dcrat | bcfb289b3e0680edd598f5eb375a207dc66a08a3e58ec147f93e7ae06ca3915c

Analysis

max time kernel
143s
max time network
153s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
09-12-2024 06:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CheckDevices.exe
Size

11KB
MD5

9eb20e1ab1851b5dce916482a3ba2f0a
SHA1

d68d36f4963865703b9b4f4eb7dcb8be2a024295
SHA256

bcfb289b3e0680edd598f5eb375a207dc66a08a3e58ec147f93e7ae06ca3915c
SHA512

c63ac69e515ca6dd4170aeca187ca28f59f7424f35b819f703ab31412fa87543f2120a05615b60280c5b87fa7ca676747a091551c0f623bba2229e39b344d3fd
SSDEEP

192:OrdeI2eMI8aq0/EaeHJoWpGm/+uFf/3kESosp+ygp3bZSEVJnYf+qqpO0:gfMI8aq0/EaepHGwn/UESoyU3l1Vmf++

Score

10^/10

dcrat xworm discovery execution infostealer persistence rat spyware stealer trojan

Malware Config

Extracted

Family

xworm

Attributes

Install_directory
%Temp%
install_file
svchost.exe
pastebin_url
https://pastebin.com/raw/vJmE27fr

Extracted

Family

xworm

Version

3.0

plus-loves.gl.at.ply.gg:59327

Attributes

Install_directory
%AppData%
install_file
USB.exe

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Detect Xworm Payload 4 IoCs

resource	yara_rule
behavioral1/files/0x002b0000000450d7-55.dat	family_xworm
behavioral1/memory/1624-66-0x0000000000910000-0x0000000000928000-memory.dmp	family_xworm
behavioral1/files/0x000d000000042c01-157.dat	family_xworm
behavioral1/memory/3604-167-0x0000000000DD0000-0x0000000000E04000-memory.dmp	family_xworm

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Microsoft Office\\MoUsoCoreWorker.exe\""	hyperSurrogateagentCrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Microsoft Office\\MoUsoCoreWorker.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\explorer.exe\""	hyperSurrogateagentCrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Microsoft Office\\MoUsoCoreWorker.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\explorer.exe\", \"C:\\HypercomponentCommon\\wininit.exe\""	hyperSurrogateagentCrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Microsoft Office\\MoUsoCoreWorker.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\explorer.exe\", \"C:\\HypercomponentCommon\\wininit.exe\", \"C:\\Recovery\\OEM\\BulbaZUpdate.exe\""	hyperSurrogateagentCrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Microsoft Office\\MoUsoCoreWorker.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\explorer.exe\", \"C:\\HypercomponentCommon\\wininit.exe\", \"C:\\Recovery\\OEM\\BulbaZUpdate.exe\", \"C:\\HypercomponentCommon\\dllhost.exe\""	hyperSurrogateagentCrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Microsoft Office\\MoUsoCoreWorker.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\explorer.exe\", \"C:\\HypercomponentCommon\\wininit.exe\", \"C:\\Recovery\\OEM\\BulbaZUpdate.exe\", \"C:\\HypercomponentCommon\\dllhost.exe\", \"C:\\HypercomponentCommon\\hyperSurrogateagentCrt.exe\""	hyperSurrogateagentCrt.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3500	2032	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4684	2032	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3324	2032	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5032	2032	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1072	2032	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1228	2032	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3528	2032	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2928	2032	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3736	2032	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1960	2032	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3636	2032	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3620	2032	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1920	2032	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1100	2032	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4024	2032	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4160	2032	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5068	2032	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1572	2032	schtasks.exe	83

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
972	powershell.exe
2124	powershell.exe
2524	powershell.exe
3312	powershell.exe
2104	powershell.exe
4324	powershell.exe
1468	powershell.exe
2020	powershell.exe
1152	powershell.exe
5012	powershell.exe
400	powershell.exe
4632	powershell.exe

Downloads MZ/PE file

Checks computer location settings 2 TTPs 8 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\Control Panel\International\Geo\Nation	hyperSurrogateagentCrt.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\Control Panel\International\Geo\Nation	9YYBEEKSEKF5LOF.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\Control Panel\International\Geo\Nation	CheckDevices.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\Control Panel\International\Geo\Nation	BulbaZUpdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\Control Panel\International\Geo\Nation	9YYBEEKSEKF5LOF.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\Control Panel\International\Geo\Nation	0UVX1NZ7MXEYGNT.exe

Drops startup file 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	BulbaZUpdate.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	BulbaZUpdate.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9YYBEEKSEKF5LOF.lnk	9YYBEEKSEKF5LOF.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9YYBEEKSEKF5LOF.lnk	9YYBEEKSEKF5LOF.exe

Executes dropped EXE 12 IoCs

pid	Process
1624	BulbaZUpdate.exe
4956	svchost.exe
3604	9YYBEEKSEKF5LOF.exe
1524	0UVX1NZ7MXEYGNT.exe
4520	hyperSurrogateagentCrt.exe
4612	svchost.exe
2480	svchost.exe.exe
1336	MoUsoCoreWorker.exe
2132	9YYBEEKSEKF5LOF.exe
2304	BulbaZUpdate.exe
4524	9YYBEEKSEKF5LOF.exe.exe
1228	MoUsoCoreWorker.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 14 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\svchost.exe"	BulbaZUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MoUsoCoreWorker = "\"C:\\Program Files\\Microsoft Office\\MoUsoCoreWorker.exe\""	hyperSurrogateagentCrt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Program Files (x86)\\Windows Portable Devices\\explorer.exe\""	hyperSurrogateagentCrt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BulbaZUpdate = "\"C:\\Recovery\\OEM\\BulbaZUpdate.exe\""	hyperSurrogateagentCrt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\HypercomponentCommon\\dllhost.exe\""	hyperSurrogateagentCrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\HypercomponentCommon\\wininit.exe\""	hyperSurrogateagentCrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BulbaZUpdate = "\"C:\\Recovery\\OEM\\BulbaZUpdate.exe\""	hyperSurrogateagentCrt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hyperSurrogateagentCrt = "\"C:\\HypercomponentCommon\\hyperSurrogateagentCrt.exe\""	hyperSurrogateagentCrt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\HypercomponentCommon\\wininit.exe\""	hyperSurrogateagentCrt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\9YYBEEKSEKF5LOF = "C:\\Users\\Admin\\AppData\\Roaming\\9YYBEEKSEKF5LOF.exe"	9YYBEEKSEKF5LOF.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MoUsoCoreWorker = "\"C:\\Program Files\\Microsoft Office\\MoUsoCoreWorker.exe\""	hyperSurrogateagentCrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Program Files (x86)\\Windows Portable Devices\\explorer.exe\""	hyperSurrogateagentCrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\HypercomponentCommon\\dllhost.exe\""	hyperSurrogateagentCrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hyperSurrogateagentCrt = "\"C:\\HypercomponentCommon\\hyperSurrogateagentCrt.exe\""	hyperSurrogateagentCrt.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
17	raw.githubusercontent.com
18	raw.githubusercontent.com
30	pastebin.com
31	pastebin.com
62	raw.githubusercontent.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
21	ip-api.com

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSC1DFE1F20F3F440F2BB17F82D63EB953.TMP	csc.exe
File created	\??\c:\Windows\System32\mh5keo.exe	csc.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Portable Devices\7a0fd90576e088	hyperSurrogateagentCrt.exe
File created	C:\Program Files\Microsoft Office\MoUsoCoreWorker.exe	hyperSurrogateagentCrt.exe
File created	C:\Program Files\Microsoft Office\1f93f77a7f4778	hyperSurrogateagentCrt.exe
File created	C:\Program Files (x86)\Windows Portable Devices\explorer.exe	hyperSurrogateagentCrt.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CheckDevices.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0UVX1NZ7MXEYGNT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings	0UVX1NZ7MXEYGNT.exe
Key created	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings	hyperSurrogateagentCrt.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 20 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1072	schtasks.exe
3528	schtasks.exe
3736	schtasks.exe
3636	schtasks.exe
3620	schtasks.exe
1920	schtasks.exe
1100	schtasks.exe
4684	schtasks.exe
3500	schtasks.exe
3324	schtasks.exe
1572	schtasks.exe
4812	schtasks.exe
4160	schtasks.exe
644	schtasks.exe
1228	schtasks.exe
2928	schtasks.exe
1960	schtasks.exe
4024	schtasks.exe
5068	schtasks.exe
5032	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5012	powershell.exe
5012	powershell.exe
972	powershell.exe
972	powershell.exe
4324	powershell.exe
4324	powershell.exe
1468	powershell.exe
1468	powershell.exe
2020	powershell.exe
2020	powershell.exe
400	powershell.exe
400	powershell.exe
1624	BulbaZUpdate.exe
4520	hyperSurrogateagentCrt.exe
4520	hyperSurrogateagentCrt.exe
4520	hyperSurrogateagentCrt.exe
4520	hyperSurrogateagentCrt.exe
4520	hyperSurrogateagentCrt.exe
4520	hyperSurrogateagentCrt.exe
4520	hyperSurrogateagentCrt.exe
4520	hyperSurrogateagentCrt.exe
4520	hyperSurrogateagentCrt.exe
4520	hyperSurrogateagentCrt.exe
4520	hyperSurrogateagentCrt.exe
4520	hyperSurrogateagentCrt.exe
4520	hyperSurrogateagentCrt.exe
4520	hyperSurrogateagentCrt.exe
4520	hyperSurrogateagentCrt.exe
4520	hyperSurrogateagentCrt.exe
4520	hyperSurrogateagentCrt.exe
4520	hyperSurrogateagentCrt.exe
4520	hyperSurrogateagentCrt.exe
4520	hyperSurrogateagentCrt.exe
4520	hyperSurrogateagentCrt.exe
4520	hyperSurrogateagentCrt.exe
4520	hyperSurrogateagentCrt.exe
4520	hyperSurrogateagentCrt.exe
4520	hyperSurrogateagentCrt.exe
4520	hyperSurrogateagentCrt.exe
4520	hyperSurrogateagentCrt.exe
4520	hyperSurrogateagentCrt.exe
4520	hyperSurrogateagentCrt.exe
4520	hyperSurrogateagentCrt.exe
4520	hyperSurrogateagentCrt.exe
4520	hyperSurrogateagentCrt.exe
4520	hyperSurrogateagentCrt.exe
4520	hyperSurrogateagentCrt.exe
4520	hyperSurrogateagentCrt.exe
4520	hyperSurrogateagentCrt.exe
4520	hyperSurrogateagentCrt.exe
4520	hyperSurrogateagentCrt.exe
4520	hyperSurrogateagentCrt.exe
4520	hyperSurrogateagentCrt.exe
4520	hyperSurrogateagentCrt.exe
4520	hyperSurrogateagentCrt.exe
4520	hyperSurrogateagentCrt.exe
4520	hyperSurrogateagentCrt.exe
4520	hyperSurrogateagentCrt.exe
4520	hyperSurrogateagentCrt.exe
4520	hyperSurrogateagentCrt.exe
4520	hyperSurrogateagentCrt.exe
4520	hyperSurrogateagentCrt.exe
4520	hyperSurrogateagentCrt.exe
4520	hyperSurrogateagentCrt.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5012	powershell.exe
Token: SeIncreaseQuotaPrivilege	5012	powershell.exe
Token: SeSecurityPrivilege	5012	powershell.exe
Token: SeTakeOwnershipPrivilege	5012	powershell.exe
Token: SeLoadDriverPrivilege	5012	powershell.exe
Token: SeSystemProfilePrivilege	5012	powershell.exe
Token: SeSystemtimePrivilege	5012	powershell.exe
Token: SeProfSingleProcessPrivilege	5012	powershell.exe
Token: SeIncBasePriorityPrivilege	5012	powershell.exe
Token: SeCreatePagefilePrivilege	5012	powershell.exe
Token: SeBackupPrivilege	5012	powershell.exe
Token: SeRestorePrivilege	5012	powershell.exe
Token: SeShutdownPrivilege	5012	powershell.exe
Token: SeDebugPrivilege	5012	powershell.exe
Token: SeSystemEnvironmentPrivilege	5012	powershell.exe
Token: SeRemoteShutdownPrivilege	5012	powershell.exe
Token: SeUndockPrivilege	5012	powershell.exe
Token: SeManageVolumePrivilege	5012	powershell.exe
Token: 33	5012	powershell.exe
Token: 34	5012	powershell.exe
Token: 35	5012	powershell.exe
Token: 36	5012	powershell.exe
Token: SeDebugPrivilege	4236	CheckDevices.exe
Token: SeDebugPrivilege	1624	BulbaZUpdate.exe
Token: SeDebugPrivilege	972	powershell.exe
Token: SeIncreaseQuotaPrivilege	972	powershell.exe
Token: SeSecurityPrivilege	972	powershell.exe
Token: SeTakeOwnershipPrivilege	972	powershell.exe
Token: SeLoadDriverPrivilege	972	powershell.exe
Token: SeSystemProfilePrivilege	972	powershell.exe
Token: SeSystemtimePrivilege	972	powershell.exe
Token: SeProfSingleProcessPrivilege	972	powershell.exe
Token: SeIncBasePriorityPrivilege	972	powershell.exe
Token: SeCreatePagefilePrivilege	972	powershell.exe
Token: SeBackupPrivilege	972	powershell.exe
Token: SeRestorePrivilege	972	powershell.exe
Token: SeShutdownPrivilege	972	powershell.exe
Token: SeDebugPrivilege	972	powershell.exe
Token: SeSystemEnvironmentPrivilege	972	powershell.exe
Token: SeRemoteShutdownPrivilege	972	powershell.exe
Token: SeUndockPrivilege	972	powershell.exe
Token: SeManageVolumePrivilege	972	powershell.exe
Token: 33	972	powershell.exe
Token: 34	972	powershell.exe
Token: 35	972	powershell.exe
Token: 36	972	powershell.exe
Token: SeDebugPrivilege	4324	powershell.exe
Token: SeIncreaseQuotaPrivilege	4324	powershell.exe
Token: SeSecurityPrivilege	4324	powershell.exe
Token: SeTakeOwnershipPrivilege	4324	powershell.exe
Token: SeLoadDriverPrivilege	4324	powershell.exe
Token: SeSystemProfilePrivilege	4324	powershell.exe
Token: SeSystemtimePrivilege	4324	powershell.exe
Token: SeProfSingleProcessPrivilege	4324	powershell.exe
Token: SeIncBasePriorityPrivilege	4324	powershell.exe
Token: SeCreatePagefilePrivilege	4324	powershell.exe
Token: SeBackupPrivilege	4324	powershell.exe
Token: SeRestorePrivilege	4324	powershell.exe
Token: SeShutdownPrivilege	4324	powershell.exe
Token: SeDebugPrivilege	4324	powershell.exe
Token: SeSystemEnvironmentPrivilege	4324	powershell.exe
Token: SeRemoteShutdownPrivilege	4324	powershell.exe
Token: SeUndockPrivilege	4324	powershell.exe
Token: SeManageVolumePrivilege	4324	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4236	CheckDevices.exe
4236	CheckDevices.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1624	BulbaZUpdate.exe
4544	SecHealthUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4236 wrote to memory of 5012	4236	CheckDevices.exe	84
PID 4236 wrote to memory of 5012	4236	CheckDevices.exe	84
PID 4236 wrote to memory of 5012	4236	CheckDevices.exe	84
PID 4236 wrote to memory of 1624	4236	CheckDevices.exe	90
PID 4236 wrote to memory of 1624	4236	CheckDevices.exe	90
PID 4236 wrote to memory of 972	4236	CheckDevices.exe	91
PID 4236 wrote to memory of 972	4236	CheckDevices.exe	91
PID 4236 wrote to memory of 972	4236	CheckDevices.exe	91
PID 1624 wrote to memory of 4324	1624	BulbaZUpdate.exe	94
PID 1624 wrote to memory of 4324	1624	BulbaZUpdate.exe	94
PID 1624 wrote to memory of 1468	1624	BulbaZUpdate.exe	96
PID 1624 wrote to memory of 1468	1624	BulbaZUpdate.exe	96
PID 1624 wrote to memory of 2020	1624	BulbaZUpdate.exe	100
PID 1624 wrote to memory of 2020	1624	BulbaZUpdate.exe	100
PID 1624 wrote to memory of 400	1624	BulbaZUpdate.exe	102
PID 1624 wrote to memory of 400	1624	BulbaZUpdate.exe	102
PID 1624 wrote to memory of 644	1624	BulbaZUpdate.exe	104
PID 1624 wrote to memory of 644	1624	BulbaZUpdate.exe	104
PID 1624 wrote to memory of 3604	1624	BulbaZUpdate.exe	119
PID 1624 wrote to memory of 3604	1624	BulbaZUpdate.exe	119
PID 3604 wrote to memory of 4812	3604	9YYBEEKSEKF5LOF.exe	120
PID 3604 wrote to memory of 4812	3604	9YYBEEKSEKF5LOF.exe	120
PID 1624 wrote to memory of 1524	1624	BulbaZUpdate.exe	122
PID 1624 wrote to memory of 1524	1624	BulbaZUpdate.exe	122
PID 1624 wrote to memory of 1524	1624	BulbaZUpdate.exe	122
PID 1524 wrote to memory of 412	1524	0UVX1NZ7MXEYGNT.exe	123
PID 1524 wrote to memory of 412	1524	0UVX1NZ7MXEYGNT.exe	123
PID 1524 wrote to memory of 412	1524	0UVX1NZ7MXEYGNT.exe	123
PID 412 wrote to memory of 4464	412	WScript.exe	124
PID 412 wrote to memory of 4464	412	WScript.exe	124
PID 412 wrote to memory of 4464	412	WScript.exe	124
PID 4464 wrote to memory of 4520	4464	cmd.exe	126
PID 4464 wrote to memory of 4520	4464	cmd.exe	126
PID 4520 wrote to memory of 3272	4520	hyperSurrogateagentCrt.exe	130
PID 4520 wrote to memory of 3272	4520	hyperSurrogateagentCrt.exe	130
PID 3272 wrote to memory of 1900	3272	csc.exe	132
PID 3272 wrote to memory of 1900	3272	csc.exe	132
PID 4520 wrote to memory of 4168	4520	hyperSurrogateagentCrt.exe	133
PID 4520 wrote to memory of 4168	4520	hyperSurrogateagentCrt.exe	133
PID 4168 wrote to memory of 4472	4168	csc.exe	135
PID 4168 wrote to memory of 4472	4168	csc.exe	135
PID 4520 wrote to memory of 3912	4520	hyperSurrogateagentCrt.exe	136
PID 4520 wrote to memory of 3912	4520	hyperSurrogateagentCrt.exe	136
PID 3912 wrote to memory of 1792	3912	csc.exe	138
PID 3912 wrote to memory of 1792	3912	csc.exe	138
PID 4520 wrote to memory of 2104	4520	hyperSurrogateagentCrt.exe	154
PID 4520 wrote to memory of 2104	4520	hyperSurrogateagentCrt.exe	154
PID 4520 wrote to memory of 3312	4520	hyperSurrogateagentCrt.exe	155
PID 4520 wrote to memory of 3312	4520	hyperSurrogateagentCrt.exe	155
PID 4520 wrote to memory of 2524	4520	hyperSurrogateagentCrt.exe	156
PID 4520 wrote to memory of 2524	4520	hyperSurrogateagentCrt.exe	156
PID 4520 wrote to memory of 1152	4520	hyperSurrogateagentCrt.exe	157
PID 4520 wrote to memory of 1152	4520	hyperSurrogateagentCrt.exe	157
PID 4520 wrote to memory of 4632	4520	hyperSurrogateagentCrt.exe	158
PID 4520 wrote to memory of 4632	4520	hyperSurrogateagentCrt.exe	158
PID 4520 wrote to memory of 2124	4520	hyperSurrogateagentCrt.exe	159
PID 4520 wrote to memory of 2124	4520	hyperSurrogateagentCrt.exe	159
PID 4520 wrote to memory of 2408	4520	hyperSurrogateagentCrt.exe	166
PID 4520 wrote to memory of 2408	4520	hyperSurrogateagentCrt.exe	166
PID 2408 wrote to memory of 2096	2408	cmd.exe	168
PID 2408 wrote to memory of 2096	2408	cmd.exe	168
PID 2408 wrote to memory of 2704	2408	cmd.exe	169
PID 2408 wrote to memory of 2704	2408	cmd.exe	169
PID 4612 wrote to memory of 2480	4612	svchost.exe	171

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\CheckDevices.exe
"C:\Users\Admin\AppData\Local\Temp\CheckDevices.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4236
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5012
- C:\Users\Admin\AppData\Local\Temp\BulbaZUpdate.exe
  "C:\Users\Admin\AppData\Local\Temp\BulbaZUpdate.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1624
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\BulbaZUpdate.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4324
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'BulbaZUpdate.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1468
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\svchost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2020
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:400
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:644
- - C:\Users\Admin\AppData\Local\Temp\9YYBEEKSEKF5LOF.exe
    "C:\Users\Admin\AppData\Local\Temp\9YYBEEKSEKF5LOF.exe"
    3⤵
    - Checks computer location settings
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:3604
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "9YYBEEKSEKF5LOF" /tr "C:\Users\Admin\AppData\Roaming\9YYBEEKSEKF5LOF.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4812
- - C:\Users\Admin\AppData\Local\Temp\0UVX1NZ7MXEYGNT.exe
    "C:\Users\Admin\AppData\Local\Temp\0UVX1NZ7MXEYGNT.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1524
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\HypercomponentCommon\I1SNCaG9QwHssjsi1vS2b9DJmZMoJ4clEjNn.vbe"
      4⤵
      Checks computer location settings
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:412
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\HypercomponentCommon\cemEzm0xYx1.bat" "
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4464
      - C:\HypercomponentCommon\hyperSurrogateagentCrt.exe
        
        "C:\HypercomponentCommon/hyperSurrogateagentCrt.exe"
        6⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4520
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jr50q1wf\jr50q1wf.cmdline"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:3272
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3956.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC9E69AB704E084976BC914493D9E65DE6.TMP"
        8⤵
        
        PID:1900
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mwupt4lr\mwupt4lr.cmdline"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:4168
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES39D3.tmp" "c:\Users\Admin\AppData\Roaming\CSCC681C4338D154702B3C57CF239B8B72E.TMP"
        8⤵
        
        PID:4472
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ckfgt0pa\ckfgt0pa.cmdline"
        7⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3912
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3A7F.tmp" "c:\Windows\System32\CSC1DFE1F20F3F440F2BB17F82D63EB953.TMP"
        8⤵
        
        PID:1792
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office\MoUsoCoreWorker.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2104
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\explorer.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3312
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\HypercomponentCommon\wininit.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2524
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\OEM\BulbaZUpdate.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1152
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\HypercomponentCommon\dllhost.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4632
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\HypercomponentCommon\hyperSurrogateagentCrt.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2124
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\fdZj2nIIvd.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2408
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:2096
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:2704
        
        C:\Recovery\OEM\BulbaZUpdate.exe
        
        "C:\Recovery\OEM\BulbaZUpdate.exe"
        8⤵
        Executes dropped EXE
        
        PID:2304
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:972

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:2996

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:116

C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe
"C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe" -ServerName:SecHealthUI.AppXep4x2tbtjws1v9qqs0rmb3hxykvkpqtn.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:4544

C:\Windows\System32\SecurityHealthHost.exe
C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
1⤵
PID:2580

C:\Windows\System32\SecurityHealthHost.exe
C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
1⤵
PID:4620

C:\Windows\System32\SecurityHealthHost.exe
C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
1⤵
PID:2340

C:\Users\Admin\AppData\Local\Temp\svchost.exe
"C:\Users\Admin\AppData\Local\Temp\svchost.exe"
1⤵
- Executes dropped EXE
PID:4956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MoUsoCoreWorkerM" /sc MINUTE /mo 14 /tr "'C:\Program Files\Microsoft Office\MoUsoCoreWorker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MoUsoCoreWorker" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\MoUsoCoreWorker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MoUsoCoreWorkerM" /sc MINUTE /mo 13 /tr "'C:\Program Files\Microsoft Office\MoUsoCoreWorker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Portable Devices\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Portable Devices\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\HypercomponentCommon\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\HypercomponentCommon\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\HypercomponentCommon\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "BulbaZUpdateB" /sc MINUTE /mo 12 /tr "'C:\Recovery\OEM\BulbaZUpdate.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "BulbaZUpdate" /sc ONLOGON /tr "'C:\Recovery\OEM\BulbaZUpdate.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "BulbaZUpdateB" /sc MINUTE /mo 14 /tr "'C:\Recovery\OEM\BulbaZUpdate.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\HypercomponentCommon\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\HypercomponentCommon\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\HypercomponentCommon\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "hyperSurrogateagentCrth" /sc MINUTE /mo 5 /tr "'C:\HypercomponentCommon\hyperSurrogateagentCrt.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "hyperSurrogateagentCrt" /sc ONLOGON /tr "'C:\HypercomponentCommon\hyperSurrogateagentCrt.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "hyperSurrogateagentCrth" /sc MINUTE /mo 11 /tr "'C:\HypercomponentCommon\hyperSurrogateagentCrt.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1572

C:\Users\Admin\AppData\Local\Temp\svchost.exe
"C:\Users\Admin\AppData\Local\Temp\svchost.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612
- C:\Users\Admin\AppData\Local\Temp\svchost.exe.exe
  "C:\Users\Admin\AppData\Local\Temp\svchost.exe.exe"
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Program Files\Microsoft Office\MoUsoCoreWorker.exe
  "C:\Program Files\Microsoft Office\MoUsoCoreWorker.exe"
  2⤵
  - Executes dropped EXE
  PID:1336

C:\Users\Admin\AppData\Roaming\9YYBEEKSEKF5LOF.exe
"C:\Users\Admin\AppData\Roaming\9YYBEEKSEKF5LOF.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:2132
- C:\Users\Admin\AppData\Roaming\9YYBEEKSEKF5LOF.exe.exe
  "C:\Users\Admin\AppData\Roaming\9YYBEEKSEKF5LOF.exe.exe"
  2⤵
  - Executes dropped EXE
  PID:4524
- C:\Program Files\Microsoft Office\MoUsoCoreWorker.exe
  "C:\Program Files\Microsoft Office\MoUsoCoreWorker.exe"
  2⤵
  - Executes dropped EXE
  PID:1228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\HypercomponentCommon\I1SNCaG9QwHssjsi1vS2b9DJmZMoJ4clEjNn.vbe

Filesize
220B

MD5
47085bdd4e3087465355c9bb9bbc6005

SHA1
bf0c5b11c20beca45cc9d4298f2a11a16c793a61

SHA256
80577e4666fad86273b01f60b8d63c15e4ce37774575ac1e0df7a7c396979752

SHA512
e74dd8e9756cab1123410a46609dc91540cc29a8fea93017155746f7bb9b7a41bfd3d7595a62788264bedceb475b2a733cce9b70f37cc4478302d5fc228d7684

Download Submit
C:\HypercomponentCommon\cemEzm0xYx1.bat

Filesize
105B

MD5
5ee2935a1949f69f67601f7375b3e8a3

SHA1
6a3229f18db384e57435bd3308298da56aa8c404

SHA256
c24a0d7f53a7aa3437f6b6566d3aaebdb36053b64e72cbd1d3796596fc8e3c06

SHA512
9777fcb9ee8a8aa0c770c835c5f30aff6efc5fb16a1819047e13d580d748703ffcb446db110067fb2546a637213cb8f25416d4b621a95a789b8e113d31d3401a

Download Submit
C:\HypercomponentCommon\hyperSurrogateagentCrt.exe

Filesize
1.9MB

MD5
7be5cea1c84ad0b2a6d2e5b6292c8d80

SHA1
631e3de0fe83ebacbe5be4e7f895dd0bd8b095ce

SHA256
6eb90684ebc56fb2713f5c468b55a964625ec2af698d9687492b1de4225693b7

SHA512
ea58d3b1664fe70968635c2722e19ce65ce4c1d66c68aed2d98441e60e773c7295f18d9c99cf4c454c510f33f5e37d3d2c0053b7434a46c542a0d63a4cc03647

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
3eb3833f769dd890afc295b977eab4b4

SHA1
e857649b037939602c72ad003e5d3698695f436f

SHA256
c485a6e2fd17c342fca60060f47d6a5655a65a412e35e001bb5bf88d96e6e485

SHA512
c24bbc8f278478d43756807b8c584d4e3fb2289db468bc92986a489f74a8da386a667a758360a397e77e018e363be8912ac260072fa3e31117ad0599ac749e72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\svchost.exe.log

Filesize
654B

MD5
11c6e74f0561678d2cf7fc075a6cc00c

SHA1
535ee79ba978554abcb98c566235805e7ea18490

SHA256
d39a78fabca39532fcb85ce908781a75132e1bd01cc50a3b290dd87127837d63

SHA512
32c63d67bf512b42e7f57f71287b354200126cb417ef9d869c72e0b9388a7c2f5e3b61f303f1353baa1bf482d0f17e06e23c9f50b2f1babd4d958b6da19c40b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
f9349064c7c8f8467cc12d78a462e5f9

SHA1
5e1d27fc64751cd8c0e9448ee47741da588b3484

SHA256
883481fe331cb89fb6061e76b43acd4dd638c16f499b10088b261036c6d0547b

SHA512
3229668491b5e4068e743b31f2896b30b1842faf96aff09fad01b08771c2f11eb8d8f02a3b76e31f0d6ad650c2894c5ac1822204e132c03d9c2b8df6ca4cd7cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
21KB

MD5
5d375c8cebeb596b129a6bf0afeaf4fc

SHA1
2aa5eb3f5a7fffa3659e332487c8ccdadd0dea09

SHA256
d7ac9872a1a3e2a5b35b0077e5a344ad0bdfe08b8554e0400339edf89f8b3dfc

SHA512
601171c87eaa9353ecc445805f2dd528e6e3912bec9e75eb525fbf7039d19b3cd22828d1f03d3ef47c7da07983e6f8e125a8d5b372f4237c4731ba2709bd5404

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
730d375c503ac7775813330efd853380

SHA1
300c1b9ab4fb1434c3d8707309794bdd972717d2

SHA256
bc155a091781a76ef6811cf536a50729729fcf645f4232107072178ad186c5ab

SHA512
ce04a25ef018692dbc125433d00416badf2a9084d536dd83f8040bfcbac96f7f947ae5d13f147337aa96164553f050a9398ee369a7681f24cadc6b194e8a4f49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
a883f92496ecf2e3fa92743e01a45e4c

SHA1
52964fcf4ddb053692da5ebd27677806e200dd04

SHA256
8c7a181a57f70244cda67dbe474763dd031c066b340fc20a8b7cea09b4562e06

SHA512
9701a4ef6f813b8cf7a3e06836cc76e6ce4a22c500ec3209491ffb7746e38ada56944acf13fe524a47fca9efc173686ffb270ce58973dc58cee19396c2f9d300

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
08ca64a9e208774527f5ac7727be9277

SHA1
c183654ffc8e91176b6c806f5e149ade8ce40a63

SHA256
53198ff9ae45d578617bd63461dc779e5f85db1100246b1045f1652f4800ec44

SHA512
99d0947f53a5f077d7f200307ef015601e9a187070b2bf1524ce850e2aa3646df089c029fb40938466454be838a93a62f7ae5cfae71eee433eea36e1fc8f6301

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
a5b65e48f20a79f06b30ca3020df0ce3

SHA1
55a2263b4bb9e5576e798d4ff0fb1e6d7bfa88cf

SHA256
0cd9d3dcec93fe4ae156a9975a9c553f6adfe8be51b1a9a9f7087b7a1424fe6e

SHA512
27fb7f3b0bc10dd9de982fe4f4b790aa33687af6e780ab454e87be1caf4607001cf2e5dd90a69a379364149ae30e7109ec6043298703e1f05beaf212f36e5b98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
e4115b6aec6e8175d5ba82ea5d6814e4

SHA1
c5f4b102a89d96e4e3d42184d14faf2d5ea25791

SHA256
6c040aa37326b1490a81680367d627442685327f974e34afb08ca45ca0681276

SHA512
1883d7153e86c5a9df2d5bcd579034208225706f40f544ffb7692cb3fa625cfea992105e551486ce23a12ee905c60b133783324d3604563da7371cd54c9a598e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
a18835e9d283c1756004203237699f68

SHA1
ff94809a79fb4f3f5770e74cbc14be6302372ebe

SHA256
2e00bc63a15e08238884d38641ace8dcaee812a3836ea57b47e4a142ca2dc374

SHA512
941ea821e23596515224bb94962399a02cfc1887e8c12b218ebb50b2467b0d4dca4e7c686791362fd4fb7eb8acb7ad14cc19e0e10d711ba17a01caeaf187a426

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
d9c1620e80fc6f4bb6968c1f6de345be

SHA1
884bb0d01deb5843f18bbdaefd1ad2c4a07e1c5e

SHA256
2806c2a745577ede89960198b9170d6a0dfe59de1e7cc6cc55f0723c0dbf7378

SHA512
094e858428e9d8181b0a58d32d2038cf16c61c3ecc072a164d37d84b660d21f8c470047d76af034d896ee3c1e12dfd799c361b962f565f2056d74a5cefdce67f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
69cdd491b63c56f5f955ef39b1366e30

SHA1
91129f3cfe0b95bc9925727ef8a0112112621fca

SHA256
5c02fad9ae42d83dc757adf8e09ee0a0ecadad0adb4d2f75cc80600b142c0f5c

SHA512
c56b796745af39defc66943a4aa5f880d635700ce895c257cfac77214cd3130f9be76c6ca03e6ab6cd915665ab3c711c34845ed3e0f0519bd822c3745a23da5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
21KB

MD5
f534ec15e54e8cd28dd02b209892cc9a

SHA1
8719586f703c3e8fc818f47b097c76d9290958d2

SHA256
29fefb4fa9618a80a9738bf3a7e72180c57bbdd30a8c7cf13e14a956fbfdfcfe

SHA512
34d82b1efbdb4d8f2dfa5d5d85aac4dc6a196b171d994beab7d62b18c7dc45f19d7e12b3287d164ecae176bd519feebf3385aee1fa120e2c917aec58347d62a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\0UVX1NZ7MXEYGNT.exe

Filesize
2.2MB

MD5
05d87a4a162784fd5256f4118aff32af

SHA1
484ed03930ed6a60866b6f909b37ef0d852dbefd

SHA256
7e3d0dabaded78094abfac40d694eaebf861f3cb865d3835bb053d435e996950

SHA512
3d4ce511e9671d8bfa15e93d681fedd972f4fe4c09ac9cfd9653afe83e936654c88ee515a76e7ac80e8f34868802e68c6531fdea0b718029d2196ad1425981fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\9YYBEEKSEKF5LOF.exe

Filesize
185KB

MD5
e0c8976957ffdc4fe5555adbe8cb0d0c

SHA1
226a764bacfa17b92131993aa85fe63f1dbf347c

SHA256
b8260ac46e03f2a7baa9ae01bee5443d16d9eb96f6ee8588a887d6de72a750d4

SHA512
3a1ea48e81ebfd5586938a72afd68bcc48d4c5d69949cfdacf33aee3371d98f202443f5db12bac876ca7cecc982ddc56827f8d9b1857d22bda71242d5b2cc71e

Download Submit
C:\Users\Admin\AppData\Local\Temp\BulbaZUpdate.exe

Filesize
73KB

MD5
d6e46bbc2d5aff61a5a6ef1e9622cd74

SHA1
07df7137ffd475f77bdbdc6c25e9a17d41807bc0

SHA256
337d1a295dc78a08800cbb19f8dcb563218eb0a89819282384990f6a8fe305be

SHA512
d0ae2166d11c683e14db1149a3f498a4868442fad08384440dcdccc18c0110f295307e3d41885b8b540c1c964d4e6db102fb6b014b3a7cf64d8b2dadb075638f

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES3956.tmp

Filesize
1KB

MD5
e4ca282ff2d331f95e51091a7bcb0391

SHA1
d2ea0eea1fe19a2db765b5f74f11bf1c98b6edba

SHA256
e1110c91b4d3fe7adb4eeb27ab445bb5781c2ba9d9c133f2e88d8b22d25d8ead

SHA512
9c24f89a3621f1dc49bdf172eff08f5bbb5da08101d8de4c746d831edb0f146cef47f72e8a70d3cb33fce5f8be336f926a496ec0ab94a424c7e8d3fa5c994072

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES39D3.tmp

Filesize
1KB

MD5
5277c277991b422eadf5e11b71c2b0d1

SHA1
d10280de8d154da2d93045bf627e3185de6b87b6

SHA256
fec4d596f653b8b432172ae30c052041cc12bed3bd262a3df4a9f5195b3baa19

SHA512
2474cc76fa456c6562d57e928ada70f898f49edaa942650fa94a8721a7c17dbd1ea16e4723db9988fd3ca45453d28359e7008a3df0cd8f04335a410ade1898fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES3A7F.tmp

Filesize
1KB

MD5
3be5b3e31881123632a1bf2400fc5108

SHA1
a352f11394d032abc5b4ae2ad457f382ab991c5e

SHA256
45f45bc85c0e50581ba85dc97091e66dff7321ddb3f1a67536f7ac2315b6a569

SHA512
deb3160c3971fcd6000a8ddf2d7ae244c592331da59cfed99a5c820821c969bbfd9d1a26d961e7f3747ed96c6758825b50fdd6a952fa0ae4b5696256748063e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4qyycilu.1md.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\fdZj2nIIvd.bat

Filesize
208B

MD5
972d293d93b9e185cb5fc71b4658f8e0

SHA1
163bb3665b2fa15d0888885e10d4060c46c8af43

SHA256
475fa11e6206958f1ace99d020563a496d8d45a2a730c2d0c0f46135ffcfc3de

SHA512
e400635125486ab6fc98f34bcbe75037d5f956ff529b94cff1bb485b3b346eec300e7020ccd89c89bf2561e933a8cf7272851b3fc61b6e33cedbff93914eec8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\svchost.exe

Filesize
4KB

MD5
e3bc142af30a8e2fcb6a2fdf08fc9ccb

SHA1
e56bda59d4a09315d893d866e668acf009e0f82d

SHA256
9dc05ef0996b5d186b25495e3a73d972c6455c7ae497cf3bed428f433269938e

SHA512
3707d39eb22aca63cbfa833bbbdfc930ec402a67a56b936165ab5697aa95b8932c3cc7e1d6316297fae39082d0b4eebecba2c306182378d03b2fb46925ce06c6

Download Submit
C:\Users\Admin\AppData\Roaming\9YYBEEKSEKF5LOF.exe

Filesize
4KB

MD5
4e7a2d892fcd869497b34be7ab450135

SHA1
8ec3741aa090a744c64beeaab3ce839e6b5ed307

SHA256
7764c08fc0614d919512a90b06162e4e2ec9bc6e181025f98afd7d3f0493d709

SHA512
66d4ffd54952ce82779e13d07a0df633a560a5bcd4524ebfc61075c8c6556ae036a44bff07570406be840c6e2278dadb4041c8167f35351f7da442ba0c53c3af

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSC9E69AB704E084976BC914493D9E65DE6.TMP

Filesize
1KB

MD5
b10290e193d94a5e3c95660f0626a397

SHA1
7b9de1fd7a43f6f506e5fc3426836b8c52d0d711

SHA256
75c9e1766bfb99754b6a00d37ef93488ab216b5ac48984ed7d9d2076a7056fd2

SHA512
6ae4201552a499eaa726416b29230f48d94ac7f40ff038165bf8582626bbefe601ef6c051ad97d9156dc4b9b55fd22081db61bcd013916136340c5f1324e4bb5

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ckfgt0pa\ckfgt0pa.0.cs

Filesize
385B

MD5
bc2974cd140d038472edeb4da9c7a7f7

SHA1
74e742681314763ca3c6a71794afb119362d3351

SHA256
f9365623a813e113f9ebbb35fccf023ecc30bc7446e2f80b9293a33839fefe4d

SHA512
6ff3551792f6a541a93c26f5f5ac7841f998be1318cbbf8d8d7802eeb94060bea9206722808011213c489d82b121efe0ed62e87e9535a50e9ec4fc66354512df

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ckfgt0pa\ckfgt0pa.cmdline

Filesize
235B

MD5
897e6dcb6c6f88bde5f7cfb78ba77028

SHA1
e6dd1ace096ae9a10d425d561f4677a48241c471

SHA256
dd567f0607094adca1eee6ebc4029f6b4149cec6e95932cee8e827c6ff1bb76c

SHA512
40d4f5c977271fbc3ae866f259a03d6ba0db73ae7a0a882f48adfb58b4cdd497fc0d878acda92a1eb9863eca12bee671f62204bb858ced4a67c5e00f2d199f72

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\jr50q1wf\jr50q1wf.0.cs

Filesize
400B

MD5
fade3129a59fe268deaef6b1e24f4256

SHA1
b987753fc6d38ce932968051f474f248a472c1b0

SHA256
56414cc08b409889af567627d2a55eb80e41802fb095d85b04e5dc337168b204

SHA512
9e311bfd5e25038488d97504bd1d52477b955e3ddc0c4d1e38139ce6aa71d66d333c722eefd0dcdfe19c9e74f8b7685e0e4cb5f2f78caae51581280ef9fb8611

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\jr50q1wf\jr50q1wf.cmdline

Filesize
250B

MD5
ace11ab56ad4e645a5d1726db94bbfe6

SHA1
cfc3ff20f36aaca347800d244d276ecd19ac339c

SHA256
5a5698bf59ef2e54dc200d740bd3a9687a925aaaf1e837ee6c4b1da01fc0f735

SHA512
cc15848e5d43803f2c2a674411a144425089037b5d6f12d14ee057595f62053fb3c339b19b28a433bb11d658d57aeb24a44c56f4762235bffadeb04f84c7c564

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\mwupt4lr\mwupt4lr.0.cs

Filesize
405B

MD5
5f1280d40e9faa7ac815363931eb9b8b

SHA1
94a35a4cca18afe33f5308ec9372052f14d42d68

SHA256
51ed3c9844d6777bc12ccb61aa6ff011ae272a92ae55613d1a6a889dc8a1ca1b

SHA512
a11bf1e5e59caf534abadf029990706079b500a37f4ffce621615cf3938d74805ff866b70feca93a650287b27c46a4c8890c26f4835e184e5d7ce650629dcbfc

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\mwupt4lr\mwupt4lr.cmdline

Filesize
255B

MD5
1d2cebed95a66b9ecfb24b75a6974a47

SHA1
b0b7cc012579bb261940e5428544002483e4e41e

SHA256
841f0f6e584c92dfbbc1ee722d20bd9f0e2b0f6ff846046329fbbb8b3891bfec

SHA512
f8b03b309916df408fddabd3ee880a2d2d058bb35457d1474d11a987489dd881c204f2ff64a67551cff805f5644c6640f760e6457ac0a17f63ca21afe0b5f924

Download Submit
\??\c:\Users\Admin\AppData\Roaming\CSCC681C4338D154702B3C57CF239B8B72E.TMP

Filesize
1KB

MD5
996d2ea6b19acee7f431abaa55c1099b

SHA1
90742df3e4090b25c95d83aa929dfe7e6be1d723

SHA256
e791c133ee92fac33fc9dbfdbb6c204586f9a71c3e04aa1ce9ea66d4541b2619

SHA512
42af077bbfc82a23af67f2a12e0ca93dc9880065dc4d61932bce05aaf98f9e0832f107f08dcb1118ad98623a04a175082ede20dbff6c64edb98cf33e20123390

Download Submit
\??\c:\Windows\System32\CSC1DFE1F20F3F440F2BB17F82D63EB953.TMP

Filesize
1KB

MD5
97a3a4ab7f63bb87648297531ccc5bf0

SHA1
9d175b8d02181c4284f0e14f165470292d462bd9

SHA256
f052e2c0a4308c072c22e2e8daa7734fc0a64885c57d2009a28160f7cddc3cc8

SHA512
154c35f3c2cac99c012d82679ff30e0e60c37140500d0c47ef788d803d8edaa1db02e4154277bc31af51cdd0e37ce00f4192c1baff3977c15a8c645140149db8

Download Submit
memory/972-79-0x0000000006720000-0x000000000676C000-memory.dmp

Filesize
304KB

Download
memory/972-76-0x00000000061F0000-0x0000000006547000-memory.dmp

Filesize
3.3MB

Download
memory/972-80-0x000000006FC10000-0x000000006FC5C000-memory.dmp

Filesize
304KB

Download
memory/972-90-0x0000000007940000-0x00000000079E3000-memory.dmp

Filesize
652KB

Download
memory/1336-355-0x000000001BEB0000-0x000000001BF1B000-memory.dmp

Filesize
428KB

Download
memory/1624-152-0x000000001B5A0000-0x000000001B5AC000-memory.dmp

Filesize
48KB

Download
memory/1624-66-0x0000000000910000-0x0000000000928000-memory.dmp

Filesize
96KB

Download
memory/2132-341-0x00000000002F0000-0x00000000002F8000-memory.dmp

Filesize
32KB

Download
memory/3604-167-0x0000000000DD0000-0x0000000000E04000-memory.dmp

Filesize
208KB

Download
memory/4236-2-0x0000000005520000-0x0000000005AC6000-memory.dmp

Filesize
5.6MB

Download
memory/4236-78-0x0000000075190000-0x0000000075941000-memory.dmp

Filesize
7.7MB

Download
memory/4236-5-0x0000000004EA0000-0x0000000004EAA000-memory.dmp

Filesize
40KB

Download
memory/4236-147-0x0000000075190000-0x0000000075941000-memory.dmp

Filesize
7.7MB

Download
memory/4236-3-0x0000000004F70000-0x0000000005002000-memory.dmp

Filesize
584KB

Download
memory/4236-6-0x0000000006DB0000-0x0000000006E16000-memory.dmp

Filesize
408KB

Download
memory/4236-1-0x00000000004A0000-0x00000000004AA000-memory.dmp

Filesize
40KB

Download
memory/4236-0-0x000000007519E000-0x000000007519F000-memory.dmp

Filesize
4KB

Download
memory/4236-50-0x000000007519E000-0x000000007519F000-memory.dmp

Filesize
4KB

Download
memory/4236-4-0x0000000075190000-0x0000000075941000-memory.dmp

Filesize
7.7MB

Download
memory/4324-95-0x00000275FFF30000-0x00000275FFF52000-memory.dmp

Filesize
136KB

Download
memory/4520-202-0x0000000000560000-0x0000000000746000-memory.dmp

Filesize
1.9MB

Download
memory/4520-204-0x0000000000F60000-0x0000000000F6E000-memory.dmp

Filesize
56KB

Download
memory/4520-206-0x0000000002780000-0x000000000279C000-memory.dmp

Filesize
112KB

Download
memory/4520-207-0x0000000002920000-0x0000000002970000-memory.dmp

Filesize
320KB

Download
memory/4520-209-0x00000000027A0000-0x00000000027B8000-memory.dmp

Filesize
96KB

Download
memory/4520-211-0x0000000000F70000-0x0000000000F7E000-memory.dmp

Filesize
56KB

Download
memory/4520-213-0x0000000000F80000-0x0000000000F8C000-memory.dmp

Filesize
48KB

Download
memory/4520-265-0x000000001B490000-0x000000001B4FB000-memory.dmp

Filesize
428KB

Download
memory/4612-336-0x0000000000EA0000-0x0000000000EA8000-memory.dmp

Filesize
32KB

Download
memory/5012-41-0x0000000075190000-0x0000000075941000-memory.dmp

Filesize
7.7MB

Download
memory/5012-23-0x0000000005F90000-0x00000000062E7000-memory.dmp

Filesize
3.3MB

Download
memory/5012-24-0x0000000006510000-0x000000000652E000-memory.dmp

Filesize
120KB

Download
memory/5012-25-0x00000000065A0000-0x00000000065EC000-memory.dmp

Filesize
304KB

Download
memory/5012-26-0x00000000074C0000-0x00000000074F2000-memory.dmp

Filesize
200KB

Download
memory/5012-13-0x0000000075190000-0x0000000075941000-memory.dmp

Filesize
7.7MB

Download
memory/5012-12-0x0000000005740000-0x00000000057A6000-memory.dmp

Filesize
408KB

Download
memory/5012-11-0x00000000055A0000-0x00000000055C2000-memory.dmp

Filesize
136KB

Download
memory/5012-28-0x0000000070D10000-0x0000000070D5C000-memory.dmp

Filesize
304KB

Download
memory/5012-9-0x0000000075190000-0x0000000075941000-memory.dmp

Filesize
7.7MB

Download
memory/5012-10-0x00000000057E0000-0x0000000005EAA000-memory.dmp

Filesize
6.8MB

Download
memory/5012-27-0x0000000075190000-0x0000000075941000-memory.dmp

Filesize
7.7MB

Download
memory/5012-8-0x0000000075190000-0x0000000075941000-memory.dmp

Filesize
7.7MB

Download
memory/5012-7-0x0000000002B60000-0x0000000002B96000-memory.dmp

Filesize
216KB

Download
memory/5012-38-0x0000000007700000-0x000000000771E000-memory.dmp

Filesize
120KB

Download
memory/5012-39-0x0000000075190000-0x0000000075941000-memory.dmp

Filesize
7.7MB

Download
memory/5012-40-0x0000000007720000-0x00000000077C3000-memory.dmp

Filesize
652KB

Download
memory/5012-49-0x0000000075190000-0x0000000075941000-memory.dmp

Filesize
7.7MB

Download
memory/5012-43-0x0000000007860000-0x000000000787A000-memory.dmp

Filesize
104KB

Download
memory/5012-42-0x0000000007EA0000-0x000000000851A000-memory.dmp

Filesize
6.5MB

Download
memory/5012-44-0x00000000078C0000-0x00000000078CA000-memory.dmp

Filesize
40KB

Download
memory/5012-45-0x0000000007AE0000-0x0000000007B76000-memory.dmp

Filesize
600KB

Download
memory/5012-46-0x0000000075190000-0x0000000075941000-memory.dmp

Filesize
7.7MB

Download