dcrat | c9f1853eb63ea24a952a37bb0a5853be5333e94097e0ff3a60474fb022e09ae7

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2024 07:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CelestialUUpdate.exe
Size

1.2MB
MD5

8b16db15e2df974f1e2d4d36934d8067
SHA1

2392ba431d064fbcdf8812056a0398e28d3985ae
SHA256

c9f1853eb63ea24a952a37bb0a5853be5333e94097e0ff3a60474fb022e09ae7
SHA512

be01dc9ca1db5dbf6399b7568b9e063adbc617dfc686f74faf648318138c9673e09e97e6922116512d1df56cb5197fb016bfe549c21b6f022493bfcde9150f29
SSDEEP

24576:2fFSkjA+SpS/h3UYU2Uq74JZXXKn4VNWF40LrBjcnbPaF/MPqoXj2:2NhfGSJUD2UqGXaHr9cn7PXC

Score

10^/10

dcrat gurcu xworm discovery evasion execution infostealer persistence rat spyware stealer trojan

Malware Config

Extracted

Family

xworm

Attributes

Install_directory
%Temp%
install_file
svchost.exe
pastebin_url
https://pastebin.com/raw/vJmE27fr
telegram
https://api.telegram.org/bot7414557379:AAHJMIrSP_hoR0jelLf8igel3SZxGY860qU/sendMessage?chat_id=2076906822

Extracted

Family

xworm

Version

3.0

plus-loves.gl.at.ply.gg:59327

Attributes

Install_directory
%AppData%
install_file
USB.exe

Extracted

Family

gurcu

https://api.telegram.org/bot7414557379:AAHJMIrSP_hoR0jelLf8igel3SZxGY860qU/sendMessage?chat_id=2076906822

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral1/memory/5080-348-0x0000000001790000-0x000000000179E000-memory.dmp	disable_win_def

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Detect Xworm Payload 15 IoCs

resource	yara_rule
behavioral1/memory/5080-6-0x00000000000B0000-0x000000000047A000-memory.dmp	family_xworm
behavioral1/memory/5080-21-0x00000000000B0000-0x000000000047A000-memory.dmp	family_xworm
behavioral1/memory/5080-102-0x00000000000B0000-0x000000000047A000-memory.dmp	family_xworm
behavioral1/memory/5080-132-0x00000000000B0000-0x000000000047A000-memory.dmp	family_xworm
behavioral1/memory/5080-133-0x00000000000B0000-0x000000000047A000-memory.dmp	family_xworm
behavioral1/files/0x0002000000021f51-139.dat	family_xworm
behavioral1/memory/996-146-0x0000000000670000-0x00000000006A4000-memory.dmp	family_xworm
behavioral1/memory/5080-155-0x00000000000B0000-0x000000000047A000-memory.dmp	family_xworm
behavioral1/memory/5080-173-0x00000000000B0000-0x000000000047A000-memory.dmp	family_xworm
behavioral1/memory/5080-209-0x00000000000B0000-0x000000000047A000-memory.dmp	family_xworm
behavioral1/memory/5080-338-0x00000000000B0000-0x000000000047A000-memory.dmp	family_xworm
behavioral1/memory/5080-349-0x00000000000B0000-0x000000000047A000-memory.dmp	family_xworm
behavioral1/memory/5080-354-0x00000000000B0000-0x000000000047A000-memory.dmp	family_xworm
behavioral1/memory/5080-360-0x00000000000B0000-0x000000000047A000-memory.dmp	family_xworm
behavioral1/memory/5080-390-0x00000000000B0000-0x000000000047A000-memory.dmp	family_xworm

Gurcu family
gurcu
Gurcu, WhiteSnake
Gurcu aka WhiteSnake is a malware stealer written in C#.
stealer gurcu

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\csrss.exe\""	hyperSurrogateagentCrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\csrss.exe\", \"C:\\Program Files\\Windows Multimedia Platform\\dwm.exe\""	hyperSurrogateagentCrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\csrss.exe\", \"C:\\Program Files\\Windows Multimedia Platform\\dwm.exe\", \"C:\\Windows\\IME\\IMEKR\\HELP\\csrss.exe\""	hyperSurrogateagentCrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\csrss.exe\", \"C:\\Program Files\\Windows Multimedia Platform\\dwm.exe\", \"C:\\Windows\\IME\\IMEKR\\HELP\\csrss.exe\", \"C:\\Users\\Default User\\dllhost.exe\""	hyperSurrogateagentCrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\csrss.exe\", \"C:\\Program Files\\Windows Multimedia Platform\\dwm.exe\", \"C:\\Windows\\IME\\IMEKR\\HELP\\csrss.exe\", \"C:\\Users\\Default User\\dllhost.exe\", \"C:\\Windows\\Cursors\\SearchApp.exe\""	hyperSurrogateagentCrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\csrss.exe\", \"C:\\Program Files\\Windows Multimedia Platform\\dwm.exe\", \"C:\\Windows\\IME\\IMEKR\\HELP\\csrss.exe\", \"C:\\Users\\Default User\\dllhost.exe\", \"C:\\Windows\\Cursors\\SearchApp.exe\", \"C:\\HypercomponentCommon\\hyperSurrogateagentCrt.exe\""	hyperSurrogateagentCrt.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4192	2480	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4180	2480	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3784	2480	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4280	2480	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2808	2480	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4580	2480	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3988	2480	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2304	2480	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5108	2480	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4036	2480	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2908	2480	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	848	2480	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	8	2480	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1948	2480	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4776	2480	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4476	2480	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4056	2480	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3132	2480	schtasks.exe	86

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	CelestialUUpdate.exe

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4328	powershell.exe
3492	powershell.exe
3388	powershell.exe
2036	powershell.exe
4844	powershell.exe
1160	powershell.exe
4532	powershell.exe
5072	powershell.exe
1184	powershell.exe
1176	powershell.exe

Downloads MZ/PE file

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	hyperSurrogateagentCrt.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	0BUAX3J9JZ3IYD3.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	CelestialUUpdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	0BUAX3J9JZ3IYD3.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	NVP0L8BM1PYH1JK.exe

Drops startup file 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	CelestialUUpdate.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0BUAX3J9JZ3IYD3.lnk	0BUAX3J9JZ3IYD3.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0BUAX3J9JZ3IYD3.lnk	0BUAX3J9JZ3IYD3.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	CelestialUUpdate.exe

Executes dropped EXE 9 IoCs

pid	Process
996	0BUAX3J9JZ3IYD3.exe
632	NVP0L8BM1PYH1JK.exe
3080	hyperSurrogateagentCrt.exe
512	0BUAX3J9JZ3IYD3.exe
936	svchost.exe
2928	dllhost.exe
3244	0BUAX3J9JZ3IYD3.exe
4280	0BUAX3J9JZ3IYD3.exe.exe
2564	csrss.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 14 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\IME\\IMEKR\\HELP\\csrss.exe\""	hyperSurrogateagentCrt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Windows\\Cursors\\SearchApp.exe\""	hyperSurrogateagentCrt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\svchost.exe"	CelestialUUpdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\Default User\\csrss.exe\""	hyperSurrogateagentCrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\Default User\\csrss.exe\""	hyperSurrogateagentCrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files\\Windows Multimedia Platform\\dwm.exe\""	hyperSurrogateagentCrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\IME\\IMEKR\\HELP\\csrss.exe\""	hyperSurrogateagentCrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Users\\Default User\\dllhost.exe\""	hyperSurrogateagentCrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hyperSurrogateagentCrt = "\"C:\\HypercomponentCommon\\hyperSurrogateagentCrt.exe\""	hyperSurrogateagentCrt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\0BUAX3J9JZ3IYD3 = "C:\\Users\\Admin\\AppData\\Roaming\\0BUAX3J9JZ3IYD3.exe"	0BUAX3J9JZ3IYD3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files\\Windows Multimedia Platform\\dwm.exe\""	hyperSurrogateagentCrt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Users\\Default User\\dllhost.exe\""	hyperSurrogateagentCrt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hyperSurrogateagentCrt = "\"C:\\HypercomponentCommon\\hyperSurrogateagentCrt.exe\""	hyperSurrogateagentCrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Windows\\Cursors\\SearchApp.exe\""	hyperSurrogateagentCrt.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
36	pastebin.com
37	pastebin.com
51	raw.githubusercontent.com
52	raw.githubusercontent.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
20	ip-api.com

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSCA5F53F5039764D8684A947C413FCEC9.TMP	csc.exe
File created	\??\c:\Windows\System32\lhkpi-.exe	csc.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 13 IoCs

pid	Process
5080	CelestialUUpdate.exe
5080	CelestialUUpdate.exe
5080	CelestialUUpdate.exe
5080	CelestialUUpdate.exe
5080	CelestialUUpdate.exe
5080	CelestialUUpdate.exe
5080	CelestialUUpdate.exe
5080	CelestialUUpdate.exe
5080	CelestialUUpdate.exe
5080	CelestialUUpdate.exe
5080	CelestialUUpdate.exe
5080	CelestialUUpdate.exe
5080	CelestialUUpdate.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Multimedia Platform\dwm.exe	hyperSurrogateagentCrt.exe
File created	C:\Program Files\Windows Multimedia Platform\6cb0b6c459d5d3	hyperSurrogateagentCrt.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\IME\IMEKR\HELP\886983d96e3d3e	hyperSurrogateagentCrt.exe
File created	C:\Windows\Cursors\SearchApp.exe	hyperSurrogateagentCrt.exe
File opened for modification	C:\Windows\Cursors\SearchApp.exe	hyperSurrogateagentCrt.exe
File created	C:\Windows\Cursors\38384e6a620884	hyperSurrogateagentCrt.exe
File created	C:\Windows\IME\IMEKR\HELP\csrss.exe	hyperSurrogateagentCrt.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CelestialUUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NVP0L8BM1PYH1JK.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4876	PING.EXE

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	hyperSurrogateagentCrt.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	NVP0L8BM1PYH1JK.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4876	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 20 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2304	schtasks.exe
4776	schtasks.exe
4476	schtasks.exe
2808	schtasks.exe
2304	schtasks.exe
848	schtasks.exe
3132	schtasks.exe
4056	schtasks.exe
2564	schtasks.exe
4280	schtasks.exe
4580	schtasks.exe
3988	schtasks.exe
1948	schtasks.exe
2908	schtasks.exe
8	schtasks.exe
4192	schtasks.exe
4180	schtasks.exe
3784	schtasks.exe
5108	schtasks.exe
4036	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4532	powershell.exe
4532	powershell.exe
5072	powershell.exe
5072	powershell.exe
3492	powershell.exe
3492	powershell.exe
1184	powershell.exe
1184	powershell.exe
5080	CelestialUUpdate.exe
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe
3080	hyperSurrogateagentCrt.exe
3080	hyperSurrogateagentCrt.exe
3080	hyperSurrogateagentCrt.exe
3080	hyperSurrogateagentCrt.exe
3080	hyperSurrogateagentCrt.exe
3080	hyperSurrogateagentCrt.exe
3080	hyperSurrogateagentCrt.exe
3080	hyperSurrogateagentCrt.exe
3080	hyperSurrogateagentCrt.exe
3080	hyperSurrogateagentCrt.exe
3080	hyperSurrogateagentCrt.exe
3080	hyperSurrogateagentCrt.exe
3080	hyperSurrogateagentCrt.exe
3080	hyperSurrogateagentCrt.exe
3080	hyperSurrogateagentCrt.exe
3080	hyperSurrogateagentCrt.exe
3080	hyperSurrogateagentCrt.exe
3080	hyperSurrogateagentCrt.exe
3080	hyperSurrogateagentCrt.exe
3080	hyperSurrogateagentCrt.exe
3080	hyperSurrogateagentCrt.exe
3080	hyperSurrogateagentCrt.exe
3080	hyperSurrogateagentCrt.exe
3080	hyperSurrogateagentCrt.exe
3080	hyperSurrogateagentCrt.exe
3080	hyperSurrogateagentCrt.exe
3080	hyperSurrogateagentCrt.exe
3080	hyperSurrogateagentCrt.exe
3080	hyperSurrogateagentCrt.exe
3080	hyperSurrogateagentCrt.exe
3080	hyperSurrogateagentCrt.exe
3080	hyperSurrogateagentCrt.exe
3080	hyperSurrogateagentCrt.exe
3080	hyperSurrogateagentCrt.exe
3080	hyperSurrogateagentCrt.exe
3080	hyperSurrogateagentCrt.exe
3080	hyperSurrogateagentCrt.exe
3080	hyperSurrogateagentCrt.exe
3080	hyperSurrogateagentCrt.exe
3080	hyperSurrogateagentCrt.exe
3080	hyperSurrogateagentCrt.exe
3080	hyperSurrogateagentCrt.exe
3080	hyperSurrogateagentCrt.exe

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: SeDebugPrivilege	5080	CelestialUUpdate.exe
Token: SeDebugPrivilege	4532	powershell.exe
Token: SeDebugPrivilege	5072	powershell.exe
Token: SeDebugPrivilege	3492	powershell.exe
Token: SeDebugPrivilege	1184	powershell.exe
Token: SeDebugPrivilege	5080	CelestialUUpdate.exe
Token: SeDebugPrivilege	996	0BUAX3J9JZ3IYD3.exe
Token: SeDebugPrivilege	996	0BUAX3J9JZ3IYD3.exe
Token: SeDebugPrivilege	2840	taskmgr.exe
Token: SeSystemProfilePrivilege	2840	taskmgr.exe
Token: SeCreateGlobalPrivilege	2840	taskmgr.exe
Token: 33	2840	taskmgr.exe
Token: SeIncBasePriorityPrivilege	2840	taskmgr.exe
Token: SeDebugPrivilege	512	0BUAX3J9JZ3IYD3.exe
Token: SeDebugPrivilege	3080	hyperSurrogateagentCrt.exe
Token: SeDebugPrivilege	1176	powershell.exe
Token: SeDebugPrivilege	1160	powershell.exe
Token: SeDebugPrivilege	3388	powershell.exe
Token: SeDebugPrivilege	2036	powershell.exe
Token: SeDebugPrivilege	4328	powershell.exe
Token: SeDebugPrivilege	4844	powershell.exe
Token: 33	3480	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3480	AUDIODG.EXE
Token: 33	5080	CelestialUUpdate.exe
Token: SeIncBasePriorityPrivilege	5080	CelestialUUpdate.exe
Token: SeDebugPrivilege	2928	dllhost.exe
Token: SeDebugPrivilege	4280	0BUAX3J9JZ3IYD3.exe.exe
Token: SeDebugPrivilege	2564	csrss.exe

Suspicious use of FindShellTrayWindow 38 IoCs

pid	Process
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe

Suspicious use of SendNotifyMessage 38 IoCs

pid	Process
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe
2840	taskmgr.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5080	CelestialUUpdate.exe
5080	CelestialUUpdate.exe
936	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5080 wrote to memory of 4532	5080	CelestialUUpdate.exe	90
PID 5080 wrote to memory of 4532	5080	CelestialUUpdate.exe	90
PID 5080 wrote to memory of 4532	5080	CelestialUUpdate.exe	90
PID 5080 wrote to memory of 5072	5080	CelestialUUpdate.exe	94
PID 5080 wrote to memory of 5072	5080	CelestialUUpdate.exe	94
PID 5080 wrote to memory of 5072	5080	CelestialUUpdate.exe	94
PID 5080 wrote to memory of 3492	5080	CelestialUUpdate.exe	96
PID 5080 wrote to memory of 3492	5080	CelestialUUpdate.exe	96
PID 5080 wrote to memory of 3492	5080	CelestialUUpdate.exe	96
PID 5080 wrote to memory of 1184	5080	CelestialUUpdate.exe	98
PID 5080 wrote to memory of 1184	5080	CelestialUUpdate.exe	98
PID 5080 wrote to memory of 1184	5080	CelestialUUpdate.exe	98
PID 5080 wrote to memory of 2564	5080	CelestialUUpdate.exe	100
PID 5080 wrote to memory of 2564	5080	CelestialUUpdate.exe	100
PID 5080 wrote to memory of 2564	5080	CelestialUUpdate.exe	100
PID 5080 wrote to memory of 996	5080	CelestialUUpdate.exe	102
PID 5080 wrote to memory of 996	5080	CelestialUUpdate.exe	102
PID 996 wrote to memory of 2304	996	0BUAX3J9JZ3IYD3.exe	103
PID 996 wrote to memory of 2304	996	0BUAX3J9JZ3IYD3.exe	103
PID 5080 wrote to memory of 632	5080	CelestialUUpdate.exe	106
PID 5080 wrote to memory of 632	5080	CelestialUUpdate.exe	106
PID 5080 wrote to memory of 632	5080	CelestialUUpdate.exe	106
PID 632 wrote to memory of 3040	632	NVP0L8BM1PYH1JK.exe	107
PID 632 wrote to memory of 3040	632	NVP0L8BM1PYH1JK.exe	107
PID 632 wrote to memory of 3040	632	NVP0L8BM1PYH1JK.exe	107
PID 3040 wrote to memory of 2292	3040	WScript.exe	108
PID 3040 wrote to memory of 2292	3040	WScript.exe	108
PID 3040 wrote to memory of 2292	3040	WScript.exe	108
PID 2292 wrote to memory of 3080	2292	cmd.exe	110
PID 2292 wrote to memory of 3080	2292	cmd.exe	110
PID 3080 wrote to memory of 2932	3080	hyperSurrogateagentCrt.exe	116
PID 3080 wrote to memory of 2932	3080	hyperSurrogateagentCrt.exe	116
PID 2932 wrote to memory of 3844	2932	csc.exe	118
PID 2932 wrote to memory of 3844	2932	csc.exe	118
PID 3080 wrote to memory of 3028	3080	hyperSurrogateagentCrt.exe	119
PID 3080 wrote to memory of 3028	3080	hyperSurrogateagentCrt.exe	119
PID 3028 wrote to memory of 4232	3028	csc.exe	121
PID 3028 wrote to memory of 4232	3028	csc.exe	121
PID 3080 wrote to memory of 5036	3080	hyperSurrogateagentCrt.exe	122
PID 3080 wrote to memory of 5036	3080	hyperSurrogateagentCrt.exe	122
PID 5036 wrote to memory of 3168	5036	csc.exe	124
PID 5036 wrote to memory of 3168	5036	csc.exe	124
PID 3080 wrote to memory of 4844	3080	hyperSurrogateagentCrt.exe	140
PID 3080 wrote to memory of 4844	3080	hyperSurrogateagentCrt.exe	140
PID 3080 wrote to memory of 3388	3080	hyperSurrogateagentCrt.exe	141
PID 3080 wrote to memory of 3388	3080	hyperSurrogateagentCrt.exe	141
PID 3080 wrote to memory of 2036	3080	hyperSurrogateagentCrt.exe	142
PID 3080 wrote to memory of 2036	3080	hyperSurrogateagentCrt.exe	142
PID 3080 wrote to memory of 1160	3080	hyperSurrogateagentCrt.exe	143
PID 3080 wrote to memory of 1160	3080	hyperSurrogateagentCrt.exe	143
PID 3080 wrote to memory of 4328	3080	hyperSurrogateagentCrt.exe	144
PID 3080 wrote to memory of 4328	3080	hyperSurrogateagentCrt.exe	144
PID 3080 wrote to memory of 1176	3080	hyperSurrogateagentCrt.exe	145
PID 3080 wrote to memory of 1176	3080	hyperSurrogateagentCrt.exe	145
PID 3080 wrote to memory of 2272	3080	hyperSurrogateagentCrt.exe	152
PID 3080 wrote to memory of 2272	3080	hyperSurrogateagentCrt.exe	152
PID 2272 wrote to memory of 2556	2272	cmd.exe	154
PID 2272 wrote to memory of 2556	2272	cmd.exe	154
PID 2272 wrote to memory of 4876	2272	cmd.exe	155
PID 2272 wrote to memory of 4876	2272	cmd.exe	155
PID 2272 wrote to memory of 2928	2272	cmd.exe	157
PID 2272 wrote to memory of 2928	2272	cmd.exe	157
PID 3244 wrote to memory of 4280	3244	0BUAX3J9JZ3IYD3.exe	159
PID 3244 wrote to memory of 4280	3244	0BUAX3J9JZ3IYD3.exe	159

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system	CelestialUUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	CelestialUUpdate.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\CelestialUUpdate.exe
"C:\Users\Admin\AppData\Local\Temp\CelestialUUpdate.exe"
1⤵
- UAC bypass
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5080
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\CelestialUUpdate.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4532
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'CelestialUUpdate.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5072
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\svchost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3492
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1184
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2564
- C:\Users\Admin\AppData\Local\Temp\0BUAX3J9JZ3IYD3.exe
  "C:\Users\Admin\AppData\Local\Temp\0BUAX3J9JZ3IYD3.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:996
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "0BUAX3J9JZ3IYD3" /tr "C:\Users\Admin\AppData\Roaming\0BUAX3J9JZ3IYD3.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2304
- C:\Users\Admin\AppData\Local\Temp\NVP0L8BM1PYH1JK.exe
  "C:\Users\Admin\AppData\Local\Temp\NVP0L8BM1PYH1JK.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:632
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\HypercomponentCommon\I1SNCaG9QwHssjsi1vS2b9DJmZMoJ4clEjNn.vbe"
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3040
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\HypercomponentCommon\cemEzm0xYx1.bat" "
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2292
    - - C:\HypercomponentCommon\hyperSurrogateagentCrt.exe
        
        "C:\HypercomponentCommon/hyperSurrogateagentCrt.exe"
        5⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        Drops file in Windows directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3080
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\sn1prmyf\sn1prmyf.cmdline"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2932
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEC11.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCC3EA945744C447C79F44E2A9FC8F74B.TMP"
        7⤵
        
        PID:3844
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0vwrv3li\0vwrv3li.cmdline"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3028
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESECBC.tmp" "c:\Users\Admin\AppData\Roaming\CSCC974A3527B604F0E8223FB716172E372.TMP"
        7⤵
        
        PID:4232
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\l5o0zyu3\l5o0zyu3.cmdline"
        6⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5036
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESED78.tmp" "c:\Windows\System32\CSCA5F53F5039764D8684A947C413FCEC9.TMP"
        7⤵
        
        PID:3168
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\csrss.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4844
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Multimedia Platform\dwm.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3388
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\IME\IMEKR\HELP\csrss.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2036
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\dllhost.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1160
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Cursors\SearchApp.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4328
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\HypercomponentCommon\hyperSurrogateagentCrt.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1176
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\1kED3mIfc1.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2272
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:2556
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4876
        
        C:\Users\Default User\dllhost.exe
        
        "C:\Users\Default User\dllhost.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2928

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2840

C:\Users\Admin\AppData\Roaming\0BUAX3J9JZ3IYD3.exe
C:\Users\Admin\AppData\Roaming\0BUAX3J9JZ3IYD3.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:512

C:\Users\Admin\AppData\Local\Temp\svchost.exe
C:\Users\Admin\AppData\Local\Temp\svchost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default User\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Multimedia Platform\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Multimedia Platform\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Windows\IME\IMEKR\HELP\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\IME\IMEKR\HELP\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Windows\IME\IMEKR\HELP\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Default User\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 9 /tr "'C:\Windows\Cursors\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:8

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Windows\Cursors\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 7 /tr "'C:\Windows\Cursors\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "hyperSurrogateagentCrth" /sc MINUTE /mo 13 /tr "'C:\HypercomponentCommon\hyperSurrogateagentCrt.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "hyperSurrogateagentCrt" /sc ONLOGON /tr "'C:\HypercomponentCommon\hyperSurrogateagentCrt.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "hyperSurrogateagentCrth" /sc MINUTE /mo 10 /tr "'C:\HypercomponentCommon\hyperSurrogateagentCrt.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3132

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x320 0x49c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3480

C:\Users\Admin\AppData\Roaming\0BUAX3J9JZ3IYD3.exe
C:\Users\Admin\AppData\Roaming\0BUAX3J9JZ3IYD3.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3244
- C:\Users\Admin\AppData\Roaming\0BUAX3J9JZ3IYD3.exe.exe
  "C:\Users\Admin\AppData\Roaming\0BUAX3J9JZ3IYD3.exe.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4280
- C:\Users\Default User\csrss.exe
  "C:\Users\Default User\csrss.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\HypercomponentCommon\I1SNCaG9QwHssjsi1vS2b9DJmZMoJ4clEjNn.vbe

Filesize
220B

MD5
47085bdd4e3087465355c9bb9bbc6005

SHA1
bf0c5b11c20beca45cc9d4298f2a11a16c793a61

SHA256
80577e4666fad86273b01f60b8d63c15e4ce37774575ac1e0df7a7c396979752

SHA512
e74dd8e9756cab1123410a46609dc91540cc29a8fea93017155746f7bb9b7a41bfd3d7595a62788264bedceb475b2a733cce9b70f37cc4478302d5fc228d7684

Download Submit
C:\HypercomponentCommon\cemEzm0xYx1.bat

Filesize
105B

MD5
5ee2935a1949f69f67601f7375b3e8a3

SHA1
6a3229f18db384e57435bd3308298da56aa8c404

SHA256
c24a0d7f53a7aa3437f6b6566d3aaebdb36053b64e72cbd1d3796596fc8e3c06

SHA512
9777fcb9ee8a8aa0c770c835c5f30aff6efc5fb16a1819047e13d580d748703ffcb446db110067fb2546a637213cb8f25416d4b621a95a789b8e113d31d3401a

Download Submit
C:\HypercomponentCommon\hyperSurrogateagentCrt.exe

Filesize
1.9MB

MD5
7be5cea1c84ad0b2a6d2e5b6292c8d80

SHA1
631e3de0fe83ebacbe5be4e7f895dd0bd8b095ce

SHA256
6eb90684ebc56fb2713f5c468b55a964625ec2af698d9687492b1de4225693b7

SHA512
ea58d3b1664fe70968635c2722e19ce65ce4c1d66c68aed2d98441e60e773c7295f18d9c99cf4c454c510f33f5e37d3d2c0053b7434a46c542a0d63a4cc03647

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\0BUAX3J9JZ3IYD3.exe.log

Filesize
654B

MD5
2ff39f6c7249774be85fd60a8f9a245e

SHA1
684ff36b31aedc1e587c8496c02722c6698c1c4e

SHA256
e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

SHA512
1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
968cb9309758126772781b83adb8a28f

SHA1
8da30e71accf186b2ba11da1797cf67f8f78b47c

SHA256
92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

SHA512
4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
db79c02487e55e4a25461c1cffa86142

SHA1
d06772740760ffa63b46b4bf703e7f661d5636ea

SHA256
aeda78ac6f052c69cf90b36ca9db027ec1d88decdc1c6ba8d10188c5d87f8ccd

SHA512
ce9c72c4439ca1fe8992bc4552c154f10ce9983ba935a266a4893a53505a1cc6fb10d9b16e408eb91e76bc7e67b15154cbd2df7e69f1957bf661f3ecf1a8e25f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
b5b9d8c0daa52dd85542ff293e4420f0

SHA1
d3692af3184069672e5332b4c9b9b5d3aae8e1ee

SHA256
1093c70819a9e21c757a5bae6b35e263f54ec04fdb95a4ddbf9b46b4cb9b37c0

SHA512
e3031a9d05edb7c4ce54febbe4a13f9c55aef8d410d960aeb21657df3bfb1e1589956e0772029d3f29392b7f0ca148089276c568b11888866c5d6ad9327e4607

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
9b80cd7a712469a4c45fec564313d9eb

SHA1
6125c01bc10d204ca36ad1110afe714678655f2d

SHA256
5a9e4969c6cdb5d522c81ce55799effb7255c1b0a9966a936d1dc3ff8fe2112d

SHA512
ac280d2623c470c9dec94726a7af0612938723f3c7d60d727eb3c21f17be2f2049f97bc8303558be8b01f94406781ece0ada9a3bc51e930aff20bebb6ca17584

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
4bbd928b17b5313210c9bee04bf2b47d

SHA1
7a9b942093ebf7d03b0feba2d71f19aef6d38066

SHA256
1b69e66865c4ff207ac178cacb3e156671d7dfb2d149438ab2057eb2b9a8886f

SHA512
e7279c7b60d4c7b31b3e555b51934ceb712ccd199cfc359b3a545dbabc67a6fc07a5ab1ff0a02f3f9a323518a345aea7699cc1082e2c4600039afb76065f0ddc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
a3b559e6f6cc152ef75fa209fd3868a7

SHA1
a05e52e1a71c3419268327c7a12e89ca65f1d1f4

SHA256
8c872097198a1bb0891cc47e8413f6efed69235fe96bec148009a97535f6c810

SHA512
c510d10b84d408275a253f2d07527242db5d455756064ca3dfa90cef59e65c6e89be571a67ef127942212c6628a563e1604f54c765e4136770c0595265d35b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\0BUAX3J9JZ3IYD3.exe

Filesize
185KB

MD5
e0c8976957ffdc4fe5555adbe8cb0d0c

SHA1
226a764bacfa17b92131993aa85fe63f1dbf347c

SHA256
b8260ac46e03f2a7baa9ae01bee5443d16d9eb96f6ee8588a887d6de72a750d4

SHA512
3a1ea48e81ebfd5586938a72afd68bcc48d4c5d69949cfdacf33aee3371d98f202443f5db12bac876ca7cecc982ddc56827f8d9b1857d22bda71242d5b2cc71e

Download Submit
C:\Users\Admin\AppData\Local\Temp\1kED3mIfc1.bat

Filesize
161B

MD5
bf53af7938694366ee5cbc0869eca35c

SHA1
7908abe6ffd69cbfcef1feb42c3395adbc21d46d

SHA256
188718ec49dcf3ba2dfad5f8f5869adb9c6f9a0b44eac36f2813d5d8b37698bd

SHA512
4affc2cc1c8e1d8ed65ac11b99ac08254ce87d5bc307ce20fd764cdd93fb12be0dafd4e0fb64d3fca292c017e31467073caa289239f22a0e4caeabee2bc0317f

Download Submit
C:\Users\Admin\AppData\Local\Temp\NVP0L8BM1PYH1JK.exe

Filesize
2.2MB

MD5
05d87a4a162784fd5256f4118aff32af

SHA1
484ed03930ed6a60866b6f909b37ef0d852dbefd

SHA256
7e3d0dabaded78094abfac40d694eaebf861f3cb865d3835bb053d435e996950

SHA512
3d4ce511e9671d8bfa15e93d681fedd972f4fe4c09ac9cfd9653afe83e936654c88ee515a76e7ac80e8f34868802e68c6531fdea0b718029d2196ad1425981fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESEC11.tmp

Filesize
1KB

MD5
91162312cb138cffe85ba5e8b2858d2f

SHA1
cb522c2cd15cfea9c1724b87afbe575b8ac42f1f

SHA256
6aae7cf233d69f2a9935f2b48f6d1f4caf3c8d6f6d7013d14f3041ffc1a65d11

SHA512
a5a1693ac261c20364bea07a14b5a14c8f1811edff80fae7475b96a0c3b60bfca8398bc2a8ebbd12a4aa870dc2aa3f30f8606865c1d20405a0d0d2aef65ec07d

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESECBC.tmp

Filesize
1KB

MD5
f40b8f0468286b22a9d278a5dfcfe975

SHA1
4cdef2992e99dac1701302923d80f1a20f0e5d48

SHA256
4690ec012f1370e23e7227b1d229351184478fc2d0e0bcc7702ba438643fa0a0

SHA512
ed65d5e65892f5eee7b9a554c10da1d86bdf51100b43f3a25acae6f78c7d7199870a9bef3d2f291bbb295a57911c752d1cd2bc0807ca5e19a2225e0cadf8b29d

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESED78.tmp

Filesize
1KB

MD5
5b04e17ff871f26895ebd2a77a9fb4fb

SHA1
81e7ae7ce34969fba07a48a45c54933769b34a69

SHA256
6b5b5d300f0779b2f9a5edcde8256044a71d1e3ef3db1fd1ba12be5f93c96d29

SHA512
2f2e071a6cd38624a8d6d56fba8690a7537d6fdd9b520bf46063e57e322ff5414c0c44493b1e76f7b2670075c6c53a863d1cd08038e9d8af1c872ff1d0883166

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wcdsujz5.vtn.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\svchost.exe

Filesize
4KB

MD5
39dd806e4d095eace0864e999b72aaad

SHA1
24e6e3a8482345c320c5d4da30b1612dade25e29

SHA256
0cea5dfebc17a2c3320bf215f451b465d282fb1fb7ed08beba49e6f14ca424be

SHA512
f2eb710ba30354fe5b062ecf5693eb573809a0bfb62909710604348cf7ce9c267857dad82fb103709fd3a1d71f91d9a4c4bccfc0323031a1486daff412d59e07

Download Submit
C:\Users\Admin\AppData\Local\Temp\svchost.exe

Filesize
1.2MB

MD5
8b16db15e2df974f1e2d4d36934d8067

SHA1
2392ba431d064fbcdf8812056a0398e28d3985ae

SHA256
c9f1853eb63ea24a952a37bb0a5853be5333e94097e0ff3a60474fb022e09ae7

SHA512
be01dc9ca1db5dbf6399b7568b9e063adbc617dfc686f74faf648318138c9673e09e97e6922116512d1df56cb5197fb016bfe549c21b6f022493bfcde9150f29

Download Submit
C:\Users\Admin\AppData\Roaming\0BUAX3J9JZ3IYD3.exe

Filesize
4KB

MD5
1536d3bbb312f089cf775fb32ae44736

SHA1
ca7c1d6474f0f224f6dfc9a6f651c4280ac903b5

SHA256
81baddd42a66f23e0fd17ac6f9505b07e739a520e911165dac069aa1f50474de

SHA512
4f4e8b090112065002f7975cf89328b74a8e22b6e603e35936fdbfec460136bc3a9b433af6f1dbc5cc3ca04d2d8936266b0789d81e93e214882c8ba71ab42cd5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0BUAX3J9JZ3IYD3.lnk

Filesize
813B

MD5
2a735b39fb482c5f3e40e5e5d3df0704

SHA1
faefdd0ad730bf2ab0d6b3d2008c266491bd766c

SHA256
d26fff6d488d9db8515e4693e118225aab0ec83a2bf6393028e17ba962fa34e7

SHA512
51a9d99876539445deb35c0d2bf525c20b96d17975c838d743b51111058032d5021a961c5e26ec37c267b7032147b638dc0fd6e7340d38d133a31d97ee5a65e6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk

Filesize
1KB

MD5
f753cf98382ebcaaa3968554cf0275c1

SHA1
17f6778e9c5caa488043c721643c13567fe694b5

SHA256
fdb17edacafb79a994fde88d259f6c2533308ec9725360dd8f62675474de19c6

SHA512
85b6d299cf1f292848ff78282fd1a869b6b2860ada578bf7bea0c82478c91c98fb6351d725ffac100ecab1fae3856508e1f316271d5267f0e86067df59a18bf4

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\0vwrv3li\0vwrv3li.0.cs

Filesize
383B

MD5
f1146ec1965975f5d64e9dd03b0bb277

SHA1
53da36e6b2607ffc97418af0805123ca8168f103

SHA256
48d57df93e56a2f05ae0c4201140865f1b6f52bec35fb15f265f23593530fe02

SHA512
1d212a49d48b80994fe10cd96593db771550de2cadb005b46eb3a49bed4c9cafe3332b55a3c4c3ea2c5c010d48eec0c7d675c46ae93c417e1ad48198c989ca9b

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\0vwrv3li\0vwrv3li.cmdline

Filesize
255B

MD5
7276b24c37d0b26d767fc073cbb40fdb

SHA1
ce2f9831cf3f2bb5129e118e8797d4e2d7acad75

SHA256
9621f48953b6c8214f26270e73c3865fdba5edd84c8dab0074a842c27cd89bef

SHA512
736988d8b29d434f7663a6099383d33912730358591c86cfbf4d49cd26a8042c4055d49130e29747cfc737201f8dab96628a529a813695998c9a9d0766e0ac77

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSCC3EA945744C447C79F44E2A9FC8F74B.TMP

Filesize
1KB

MD5
b10290e193d94a5e3c95660f0626a397

SHA1
7b9de1fd7a43f6f506e5fc3426836b8c52d0d711

SHA256
75c9e1766bfb99754b6a00d37ef93488ab216b5ac48984ed7d9d2076a7056fd2

SHA512
6ae4201552a499eaa726416b29230f48d94ac7f40ff038165bf8582626bbefe601ef6c051ad97d9156dc4b9b55fd22081db61bcd013916136340c5f1324e4bb5

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\l5o0zyu3\l5o0zyu3.0.cs

Filesize
363B

MD5
b295dbbb746240c47928ae47530f2d8e

SHA1
801c9069a320e40d06418693877f13e75cb4dafc

SHA256
a83a4fbadb6a5d97e3f78ef2211a3506a7b3ceb19c2bc9b8e9c4430efcf236e8

SHA512
aef1925973a478312215fee3ad5dba7aa48ca783aff09a9ce37d7e3f85c2cb7cdeebac4994be4319462ca84ee7636480a01b546623a16392cc7855338d4ba25e

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\l5o0zyu3\l5o0zyu3.cmdline

Filesize
235B

MD5
6049ad04af0783d645efd780d2108374

SHA1
db3afe3166fdd533ca712753bee2b81c1217e06a

SHA256
d4c4e677bd704121d2aabaa7b8260e115b546e358db5e70f44da210f9481e392

SHA512
55332776a1f496b2691559d329f174cf63945e0595127de68247767850a53bb4e60ab2f9e2560d50dc737bf81818815a535e2d7d895c18b6c839b4c019670943

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\sn1prmyf\sn1prmyf.0.cs

Filesize
378B

MD5
16af4e6e1a48abe4cd20f7d0fb0e239a

SHA1
4764a18279f67612b360d3d3d5790dc83a973674

SHA256
d1cf4c164535ab206e03083140815bfeb77870f983c56f0e1d38790fb6925d61

SHA512
0aa40193e7a991e0524e3f0d07791b9e8ac75611df8bf50feb22ddf5ecdc86dc2a3e0f60dbd98f9eac45e269e8f90c9f2286b26f4134e002d0e794f05cf3e51a

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\sn1prmyf\sn1prmyf.cmdline

Filesize
250B

MD5
29e1ac4650344f3027e51a827e972d5a

SHA1
95fc843e0c1f20d78ed891cfec23450ae7d0fa1a

SHA256
601e2fe3ce43aa870e1337680a31e34da3409ba1b6e75c94741b885a7dcdabf9

SHA512
ae8ca5905d46784ffea8dfbff86abc6b88dc3059e3ba3f8660ceab509cb94ae9997d01a02f4dd6763a53c3f8e127f5883d3cd19e09fd77d34d31139ac15c79ec

Download Submit
\??\c:\Users\Admin\AppData\Roaming\CSCC974A3527B604F0E8223FB716172E372.TMP

Filesize
1KB

MD5
3b7f2749ae25edd24732ae71b6f393ad

SHA1
5b22a61633313f21a6aa44701f1f2164b2d1ab46

SHA256
8538988d65ad020e3445cbc188f1d1bef7e391579730606d657b5c17298732a4

SHA512
a43fa581085bc08ddb306f9c674613c763b921c5532c71737351a405c5420fcb597cdd6fb5683d72e2cc2bd4c0e55201c65f8aad78f57b8dbe61ad9d6998a755

Download Submit
\??\c:\Windows\System32\CSCA5F53F5039764D8684A947C413FCEC9.TMP

Filesize
1KB

MD5
75e32610d8ef6143201c7c28465fcda9

SHA1
b2bae99fade2dda07aecbe1659d184be0fc4e7a6

SHA256
97ee1cac3965d9cc55a60f20206f384719431f19ac96bdc52b93a98de51a639b

SHA512
b303fb99586efd19a08223ba93472fa6d33fcf9198bbf42fb16ba61001db59e5fd5835ea7696ed34e4004d23fa60697e724e6085d1269d788204bf95dfe46abc

Download Submit
memory/936-197-0x0000000000250000-0x000000000061A000-memory.dmp

Filesize
3.8MB

Download
memory/936-337-0x0000000000250000-0x000000000061A000-memory.dmp

Filesize
3.8MB

Download
memory/996-146-0x0000000000670000-0x00000000006A4000-memory.dmp

Filesize
208KB

Download
memory/1176-270-0x000002D2FAB40000-0x000002D2FAB62000-memory.dmp

Filesize
136KB

Download
memory/1184-114-0x000000006FBF0000-0x000000006FC3C000-memory.dmp

Filesize
304KB

Download
memory/1184-112-0x0000000005B30000-0x0000000005E84000-memory.dmp

Filesize
3.3MB

Download
memory/2840-167-0x0000028691160000-0x0000028691161000-memory.dmp

Filesize
4KB

Download
memory/2840-156-0x0000028691160000-0x0000028691161000-memory.dmp

Filesize
4KB

Download
memory/2840-162-0x0000028691160000-0x0000028691161000-memory.dmp

Filesize
4KB

Download
memory/2840-164-0x0000028691160000-0x0000028691161000-memory.dmp

Filesize
4KB

Download
memory/2840-163-0x0000028691160000-0x0000028691161000-memory.dmp

Filesize
4KB

Download
memory/2840-165-0x0000028691160000-0x0000028691161000-memory.dmp

Filesize
4KB

Download
memory/2840-166-0x0000028691160000-0x0000028691161000-memory.dmp

Filesize
4KB

Download
memory/2840-168-0x0000028691160000-0x0000028691161000-memory.dmp

Filesize
4KB

Download
memory/2840-157-0x0000028691160000-0x0000028691161000-memory.dmp

Filesize
4KB

Download
memory/2840-158-0x0000028691160000-0x0000028691161000-memory.dmp

Filesize
4KB

Download
memory/2928-350-0x000000001C580000-0x000000001C5EB000-memory.dmp

Filesize
428KB

Download
memory/3080-204-0x000000001B1A0000-0x000000001B1B8000-memory.dmp

Filesize
96KB

Download
memory/3080-263-0x000000001C180000-0x000000001C1EB000-memory.dmp

Filesize
428KB

Download
memory/3080-208-0x000000001B120000-0x000000001B12C000-memory.dmp

Filesize
48KB

Download
memory/3080-206-0x000000001B110000-0x000000001B11E000-memory.dmp

Filesize
56KB

Download
memory/3080-202-0x000000001BDF0000-0x000000001BE40000-memory.dmp

Filesize
320KB

Download
memory/3080-201-0x000000001B180000-0x000000001B19C000-memory.dmp

Filesize
112KB

Download
memory/3080-199-0x000000001B100000-0x000000001B10E000-memory.dmp

Filesize
56KB

Download
memory/3080-195-0x0000000000370000-0x0000000000556000-memory.dmp

Filesize
1.9MB

Download
memory/3244-397-0x00000000007C0000-0x00000000007C8000-memory.dmp

Filesize
32KB

Download
memory/3492-91-0x000000006FBF0000-0x000000006FC3C000-memory.dmp

Filesize
304KB

Download
memory/4532-43-0x0000000074420000-0x0000000074BD0000-memory.dmp

Filesize
7.7MB

Download
memory/4532-44-0x0000000006DE0000-0x0000000006E83000-memory.dmp

Filesize
652KB

Download
memory/4532-53-0x0000000007230000-0x0000000007238000-memory.dmp

Filesize
32KB

Download
memory/4532-56-0x0000000074420000-0x0000000074BD0000-memory.dmp

Filesize
7.7MB

Download
memory/4532-32-0x0000000074420000-0x0000000074BD0000-memory.dmp

Filesize
7.7MB

Download
memory/4532-52-0x0000000007250000-0x000000000726A000-memory.dmp

Filesize
104KB

Download
memory/4532-10-0x0000000000A40000-0x0000000000A76000-memory.dmp

Filesize
216KB

Download
memory/4532-49-0x0000000007110000-0x0000000007121000-memory.dmp

Filesize
68KB

Download
memory/4532-48-0x0000000007190000-0x0000000007226000-memory.dmp

Filesize
600KB

Download
memory/4532-47-0x0000000006F80000-0x0000000006F8A000-memory.dmp

Filesize
40KB

Download
memory/4532-11-0x0000000074420000-0x0000000074BD0000-memory.dmp

Filesize
7.7MB

Download
memory/4532-45-0x0000000007560000-0x0000000007BDA000-memory.dmp

Filesize
6.5MB

Download
memory/4532-46-0x0000000006F10000-0x0000000006F2A000-memory.dmp

Filesize
104KB

Download
memory/4532-28-0x0000000005C10000-0x0000000005C5C000-memory.dmp

Filesize
304KB

Download
memory/4532-30-0x00000000061C0000-0x00000000061F2000-memory.dmp

Filesize
200KB

Download
memory/4532-12-0x0000000004E00000-0x0000000005428000-memory.dmp

Filesize
6.2MB

Download
memory/4532-31-0x000000006FBF0000-0x000000006FC3C000-memory.dmp

Filesize
304KB

Download
memory/4532-13-0x0000000004D20000-0x0000000004D42000-memory.dmp

Filesize
136KB

Download
memory/4532-15-0x0000000074420000-0x0000000074BD0000-memory.dmp

Filesize
7.7MB

Download
memory/4532-14-0x0000000005520000-0x0000000005586000-memory.dmp

Filesize
408KB

Download
memory/4532-27-0x0000000005BF0000-0x0000000005C0E000-memory.dmp

Filesize
120KB

Download
memory/4532-50-0x0000000007140000-0x000000000714E000-memory.dmp

Filesize
56KB

Download
memory/4532-51-0x0000000007150000-0x0000000007164000-memory.dmp

Filesize
80KB

Download
memory/4532-26-0x0000000005600000-0x0000000005954000-memory.dmp

Filesize
3.3MB

Download
memory/4532-42-0x0000000006DC0000-0x0000000006DDE000-memory.dmp

Filesize
120KB

Download
memory/5072-68-0x0000000005AB0000-0x0000000005E04000-memory.dmp

Filesize
3.3MB

Download
memory/5072-70-0x000000006FBF0000-0x000000006FC3C000-memory.dmp

Filesize
304KB

Download
memory/5080-129-0x000000000AF30000-0x000000000B4D4000-memory.dmp

Filesize
5.6MB

Download
memory/5080-338-0x00000000000B0000-0x000000000047A000-memory.dmp

Filesize
3.8MB

Download
memory/5080-132-0x00000000000B0000-0x000000000047A000-memory.dmp

Filesize
3.8MB

Download
memory/5080-209-0x00000000000B0000-0x000000000047A000-memory.dmp

Filesize
3.8MB

Download
memory/5080-21-0x00000000000B0000-0x000000000047A000-memory.dmp

Filesize
3.8MB

Download
memory/5080-155-0x00000000000B0000-0x000000000047A000-memory.dmp

Filesize
3.8MB

Download
memory/5080-131-0x000000000AD30000-0x000000000AD3A000-memory.dmp

Filesize
40KB

Download
memory/5080-130-0x000000000ADC0000-0x000000000AE52000-memory.dmp

Filesize
584KB

Download
memory/5080-0-0x00000000000B0000-0x000000000047A000-memory.dmp

Filesize
3.8MB

Download
memory/5080-134-0x000000000AD90000-0x000000000AD9C000-memory.dmp

Filesize
48KB

Download
memory/5080-173-0x00000000000B0000-0x000000000047A000-memory.dmp

Filesize
3.8MB

Download
memory/5080-58-0x0000000074420000-0x0000000074BD0000-memory.dmp

Filesize
7.7MB

Download
memory/5080-9-0x0000000074420000-0x0000000074BD0000-memory.dmp

Filesize
7.7MB

Download
memory/5080-8-0x00000000089E0000-0x0000000008A46000-memory.dmp

Filesize
408KB

Download
memory/5080-7-0x0000000008A80000-0x0000000008B1C000-memory.dmp

Filesize
624KB

Download
memory/5080-335-0x0000000001650000-0x00000000016DE000-memory.dmp

Filesize
568KB

Download
memory/5080-6-0x00000000000B0000-0x000000000047A000-memory.dmp

Filesize
3.8MB

Download
memory/5080-29-0x000000007442E000-0x000000007442F000-memory.dmp

Filesize
4KB

Download
memory/5080-348-0x0000000001790000-0x000000000179E000-memory.dmp

Filesize
56KB

Download
memory/5080-349-0x00000000000B0000-0x000000000047A000-memory.dmp

Filesize
3.8MB

Download
memory/5080-102-0x00000000000B0000-0x000000000047A000-memory.dmp

Filesize
3.8MB

Download
memory/5080-351-0x00000000017A0000-0x00000000017D6000-memory.dmp

Filesize
216KB

Download
memory/5080-352-0x000000000A510000-0x000000000A528000-memory.dmp

Filesize
96KB

Download
memory/5080-354-0x00000000000B0000-0x000000000047A000-memory.dmp

Filesize
3.8MB

Download
memory/5080-357-0x000000000A570000-0x000000000A57A000-memory.dmp

Filesize
40KB

Download
memory/5080-5-0x000000007442E000-0x000000007442F000-memory.dmp

Filesize
4KB

Download
memory/5080-360-0x00000000000B0000-0x000000000047A000-memory.dmp

Filesize
3.8MB

Download
memory/5080-390-0x00000000000B0000-0x000000000047A000-memory.dmp

Filesize
3.8MB

Download
memory/5080-391-0x0000000009230000-0x00000000092E0000-memory.dmp

Filesize
704KB

Download
memory/5080-392-0x000000000D8D0000-0x000000000DDFC000-memory.dmp

Filesize
5.2MB

Download
memory/5080-2-0x00000000000B0000-0x000000000047A000-memory.dmp

Filesize
3.8MB

Download
memory/5080-1-0x0000000003070000-0x0000000003071000-memory.dmp

Filesize
4KB

Download
memory/5080-133-0x00000000000B0000-0x000000000047A000-memory.dmp

Filesize
3.8MB

Download
memory/5080-401-0x0000000008B70000-0x0000000008B7A000-memory.dmp

Filesize
40KB

Download
memory/5080-402-0x0000000009130000-0x0000000009152000-memory.dmp

Filesize
136KB

Download