0466159525cb3fab5109b4067f0a429f9880275f7e37aee7b3311fb3356c59c9

Analysis

max time kernel
148s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 18:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0466159525cb3fab5109b4067f0a429f9880275f7e37aee7b3311fb3356c59c9.exe
Size

5.4MB
MD5

4fcd5ffc44994df50e06a0889e149b31
SHA1

7561935356870ab77c4a83e728eba8e5804c68f5
SHA256

0466159525cb3fab5109b4067f0a429f9880275f7e37aee7b3311fb3356c59c9
SHA512

ca57e591a33c053d4a991ce5549d9d95107cc3651c64ec643d41ba3eb073fef236af46ecd1e09feb4342d5b7be3fba7195bdb0c6aa2bf49763f09e4cb99a1169
SSDEEP

98304:sLrUH+U8GRcZz1a6Fg6DfCOW66hNjyHkmrJv0Ihx7KM:wS+oRlmrFdjKM

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Defender\\sppsvc.exe\", \"C:\\Users\\Default\\Links\\sppsvc.exe\", \"C:\\Users\\Default User\\fontdrvhost.exe\", \"C:\\Users\\All Users\\System.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\Visualizations\\RuntimeBroker.exe\", \"C:\\Chainsurrogatenet\\portSurrogateserverComponent.exe\""	portSurrogateserverComponent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Defender\\sppsvc.exe\""	portSurrogateserverComponent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Defender\\sppsvc.exe\", \"C:\\Users\\Default\\Links\\sppsvc.exe\""	portSurrogateserverComponent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Defender\\sppsvc.exe\", \"C:\\Users\\Default\\Links\\sppsvc.exe\", \"C:\\Users\\Default User\\fontdrvhost.exe\""	portSurrogateserverComponent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Defender\\sppsvc.exe\", \"C:\\Users\\Default\\Links\\sppsvc.exe\", \"C:\\Users\\Default User\\fontdrvhost.exe\", \"C:\\Users\\All Users\\System.exe\""	portSurrogateserverComponent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Defender\\sppsvc.exe\", \"C:\\Users\\Default\\Links\\sppsvc.exe\", \"C:\\Users\\Default User\\fontdrvhost.exe\", \"C:\\Users\\All Users\\System.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\Visualizations\\RuntimeBroker.exe\""	portSurrogateserverComponent.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4212	2620	schtasks.exe	101
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4980	2620	schtasks.exe	101
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4404	2620	schtasks.exe	101
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1284	2620	schtasks.exe	101
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1648	2620	schtasks.exe	101
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1428	2620	schtasks.exe	101
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1744	2620	schtasks.exe	101
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2564	2620	schtasks.exe	101
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4944	2620	schtasks.exe	101
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3968	2620	schtasks.exe	101
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2568	2620	schtasks.exe	101
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1200	2620	schtasks.exe	101
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1020	2620	schtasks.exe	101
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2528	2620	schtasks.exe	101
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4628	2620	schtasks.exe	101
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1628	2620	schtasks.exe	101
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2516	2620	schtasks.exe	101
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2260	2620	schtasks.exe	101

Detects executables packed with unregistered version of .NET Reactor 4 IoCs

resource	yara_rule
behavioral2/files/0x00070000000235f8-16.dat	INDICATOR_EXE_Packed_DotNetReactor
behavioral2/memory/2736-19-0x0000000000400000-0x0000000000974000-memory.dmp	INDICATOR_EXE_Packed_DotNetReactor
behavioral2/files/0x00080000000235fa-32.dat	INDICATOR_EXE_Packed_DotNetReactor
behavioral2/memory/4312-34-0x00000000006B0000-0x000000000088A000-memory.dmp	INDICATOR_EXE_Packed_DotNetReactor

Checks computer location settings 2 TTPs 11 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	sppsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	sppsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	0466159525cb3fab5109b4067f0a429f9880275f7e37aee7b3311fb3356c59c9.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	sppsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	sppsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	sppsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	sppsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	sppsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	Nexus (2).exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	portSurrogateserverComponent.exe

Executes dropped EXE 10 IoCs

pid	Process
1764	Macro (1).exe
1708	Nexus (2).exe
4312	portSurrogateserverComponent.exe
1576	sppsvc.exe
2392	sppsvc.exe
4812	sppsvc.exe
2072	sppsvc.exe
3296	sppsvc.exe
3116	sppsvc.exe
516	sppsvc.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Program Files\\Windows Defender\\sppsvc.exe\""	portSurrogateserverComponent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Program Files\\Windows Defender\\sppsvc.exe\""	portSurrogateserverComponent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Users\\Default\\Links\\sppsvc.exe\""	portSurrogateserverComponent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Users\\Default\\Links\\sppsvc.exe\""	portSurrogateserverComponent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Users\\All Users\\System.exe\""	portSurrogateserverComponent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Users\\Default User\\fontdrvhost.exe\""	portSurrogateserverComponent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Users\\Default User\\fontdrvhost.exe\""	portSurrogateserverComponent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Users\\All Users\\System.exe\""	portSurrogateserverComponent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files (x86)\\Windows Media Player\\Visualizations\\RuntimeBroker.exe\""	portSurrogateserverComponent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files (x86)\\Windows Media Player\\Visualizations\\RuntimeBroker.exe\""	portSurrogateserverComponent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\portSurrogateserverComponent = "\"C:\\Chainsurrogatenet\\portSurrogateserverComponent.exe\""	portSurrogateserverComponent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\portSurrogateserverComponent = "\"C:\\Chainsurrogatenet\\portSurrogateserverComponent.exe\""	portSurrogateserverComponent.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSC3F97413D6CF540418F1B3C9D39F65D5.TMP	csc.exe
File created	\??\c:\Windows\System32\jpzkqk.exe	csc.exe

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File created	\??\c:\Program Files (x86)\Microsoft\Edge\Application\CSC83D11535C48464694F6C9DEEB9DAAAC.TMP	csc.exe
File created	\??\c:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	csc.exe
File created	C:\Program Files (x86)\Windows Media Player\Visualizations\RuntimeBroker.exe	portSurrogateserverComponent.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\Visualizations\RuntimeBroker.exe	portSurrogateserverComponent.exe
File created	C:\Program Files (x86)\Windows Media Player\Visualizations\9e8d7a4ca61bd9	portSurrogateserverComponent.exe
File created	C:\Program Files\Windows Defender\sppsvc.exe	portSurrogateserverComponent.exe
File created	C:\Program Files\Windows Defender\0a1fd5f707cd16	portSurrogateserverComponent.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2564	schtasks.exe
3968	schtasks.exe
2568	schtasks.exe
1020	schtasks.exe
2528	schtasks.exe
1628	schtasks.exe
1648	schtasks.exe
1428	schtasks.exe
1744	schtasks.exe
4944	schtasks.exe
1200	schtasks.exe
2260	schtasks.exe
1284	schtasks.exe
2516	schtasks.exe
4980	schtasks.exe
4404	schtasks.exe
4628	schtasks.exe
4212	schtasks.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	sppsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	sppsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	sppsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	sppsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	sppsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	Nexus (2).exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	portSurrogateserverComponent.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	sppsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	sppsvc.exe

Runs ping.exe 1 TTPs 5 IoCs

Remote System Discovery

T1018

pid	Process
4044	PING.EXE
4844	PING.EXE
4636	PING.EXE
3264	PING.EXE
2692	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4312	portSurrogateserverComponent.exe
4312	portSurrogateserverComponent.exe
4312	portSurrogateserverComponent.exe
4312	portSurrogateserverComponent.exe
4312	portSurrogateserverComponent.exe
4312	portSurrogateserverComponent.exe
4312	portSurrogateserverComponent.exe
4312	portSurrogateserverComponent.exe
4312	portSurrogateserverComponent.exe
4312	portSurrogateserverComponent.exe
4312	portSurrogateserverComponent.exe
4312	portSurrogateserverComponent.exe
4312	portSurrogateserverComponent.exe
4312	portSurrogateserverComponent.exe
4312	portSurrogateserverComponent.exe
4312	portSurrogateserverComponent.exe
4312	portSurrogateserverComponent.exe
4312	portSurrogateserverComponent.exe
4312	portSurrogateserverComponent.exe
4312	portSurrogateserverComponent.exe
4312	portSurrogateserverComponent.exe
4312	portSurrogateserverComponent.exe
4312	portSurrogateserverComponent.exe
4312	portSurrogateserverComponent.exe
4312	portSurrogateserverComponent.exe
4312	portSurrogateserverComponent.exe
4312	portSurrogateserverComponent.exe
4312	portSurrogateserverComponent.exe
4312	portSurrogateserverComponent.exe
4312	portSurrogateserverComponent.exe
4312	portSurrogateserverComponent.exe
4312	portSurrogateserverComponent.exe
4312	portSurrogateserverComponent.exe
4312	portSurrogateserverComponent.exe
4312	portSurrogateserverComponent.exe
4312	portSurrogateserverComponent.exe
4312	portSurrogateserverComponent.exe
4312	portSurrogateserverComponent.exe
4312	portSurrogateserverComponent.exe
4312	portSurrogateserverComponent.exe
4312	portSurrogateserverComponent.exe
4312	portSurrogateserverComponent.exe
4312	portSurrogateserverComponent.exe
4312	portSurrogateserverComponent.exe
4312	portSurrogateserverComponent.exe
4312	portSurrogateserverComponent.exe
4312	portSurrogateserverComponent.exe
4312	portSurrogateserverComponent.exe
4312	portSurrogateserverComponent.exe
4312	portSurrogateserverComponent.exe
4312	portSurrogateserverComponent.exe
4312	portSurrogateserverComponent.exe
4312	portSurrogateserverComponent.exe
4312	portSurrogateserverComponent.exe
4312	portSurrogateserverComponent.exe
4312	portSurrogateserverComponent.exe
4312	portSurrogateserverComponent.exe
4312	portSurrogateserverComponent.exe
4312	portSurrogateserverComponent.exe
4312	portSurrogateserverComponent.exe
4312	portSurrogateserverComponent.exe
4312	portSurrogateserverComponent.exe
4312	portSurrogateserverComponent.exe
4312	portSurrogateserverComponent.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	4312	portSurrogateserverComponent.exe
Token: SeDebugPrivilege	1576	sppsvc.exe
Token: SeDebugPrivilege	2392	sppsvc.exe
Token: SeDebugPrivilege	4812	sppsvc.exe
Token: SeDebugPrivilege	2072	sppsvc.exe
Token: SeDebugPrivilege	3296	sppsvc.exe
Token: SeDebugPrivilege	3116	sppsvc.exe
Token: SeDebugPrivilege	516	sppsvc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 1764	2736	0466159525cb3fab5109b4067f0a429f9880275f7e37aee7b3311fb3356c59c9.exe	89
PID 2736 wrote to memory of 1764	2736	0466159525cb3fab5109b4067f0a429f9880275f7e37aee7b3311fb3356c59c9.exe	89
PID 2736 wrote to memory of 1764	2736	0466159525cb3fab5109b4067f0a429f9880275f7e37aee7b3311fb3356c59c9.exe	89
PID 2736 wrote to memory of 1708	2736	0466159525cb3fab5109b4067f0a429f9880275f7e37aee7b3311fb3356c59c9.exe	91
PID 2736 wrote to memory of 1708	2736	0466159525cb3fab5109b4067f0a429f9880275f7e37aee7b3311fb3356c59c9.exe	91
PID 2736 wrote to memory of 1708	2736	0466159525cb3fab5109b4067f0a429f9880275f7e37aee7b3311fb3356c59c9.exe	91
PID 1708 wrote to memory of 2072	1708	Nexus (2).exe	92
PID 1708 wrote to memory of 2072	1708	Nexus (2).exe	92
PID 1708 wrote to memory of 2072	1708	Nexus (2).exe	92
PID 2072 wrote to memory of 3900	2072	WScript.exe	98
PID 2072 wrote to memory of 3900	2072	WScript.exe	98
PID 2072 wrote to memory of 3900	2072	WScript.exe	98
PID 3900 wrote to memory of 4312	3900	cmd.exe	100
PID 3900 wrote to memory of 4312	3900	cmd.exe	100
PID 4312 wrote to memory of 4908	4312	portSurrogateserverComponent.exe	105
PID 4312 wrote to memory of 4908	4312	portSurrogateserverComponent.exe	105
PID 4908 wrote to memory of 3004	4908	csc.exe	107
PID 4908 wrote to memory of 3004	4908	csc.exe	107
PID 4312 wrote to memory of 4776	4312	portSurrogateserverComponent.exe	108
PID 4312 wrote to memory of 4776	4312	portSurrogateserverComponent.exe	108
PID 4776 wrote to memory of 4180	4776	csc.exe	110
PID 4776 wrote to memory of 4180	4776	csc.exe	110
PID 4312 wrote to memory of 620	4312	portSurrogateserverComponent.exe	126
PID 4312 wrote to memory of 620	4312	portSurrogateserverComponent.exe	126
PID 620 wrote to memory of 4700	620	cmd.exe	128
PID 620 wrote to memory of 4700	620	cmd.exe	128
PID 620 wrote to memory of 4044	620	cmd.exe	129
PID 620 wrote to memory of 4044	620	cmd.exe	129
PID 620 wrote to memory of 1576	620	cmd.exe	131
PID 620 wrote to memory of 1576	620	cmd.exe	131
PID 1576 wrote to memory of 4892	1576	sppsvc.exe	132
PID 1576 wrote to memory of 4892	1576	sppsvc.exe	132
PID 4892 wrote to memory of 2092	4892	cmd.exe	134
PID 4892 wrote to memory of 2092	4892	cmd.exe	134
PID 4892 wrote to memory of 4844	4892	cmd.exe	135
PID 4892 wrote to memory of 4844	4892	cmd.exe	135
PID 4892 wrote to memory of 2392	4892	cmd.exe	141
PID 4892 wrote to memory of 2392	4892	cmd.exe	141
PID 2392 wrote to memory of 3856	2392	sppsvc.exe	142
PID 2392 wrote to memory of 3856	2392	sppsvc.exe	142
PID 3856 wrote to memory of 2260	3856	cmd.exe	144
PID 3856 wrote to memory of 2260	3856	cmd.exe	144
PID 3856 wrote to memory of 3800	3856	cmd.exe	145
PID 3856 wrote to memory of 3800	3856	cmd.exe	145
PID 3856 wrote to memory of 4812	3856	cmd.exe	146
PID 3856 wrote to memory of 4812	3856	cmd.exe	146
PID 4812 wrote to memory of 2000	4812	sppsvc.exe	147
PID 4812 wrote to memory of 2000	4812	sppsvc.exe	147
PID 2000 wrote to memory of 4940	2000	cmd.exe	149
PID 2000 wrote to memory of 4940	2000	cmd.exe	149
PID 2000 wrote to memory of 4372	2000	cmd.exe	150
PID 2000 wrote to memory of 4372	2000	cmd.exe	150
PID 2000 wrote to memory of 2072	2000	cmd.exe	151
PID 2000 wrote to memory of 2072	2000	cmd.exe	151
PID 2072 wrote to memory of 3492	2072	sppsvc.exe	152
PID 2072 wrote to memory of 3492	2072	sppsvc.exe	152
PID 3492 wrote to memory of 4208	3492	cmd.exe	154
PID 3492 wrote to memory of 4208	3492	cmd.exe	154
PID 3492 wrote to memory of 3248	3492	cmd.exe	155
PID 3492 wrote to memory of 3248	3492	cmd.exe	155
PID 3492 wrote to memory of 3296	3492	cmd.exe	156
PID 3492 wrote to memory of 3296	3492	cmd.exe	156
PID 3296 wrote to memory of 3964	3296	sppsvc.exe	157
PID 3296 wrote to memory of 3964	3296	sppsvc.exe	157

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\0466159525cb3fab5109b4067f0a429f9880275f7e37aee7b3311fb3356c59c9.exe
"C:\Users\Admin\AppData\Local\Temp\0466159525cb3fab5109b4067f0a429f9880275f7e37aee7b3311fb3356c59c9.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Users\Admin\AppData\Local\Temp\Macro (1).exe
  "C:\Users\Admin\AppData\Local\Temp\Macro (1).exe"
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Users\Admin\AppData\Local\Temp\Nexus (2).exe
  "C:\Users\Admin\AppData\Local\Temp\Nexus (2).exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1708
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Chainsurrogatenet\pIpVdImuRMH9hh54u.vbe"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:2072
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Chainsurrogatenet\VwYg2j1DDvFWQHo9EYK9bChWxwQTPdDjhaqe3NKIIJ6eI1htfRMo.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3900
    - - C:\Chainsurrogatenet\portSurrogateserverComponent.exe
        
        "C:\Chainsurrogatenet/portSurrogateserverComponent.exe"
        5⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4312
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\cxsbxxei\cxsbxxei.cmdline"
        6⤵
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:4908
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES54D2.tmp" "c:\Program Files (x86)\Microsoft\Edge\Application\CSC83D11535C48464694F6C9DEEB9DAAAC.TMP"
        7⤵
        
        PID:3004
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qlkg03vr\qlkg03vr.cmdline"
        6⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4776
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES554F.tmp" "c:\Windows\System32\CSC3F97413D6CF540418F1B3C9D39F65D5.TMP"
        7⤵
        
        PID:4180
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8vvE9d180q.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:620
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:4700
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        7⤵
        Runs ping.exe
        
        PID:4044
        
        C:\Program Files\Windows Defender\sppsvc.exe
        
        "C:\Program Files\Windows Defender\sppsvc.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1576
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ImsszXQrCQ.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:4892
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        9⤵
        
        PID:2092
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        9⤵
        Runs ping.exe
        
        PID:4844
        
        C:\Program Files\Windows Defender\sppsvc.exe
        
        "C:\Program Files\Windows Defender\sppsvc.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2392
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9ShSWMkBVB.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:3856
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        11⤵
        
        PID:2260
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:3800
        
        C:\Program Files\Windows Defender\sppsvc.exe
        
        "C:\Program Files\Windows Defender\sppsvc.exe"
        11⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4812
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9ShSWMkBVB.bat"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:2000
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        13⤵
        
        PID:4940
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:4372
        
        C:\Program Files\Windows Defender\sppsvc.exe
        
        "C:\Program Files\Windows Defender\sppsvc.exe"
        13⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2072
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\qTmai1Dpby.bat"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:3492
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        15⤵
        
        PID:4208
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:3248
        
        C:\Program Files\Windows Defender\sppsvc.exe
        
        "C:\Program Files\Windows Defender\sppsvc.exe"
        15⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3296
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\r3ED9wUyR4.bat"
        16⤵
        
        PID:3964
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        17⤵
        
        PID:1536
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        17⤵
        Runs ping.exe
        
        PID:4636
        
        C:\Program Files\Windows Defender\sppsvc.exe
        
        "C:\Program Files\Windows Defender\sppsvc.exe"
        17⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3116
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\lr5Zi8WiUT.bat"
        18⤵
        
        PID:60
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        19⤵
        
        PID:3940
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        19⤵
        Runs ping.exe
        
        PID:3264
        
        C:\Program Files\Windows Defender\sppsvc.exe
        
        "C:\Program Files\Windows Defender\sppsvc.exe"
        19⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:516
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ZI9TpMxUin.bat"
        20⤵
        
        PID:1996
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        21⤵
        
        PID:5016
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        21⤵
        Runs ping.exe
        
        PID:2692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4332,i,9746875443948590908,1444894342962555245,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:8
1⤵
PID:4428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Defender\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Defender\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Links\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\Default\Links\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Users\Default\Links\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Default User\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\All Users\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Media Player\Visualizations\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\Visualizations\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Media Player\Visualizations\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "portSurrogateserverComponentp" /sc MINUTE /mo 9 /tr "'C:\Chainsurrogatenet\portSurrogateserverComponent.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "portSurrogateserverComponent" /sc ONLOGON /tr "'C:\Chainsurrogatenet\portSurrogateserverComponent.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "portSurrogateserverComponentp" /sc MINUTE /mo 12 /tr "'C:\Chainsurrogatenet\portSurrogateserverComponent.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Chainsurrogatenet\VwYg2j1DDvFWQHo9EYK9bChWxwQTPdDjhaqe3NKIIJ6eI1htfRMo.bat

Filesize
101B

MD5
90259be1555c7bd717a777fb1ffeceb2

SHA1
e2957a2bedd9888366bd05c80c19746e02361d49

SHA256
d0640a5cc72486c994729418db64705abf69b12836b5884dbb84db59f77f8618

SHA512
edddaf7b375291390a1eaf78d2f7cb12d70559c4bf1cc05d1d8509585adcb8fac3b7e68fd5ead08e7fd3ad1f2b1a781cb9113074c4c81748846ab3cbee910cf8

Download Submit
C:\Chainsurrogatenet\pIpVdImuRMH9hh54u.vbe

Filesize
248B

MD5
da74834f1c2092ba6db81d7ed4134bda

SHA1
4e69c3e3c8cdd2cecf5c9cacef72f5b5fb563bf2

SHA256
461a5adf03fb734274739a808e2cf7c5ad039c683a85f5c4bcccc6a10c6f7fa6

SHA512
3dfcc244236aa70884393952aa1c8e65c2d2575558b5538505ef6d82706a8de898d47df1a4f7d7fceb23d2e2ad7716b382260d7e79ed98da7a2c9d62de23d21c

Download Submit
C:\Chainsurrogatenet\portSurrogateserverComponent.exe

Filesize
1.8MB

MD5
dbb563c431493308ba01c91e2192d1a5

SHA1
2ad9f62547b000048d8049eceb56af58a1d35279

SHA256
65b2410871ab35a751c138aded89b8a46fcdc027f1ea800ca06364be7f478fc0

SHA512
bee2fe093a5e13f2ca2f6a53c0604e320835a3828788900f2cce5445e2e19a7b6ba40dbb6847cfc36eae8630590211c714f2c27ce94a95a89e98a616c44412f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\sppsvc.exe.log

Filesize
1KB

MD5
f8b2fca3a50771154571c11f1c53887b

SHA1
2e83b0c8e2f4c10b145b7fb4832ed1c78743de3f

SHA256
0efa72802031a8f902c3a4ab18fe3d667dafc71c93eb3a1811e78353ecf4a6b6

SHA512
b98b8d5516593d13415199d4ac6fbe4ff924488487c4bd863cb677601048785d872a3ff30129148e2961cb6fb2fc33117540302980a132f57f7ec9a497813f1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\8vvE9d180q.bat

Filesize
172B

MD5
cac644c57edc62b33dea9222d6381024

SHA1
5da74afcbff9c1cbf1d198baaa1915a2d48e7189

SHA256
be8305aa059548783175f522386d4d2dba604836d563f33b30f054d10fd76719

SHA512
8d767dce8879a21a3406587d3dd9e3a448af9157ce40ca7041cc9c0cadc4c4bb089253482d71a1d17affcb5a58f1e7dd109ed118b05e5ccbf3f18b679e06d9b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\9ShSWMkBVB.bat

Filesize
220B

MD5
c1c00b2cae46d68196b752636050841e

SHA1
dc171de77e8e474ae2cdb451858754bd338b91e1

SHA256
48e2ab6d4b983bf5e7a9629464c5755a689b6d8cee53686732da64c71c3e93fe

SHA512
b513a4145cefc75ea9816e996dcb67b59ebbe121622592f221c802ce7496407255ff75541c4a7a1e0a1277b7c42caf8f6bbe2079d3f1fa240b6fb8cf058a9b28

Download Submit
C:\Users\Admin\AppData\Local\Temp\ImsszXQrCQ.bat

Filesize
172B

MD5
b9f38b923507fdc95acfa4f5320d61ef

SHA1
6cd09b944fe3e5786b9ecd03e29af57cde4415a1

SHA256
c54bbef1790ab1159ab017f0d3120e069e76eb3db50751304af65e4a9dcb3ad1

SHA512
9dbe956a521d21d6023e1b8abca6c6b5184e573a6112371df05b234c8e821a76a311aeb17759bc370029a2379608fa71f5d22c10cc83a6dd8dd2e5168baa227d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Macro (1).exe

Filesize
3.3MB

MD5
380985f8470bcdee9acbae4a7080dd31

SHA1
4da846d65b19cdf296f937432b551b39d150f964

SHA256
c0235b10b3faa1710f6831e49acd96af17107b4b4b5face7bc46becb373a02db

SHA512
36fca5b00394757982edb2b88dab32540306dda9b3b4f9e1cddf5f03aad81f68663f191576c8ccdbddc543176b02c0cde818f7fb4c1ed8567c0a8c69a102db6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Nexus (2).exe

Filesize
2.2MB

MD5
195d5f19f6ffde8780067e466f76b090

SHA1
8708f5dac4bf119382661adce42a6adf7349ed7f

SHA256
1773d652eedac25cd64b91f0bff1bb15150c0dc60c1a3ca66cf3106f13549d87

SHA512
18e8735d75404d1f29756aa893aec04eec9111f8320259aefc4020769ca9d75f5c03262bcc390463dd5afcb9a1f3246db1ad792661923c1a924a6a144630337d

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES54D2.tmp

Filesize
1KB

MD5
689773ebaaf8876d14679d37c0d4ad64

SHA1
55977f1ebed8920cb8d63d7c2519cabc2e5bba07

SHA256
776098d80caeed155b8e4fe91152c3caa8e42dde589ac50546b8fe1ce8af0a37

SHA512
996ce3f5e470cad26caa917b1530b8da1d14e8d0f140eb1fb12d4c49c7e5381192a35ca4882a3fd9e571bdd077d948badecdbf7d0652289999168fdb8560ac24

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES554F.tmp

Filesize
1KB

MD5
7b8f346b8e56e87a016065bd2adb4c31

SHA1
772ec2b35259ca50e379461dd36b449b16817425

SHA256
6433d49f915f55a6d3646cec69125a7bb418bfeaeccafaa5c3a18aa1e3af2a83

SHA512
70b97149a0953032d8f3c6c5ef0c724470355458657b6f7bb603a1e5ccfb0b5e56e37a379a6ba18ac234e72317e17b45e3cdeaf46dc42678ca9ece65458ba7aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\ZI9TpMxUin.bat

Filesize
172B

MD5
0f3b2331557a223f9b1224d55b46b552

SHA1
6cc2f2197007c58c960ed320fe8c45fcd6e186af

SHA256
2fb32b0c9f7944953de23ce33698d67671fc372344318e3c1949d37978187033

SHA512
d2081eaab037cd397555f7da1a0c9c1155cf907178bc4e44754ede9a5a2900bc79facfa5ed16706cbe4b3da7bcb90219a8bffcf4a3dd1e02ae1413a232de26ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\lr5Zi8WiUT.bat

Filesize
172B

MD5
95dde21bc87194cc06629ea4efac1aad

SHA1
15503936de3e2744bce13184d90c17bd8077d93f

SHA256
5ef8fab9978db7cb994a069ade42b29ba557005de58a73d0c442b0253b68b10f

SHA512
5c0fd852164e1e872b8d1b7c78d04213ff617678f4b7ddfa50952a576be1ac4f3d47cd3a94889b19e6d2f6a461d457ab1f39a649ad945d5dddc1d0539ada6cce

Download Submit
C:\Users\Admin\AppData\Local\Temp\qTmai1Dpby.bat

Filesize
220B

MD5
4b1ab72e4649ed5e4e84a6ac627c5f44

SHA1
b555f29501c0d58df2c46b51e56851265f8002ee

SHA256
c4b731322ad51b7974f573067132f1c1260f3a3f7d682bd14461ecb5dae6f68b

SHA512
185a4533a825693a0a3382eb5b3701f31ca1985275444a06eff328b1787d381980162d9d44017f84a6375a1332a69b3a391d1be3bd706cb3e5066b0695924eb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\r3ED9wUyR4.bat

Filesize
172B

MD5
28443145b67f1709ac0c6f85532da9c7

SHA1
76e71d700e74b6f0816955ae5f8bdcdc0ec7ad77

SHA256
23833b7d227d77a1f0fdb343703736bf84f87a5cc51552394d83f1e66509bcce

SHA512
964686cd847a1e1fed2a98770ccc99f4583a263fd5bf9c336f0ee1913b63f8d0acecb3f9f071e7d1a0b270595201231c0719a3c48ff3db0c151d3e2485b1c13c

Download Submit
\??\c:\Program Files (x86)\Microsoft\Edge\Application\CSC83D11535C48464694F6C9DEEB9DAAAC.TMP

Filesize
1KB

MD5
b5189fb271be514bec128e0d0809c04e

SHA1
5dd625d27ed30fca234ec097ad66f6c13a7edcbe

SHA256
e1984ba1e3ff8b071f7a320a6f1f18e1d5f4f337d31dc30d5bdfb021df39060f

SHA512
f0fcb8f97279579beb59f58ea89527ee0d86a64c9de28300f14460bec6c32dda72f0e6466573b6654a1e992421d6fe81ae7cce50f27059f54cf9fdca6953602e

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\cxsbxxei\cxsbxxei.0.cs

Filesize
406B

MD5
99b065261594186213c901b825956e15

SHA1
63b0425c2d070249296932daaa57977ca81111f8

SHA256
431ed218573cb0f06f9d1329689daa16dac472dc6d683e0d81dc084e695b4ebc

SHA512
8397dbe77af734cfa4bf7407ae7a4648433cedf4f48f0c62bfc2c99ff3064a56a31e2571d287f80c16e5ff64e452661e7f15e0282162029aef23c0ce249bcaa4

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\cxsbxxei\cxsbxxei.cmdline

Filesize
265B

MD5
9838dcad62bc4935828f9bb6d8a7710b

SHA1
69ab87b3030986c1c74ae8b27e3b49096f021312

SHA256
7f05a048742d1ef0d629084ca03faaebb51836e336afcd4d323b53d85ff3d3f4

SHA512
0847656409fd166bc691b03a34c394314b4a5d2416a9da178db1f95d59d98b85e26ee7b9e4f5b6a4ddbd444f23b405c111fb8641afc2920638b1901a2daef2e3

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\qlkg03vr\qlkg03vr.0.cs

Filesize
376B

MD5
6f9308e1de44f8361a3bf897080a5a29

SHA1
6798d09a4fe7bf464a0086e8b0215d499f5e6dfd

SHA256
73b0c3871c26755a17d35884d9ff15fa392fc256dc67b475fdb08168db457092

SHA512
a659704f3b391045c78a59cf2c4f7c21aff95031eec041df57748ead435ebc294913e1f78bb65f80cbce9ec5eae56fe717e6041fae875b0c32e69833d6eaf959

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\qlkg03vr\qlkg03vr.cmdline

Filesize
235B

MD5
cc333f1bf4dbd1e9954553a0ee695ae8

SHA1
c40b820664dbdd40c4851ea250196760a08ad226

SHA256
3c1d5a06bb4ea5c80ea819e406063f7549f978e960fd3aacc8e937d4785ec59c

SHA512
37162d9bbcd9a2084d1fad7227886dc43a0634caa979d7dfa9e72aa7aea88019a42a57c729a9200fabb28ae5fc39649bbbf67e7b5c410daec4c763e1d65ec150

Download Submit
\??\c:\Windows\System32\CSC3F97413D6CF540418F1B3C9D39F65D5.TMP

Filesize
1KB

MD5
01dc60b32f9121b11b30ff8d8e3ed9bd

SHA1
d4c7beabbb4b96239ff85348a9cd1957a10c27ab

SHA256
bbedf7b9680a97b0ebd09540310951791296334e7d8a3056b73ad564c55556ea

SHA512
0bc2dfe0549f8f0fc70c68df1fc61abf21f0c05954220ab1df7375d15f9a4d332cdccb5aefdef705a88f801c9e5e792815287f27674263db7dcb6a2f086429be

Download Submit
memory/1764-13-0x00000000023F0000-0x00000000023F1000-memory.dmp

Filesize
4KB

Download
memory/1764-86-0x00000000023F0000-0x00000000023F1000-memory.dmp

Filesize
4KB

Download
memory/1764-29-0x0000000000400000-0x000000000075F000-memory.dmp

Filesize
3.4MB

Download
memory/2736-19-0x0000000000400000-0x0000000000974000-memory.dmp

Filesize
5.5MB

Download
memory/3116-163-0x000000001C120000-0x000000001C222000-memory.dmp

Filesize
1.0MB

Download
memory/3116-158-0x000000001C120000-0x000000001C222000-memory.dmp

Filesize
1.0MB

Download
memory/3296-144-0x000000001B2A0000-0x000000001B3A2000-memory.dmp

Filesize
1.0MB

Download
memory/3296-149-0x000000001B2A0000-0x000000001B3A2000-memory.dmp

Filesize
1.0MB

Download
memory/4312-34-0x00000000006B0000-0x000000000088A000-memory.dmp

Filesize
1.9MB

Download
memory/4312-36-0x0000000001060000-0x000000000106E000-memory.dmp

Filesize
56KB

Download
memory/4312-38-0x000000001B3C0000-0x000000001B3DC000-memory.dmp

Filesize
112KB

Download
memory/4312-39-0x000000001B570000-0x000000001B5C0000-memory.dmp

Filesize
320KB

Download
memory/4312-41-0x000000001B3E0000-0x000000001B3F8000-memory.dmp

Filesize
96KB

Download
memory/4312-43-0x0000000001210000-0x000000000121C000-memory.dmp

Filesize
48KB

Download