        
        C:\agentMonitornetcommon\dllhost.exe
        
        "C:\agentMonitornetcommon\dllhost.exe"
        18⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2044
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\e6v3dq4CIc.bat"
        19⤵
        
        PID:1744
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:4128
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:976
        
        C:\agentMonitornetcommon\dllhost.exe
        
        "C:\agentMonitornetcommon\dllhost.exe"
        20⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:1904
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\RI9pGJW8L1.bat"
        21⤵
        
        PID:1480
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:5000
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:396
        
        C:\agentMonitornetcommon\dllhost.exe
        
        "C:\agentMonitornetcommon\dllhost.exe"
        22⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:752
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8JExSyzmRo.bat"
        23⤵
        
        PID:1952
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:3868
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:2404
        
        C:\agentMonitornetcommon\dllhost.exe
        
        "C:\agentMonitornetcommon\dllhost.exe"
        24⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2016
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\KtA3LkY0CV.bat"
        25⤵
        
        PID:4364
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        26⤵
        
        PID:3680
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:3524
        
        C:\agentMonitornetcommon\dllhost.exe
        
        "C:\agentMonitornetcommon\dllhost.exe"
        26⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2756
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Y9fzlxD6eQ.bat"
        27⤵
        
        PID:1440
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        28⤵
        
        PID:3696
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        28⤵
        
        PID:3552
        
        C:\agentMonitornetcommon\dllhost.exe
        
        "C:\agentMonitornetcommon\dllhost.exe"
        28⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4092
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\mCHKcGl2nx.bat"
        29⤵
        
        PID:4492
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        30⤵
        
        PID:1896
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        30⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1476
        
        C:\agentMonitornetcommon\dllhost.exe
        
        "C:\agentMonitornetcommon\dllhost.exe"
        30⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:1916
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\QjhCqOFzVv.bat"
        31⤵
        
        PID:4660
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        32⤵
        
        PID:4864
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        32⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4420
        
        C:\agentMonitornetcommon\dllhost.exe
        
        "C:\agentMonitornetcommon\dllhost.exe"
        32⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3332
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\URBaIgEX4g.bat"
        33⤵
        
        PID:2296
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        34⤵
        
        PID:4744
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        34⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3056
        
        C:\agentMonitornetcommon\dllhost.exe
        
        "C:\agentMonitornetcommon\dllhost.exe"
        34⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:492
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Cg5rz6h3MO.bat"
        35⤵
        
        PID:3604
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        36⤵
        
        PID:4680
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        36⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Photo Viewer\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Photo Viewer\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 12 /tr "'C:\Windows\Setup\State\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Windows\Setup\State\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 14 /tr "'C:\Windows\Setup\State\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\agentMonitornetcommon\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\agentMonitornetcommon\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\agentMonitornetcommon\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Program Files\WindowsPowerShell\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Program Files\WindowsPowerShell\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MsfontruntimeM" /sc MINUTE /mo 10 /tr "'C:\agentMonitornetcommon\Msfontruntime.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Msfontruntime" /sc ONLOGON /tr "'C:\agentMonitornetcommon\Msfontruntime.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MsfontruntimeM" /sc MINUTE /mo 9 /tr "'C:\agentMonitornetcommon\Msfontruntime.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\dllhost.exe.log

Filesize
1KB

MD5
f2e58a4d6897d4adf2e33ca36ace55ce

SHA1
67294a7cca4e465fa83b73debd117b3e6f8277d3

SHA256
c146c805685f0d4962c861f33b3ed0740cc7a21f97e79bdf0411dab030d85b1d

SHA512
5e1a8525517f2d1e0d2e422ad06ec3cf2e22252c77f320d36db6792f39b1f6473eb7a0d34518178f705921c51c2c2ded71c2167ab6605c6262d29da4c16e1bb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\8JExSyzmRo.bat

Filesize
212B

MD5
fd4209bf92b5eb5a73f917480f8f753b

SHA1
058aba457b816b2601404a236d4c0eb015df0899

SHA256
1cfc458f3e4f58d13ce4adb5b6298cbcd02c06ca67c392aa8fb82ee2381358a7

SHA512
da4ecc19da4783f2f5eb7051090c73a5209f6685ab05cf7346aead37e628d263da22b0a58459671e4a4f2785fc82ed191f6289c97b5d8f248f3b23ba970527a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\8ybTWoiUnd.bat

Filesize
164B

MD5
84ea06127dc08a109a72e0d85d979cc2

SHA1
254cf56c4f125c8c12cb8ef886acae2475b4ee2a

SHA256
f84e02fbcdfff4e7ba838ad1e6568c0a2f71f67a84c0f6740f8be477e13a42d9

SHA512
247ad3f8b8a4ad2aa4e12d3f5e337be53922b4be1601ac23cd1625ad5013049d99eca529de06916a767af6c7df83f685c576b6123208586218e67b222b850d49

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cg5rz6h3MO.bat

Filesize
164B

MD5
b3ffcd92894e44b9c576bfe5d3b93b94

SHA1
384323be7159f141e9dd9ff66f73c6e63348b33a

SHA256
2cda53ba0148c478808a886e462af38e4b3cd089966995c97e90629e1cf14b23

SHA512
a4afd0c4c414079b9d2864542fdd67a995287b1fe4e635a347e49e38970d4780145e3bab4b8a979a607502aae3ac1e7432a16a96a70647e00d41ffdd837ded9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\KtA3LkY0CV.bat

Filesize
212B

MD5
07afa55bb5165f7118024f49ec5b018e

SHA1
281006979824f4e55ae072503d1b90ce4531c72f

SHA256
949a3355516023a1c989bbb4c085b11eaedae0309f2aff326592460ad14cfa84

SHA512
7f6b6d3ceee7b41b55c32e073f2cb9a0295a767c9cd2b945d4aa2e6eaeef763bee93141c1ea1e2ba4bcf155cbd786c2c36fc2e89eecb0e451d68fbb47a8e6ef8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Q4KhmYWH96.bat

Filesize
212B

MD5
c1b1c55b8d28039d88370c0f5ab91d73

SHA1
6a6dc12716b25928aa2f67b50d3aedf8b93cedb2

SHA256
592c5b5b2f36ac270dcd4c784707a972e2c87b77082056184deb9542994690b0

SHA512
83a8da46d13cb2ec191eb3e74345a6fe8332826a2216f9a102a0a229f6560cb835ef10bcc769087b3aa48379dba59d2360c3b7c466209232ebb9db96399d350e

Download Submit
C:\Users\Admin\AppData\Local\Temp\QUhC0CFoRL.bat

Filesize
164B

MD5
b4875f01d1ac240c2412a71cf33c8622

SHA1
a550af3779032b2c0ed030a397123b49c4fa1053

SHA256
d8b95ae2eb824871589e39d5b56c3d29f4fa79305ebbe00cc07d60374084e86d

SHA512
7081d50bbeb6988e5795e402b8d1c78fc0f9e11a270e000add2d6e048131b8ff8dc106062e20d5e8ab5d6afa560f1547eba458e1951439fc2ea2fb02c0646821

Download Submit
C:\Users\Admin\AppData\Local\Temp\QjhCqOFzVv.bat

Filesize
164B

MD5
0343c62927ded41a2fd32b77b8202a69

SHA1
5ffba316c7d16d0a9995c927e78ecdffc6ea203e

SHA256
32d64bde2b478d9e6a50bcaefa24a20edca9cce97bd14faed9e6c7c1e81f9fb3

SHA512
fe380f1081155adb148aa253e57295146a526e1a501cb417b001b877679e6afc83ccb6ac415993da38b8554d188d27aaa74e19a8eb9def1f8194b0fe7e1a1069

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESA345.tmp

Filesize
1KB

MD5
d61d20f5bb195b1ff803bc19d2699f68

SHA1
80c0c24909a1ad56208b7ab740c5fc2c5d9f58b3

SHA256
b068addff45391fdf022a8031697559a8973f0131951d12bdf130dd81ddcc707

SHA512
0ae21ac5fe6b171100ca3e6b150d43bb611cea87751624e2c7851f84283f57b372337f478fcde272acc01b6031702a531c56803c90fcfeb87379dad421388d5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\RI9pGJW8L1.bat

Filesize
212B

MD5
ed7acfcd49be26e1880aef34b0bc17be

SHA1
5d673688a5e9ea173c52eda4fb49bb9e450cac5d

SHA256
19fad82eb4468100053fc71c4f2567d507e55bae0f85beacfbb58b56443a4b58

SHA512
39f93f597c9488731933a47041b49286bcfba459e0e9332f4f23591c8b6728003f0a0d0b6747acea520473fe9a16c7e8aa167d90b42665e2a64d81c054e57797

Download Submit
C:\Users\Admin\AppData\Local\Temp\URBaIgEX4g.bat

Filesize
164B

MD5
da95838bbc32cf492edab4f7c548e846

SHA1
ef8fc2a86a6b27a8c72c324ef6573f29464e6049

SHA256
e67ae07a199d684bc50f501e041579999cc3b19abf6d38d0ba6d0a4caf4d9005

SHA512
79987474124720dc921ebca25b2bd3e70b0857c4b012f1d6bee1ec3935c50b55ea40810c6303eca60d20892005b522338946e6db104bce2b1e3a3c7abb2f7e83

Download Submit
C:\Users\Admin\AppData\Local\Temp\Y9fzlxD6eQ.bat

Filesize
212B

MD5
2571021a32d579128c9b52b1d11e5a94

SHA1
f1c9a8d04d5d5b68bfab53ac93d9ddb52b6f94c2

SHA256
83241f858731b43e246c737e8d74559fe57c3afeab5d78bde7d561e8954f4600

SHA512
06d425a55c497ddb1762ce610f6c968e8e123981f8fc47cd6d25ca6e0bab27d88f00e0860eb2bd3d4b8ceb1f8dfebd744f5987f726ae3d381582cdb33e8fd357

Download Submit
C:\Users\Admin\AppData\Local\Temp\ZAbXgo5nXx.bat

Filesize
164B

MD5
15f72785ecdddf63f1ef363e06cba6bc

SHA1
baafd2d1ce657c1210660e8ac7f71ba9006b36c3

SHA256
77b16f7e43c97d186de2c61d0712aa92c2335ef636e1d09f34592ebd1160c502

SHA512
0ba69e7d675cf8a8f292ac04d7e23b12bbd783746f2c28a7194d28dc7153a3fc4cfa3fca387b67a666728ff9f24c4664af9d7abb48d1d7cc13644647752f4ddb

Download Submit
C:\Users\Admin\AppData\Local\Temp\ds6v954M6h.bat

Filesize
212B

MD5
4998b7db6b15e0b4db93d018f46c1875

SHA1
e0a6a9667f4610294f2a6ba29f10f9f0b192c84d

SHA256
434fccbf36b608bfc99381bdb294726f74ff1cfa077fe7ae46193a6417c58bb0

SHA512
d23719beae292bf4b3b1311e9f6e3ce40b6e9988f5dafacbda08c428c04a5decb16093742b89545954736c68edecf9804082455dd1933009343a54a884cff87e

Download Submit
C:\Users\Admin\AppData\Local\Temp\e6v3dq4CIc.bat

Filesize
164B

MD5
d98842d480c45d95e61398f7c434abe4

SHA1
6fb8fcebd4cb48e000ee7e5b4d002ba8cfd7e6dd

SHA256
9f3bcbb2d864984f380993472f80a82edd5e869c7361f79c72f30249ca60586a

SHA512
80f7edd1d62f57abeaf122f7d7213bcc593822ac0837eca5686b399389ae78637e0440f19ef17a8d21e84cb0235818cafb3d91ccd4a788f63fa8afb5cf386aab

Download Submit
C:\Users\Admin\AppData\Local\Temp\fLkB8c43UX.bat

Filesize
164B

MD5
407533762e26f22e79e64764d10148db

SHA1
f8103d3571e063e63b8dce3c6599cc2486c889cb

SHA256
44d8db0f33dd147d3e0fc4c1c628c07ce7dbfe0c04da463b080a70420f78da33

SHA512
eb441bc659bf572f0d1c28277fdb4a2aa7d8dd849c5a8cf99218407d40f6ddd7c5150979f837248ab385cbe79f7a4427c7c13b82d83c0783c492f80933965da4

Download Submit
C:\Users\Admin\AppData\Local\Temp\mCHKcGl2nx.bat

Filesize
164B

MD5
d629df05796cacf34147b19d32ad7ff6

SHA1
566144769113f6591633e2ce9403f5bd8589f235

SHA256
ffe92f8b64c4d67454382461cae1932df563a52b27b797b5fb2dc09f1cce1dec

SHA512
d8393b7718f10f2566b1029ee3eabaf9ff708e2252e4e0d6df55f4c01ccef9d9546a5f813e47bcbbaeb8c5b132b19eeed69dda0c4c103da0abf90d2433ff082a

Download Submit
C:\Users\Admin\AppData\Local\Temp\ylDQV2JGYe.bat

Filesize
164B

MD5
3aaae3425d89ddf1e86a42cf5e0ffcd1

SHA1
b4812463322aef8de17219f907f86f1947a4fc06

SHA256
7ed0a71bafcd8bd22cad7e90344f52902506e31daa2a41856d6928acfece4a86

SHA512
52738f027bb356c397f6521cfb5999ccdefb1e1e1345730c74dca846fdc734eb417fadfa99f24afa9b765ed2d4793d16515cae3243816eda564272c9031ebda0

Download Submit
C:\agentMonitornetcommon\GBi0Q8YazuDC5WsFvOE.vbe

Filesize
231B

MD5
e9836fb94a627362459e478f344fe010

SHA1
ce16cdd9513923ac775a7498e4548d4a66bcef2c

SHA256
fe4eda0eca7f098fe7ad5ce5a5e8f68d8735e24e93654fb61e3187d6e6207235

SHA512
f589c484cea94694a9405a3cd49111671ba479f526a9068d46c30f59dd1f813b85eb08c1fb76d39ff4d268ee94da307b4fa70afe3454faa062ddaa71ad7e7f1b

Download Submit
C:\agentMonitornetcommon\Msfontruntime.exe

Filesize
1.8MB

MD5
769730d9ed728056adc3c69648deae26

SHA1
6c0a76de7715745eb3ca344d6ad5665c66f10ace

SHA256
c4f58fcf47c8897c4e3fe97b40c8ae6e3093242d37eecc325f5e89e1f7f1ca89

SHA512
9124c43ff1df0b56bfe9c1211abe997ce83bc4941546fd48c26414e43ec9117a2f009c7290019579fc09726cb93c78de90aa4d3589222a105985f287c28116ab

Download Submit
C:\agentMonitornetcommon\g9S8CVbETtCg5QN5yxxbdptY4CtSRTw.bat

Filesize
82B

MD5
8beb041aab9fe0aa4f76082b7329a1a5

SHA1
6c1dd365d03640042ff51a2a3ada9a764706efba

SHA256
4504697922de405075ca52ec9d6c636ad153e3cd06b1ad1ae33a9f5e6edb2646

SHA512
286a95f6182408207e0db553ee3b5ab67ff60d5238984db49abe0a4497ee0fdf9c4210d2adfb5a1257dcdedabff0b067a8bee27f1e581a02364f9e8fd6bda7e6

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\upnbfkxr\upnbfkxr.0.cs

Filesize
379B

MD5
44081d369e7ba34015f0b3128873a2b2

SHA1
194c066702c29f0d3d6a6057a42833717646d3a5

SHA256
22223d810974069bb52929eea3e05cb1c61e9431ba7671e57c1658a6fceec51d

SHA512
30fa719a174f3b681ce8fd850bebc2305b0277bc053a9451a589de1152ef28ae001b74a1e8de2fa2654347f5c65f5c9cc830b342c55dbd18602a1409156ef9db

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\upnbfkxr\upnbfkxr.cmdline

Filesize
235B

MD5
c0698480840674423a4c55df53be16b2

SHA1
fb604acb144813b2ef7192c4482ba4da84e0e18d

SHA256
2fe1a51436b2fb97d8388bba42ff9da1ea64358771c0feda39f38010af86cc5c

SHA512
b4ddc84e85c500e9bf6e59e4b9b12d3fea52429202a238327435de47ba48f262968bcba4b0cf54fdfbf3a0c1df8b4e1f0cfdc09086a0971b8cea81f1dca51186

Download Submit
\??\c:\Windows\System32\CSC98E449CB418C445C90A36BCF63C64ADD.TMP

Filesize
1KB

MD5
acfb6faeec3eb6e047a5a2e7fc46f7c4

SHA1
bd7ca4bf6c574dec440c891d55a541a4cc20c376

SHA256
003e0aa24c6b8e2110a735f67fbd04e8669846591a5b4e21fe065ccc61fd92b8

SHA512
8084ffb6db54d21d869eb4f3d24f5081e0c177bffc703f1717e30b71dbf4898cccef8ef405d634556ef0370ecf67c1715151ae3d47277dea9cf612f73fc1e767

Download Submit
memory/4924-15-0x0000000002F20000-0x0000000002F2E000-memory.dmp

Filesize
56KB

Download
memory/4924-12-0x00007FFE1C583000-0x00007FFE1C585000-memory.dmp

Filesize
8KB

Download
memory/4924-13-0x00000000009F0000-0x0000000000BCA000-memory.dmp

Filesize
1.9MB

Download
memory/4924-18-0x000000001C4E0000-0x000000001C530000-memory.dmp

Filesize
320KB

Download
memory/4924-22-0x0000000002F30000-0x0000000002F3C000-memory.dmp

Filesize
48KB

Download
memory/4924-20-0x000000001B8A0000-0x000000001B8B8000-memory.dmp

Filesize
96KB

Download
memory/4924-17-0x000000001B880000-0x000000001B89C000-memory.dmp

Filesize
112KB

Download