dcrat | d09ecf875a5673d913c9162b9483331043bc8c17d61d24c51e92269ca29afd62

Analysis

max time kernel
103s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2025, 05:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-04-04_7ceeaab80e3c4481ebc4a025857bc0fe_black-basta_cova_luca-stealer.exe
Size

3.8MB
MD5

7ceeaab80e3c4481ebc4a025857bc0fe
SHA1

6b821230811b3e85befa6549374862a21f9c041b
SHA256

d09ecf875a5673d913c9162b9483331043bc8c17d61d24c51e92269ca29afd62
SHA512

92b8bb20771aae6f40f3da8bec754541f2b10d51aa30c493ab4b26d3e9d05416f29905954968cc1a8a013b013b8f26aeef011338e0f161b7dc4235ef91230ec9
SSDEEP

98304:bIVsEgIT4bNJFY3OqtEy7iS1ceWg8ioKgcEZm:bCOjBHY0ciSiGoKU0

Score

10^/10

dcrat discovery infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows NT\\wininit.exe\""	BlockSavesMonitorDll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows NT\\wininit.exe\", \"C:\\PortFontBrokerPerf\\spoolsv.exe\""	BlockSavesMonitorDll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows NT\\wininit.exe\", \"C:\\PortFontBrokerPerf\\spoolsv.exe\", \"C:\\Users\\Public\\Libraries\\backgroundTaskHost.exe\""	BlockSavesMonitorDll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows NT\\wininit.exe\", \"C:\\PortFontBrokerPerf\\spoolsv.exe\", \"C:\\Users\\Public\\Libraries\\backgroundTaskHost.exe\", \"C:\\PortFontBrokerPerf\\sppsvc.exe\""	BlockSavesMonitorDll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows NT\\wininit.exe\", \"C:\\PortFontBrokerPerf\\spoolsv.exe\", \"C:\\Users\\Public\\Libraries\\backgroundTaskHost.exe\", \"C:\\PortFontBrokerPerf\\sppsvc.exe\", \"C:\\Program Files\\Windows Media Player\\uk-UA\\backgroundTaskHost.exe\""	BlockSavesMonitorDll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows NT\\wininit.exe\", \"C:\\PortFontBrokerPerf\\spoolsv.exe\", \"C:\\Users\\Public\\Libraries\\backgroundTaskHost.exe\", \"C:\\PortFontBrokerPerf\\sppsvc.exe\", \"C:\\Program Files\\Windows Media Player\\uk-UA\\backgroundTaskHost.exe\", \"C:\\PortFontBrokerPerf\\BlockSavesMonitorDll.exe\""	BlockSavesMonitorDll.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4376	1892	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3256	1892	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2508	1892	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3776	1892	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4316	1892	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4756	1892	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4420	1892	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2780	1892	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1644	1892	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4620	1892	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4508	1892	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5100	1892	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3352	1892	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5028	1892	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3256	1892	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2608	1892	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3448	1892	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4704	1892	schtasks.exe	97

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Control Panel\International\Geo\Nation	BlockSavesMonitorDll.exe
Key value queried	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Control Panel\International\Geo\Nation	2025-04-04_7ceeaab80e3c4481ebc4a025857bc0fe_black-basta_cova_luca-stealer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Control Panel\International\Geo\Nation	SRRYXX DLC 2025.exe

Executes dropped EXE 16 IoCs

pid	Process
2788	SORRYXX FREE DLC V3.exe
2200	SRRYXX DLC 2025.exe
2580	BlockSavesMonitorDll.exe
1236	wininit.exe
4948	wininit.exe
396	spoolsv.exe
1732	spoolsv.exe
4404	backgroundTaskHost.exe
2352	backgroundTaskHost.exe
4588	sppsvc.exe
4268	sppsvc.exe
5092	backgroundTaskHost.exe
2600	backgroundTaskHost.exe
1564	BlockSavesMonitorDll.exe
1424	BlockSavesMonitorDll.exe
1348	wininit.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\PortFontBrokerPerf\\spoolsv.exe\""	BlockSavesMonitorDll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Users\\Public\\Libraries\\backgroundTaskHost.exe\""	BlockSavesMonitorDll.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\PortFontBrokerPerf\\sppsvc.exe\""	BlockSavesMonitorDll.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Program Files\\Windows Media Player\\uk-UA\\backgroundTaskHost.exe\""	BlockSavesMonitorDll.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Program Files (x86)\\Windows NT\\wininit.exe\""	BlockSavesMonitorDll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Program Files (x86)\\Windows NT\\wininit.exe\""	BlockSavesMonitorDll.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Users\\Public\\Libraries\\backgroundTaskHost.exe\""	BlockSavesMonitorDll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\PortFontBrokerPerf\\sppsvc.exe\""	BlockSavesMonitorDll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Program Files\\Windows Media Player\\uk-UA\\backgroundTaskHost.exe\""	BlockSavesMonitorDll.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BlockSavesMonitorDll = "\"C:\\PortFontBrokerPerf\\BlockSavesMonitorDll.exe\""	BlockSavesMonitorDll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BlockSavesMonitorDll = "\"C:\\PortFontBrokerPerf\\BlockSavesMonitorDll.exe\""	BlockSavesMonitorDll.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\PortFontBrokerPerf\\spoolsv.exe\""	BlockSavesMonitorDll.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSC57C6C220FEA0423D8EA3E2CB03A754.TMP	csc.exe
File created	\??\c:\Windows\System32\gul3os.exe	csc.exe

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File created	\??\c:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	csc.exe
File created	C:\Program Files\Windows Media Player\uk-UA\backgroundTaskHost.exe	BlockSavesMonitorDll.exe
File opened for modification	C:\Program Files\Windows Media Player\uk-UA\backgroundTaskHost.exe	BlockSavesMonitorDll.exe
File created	C:\Program Files\Windows Media Player\uk-UA\eddb19405b7ce1	BlockSavesMonitorDll.exe
File created	C:\Program Files (x86)\Windows NT\wininit.exe	BlockSavesMonitorDll.exe
File created	C:\Program Files (x86)\Windows NT\56085415360792	BlockSavesMonitorDll.exe
File created	\??\c:\Program Files (x86)\Microsoft\Edge\Application\CSCB3000D59D0740FB934AFE191A83B445.TMP	csc.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\LanguageOverlayCache\explorer.exe	BlockSavesMonitorDll.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-04-04_7ceeaab80e3c4481ebc4a025857bc0fe_black-basta_cova_luca-stealer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SRRYXX DLC 2025.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	SORRYXX FREE DLC V3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SORRYXX FREE DLC V3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	SORRYXX FREE DLC V3.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000_Classes\Local Settings	BlockSavesMonitorDll.exe
Key created	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000_Classes\Local Settings	SRRYXX DLC 2025.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4756	schtasks.exe
2780	schtasks.exe
5028	schtasks.exe
2608	schtasks.exe
4316	schtasks.exe
4508	schtasks.exe
3352	schtasks.exe
4704	schtasks.exe
2508	schtasks.exe
1644	schtasks.exe
4620	schtasks.exe
3256	schtasks.exe
4376	schtasks.exe
3256	schtasks.exe
3776	schtasks.exe
4420	schtasks.exe
5100	schtasks.exe
3448	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2580	BlockSavesMonitorDll.exe
2580	BlockSavesMonitorDll.exe
2580	BlockSavesMonitorDll.exe
2580	BlockSavesMonitorDll.exe
2580	BlockSavesMonitorDll.exe
2580	BlockSavesMonitorDll.exe
2580	BlockSavesMonitorDll.exe
2580	BlockSavesMonitorDll.exe
2580	BlockSavesMonitorDll.exe
2580	BlockSavesMonitorDll.exe
2580	BlockSavesMonitorDll.exe
2580	BlockSavesMonitorDll.exe
2580	BlockSavesMonitorDll.exe
2580	BlockSavesMonitorDll.exe
2580	BlockSavesMonitorDll.exe
2580	BlockSavesMonitorDll.exe
2580	BlockSavesMonitorDll.exe
2580	BlockSavesMonitorDll.exe
2580	BlockSavesMonitorDll.exe
2580	BlockSavesMonitorDll.exe
2580	BlockSavesMonitorDll.exe
2580	BlockSavesMonitorDll.exe
2580	BlockSavesMonitorDll.exe
2580	BlockSavesMonitorDll.exe
2580	BlockSavesMonitorDll.exe
2580	BlockSavesMonitorDll.exe
2580	BlockSavesMonitorDll.exe
2580	BlockSavesMonitorDll.exe
2580	BlockSavesMonitorDll.exe
2580	BlockSavesMonitorDll.exe
2580	BlockSavesMonitorDll.exe
2580	BlockSavesMonitorDll.exe
2580	BlockSavesMonitorDll.exe
2580	BlockSavesMonitorDll.exe
2580	BlockSavesMonitorDll.exe
2580	BlockSavesMonitorDll.exe
2580	BlockSavesMonitorDll.exe
2580	BlockSavesMonitorDll.exe
2580	BlockSavesMonitorDll.exe
2580	BlockSavesMonitorDll.exe
2580	BlockSavesMonitorDll.exe
2580	BlockSavesMonitorDll.exe
2580	BlockSavesMonitorDll.exe
2580	BlockSavesMonitorDll.exe
2580	BlockSavesMonitorDll.exe
2580	BlockSavesMonitorDll.exe
2580	BlockSavesMonitorDll.exe
2580	BlockSavesMonitorDll.exe
2580	BlockSavesMonitorDll.exe
2580	BlockSavesMonitorDll.exe
2580	BlockSavesMonitorDll.exe
2580	BlockSavesMonitorDll.exe
2580	BlockSavesMonitorDll.exe
2580	BlockSavesMonitorDll.exe
2580	BlockSavesMonitorDll.exe
2580	BlockSavesMonitorDll.exe
2580	BlockSavesMonitorDll.exe
2580	BlockSavesMonitorDll.exe
2580	BlockSavesMonitorDll.exe
2580	BlockSavesMonitorDll.exe
2580	BlockSavesMonitorDll.exe
2580	BlockSavesMonitorDll.exe
2580	BlockSavesMonitorDll.exe
2580	BlockSavesMonitorDll.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	2580	BlockSavesMonitorDll.exe
Token: SeDebugPrivilege	1236	wininit.exe
Token: SeDebugPrivilege	4948	wininit.exe
Token: SeDebugPrivilege	396	spoolsv.exe
Token: SeDebugPrivilege	1732	spoolsv.exe
Token: SeDebugPrivilege	4404	backgroundTaskHost.exe
Token: SeDebugPrivilege	2352	backgroundTaskHost.exe
Token: SeDebugPrivilege	4588	sppsvc.exe
Token: SeDebugPrivilege	4268	sppsvc.exe
Token: SeDebugPrivilege	5092	backgroundTaskHost.exe
Token: SeDebugPrivilege	2600	backgroundTaskHost.exe
Token: SeDebugPrivilege	1564	BlockSavesMonitorDll.exe
Token: SeDebugPrivilege	1424	BlockSavesMonitorDll.exe
Token: SeDebugPrivilege	1348	wininit.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 232 wrote to memory of 2788	232	2025-04-04_7ceeaab80e3c4481ebc4a025857bc0fe_black-basta_cova_luca-stealer.exe	87
PID 232 wrote to memory of 2788	232	2025-04-04_7ceeaab80e3c4481ebc4a025857bc0fe_black-basta_cova_luca-stealer.exe	87
PID 232 wrote to memory of 2200	232	2025-04-04_7ceeaab80e3c4481ebc4a025857bc0fe_black-basta_cova_luca-stealer.exe	88
PID 232 wrote to memory of 2200	232	2025-04-04_7ceeaab80e3c4481ebc4a025857bc0fe_black-basta_cova_luca-stealer.exe	88
PID 232 wrote to memory of 2200	232	2025-04-04_7ceeaab80e3c4481ebc4a025857bc0fe_black-basta_cova_luca-stealer.exe	88
PID 2200 wrote to memory of 4416	2200	SRRYXX DLC 2025.exe	89
PID 2200 wrote to memory of 4416	2200	SRRYXX DLC 2025.exe	89
PID 2200 wrote to memory of 4416	2200	SRRYXX DLC 2025.exe	89
PID 4416 wrote to memory of 5036	4416	WScript.exe	101
PID 4416 wrote to memory of 5036	4416	WScript.exe	101
PID 4416 wrote to memory of 5036	4416	WScript.exe	101
PID 5036 wrote to memory of 2580	5036	cmd.exe	103
PID 5036 wrote to memory of 2580	5036	cmd.exe	103
PID 2580 wrote to memory of 2644	2580	BlockSavesMonitorDll.exe	107
PID 2580 wrote to memory of 2644	2580	BlockSavesMonitorDll.exe	107
PID 2644 wrote to memory of 4640	2644	csc.exe	109
PID 2644 wrote to memory of 4640	2644	csc.exe	109
PID 2580 wrote to memory of 2360	2580	BlockSavesMonitorDll.exe	110
PID 2580 wrote to memory of 2360	2580	BlockSavesMonitorDll.exe	110
PID 2360 wrote to memory of 4076	2360	csc.exe	112
PID 2360 wrote to memory of 4076	2360	csc.exe	112
PID 2476 wrote to memory of 1236	2476	cmd.exe	120
PID 2476 wrote to memory of 1236	2476	cmd.exe	120
PID 2892 wrote to memory of 4948	2892	cmd.exe	126
PID 2892 wrote to memory of 4948	2892	cmd.exe	126
PID 4080 wrote to memory of 396	4080	cmd.exe	128
PID 4080 wrote to memory of 396	4080	cmd.exe	128
PID 4796 wrote to memory of 1732	4796	cmd.exe	129
PID 4796 wrote to memory of 1732	4796	cmd.exe	129
PID 5108 wrote to memory of 2352	5108	cmd.exe	138
PID 5108 wrote to memory of 2352	5108	cmd.exe	138
PID 2324 wrote to memory of 4404	2324	cmd.exe	139
PID 2324 wrote to memory of 4404	2324	cmd.exe	139
PID 2668 wrote to memory of 4588	2668	cmd.exe	146
PID 2668 wrote to memory of 4588	2668	cmd.exe	146
PID 2400 wrote to memory of 4268	2400	cmd.exe	150
PID 2400 wrote to memory of 4268	2400	cmd.exe	150
PID 4204 wrote to memory of 5092	4204	cmd.exe	155
PID 4204 wrote to memory of 5092	4204	cmd.exe	155
PID 3496 wrote to memory of 2600	3496	cmd.exe	161
PID 3496 wrote to memory of 2600	3496	cmd.exe	161
PID 2580 wrote to memory of 968	2580	BlockSavesMonitorDll.exe	162
PID 2580 wrote to memory of 968	2580	BlockSavesMonitorDll.exe	162
PID 4748 wrote to memory of 1564	4748	cmd.exe	164
PID 4748 wrote to memory of 1564	4748	cmd.exe	164
PID 3060 wrote to memory of 1424	3060	cmd.exe	165
PID 3060 wrote to memory of 1424	3060	cmd.exe	165
PID 968 wrote to memory of 1188	968	cmd.exe	166
PID 968 wrote to memory of 1188	968	cmd.exe	166
PID 968 wrote to memory of 3416	968	cmd.exe	167
PID 968 wrote to memory of 3416	968	cmd.exe	167
PID 968 wrote to memory of 1348	968	cmd.exe	169
PID 968 wrote to memory of 1348	968	cmd.exe	169

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2025-04-04_7ceeaab80e3c4481ebc4a025857bc0fe_black-basta_cova_luca-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2025-04-04_7ceeaab80e3c4481ebc4a025857bc0fe_black-basta_cova_luca-stealer.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:232
- C:\Users\Admin\AppData\Local\Temp\SORRYXX FREE DLC V3.exe
  "C:\Users\Admin\AppData\Local\Temp\SORRYXX FREE DLC V3.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates system info in registry
  PID:2788
- C:\Users\Admin\AppData\Local\Temp\SRRYXX DLC 2025.exe
  "C:\Users\Admin\AppData\Local\Temp\SRRYXX DLC 2025.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2200
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\PortFontBrokerPerf\Y4EiKOdPrb8Z.vbe"
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4416
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\PortFontBrokerPerf\Rtn7cpFGR9lldPKi6lSKrpTABHrWJw3F.bat" "
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5036
    - - C:\PortFontBrokerPerf\BlockSavesMonitorDll.exe
        
        "C:\PortFontBrokerPerf/BlockSavesMonitorDll.exe"
        5⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        Drops file in Windows directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2580
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\paos1sei\paos1sei.cmdline"
        6⤵
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:2644
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCF46.tmp" "c:\Program Files (x86)\Microsoft\Edge\Application\CSCB3000D59D0740FB934AFE191A83B445.TMP"
        7⤵
        
        PID:4640
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\m35jppd4\m35jppd4.cmdline"
        6⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2360
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCFB4.tmp" "c:\Windows\System32\CSC57C6C220FEA0423D8EA3E2CB03A754.TMP"
        7⤵
        
        PID:4076
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\oe20ezvEuA.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:968
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:1188
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:3416
        
        C:\Program Files (x86)\Windows NT\wininit.exe
        
        "C:\Program Files (x86)\Windows NT\wininit.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows NT\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows NT\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2508

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Windows NT\wininit.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Program Files (x86)\Windows NT\wininit.exe
  "C:\Program Files (x86)\Windows NT\wininit.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4948

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Windows NT\wininit.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Program Files (x86)\Windows NT\wininit.exe
  "C:\Program Files (x86)\Windows NT\wininit.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\PortFontBrokerPerf\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\PortFontBrokerPerf\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\PortFontBrokerPerf\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4756

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\PortFontBrokerPerf\spoolsv.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4796
- C:\PortFontBrokerPerf\spoolsv.exe
  C:\PortFontBrokerPerf\spoolsv.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1732

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\PortFontBrokerPerf\spoolsv.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4080
- C:\PortFontBrokerPerf\spoolsv.exe
  C:\PortFontBrokerPerf\spoolsv.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Libraries\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Users\Public\Libraries\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 6 /tr "'C:\Users\Public\Libraries\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1644

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Public\Libraries\backgroundTaskHost.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Users\Public\Libraries\backgroundTaskHost.exe
  C:\Users\Public\Libraries\backgroundTaskHost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4404

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Public\Libraries\backgroundTaskHost.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5108
- C:\Users\Public\Libraries\backgroundTaskHost.exe
  C:\Users\Public\Libraries\backgroundTaskHost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\PortFontBrokerPerf\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\PortFontBrokerPerf\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\PortFontBrokerPerf\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5100

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\PortFontBrokerPerf\sppsvc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2400
- C:\PortFontBrokerPerf\sppsvc.exe
  C:\PortFontBrokerPerf\sppsvc.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4268

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\PortFontBrokerPerf\sppsvc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2668
- C:\PortFontBrokerPerf\sppsvc.exe
  C:\PortFontBrokerPerf\sppsvc.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Media Player\uk-UA\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\uk-UA\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Media Player\uk-UA\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3256

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files\Windows Media Player\uk-UA\backgroundTaskHost.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4204
- C:\Program Files\Windows Media Player\uk-UA\backgroundTaskHost.exe
  "C:\Program Files\Windows Media Player\uk-UA\backgroundTaskHost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5092

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files\Windows Media Player\uk-UA\backgroundTaskHost.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3496
- C:\Program Files\Windows Media Player\uk-UA\backgroundTaskHost.exe
  "C:\Program Files\Windows Media Player\uk-UA\backgroundTaskHost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "BlockSavesMonitorDllB" /sc MINUTE /mo 11 /tr "'C:\PortFontBrokerPerf\BlockSavesMonitorDll.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "BlockSavesMonitorDll" /sc ONLOGON /tr "'C:\PortFontBrokerPerf\BlockSavesMonitorDll.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "BlockSavesMonitorDllB" /sc MINUTE /mo 13 /tr "'C:\PortFontBrokerPerf\BlockSavesMonitorDll.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4704

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\PortFontBrokerPerf\BlockSavesMonitorDll.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3060
- C:\PortFontBrokerPerf\BlockSavesMonitorDll.exe
  C:\PortFontBrokerPerf\BlockSavesMonitorDll.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1424

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\PortFontBrokerPerf\BlockSavesMonitorDll.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4748
- C:\PortFontBrokerPerf\BlockSavesMonitorDll.exe
  C:\PortFontBrokerPerf\BlockSavesMonitorDll.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PortFontBrokerPerf\BlockSavesMonitorDll.exe

Filesize
1.8MB

MD5
f40a7dce8cf4fd30130b0c66820dd038

SHA1
e6c85384db6fb3e9beb37979763de78977c772ef

SHA256
ed8be6cca60868cc3902b49d1920cb8668a1a3c3f99a4bf55ee8c091e45c074f

SHA512
e0000cfdebbd83edcc0dd0daa8f813f0848d4c0a7e7b2624d0358439921e92fbb69921fd8934b203a0fb4119445d9c04b60f4d37760a92babff8e95fc9c2dbdc

Download Submit
C:\PortFontBrokerPerf\Rtn7cpFGR9lldPKi6lSKrpTABHrWJw3F.bat

Filesize
104B

MD5
94fb8c242f1a075c7019b39500983b1a

SHA1
10781254369495e918bf0923ac2b567185c1337b

SHA256
fca2097f81ff4ab35ec60d7dfc82c3f672f6dd181f21c414567a53b950382106

SHA512
0e7863c5f038e0d68ddcca088b6dbaeca60cfb97fda916a530af774c37f0727f008a229815a0f940a156fba7c5cb3d89afb70c4d3e37d1077090b770d475893c

Download Submit
C:\PortFontBrokerPerf\Y4EiKOdPrb8Z.vbe

Filesize
229B

MD5
17687d6af43eed1b71b06021c50da290

SHA1
c5b4f3de7003745ead126f88c02cac3bd4d25d5b

SHA256
05ce8f3660c24152cc12d63d3f14e36d893279ef2797bcfde76b8cc91474bc00

SHA512
209d79c140ea933763fde399267b6c1a128ca352cae282bdeaa38dd24ec72d023de35cc88c2e5cdbd2bf4583cfb900ae7fbce3429b2a5fce1ecee5e6b366673b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\BlockSavesMonitorDll.exe.log

Filesize
1KB

MD5
af6acd95d59de87c04642509c30e81c1

SHA1
f9549ae93fdb0a5861a79a08f60aa81c4b32377b

SHA256
7521ee2d065a78efcab55a194fbd78492f84b70595f139263875f4ea92b194d6

SHA512
93ab99bcf588fde553de3240e0d2b0cbd4e4bc5ef5e99d53f45a267d7ff30103a80b5a7aa1c52d6eff1e070af0ec82d2c0b8aafb7099742aa16810edc1815c3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\wininit.exe.log

Filesize
847B

MD5
66a0a4aa01208ed3d53a5e131a8d030a

SHA1
ef5312ba2b46b51a4d04b574ca1789ac4ff4a6b1

SHA256
f0ab05c32d6af3c2b559dbce4dec025ce3e730655a2430ade520e89a557cace8

SHA512
626f0dcf0c6bcdc0fef25dc7da058003cf929fd9a39a9f447b79fb139a417532a46f8bca1ff2dbde09abfcd70f5fb4f8d059b1fe91977c377df2f5f751c84c5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESCF46.tmp

Filesize
1KB

MD5
e0c0139b0282f47d5ef9709d1b15eaf0

SHA1
3ef08f7e505e80487e7686745f77ca603d6b8af8

SHA256
7eacbc710d91ca64bc92f4c1777db3847373239c136a4ce509da566a3e7d041d

SHA512
240d5014561c13d58fecab69e0130663363090758f8baa1a46aa93068395aad95057b1282f000597681fbb1b401c2507b99a8c07623ada8430e01ef2ec540fd0

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESCFB4.tmp

Filesize
1KB

MD5
06975f89374b475a0249008d841124a5

SHA1
98f8f4e42e76258af1151f8ecfe3cdababd49691

SHA256
df0c053e470f998076a895031380b1ffce3c9262f9b4fbb4b4780d9899e3eafb

SHA512
b23c0aace48e8ec69a72232b5e569a90e3065faa7c35a85d4a1f701ad1e058e56fa823321b8574b29e460395e0b48faa0241356c8b7b842b63e04abec32199d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\SORRYXX FREE DLC V3.exe

Filesize
1.6MB

MD5
b0c446dcb15c5403dcd03f645cb0b866

SHA1
cc41ccde3557236d9abf567c18c25c20bbff1ac2

SHA256
15c673eac88b62717a7139466c2de7d43378dc1668fe83154dfcf5ddfc53e3fe

SHA512
ffbddad24b6b9cbbc90bb12bd4e2b924793fc60fb545de2d0ab0a849f354260e743d68adbea65ee1625e8f0bc499b401c117de90febecb5522d46d39405428bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\SRRYXX DLC 2025.exe

Filesize
2.1MB

MD5
f7b4c0fad8ea1c80f5384bb45ad18b64

SHA1
c68097749d0fced63ab1c22e4328e02b54df37ee

SHA256
c809df9e2d9115ddeb5e4f6c82ca7ee85753b78cd2396dbda6f951ef1b2e81af

SHA512
03ca9474fb9d03e920a0c755c3c2d8461d0446f10da7d72f15058b54ef063541004c821a0d46730c768e8d1e9823ec8710764e06bd5c441271e2da26ae9b46b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\oe20ezvEuA.bat

Filesize
221B

MD5
a17bd62777cd8424cd852badf64b22c2

SHA1
3b25348c8ccfe9a42837a473d0c5e1430d702815

SHA256
32aeb547c3272fab774557a991de4fd16e12221e174b8ad3c67dee3d690a008f

SHA512
145da37d754686a19f618a327794dec70eba02bc0d0065ae203585da3d711066d62e3b7343afbe2e08b8b85ce92e41e45b152d49c850cffea4751131b1ae2833

Download Submit
\??\c:\Program Files (x86)\Microsoft\Edge\Application\CSCB3000D59D0740FB934AFE191A83B445.TMP

Filesize
1KB

MD5
b5189fb271be514bec128e0d0809c04e

SHA1
5dd625d27ed30fca234ec097ad66f6c13a7edcbe

SHA256
e1984ba1e3ff8b071f7a320a6f1f18e1d5f4f337d31dc30d5bdfb021df39060f

SHA512
f0fcb8f97279579beb59f58ea89527ee0d86a64c9de28300f14460bec6c32dda72f0e6466573b6654a1e992421d6fe81ae7cce50f27059f54cf9fdca6953602e

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\m35jppd4\m35jppd4.0.cs

Filesize
377B

MD5
b0573e530ba1a2ad6b5b04e12d0e3c73

SHA1
c70773fd3160850049bc490fdae4cbc90b112cf8

SHA256
a25b646ca760aa7915fcd6532687e0892fa07267ad31230399c08c5481b69d3b

SHA512
4725f9136b71a62fe0daa16c68a75b152df5a8059e8cdfe4b7ee454d5642219930d478ea6efe0858f2b0932f83261011499a95b85d6a340dece8690383edf793

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\m35jppd4\m35jppd4.cmdline

Filesize
235B

MD5
829bf03a8302938c2d7b31d35ba65250

SHA1
58182395beb11168856d733542eb2c4ae09f6170

SHA256
2a4d99ea6e4932fbd17ecc89bd08e9c4283d698aa9e5b13056e563f89a1962d8

SHA512
205e222188d1c1b01b54c3cc4be173933324a014954f608a20901f7947f3741b4a2dd96e96e6aa6623cfac81f3ca25735764d0b929ae35705fb45dcfc0c5a1e7

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\paos1sei\paos1sei.0.cs

Filesize
407B

MD5
b9cc9620e33e01771049426f28c29f21

SHA1
7699c7ac737452d9696df3eb9a89d194be7f8567

SHA256
9abc09b504e709c26ae097f219feaef0d1b4d886109c7835c93df863ddb8adf2

SHA512
115a4ef5049fbce04b3b931f98ce1c47e92903cdff5bf41073c9daf7b6ce3dd6474d0fb638a53547749c479e89325c2b51380dbf3b45f869426a7f6e6dd2828d

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\paos1sei\paos1sei.cmdline

Filesize
265B

MD5
a138ff0af46845693dcdfd7a0aa05e16

SHA1
af0d59d062d0e416917930045fb1a31caaa80b67

SHA256
ed477c5ebfec5390511f67b67845ce7d3e33f510d33416f12c455227a66983ab

SHA512
2e994eaa9b188ff74c38c9ea2f6ac21ea0b1e89fe702453681897382f38f87c2139b34ec3909253d97063fc03a7f639ec739fb61bb1e7917a75fae65d64f2d69

Download Submit
\??\c:\Windows\System32\CSC57C6C220FEA0423D8EA3E2CB03A754.TMP

Filesize
1KB

MD5
6e8b2079a1bf0d260cd6ba3693595d5d

SHA1
edb57d4482e55634eda59f02c40910b8d4b1a3cf

SHA256
6a93f682b8c6ab04a18202df27d29134eba92923250f0a73df00aac72719de42

SHA512
7f5f2aa4d5eba8e5edbc59242d8e1fdd3a319a60e91cc352b10c06758b3cdc75fe6eb119e975a6dd6d070a0effe61254739c6a036999ec7a8557a2b8ca977f74

Download Submit
memory/232-20-0x0000000000400000-0x00000000007CB000-memory.dmp

Filesize
3.8MB

Download
memory/2580-38-0x0000000000C60000-0x0000000000E3A000-memory.dmp

Filesize
1.9MB

Download
memory/2580-43-0x000000001BA00000-0x000000001BA50000-memory.dmp

Filesize
320KB

Download
memory/2580-42-0x0000000002E60000-0x0000000002E7C000-memory.dmp

Filesize
112KB

Download
memory/2580-40-0x0000000002E30000-0x0000000002E3E000-memory.dmp

Filesize
56KB

Download
memory/2580-45-0x0000000002FA0000-0x0000000002FB8000-memory.dmp

Filesize
96KB

Download
memory/2580-47-0x0000000002E40000-0x0000000002E4C000-memory.dmp

Filesize
48KB

Download
memory/2788-32-0x00007FFEE4D83000-0x00007FFEE4D85000-memory.dmp

Filesize
8KB

Download
memory/2788-33-0x00007FFEE4D80000-0x00007FFEE5841000-memory.dmp

Filesize
10.8MB

Download
memory/2788-22-0x00007FFEE4D80000-0x00007FFEE5841000-memory.dmp

Filesize
10.8MB

Download
memory/2788-21-0x000001E39CA20000-0x000001E39CC34000-memory.dmp

Filesize
2.1MB

Download
memory/2788-17-0x000001E382090000-0x000001E382238000-memory.dmp

Filesize
1.7MB

Download
memory/2788-14-0x00007FFEE4D83000-0x00007FFEE4D85000-memory.dmp

Filesize
8KB

Download