modiloader | 3a6aabc0788476663742c854e6378a74ce1b842c2c14a9112db789b26bf775a4

Analysis

max time kernel
1793s
max time network
1798s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 12:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

XClient.exe
Size

61KB
MD5

cba7d25f925fa34425ebf47293f2133a
SHA1

834b3ade6562c14834b09e2fbcd733a5651c479d
SHA256

3a6aabc0788476663742c854e6378a74ce1b842c2c14a9112db789b26bf775a4
SHA512

8bfd45e629934dc0037831f15a9e2d21d5f62c3353223da13347b46a870367e87db614f04bfc78118f43e54142fbfdb27b0c509f79af61337694e8743818b932
SSDEEP

1536:lSawG3K3vBzul3CHjxise5Ot+bSsVG55z6f4NO2VkGk:lKG3K3v+8FiFYt+bd25GMO2Vkv

Score

10^/10

modiloader xworm defense_evasion evasion execution persistence rat spyware stealer trojan

Malware Config

Extracted

Family

xworm

politics-installing.gl.at.ply.gg:59813

Attributes

install_file
USB.exe

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral1/memory/856-270-0x00000000007A0000-0x00000000007AE000-memory.dmp	disable_win_def

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/856-1-0x0000000000A40000-0x0000000000A56000-memory.dmp	family_xworm

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\HypercomponentCommon\\cmd.exe\", \"C:\\HypercomponentCommon\\csrss.exe\""	hyperSurrogateagentCrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\HypercomponentCommon\\cmd.exe\", \"C:\\HypercomponentCommon\\csrss.exe\", \"C:\\Users\\Default User\\csrss.exe\""	hyperSurrogateagentCrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\HypercomponentCommon\\cmd.exe\", \"C:\\HypercomponentCommon\\csrss.exe\", \"C:\\Users\\Default User\\csrss.exe\", \"C:\\Windows\\it-IT\\smss.exe\""	hyperSurrogateagentCrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\HypercomponentCommon\\cmd.exe\", \"C:\\HypercomponentCommon\\csrss.exe\", \"C:\\Users\\Default User\\csrss.exe\", \"C:\\Windows\\it-IT\\smss.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList\\lsass.exe\""	hyperSurrogateagentCrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\HypercomponentCommon\\cmd.exe\", \"C:\\HypercomponentCommon\\csrss.exe\", \"C:\\Users\\Default User\\csrss.exe\", \"C:\\Windows\\it-IT\\smss.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList\\lsass.exe\", \"C:\\HypercomponentCommon\\hyperSurrogateagentCrt.exe\""	hyperSurrogateagentCrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\HypercomponentCommon\\cmd.exe\""	hyperSurrogateagentCrt.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1660	1884	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	408	1884	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1296	1884	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3060	1884	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	380	1884	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1288	1884	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2876	1884	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1864	1884	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2924	1884	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1560	1884	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	912	1884	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2584	1884	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2580	1884	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2688	1884	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2040	1884	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1808	1884	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2780	1884	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2676	1884	schtasks.exe	35

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

ModiLoader Second Stage 2 IoCs

resource	yara_rule
behavioral1/files/0x0006000000016d4b-244.dat	modiloader_stage2
behavioral1/memory/2552-264-0x0000000000400000-0x000000000046A000-memory.dmp	modiloader_stage2

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2660	powershell.exe
2928	powershell.exe
2204	powershell.exe
2900	powershell.exe
2496	powershell.exe
2608	powershell.exe
2164	powershell.exe
2004	powershell.exe

Disables Task Manager via registry modification
evasion
Downloads MZ/PE file

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	XClient.exe

Deletes itself 1 IoCs

pid	Process
3028	cmd.exe

Executes dropped EXE 25 IoCs

pid	Process
1456	OOK0HT5310R968G.exe
2840	hyperSurrogateagentCrt.exe
1216	csrss.exe
2552	wrodnw.exe
2148	cmd.exe
2944	csrss.exe
1724	csrss.exe
2104	smss.exe
2472	lsass.exe
2152	hyperSurrogateagentCrt.exe
2284	smss.exe
1588	lsass.exe
1836	WMCE4SCH7ET1JTC.exe
1688	hyperSurrogateagentCrt.exe
1320	csrss.exe
572	smss.exe
2012	cmd.exe
1396	hyperSurrogateagentCrt.exe
720	lsass.exe
2936	smss.exe
2928	csrss.exe
1324	lsass.exe
2424	smss.exe
1460	hyperSurrogateagentCrt.exe
2188	cmd.exe

Impair Defenses: Safe Mode Boot 1 TTPs 3 IoCs

defense_evasion

Safe Mode Boot

T1562.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\WinDefend	wrodnw.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc	wrodnw.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power	wrodnw.exe

Loads dropped DLL 3 IoCs

pid	Process
2364	cmd.exe
2364	cmd.exe
1288	cmd.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 13 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Windows\\it-IT\\smss.exe\""	hyperSurrogateagentCrt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList\\lsass.exe\""	hyperSurrogateagentCrt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\hyperSurrogateagentCrt = "\"C:\\HypercomponentCommon\\hyperSurrogateagentCrt.exe\""	hyperSurrogateagentCrt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\wrodnw.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wrodnw.exe"	wrodnw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\HypercomponentCommon\\cmd.exe\""	hyperSurrogateagentCrt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\Default User\\csrss.exe\""	hyperSurrogateagentCrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hyperSurrogateagentCrt = "\"C:\\HypercomponentCommon\\hyperSurrogateagentCrt.exe\""	hyperSurrogateagentCrt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\HypercomponentCommon\\cmd.exe\""	hyperSurrogateagentCrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\Default User\\csrss.exe\""	hyperSurrogateagentCrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList\\lsass.exe\""	hyperSurrogateagentCrt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\HypercomponentCommon\\csrss.exe\""	hyperSurrogateagentCrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\HypercomponentCommon\\csrss.exe\""	hyperSurrogateagentCrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Windows\\it-IT\\smss.exe\""	hyperSurrogateagentCrt.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
17	raw.githubusercontent.com
18	raw.githubusercontent.com
137	raw.githubusercontent.com
138	raw.githubusercontent.com

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSCB7AC6DD5EEA54CA197505CA0E5A663A2.TMP	csc.exe
File created	\??\c:\Windows\System32\tcszo9.exe	csc.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\lsass.exe	hyperSurrogateagentCrt.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\6203df4a6bafc7	hyperSurrogateagentCrt.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\lsass.exe	hyperSurrogateagentCrt.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\it-IT\smss.exe	hyperSurrogateagentCrt.exe
File created	C:\Windows\it-IT\69ddcba757bf72	hyperSurrogateagentCrt.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2100	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	explorer.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_Classes\Local Settings	explorer.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	XClient.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	XClient.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	XClient.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	XClient.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1164	NOTEPAD.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1460	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1864	schtasks.exe
2924	schtasks.exe
1560	schtasks.exe
2584	schtasks.exe
1296	schtasks.exe
3060	schtasks.exe
2040	schtasks.exe
2780	schtasks.exe
2676	schtasks.exe
2876	schtasks.exe
2688	schtasks.exe
1288	schtasks.exe
912	schtasks.exe
2580	schtasks.exe
1660	schtasks.exe
380	schtasks.exe
408	schtasks.exe
1808	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2004	powershell.exe
2660	powershell.exe
856	XClient.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
784	explorer.exe
1216	csrss.exe
856	XClient.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	856	XClient.exe
Token: SeDebugPrivilege	2004	powershell.exe
Token: SeDebugPrivilege	2660	powershell.exe
Token: SeDebugPrivilege	856	XClient.exe
Token: SeDebugPrivilege	2840	hyperSurrogateagentCrt.exe
Token: SeDebugPrivilege	2204	powershell.exe
Token: SeDebugPrivilege	2608	powershell.exe
Token: SeDebugPrivilege	2928	powershell.exe
Token: SeDebugPrivilege	2496	powershell.exe
Token: SeDebugPrivilege	2164	powershell.exe
Token: SeDebugPrivilege	2900	powershell.exe
Token: SeDebugPrivilege	1216	csrss.exe
Token: SeDebugPrivilege	2148	cmd.exe
Token: SeDebugPrivilege	2944	csrss.exe
Token: SeDebugPrivilege	2472	lsass.exe
Token: SeDebugPrivilege	1724	csrss.exe
Token: SeDebugPrivilege	2104	smss.exe
Token: SeDebugPrivilege	2152	hyperSurrogateagentCrt.exe
Token: SeShutdownPrivilege	784	explorer.exe
Token: SeShutdownPrivilege	784	explorer.exe
Token: SeShutdownPrivilege	784	explorer.exe
Token: SeShutdownPrivilege	784	explorer.exe
Token: SeShutdownPrivilege	784	explorer.exe
Token: SeShutdownPrivilege	784	explorer.exe
Token: SeShutdownPrivilege	784	explorer.exe
Token: SeShutdownPrivilege	784	explorer.exe
Token: SeShutdownPrivilege	784	explorer.exe
Token: 33	2124	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2124	AUDIODG.EXE
Token: 33	2124	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2124	AUDIODG.EXE
Token: SeShutdownPrivilege	784	explorer.exe
Token: SeShutdownPrivilege	784	explorer.exe
Token: SeShutdownPrivilege	784	explorer.exe
Token: SeShutdownPrivilege	784	explorer.exe
Token: SeDebugPrivilege	1792	taskmgr.exe
Token: SeShutdownPrivilege	784	explorer.exe
Token: SeShutdownPrivilege	784	explorer.exe
Token: SeShutdownPrivilege	784	explorer.exe
Token: SeShutdownPrivilege	784	explorer.exe
Token: SeShutdownPrivilege	784	explorer.exe
Token: SeShutdownPrivilege	784	explorer.exe
Token: SeShutdownPrivilege	784	explorer.exe
Token: SeShutdownPrivilege	784	explorer.exe
Token: SeShutdownPrivilege	784	explorer.exe
Token: SeShutdownPrivilege	784	explorer.exe
Token: SeShutdownPrivilege	784	explorer.exe
Token: SeShutdownPrivilege	784	explorer.exe
Token: SeShutdownPrivilege	784	explorer.exe
Token: SeShutdownPrivilege	784	explorer.exe
Token: SeShutdownPrivilege	784	explorer.exe
Token: SeDebugPrivilege	2284	smss.exe
Token: SeShutdownPrivilege	784	explorer.exe
Token: SeShutdownPrivilege	784	explorer.exe
Token: SeShutdownPrivilege	784	explorer.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	784	explorer.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
784	explorer.exe
784	explorer.exe
784	explorer.exe
784	explorer.exe
784	explorer.exe
784	explorer.exe
784	explorer.exe
784	explorer.exe
784	explorer.exe
784	explorer.exe
784	explorer.exe
784	explorer.exe
784	explorer.exe
784	explorer.exe
784	explorer.exe
784	explorer.exe
784	explorer.exe
784	explorer.exe
784	explorer.exe
784	explorer.exe
784	explorer.exe
784	explorer.exe
784	explorer.exe
784	explorer.exe
784	explorer.exe
784	explorer.exe
784	explorer.exe
784	explorer.exe
1792	taskmgr.exe
1792	taskmgr.exe
1792	taskmgr.exe
1792	taskmgr.exe
1792	taskmgr.exe
1792	taskmgr.exe
1792	taskmgr.exe
1792	taskmgr.exe
1792	taskmgr.exe
1792	taskmgr.exe
1792	taskmgr.exe
1792	taskmgr.exe
1792	taskmgr.exe
784	explorer.exe
784	explorer.exe
1792	taskmgr.exe
1792	taskmgr.exe
1792	taskmgr.exe
1792	taskmgr.exe
1792	taskmgr.exe
1792	taskmgr.exe
1792	taskmgr.exe
1792	taskmgr.exe
1792	taskmgr.exe
1792	taskmgr.exe
1792	taskmgr.exe
1792	taskmgr.exe
1792	taskmgr.exe
1792	taskmgr.exe
1792	taskmgr.exe
1792	taskmgr.exe
1792	taskmgr.exe
1792	taskmgr.exe
1792	taskmgr.exe
1792	taskmgr.exe
1792	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
784	explorer.exe
784	explorer.exe
784	explorer.exe
784	explorer.exe
784	explorer.exe
784	explorer.exe
784	explorer.exe
784	explorer.exe
784	explorer.exe
784	explorer.exe
784	explorer.exe
784	explorer.exe
784	explorer.exe
784	explorer.exe
784	explorer.exe
784	explorer.exe
784	explorer.exe
784	explorer.exe
784	explorer.exe
784	explorer.exe
784	explorer.exe
784	explorer.exe
784	explorer.exe
784	explorer.exe
784	explorer.exe
784	explorer.exe
784	explorer.exe
784	explorer.exe
784	explorer.exe
784	explorer.exe
784	explorer.exe
784	explorer.exe
784	explorer.exe
784	explorer.exe
784	explorer.exe
784	explorer.exe
784	explorer.exe
784	explorer.exe
784	explorer.exe
1792	taskmgr.exe
1792	taskmgr.exe
1792	taskmgr.exe
1792	taskmgr.exe
1792	taskmgr.exe
1792	taskmgr.exe
1792	taskmgr.exe
1792	taskmgr.exe
1792	taskmgr.exe
1792	taskmgr.exe
1792	taskmgr.exe
1792	taskmgr.exe
1792	taskmgr.exe
784	explorer.exe
1792	taskmgr.exe
1792	taskmgr.exe
784	explorer.exe
784	explorer.exe
784	explorer.exe
784	explorer.exe
784	explorer.exe
784	explorer.exe
1792	taskmgr.exe
784	explorer.exe
784	explorer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
856	XClient.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 856 wrote to memory of 2004	856	XClient.exe	28
PID 856 wrote to memory of 2004	856	XClient.exe	28
PID 856 wrote to memory of 2004	856	XClient.exe	28
PID 856 wrote to memory of 2660	856	XClient.exe	30
PID 856 wrote to memory of 2660	856	XClient.exe	30
PID 856 wrote to memory of 2660	856	XClient.exe	30
PID 856 wrote to memory of 1456	856	XClient.exe	36
PID 856 wrote to memory of 1456	856	XClient.exe	36
PID 856 wrote to memory of 1456	856	XClient.exe	36
PID 856 wrote to memory of 1456	856	XClient.exe	36
PID 1456 wrote to memory of 312	1456	OOK0HT5310R968G.exe	37
PID 1456 wrote to memory of 312	1456	OOK0HT5310R968G.exe	37
PID 1456 wrote to memory of 312	1456	OOK0HT5310R968G.exe	37
PID 1456 wrote to memory of 312	1456	OOK0HT5310R968G.exe	37
PID 312 wrote to memory of 2364	312	WScript.exe	38
PID 312 wrote to memory of 2364	312	WScript.exe	38
PID 312 wrote to memory of 2364	312	WScript.exe	38
PID 312 wrote to memory of 2364	312	WScript.exe	38
PID 2364 wrote to memory of 2840	2364	cmd.exe	40
PID 2364 wrote to memory of 2840	2364	cmd.exe	40
PID 2364 wrote to memory of 2840	2364	cmd.exe	40
PID 2364 wrote to memory of 2840	2364	cmd.exe	40
PID 2840 wrote to memory of 1748	2840	hyperSurrogateagentCrt.exe	44
PID 2840 wrote to memory of 1748	2840	hyperSurrogateagentCrt.exe	44
PID 2840 wrote to memory of 1748	2840	hyperSurrogateagentCrt.exe	44
PID 1748 wrote to memory of 1048	1748	csc.exe	46
PID 1748 wrote to memory of 1048	1748	csc.exe	46
PID 1748 wrote to memory of 1048	1748	csc.exe	46
PID 2840 wrote to memory of 2928	2840	hyperSurrogateagentCrt.exe	62
PID 2840 wrote to memory of 2928	2840	hyperSurrogateagentCrt.exe	62
PID 2840 wrote to memory of 2928	2840	hyperSurrogateagentCrt.exe	62
PID 2840 wrote to memory of 2204	2840	hyperSurrogateagentCrt.exe	63
PID 2840 wrote to memory of 2204	2840	hyperSurrogateagentCrt.exe	63
PID 2840 wrote to memory of 2204	2840	hyperSurrogateagentCrt.exe	63
PID 2840 wrote to memory of 2900	2840	hyperSurrogateagentCrt.exe	66
PID 2840 wrote to memory of 2900	2840	hyperSurrogateagentCrt.exe	66
PID 2840 wrote to memory of 2900	2840	hyperSurrogateagentCrt.exe	66
PID 2840 wrote to memory of 2164	2840	hyperSurrogateagentCrt.exe	67
PID 2840 wrote to memory of 2164	2840	hyperSurrogateagentCrt.exe	67
PID 2840 wrote to memory of 2164	2840	hyperSurrogateagentCrt.exe	67
PID 2840 wrote to memory of 2608	2840	hyperSurrogateagentCrt.exe	68
PID 2840 wrote to memory of 2608	2840	hyperSurrogateagentCrt.exe	68
PID 2840 wrote to memory of 2608	2840	hyperSurrogateagentCrt.exe	68
PID 2840 wrote to memory of 2496	2840	hyperSurrogateagentCrt.exe	69
PID 2840 wrote to memory of 2496	2840	hyperSurrogateagentCrt.exe	69
PID 2840 wrote to memory of 2496	2840	hyperSurrogateagentCrt.exe	69
PID 2840 wrote to memory of 2884	2840	hyperSurrogateagentCrt.exe	74
PID 2840 wrote to memory of 2884	2840	hyperSurrogateagentCrt.exe	74
PID 2840 wrote to memory of 2884	2840	hyperSurrogateagentCrt.exe	74
PID 2884 wrote to memory of 1384	2884	cmd.exe	76
PID 2884 wrote to memory of 1384	2884	cmd.exe	76
PID 2884 wrote to memory of 1384	2884	cmd.exe	76
PID 2884 wrote to memory of 1460	2884	cmd.exe	77
PID 2884 wrote to memory of 1460	2884	cmd.exe	77
PID 2884 wrote to memory of 1460	2884	cmd.exe	77
PID 2884 wrote to memory of 1216	2884	cmd.exe	80
PID 2884 wrote to memory of 1216	2884	cmd.exe	80
PID 2884 wrote to memory of 1216	2884	cmd.exe	80
PID 856 wrote to memory of 2552	856	XClient.exe	81
PID 856 wrote to memory of 2552	856	XClient.exe	81
PID 856 wrote to memory of 2552	856	XClient.exe	81
PID 856 wrote to memory of 2552	856	XClient.exe	81
PID 2552 wrote to memory of 784	2552	wrodnw.exe	89
PID 2552 wrote to memory of 784	2552	wrodnw.exe	89

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\XClient.exe
"C:\Users\Admin\AppData\Local\Temp\XClient.exe"
1⤵
- Drops file in Drivers directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:856
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XClient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2004
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2660
- C:\Users\Admin\AppData\Local\Temp\OOK0HT5310R968G.exe
  "C:\Users\Admin\AppData\Local\Temp\OOK0HT5310R968G.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1456
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\HypercomponentCommon\I1SNCaG9QwHssjsi1vS2b9DJmZMoJ4clEjNn.vbe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:312
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\HypercomponentCommon\cemEzm0xYx1.bat" "
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:2364
    - - C:\HypercomponentCommon\hyperSurrogateagentCrt.exe
        
        "C:\HypercomponentCommon/hyperSurrogateagentCrt.exe"
        5⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2840
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\y5vl34vc\y5vl34vc.cmdline"
        6⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1748
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES69F9.tmp" "c:\Windows\System32\CSCB7AC6DD5EEA54CA197505CA0E5A663A2.TMP"
        7⤵
        
        PID:1048
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\HypercomponentCommon\cmd.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2928
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\HypercomponentCommon\csrss.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2204
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\csrss.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2900
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\it-IT\smss.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2164
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\lsass.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2608
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\HypercomponentCommon\hyperSurrogateagentCrt.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2496
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\fHsM3u1rww.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2884
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:1384
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        7⤵
        Runs ping.exe
        
        PID:1460
        
        C:\Users\Default User\csrss.exe
        
        "C:\Users\Default User\csrss.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:1216
- C:\Users\Admin\AppData\Local\Temp\wrodnw.exe
  "C:\Users\Admin\AppData\Local\Temp\wrodnw.exe"
  2⤵
  - Executes dropped EXE
  - Impair Defenses: Safe Mode Boot
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2552
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:784
  - - C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /4
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:1792
  - - C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\New Text Document.txt
      4⤵
      PID:2308
  - - C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\11.txt
      4⤵
      Opens file in notepad (likely ransom note)
      PID:1164
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      Enumerates system info in registry
      Suspicious use of AdjustPrivilegeToken
      PID:2632
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef1779758,0x7fef1779768,0x7fef1779778
        5⤵
        
        PID:580
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1192 --field-trial-handle=1384,i,4798819147819371074,5581526286899883365,131072 /prefetch:2
        5⤵
        
        PID:624
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1528 --field-trial-handle=1384,i,4798819147819371074,5581526286899883365,131072 /prefetch:8
        5⤵
        
        PID:2712
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1612 --field-trial-handle=1384,i,4798819147819371074,5581526286899883365,131072 /prefetch:8
        5⤵
        
        PID:2080
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2140 --field-trial-handle=1384,i,4798819147819371074,5581526286899883365,131072 /prefetch:1
        5⤵
        
        PID:2008
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2144 --field-trial-handle=1384,i,4798819147819371074,5581526286899883365,131072 /prefetch:1
        5⤵
        
        PID:2100
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1408 --field-trial-handle=1384,i,4798819147819371074,5581526286899883365,131072 /prefetch:2
        5⤵
        
        PID:2320
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3240 --field-trial-handle=1384,i,4798819147819371074,5581526286899883365,131072 /prefetch:1
        5⤵
        
        PID:1664
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3640 --field-trial-handle=1384,i,4798819147819371074,5581526286899883365,131072 /prefetch:8
        5⤵
        
        PID:1704
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3760 --field-trial-handle=1384,i,4798819147819371074,5581526286899883365,131072 /prefetch:1
        5⤵
        
        PID:1612
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3476 --field-trial-handle=1384,i,4798819147819371074,5581526286899883365,131072 /prefetch:1
        5⤵
        
        PID:2292
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3256 --field-trial-handle=1384,i,4798819147819371074,5581526286899883365,131072 /prefetch:1
        5⤵
        
        PID:1372
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=3376 --field-trial-handle=1384,i,4798819147819371074,5581526286899883365,131072 /prefetch:1
        5⤵
        
        PID:2576
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=2340 --field-trial-handle=1384,i,4798819147819371074,5581526286899883365,131072 /prefetch:1
        5⤵
        
        PID:2176
- C:\Users\Admin\AppData\Local\Temp\WMCE4SCH7ET1JTC.exe
  "C:\Users\Admin\AppData\Local\Temp\WMCE4SCH7ET1JTC.exe"
  2⤵
  - Executes dropped EXE
  PID:1836
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\HypercomponentCommon\I1SNCaG9QwHssjsi1vS2b9DJmZMoJ4clEjNn.vbe"
    3⤵
    PID:608
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\HypercomponentCommon\cemEzm0xYx1.bat" "
      4⤵
      Loads dropped DLL
      PID:1288
    - - C:\HypercomponentCommon\hyperSurrogateagentCrt.exe
        
        "C:\HypercomponentCommon/hyperSurrogateagentCrt.exe"
        5⤵
        Executes dropped EXE
        
        PID:1688
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpF328.tmp.bat""
  2⤵
  - Deletes itself
  PID:3028
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:2100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 7 /tr "'C:\HypercomponentCommon\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\HypercomponentCommon\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 13 /tr "'C:\HypercomponentCommon\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\HypercomponentCommon\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\HypercomponentCommon\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\HypercomponentCommon\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default User\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Windows\it-IT\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\it-IT\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\Windows\it-IT\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "hyperSurrogateagentCrth" /sc MINUTE /mo 13 /tr "'C:\HypercomponentCommon\hyperSurrogateagentCrt.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "hyperSurrogateagentCrt" /sc ONLOGON /tr "'C:\HypercomponentCommon\hyperSurrogateagentCrt.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "hyperSurrogateagentCrth" /sc MINUTE /mo 7 /tr "'C:\HypercomponentCommon\hyperSurrogateagentCrt.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2676

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2080

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:924

C:\HypercomponentCommon\cmd.exe
"C:\HypercomponentCommon\cmd.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2148

C:\HypercomponentCommon\csrss.exe
"C:\HypercomponentCommon\csrss.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2944

C:\Users\Default User\csrss.exe
"C:\Users\Default User\csrss.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1724

C:\Windows\it-IT\smss.exe
"C:\Windows\it-IT\smss.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2104

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\lsass.exe
"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\lsass.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2472

C:\HypercomponentCommon\hyperSurrogateagentCrt.exe
"C:\HypercomponentCommon\hyperSurrogateagentCrt.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2152

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x58c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2124

C:\Windows\system32\taskeng.exe
taskeng.exe {492458E1-8C17-482E-9A14-223D50B87F83} S-1-5-21-2297530677-1229052932-2803917579-1000:HKULBIBU\Admin:Interactive:[1]
1⤵
PID:2052
- C:\Windows\it-IT\smss.exe
  C:\Windows\it-IT\smss.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2284
- C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\lsass.exe
  "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\lsass.exe"
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Users\Default User\csrss.exe
  "C:\Users\Default User\csrss.exe"
  2⤵
  - Executes dropped EXE
  PID:1320
- C:\Windows\it-IT\smss.exe
  C:\Windows\it-IT\smss.exe
  2⤵
  - Executes dropped EXE
  PID:572
- C:\HypercomponentCommon\hyperSurrogateagentCrt.exe
  C:\HypercomponentCommon\hyperSurrogateagentCrt.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\HypercomponentCommon\cmd.exe
  C:\HypercomponentCommon\cmd.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\lsass.exe
  "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\lsass.exe"
  2⤵
  - Executes dropped EXE
  PID:720
- C:\Windows\it-IT\smss.exe
  C:\Windows\it-IT\smss.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Users\Default User\csrss.exe
  "C:\Users\Default User\csrss.exe"
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\lsass.exe
  "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\lsass.exe"
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\it-IT\smss.exe
  C:\Windows\it-IT\smss.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\HypercomponentCommon\hyperSurrogateagentCrt.exe
  C:\HypercomponentCommon\hyperSurrogateagentCrt.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\HypercomponentCommon\cmd.exe
  C:\HypercomponentCommon\cmd.exe
  2⤵
  - Executes dropped EXE
  PID:2188

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Safe Mode Boot

T1562.009

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\HypercomponentCommon\I1SNCaG9QwHssjsi1vS2b9DJmZMoJ4clEjNn.vbe

Filesize
220B

MD5
47085bdd4e3087465355c9bb9bbc6005

SHA1
bf0c5b11c20beca45cc9d4298f2a11a16c793a61

SHA256
80577e4666fad86273b01f60b8d63c15e4ce37774575ac1e0df7a7c396979752

SHA512
e74dd8e9756cab1123410a46609dc91540cc29a8fea93017155746f7bb9b7a41bfd3d7595a62788264bedceb475b2a733cce9b70f37cc4478302d5fc228d7684

Download Submit
C:\HypercomponentCommon\cemEzm0xYx1.bat

Filesize
105B

MD5
5ee2935a1949f69f67601f7375b3e8a3

SHA1
6a3229f18db384e57435bd3308298da56aa8c404

SHA256
c24a0d7f53a7aa3437f6b6566d3aaebdb36053b64e72cbd1d3796596fc8e3c06

SHA512
9777fcb9ee8a8aa0c770c835c5f30aff6efc5fb16a1819047e13d580d748703ffcb446db110067fb2546a637213cb8f25416d4b621a95a789b8e113d31d3401a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cfc723eb38d80cf6f55a3e95c664e718

SHA1
376f62c6f1df80965456ff2d15f5d32935b21191

SHA256
2108383aa5037ee84b251618c692239dc50c67a5efd60e5d0b1f99fd029c8438

SHA512
9b0f5527eba4df98a171e0e34bcb960c7a8d708360db27a15704350bb9267b3dbaaf7f2a96e9eb5eff8b5d272e0c503ef3c41c3607dba43039929f696b72616d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ece79a8b52d4632024b9ebfae546003d

SHA1
2eed0bb15163afba0d7a927ecd8fdbc6512ba5fa

SHA256
61a1e1272394974ebbe2e6fcca50afac9a2b12aea7e795d4ba3a8453cde8cf50

SHA512
ead2ee4a9de5bc88b4e143e1d23e3d5edb31f02a9eccc88e781db83521b2c051f521b7d2a24bd8cba9246593afbe9fde1b424cdf80941f2e35fee05a6eb8bc61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8583d1f06b6fdd5d34c86f462968fc55

SHA1
3e990c56ec8219145c876ab735715b9750129248

SHA256
234a1bfe3157b16956c6032be74a3a484d0ade0118e1871a4478150a92126f27

SHA512
f22ca65c76cdc53d0a09110048230819dbb98f0a5541a467314fda2f8309a6e3526cbf6a8175cb69cddeb5cebddb3aaa148abef52cf329fb3c50ca1e62b16bea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2a42abb1e6d18e624d4baf2047a2d2ee

SHA1
7a271d3fd85417fee3dedd90f33cc0ce631bc8f5

SHA256
b90dc2f1810948151e23897d986535b06ed0f30955739d04fb5aa923a39ab941

SHA512
a6438cd49ec0027e84ffe1c9e32195c5fadbaadd54d66e9991153eca066399a70bb5ae2d8e0a6f4381d913e0f96b988c2358c016400e33ac88fd97833a613fc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
558800c27f80a65d884510b6dc8a67ff

SHA1
43b8a4e0d16ec0acf198f0dfa0f94b040a66be15

SHA256
88f5cced5e81178ed50b14d859f436cbe01480b1b93f1ecfedb09582e08fbc3d

SHA512
8082662284cf24c5b70dc3fa5abdbc77f8f696f4e13f447ebb20e68486404f31edda70b80da18db239da4202e5034cc85e16f7ba21f52dcf7aa733751c49e433

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4c8f04ea7e156521b0c6c6966a641829

SHA1
6d25eb43eb2c7356b853f40930e7f3432c41f233

SHA256
9be2a6a911a20e09faa5ba025ceeb16bae39f0537f581144c474869bcdbd5b21

SHA512
ac0758a3eec9c6236c8a039e8c2ea89ca4b5058a01744effec06a430c5fac874b1ab06351f7a6bcb2ba0c5e57e51d7037cf007a88b5f811fd022bec978c50385

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ac1c23a723083a227ffb7ff431836709

SHA1
e84967bf0ca7627c8ebf40e3ddb320bed026afd2

SHA256
cd9d38ead19d3a374ad03e255986fdb79e226c66aaa9e1663de88c8c93e007b1

SHA512
f7d6dc7ac2723f727ce06811b790c66d8cb78e3f48d827d084e349cdc37bbc04c0c859e6d9b5603eeb223da57ac38ec8ba8396a5f3d4b37224f48bd96eca5abf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\3994409d-10ae-4035-b19a-1b5760cfeed4.tmp

Filesize
280KB

MD5
eb4d16c71b861e75f5b9b0f2e0b01258

SHA1
6ad67ab5cc60760f1a9455eee403406461099aaf

SHA256
ae985ae5d2a17ec8d6e77e740494a2aab48ad5939704259fe89a16f1c55f5bff

SHA512
9e30ab6ef8579e360fb8856b6c82740dce195dfe3c2b4dd0a157e3ba43485337c3ac8f61e49dec1561b87989db4fbd97914635e328eb4d6cdee056c7cdec61c6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
904B

MD5
80843a266a231ca9496ed76a0bdc5114

SHA1
d1ec4a163a9f0d46bf8cd9c7eefb189739743b1e

SHA256
96ac6686135c73426704dd06a7a804442b62e0e076e22fce9307488b175d02e7

SHA512
f7a937b58c5e34d98e69e3305076388695fdc869ad9ce1b879d51c35fb0e26f4c5bf70b5d783eb2f3f1362024916b8a7951befade1bdb5de121bde173bb6f4fb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
39b3762107e9d0cf74e313f4c849b192

SHA1
bacd2eac986ebb9e458165e9eea8e7aaf3680e6a

SHA256
7bfc213c99a9880199ab07357150d7a11f46e4cd1532de976a43b7b404431175

SHA512
36034f5960000a2b91d55c75d1755c97b6ce1a08dc75b171ffa3f3dadc27d9a65bb3c565e1c80ff7a1bfd1dbce658f6c2e68e4a3f690b18826692c0c94cef4ba

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
d38aa053b5e773e794e81938d0d091e8

SHA1
120b1c1c142cc48066d94d98c1de03232f85ed3f

SHA256
0cdad780d5f659c8518b1ee0dde8c0a8977d1fe708cd15174ea7bfa6f1f869aa

SHA512
dd08e470b19f105f2259b7027c3b525e6ce727b7e26cdbf80466253fd408cc1f40fd36b9e5d96e29b775819d230b75b0d84a6687d2e40554bfeba947f8f6c4bb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
c7ac6538acedfdba4977d2f6cd490798

SHA1
c319a7359ecf5f66f85798b1555415c834fd2862

SHA256
668e47e1b31e44eec813773dbec3abb1cfa6cbea2ede92366c1d9fe0324cfa7a

SHA512
427041de6b8d92fe28574f6428db8762c58057031f42d813d96de5cf4a6feb867d5a306ca859b2a4635db32fad83f2e9568a8cca3f0b03f995fa1757e31eee99

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
baa73db865ea73c6bb1015c1f75228a8

SHA1
db6f554f5d1d76fe8e741d1f8e532f8700ffd30e

SHA256
835e74ace41288129e3dc33e170ebc3bd5e37733ce8ece5d779cbbc304995384

SHA512
a653e197d5e00da2b3a025a4987874b9cc55331dd5eea89a6fc33d96a7344407ce2cfd62d5a715f5cc1e1a206c99fbc94a0c6bf4929898b72a58a1bafa726310

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
280KB

MD5
3b6c61ef5c1757a8f3366b86a1291418

SHA1
dc428dff0535e9af79a2dacd4bb6e17e96335208

SHA256
c2c1be38145a8de57732fd4669ae8eee8ec4250110a16dd92e8184b125d0d00b

SHA512
0fb84c16f4e98178d4ad5097475cb0dd321db4fe6cba4cb5643fea04291822f43dd96159b698fbe11b87920dc4d813b89ac4fffb8fede2e7e6c4ee8cfb2fcb8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\OOK0HT5310R968G.exe

Filesize
2.2MB

MD5
05d87a4a162784fd5256f4118aff32af

SHA1
484ed03930ed6a60866b6f909b37ef0d852dbefd

SHA256
7e3d0dabaded78094abfac40d694eaebf861f3cb865d3835bb053d435e996950

SHA512
3d4ce511e9671d8bfa15e93d681fedd972f4fe4c09ac9cfd9653afe83e936654c88ee515a76e7ac80e8f34868802e68c6531fdea0b718029d2196ad1425981fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES69F9.tmp

Filesize
1KB

MD5
26f8e05b6e10dd44182a1808705c0af5

SHA1
e736b334196d61326a30e0dacecd1482771da19f

SHA256
3f7c4ddd2381bec95528612097e5300dde3ddc61cc6ed654809eae59d79ddbd3

SHA512
bea4bec4f45441b5507ea817bb9676b9b0331db19f0d00e0cf8037b8cda0779e89fefa8f2cf8456445b22ca104300ab9cc9fcd984affea5d796671e44db473e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4DE9.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\fHsM3u1rww.bat

Filesize
159B

MD5
835cefc9a71feb22b0a1770bef35fc4a

SHA1
f0dc77a28460bf83afcfea24faa600f8254b01ae

SHA256
acde76411fe5fd63b6521bbce71c826043d281f2380620d9bfc42b8bd198a3c6

SHA512
d2c857aa1e0ccd000f81ccec53490b09f2f09f26dcb837192475e5a8ffe7b6da1d7dd2779bfdf2eba830e99cd57e1674189cb0c72f9d8f66ad7394bdcd3a35af

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpF328.tmp.bat

Filesize
159B

MD5
7418937b77b0319eda3da6df0df22901

SHA1
8bc4f23f565da0b455f1c59b737673a97bb9ab83

SHA256
f7d5fcc3c4d6f9daec3c0d03a795366c12dd55d45fc6f457b3718535cdb2d812

SHA512
fc0db133358db5a0f2b307cebecd0346bdd2e37f065eeb3a9dc0e574ac28123dd866aa058261fa7646a0300c72bed8d0ab7910c98bc236761c681994ceb9963f

Download Submit
C:\Users\Admin\AppData\Local\Temp\wrodnw.exe

Filesize
397KB

MD5
7951e8baa6a654f7ceb9fbedbeb84f2a

SHA1
eb26db8d976b0bc52c5c0a789e1ba1fbfc961e54

SHA256
2f5170b86ac950832eff0fba3fccd0d68cbfd92c077c8ac1a980f1979c5a16b5

SHA512
c4ad760434be710668045921fbd5c70b0560f4ac1cb506e510220149810823b7fe337541579c3d06a0805ceee1b1be366eaf21885b5cf1bc8fc51efa958d0208

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
082924bb483debf0b18cb8455d12950e

SHA1
65ae077dce7f34701241513bc4cbb9fabff0c733

SHA256
345d74704d447b0505d6bde2d3d18082554a912f76626bedad89ef40555a7be7

SHA512
aed1384f94b7cbc4e072e505e3ea2b753c5655602cddc78d58707750d4540fd47c4ea9900f8ead1a20ea251d90ed97a936f01a0a474dc6751b580562b6e1dc48

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
4192760060b4943820a2293795b6245a

SHA1
ca1d8ee798f2295a8e1a7f201d458d3ade04ac5b

SHA256
a83a908875974d87ce51561b8a91eda14c8026b40343c60f505a8cfb90d93d24

SHA512
54ff8ad89bd22ba3e585d75577150312b026811500575bde603b5d247395bf91c6dbdc5ee37533062fc40721aa598e0777e1de446ea2f80783dffd60ca7cf1fb

Download Submit
C:\Users\Admin\Desktop\11.txt

Filesize
21B

MD5
ec5b3b67455e9ac9b42560e3382c0276

SHA1
1cba489fbf46ffbafbc92b3e8d682a548a128513

SHA256
e23695a895a580a389d684375349bd37ab2c0f0a6c4cf63ca84b559f86f0de10

SHA512
ab05638069cf2410376eb169fa5782569b7b3eb1d4f1d53b699f27d7606c8df1c99f76cfaf9093d08c06a8cd46c75f40d4259455a8fb92602dce39ead7e5d907

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
997B

MD5
e43857c9fe3f73f623449cb61a9763b7

SHA1
75a92e117923e4a9682a04c480b451390705179b

SHA256
55bae45f5b1de623d91a5c6e0acd63039e37aa41f3034f5bae254b134beb4af0

SHA512
2a76184865552b2de6738ba8816579ce81d76e787cdfad00a9069a8dc021a9c2f9460097e8c2ffd61a122509e2b04466cc2fdcdb1a9c3d5e4416c35915ce41ba

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\y5vl34vc\y5vl34vc.0.cs

Filesize
363B

MD5
aecfaa89aa865e76add8a2d521931888

SHA1
f3bc2712c21b68053a5d04a28426e69557d636ba

SHA256
6089b9615a58b6915b97936c2c1f4e2a79b591e32db7fd11562b036e5284de4a

SHA512
ac89458a3dd866efacd612aee8462f4296f33a755f75ad8ccf770a598adbcb0d49333976f95a27ccf9f9086b45e57c4327e82e549ab0dee7c29d633cebcfb51f

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\y5vl34vc\y5vl34vc.cmdline

Filesize
235B

MD5
23a458f0bf6977a8aca4e6277abce57a

SHA1
496118913b0cb9afd3131334ef3f9b812a5412eb

SHA256
830bf80cc7b8560e8d5634bdf753e5f72781f633b7991e898d88d910cbc569e8

SHA512
85a5e28951b9c4711c19643c0499402f9c9a95ace0721961b09aaec1726c00bf0050d607217d6bd2d96d22d8f5417a15a66926d2f545d102b5a947289f44332c

Download Submit
\??\c:\Windows\System32\CSCB7AC6DD5EEA54CA197505CA0E5A663A2.TMP

Filesize
1KB

MD5
d8db284f657dc7249f8d2e9798f16b87

SHA1
2c9e00cba50091d4239c90f375509c8d58408ec1

SHA256
67e68135a985b6d3a0d63df5c6795567cbc1d5b8f124d65662e463af4da65823

SHA512
4330f819da94bcb38b930d39f016c5989e68a20780b74de751f59b759e46de031244be9186261bb245507e9ca816c1655049575a03e85339b5fc596f5b7cfd39

Download Submit
\HypercomponentCommon\hyperSurrogateagentCrt.exe

Filesize
1.9MB

MD5
7be5cea1c84ad0b2a6d2e5b6292c8d80

SHA1
631e3de0fe83ebacbe5be4e7f895dd0bd8b095ce

SHA256
6eb90684ebc56fb2713f5c468b55a964625ec2af698d9687492b1de4225693b7

SHA512
ea58d3b1664fe70968635c2722e19ce65ce4c1d66c68aed2d98441e60e773c7295f18d9c99cf4c454c510f33f5e37d3d2c0053b7434a46c542a0d63a4cc03647

Download Submit
memory/572-934-0x0000000001390000-0x0000000001576000-memory.dmp

Filesize
1.9MB

Download
memory/784-277-0x0000000004070000-0x0000000004080000-memory.dmp

Filesize
64KB

Download
memory/856-19-0x0000000000770000-0x000000000077C000-memory.dmp

Filesize
48KB

Download
memory/856-17-0x000007FEF5A13000-0x000007FEF5A14000-memory.dmp

Filesize
4KB

Download
memory/856-1-0x0000000000A40000-0x0000000000A56000-memory.dmp

Filesize
88KB

Download
memory/856-285-0x0000000002120000-0x000000000212A000-memory.dmp

Filesize
40KB

Download
memory/856-16-0x000000001B1D0000-0x000000001B250000-memory.dmp

Filesize
512KB

Download
memory/856-18-0x000000001B1D0000-0x000000001B250000-memory.dmp

Filesize
512KB

Download
memory/856-300-0x00000000021E0000-0x00000000021EA000-memory.dmp

Filesize
40KB

Download
memory/856-286-0x00000000021B0000-0x00000000021BC000-memory.dmp

Filesize
48KB

Download
memory/856-270-0x00000000007A0000-0x00000000007AE000-memory.dmp

Filesize
56KB

Download
memory/856-275-0x00000000007B0000-0x00000000007BA000-memory.dmp

Filesize
40KB

Download
memory/856-276-0x0000000002100000-0x000000000210A000-memory.dmp

Filesize
40KB

Download
memory/856-0-0x000007FEF5A13000-0x000007FEF5A14000-memory.dmp

Filesize
4KB

Download
memory/856-281-0x000000001B050000-0x000000001B100000-memory.dmp

Filesize
704KB

Download
memory/1216-219-0x0000000000BD0000-0x0000000000DB6000-memory.dmp

Filesize
1.9MB

Download
memory/1396-935-0x0000000001010000-0x00000000011F6000-memory.dmp

Filesize
1.9MB

Download
memory/1588-743-0x0000000001250000-0x0000000001436000-memory.dmp

Filesize
1.9MB

Download
memory/1792-269-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/1792-268-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/1792-267-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/1792-266-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2004-8-0x0000000001F40000-0x0000000001F48000-memory.dmp

Filesize
32KB

Download
memory/2004-7-0x000000001B690000-0x000000001B972000-memory.dmp

Filesize
2.9MB

Download
memory/2004-6-0x0000000002E30000-0x0000000002EB0000-memory.dmp

Filesize
512KB

Download
memory/2104-258-0x0000000000350000-0x0000000000536000-memory.dmp

Filesize
1.9MB

Download
memory/2148-259-0x0000000001180000-0x0000000001366000-memory.dmp

Filesize
1.9MB

Download
memory/2188-938-0x0000000001350000-0x0000000001536000-memory.dmp

Filesize
1.9MB

Download
memory/2204-201-0x0000000001F00000-0x0000000001F08000-memory.dmp

Filesize
32KB

Download
memory/2204-200-0x000000001B630000-0x000000001B912000-memory.dmp

Filesize
2.9MB

Download
memory/2284-298-0x0000000000160000-0x0000000000346000-memory.dmp

Filesize
1.9MB

Download
memory/2424-937-0x00000000012D0000-0x00000000014B6000-memory.dmp

Filesize
1.9MB

Download
memory/2472-257-0x0000000000F70000-0x0000000001156000-memory.dmp

Filesize
1.9MB

Download
memory/2552-264-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2660-15-0x0000000002720000-0x0000000002728000-memory.dmp

Filesize
32KB

Download
memory/2660-14-0x000000001B680000-0x000000001B962000-memory.dmp

Filesize
2.9MB

Download
memory/2840-151-0x0000000000A20000-0x0000000000A38000-memory.dmp

Filesize
96KB

Download
memory/2840-149-0x0000000000A00000-0x0000000000A1C000-memory.dmp

Filesize
112KB

Download
memory/2840-147-0x00000000004A0000-0x00000000004AE000-memory.dmp

Filesize
56KB

Download
memory/2840-145-0x00000000012F0000-0x00000000014D6000-memory.dmp

Filesize
1.9MB

Download
memory/2840-153-0x0000000000630000-0x000000000063E000-memory.dmp

Filesize
56KB

Download
memory/2840-155-0x0000000000640000-0x000000000064C000-memory.dmp

Filesize
48KB

Download
memory/2936-936-0x0000000000280000-0x0000000000466000-memory.dmp

Filesize
1.9MB

Download
memory/2944-252-0x00000000000F0000-0x00000000002D6000-memory.dmp

Filesize
1.9MB

Download