Analysis
-
max time kernel
90s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
29-11-2022 17:05
Static task
static1
Behavioral task
behavioral1
Sample
148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe
Resource
win7-20220812-en
General
-
Target
148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe
-
Size
2.0MB
-
MD5
443880cbb37d23e8c3846e0b3c7f7358
-
SHA1
0824425675beced43463ee3943f745f4dd4f9110
-
SHA256
148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1
-
SHA512
5ca14e9a0ab251e30deb47383f20f8d288e34086bbf2e75438e6907e31e9128a49373dba29cedaef95e5cb228efdd69b39a4e14ef761b7d95dabd3b33ad0c766
-
SSDEEP
24576:CNhI4oUnscbH/4IhUaTkO4yMFBSPQh6PTntnjjgRGVDkkahscbqk9zDRXq6LYsU/:MXHw+UBT6Ld/9Ss8DxxL7dEMZ
Malware Config
Extracted
colibri
1.2.0
Build1
http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php
http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php
Signatures
-
Process spawned unexpected child process 36 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4012 1964 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4236 1964 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 984 1964 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2912 1964 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1528 1964 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2852 1964 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3752 1964 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4468 1964 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1476 1964 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2292 1964 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4212 1964 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3504 1964 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 308 1964 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 220 1964 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4732 1964 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2664 1964 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 896 1964 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3156 1964 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1444 1964 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3304 1964 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3588 1964 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4852 1964 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 936 1964 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1272 1964 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4336 1964 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4632 1964 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4116 1964 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4356 1964 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3992 1964 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4476 1964 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1940 1964 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4448 1964 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1288 1964 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4668 1964 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3832 1964 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3796 1964 schtasks.exe -
Executes dropped EXE 5 IoCs
Processes:
tmpAF5F.tmp.exetmpAF5F.tmp.exe148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exetmpE7E4.tmp.exetmpE7E4.tmp.exepid process 2788 tmpAF5F.tmp.exe 392 tmpAF5F.tmp.exe 1680 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe 4376 tmpE7E4.tmp.exe 2016 tmpE7E4.tmp.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
tmpAF5F.tmp.exetmpE7E4.tmp.exedescription pid process target process PID 2788 set thread context of 392 2788 tmpAF5F.tmp.exe tmpAF5F.tmp.exe PID 4376 set thread context of 2016 4376 tmpE7E4.tmp.exe tmpE7E4.tmp.exe -
Drops file in Program Files directory 3 IoCs
Processes:
148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exedescription ioc process File created C:\Program Files\ModifiableWindowsApps\csrss.exe 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe File created C:\Program Files\Java\jre1.8.0_66\RuntimeBroker.exe 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe File created C:\Program Files\Java\jre1.8.0_66\9e8d7a4ca61bd9 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe -
Drops file in Windows directory 5 IoCs
Processes:
148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exedescription ioc process File created C:\Windows\twain_32\e6c9b481da804f 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe File created C:\Windows\WinSxS\explorer.exe 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe File created C:\Windows\Tasks\fontdrvhost.exe 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe File created C:\Windows\Tasks\5b884080fd4f94 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe File created C:\Windows\twain_32\OfficeClickToRun.exe 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 36 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 220 schtasks.exe 4732 schtasks.exe 4336 schtasks.exe 984 schtasks.exe 2852 schtasks.exe 3504 schtasks.exe 936 schtasks.exe 3752 schtasks.exe 4212 schtasks.exe 1444 schtasks.exe 896 schtasks.exe 4448 schtasks.exe 4236 schtasks.exe 4356 schtasks.exe 4852 schtasks.exe 4632 schtasks.exe 1940 schtasks.exe 3832 schtasks.exe 2912 schtasks.exe 2292 schtasks.exe 2664 schtasks.exe 4476 schtasks.exe 308 schtasks.exe 3588 schtasks.exe 1272 schtasks.exe 3796 schtasks.exe 3156 schtasks.exe 4116 schtasks.exe 3992 schtasks.exe 1476 schtasks.exe 3304 schtasks.exe 1288 schtasks.exe 4668 schtasks.exe 4012 schtasks.exe 1528 schtasks.exe 4468 schtasks.exe -
Modifies registry class 1 IoCs
Processes:
148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepid process 4836 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe 4836 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe 4836 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe 4836 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe 4836 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe 4836 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe 4836 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe 4836 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe 4836 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe 4836 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe 4836 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe 4836 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe 4836 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe 4836 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe 4836 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe 4836 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe 4836 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe 4836 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe 4836 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe 4836 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe 4836 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe 4836 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe 4836 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe 4836 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe 4836 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe 4836 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe 4836 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe 4836 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe 4836 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe 4836 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe 4836 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe 4836 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe 4836 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe 1868 powershell.exe 1868 powershell.exe 4836 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe 4836 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe 4836 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe 4836 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe 4836 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe 4836 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe 4836 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe 4108 powershell.exe 4108 powershell.exe 4384 powershell.exe 4384 powershell.exe 4756 powershell.exe 4756 powershell.exe 888 powershell.exe 888 powershell.exe 4680 powershell.exe 4680 powershell.exe 1008 powershell.exe 1008 powershell.exe 1088 powershell.exe 1088 powershell.exe 5004 powershell.exe 5004 powershell.exe 3384 powershell.exe 3384 powershell.exe 928 powershell.exe 928 powershell.exe 4444 powershell.exe 4444 powershell.exe -
Suspicious use of AdjustPrivilegeToken 14 IoCs
Processes:
148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exedescription pid process Token: SeDebugPrivilege 4836 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe Token: SeDebugPrivilege 1868 powershell.exe Token: SeDebugPrivilege 4108 powershell.exe Token: SeDebugPrivilege 888 powershell.exe Token: SeDebugPrivilege 4384 powershell.exe Token: SeDebugPrivilege 4756 powershell.exe Token: SeDebugPrivilege 4680 powershell.exe Token: SeDebugPrivilege 1008 powershell.exe Token: SeDebugPrivilege 1088 powershell.exe Token: SeDebugPrivilege 5004 powershell.exe Token: SeDebugPrivilege 3384 powershell.exe Token: SeDebugPrivilege 928 powershell.exe Token: SeDebugPrivilege 4444 powershell.exe Token: SeDebugPrivilege 1680 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe -
Suspicious use of WriteProcessMemory 50 IoCs
Processes:
148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exetmpAF5F.tmp.execmd.exe148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exetmpE7E4.tmp.exedescription pid process target process PID 4836 wrote to memory of 2788 4836 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe tmpAF5F.tmp.exe PID 4836 wrote to memory of 2788 4836 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe tmpAF5F.tmp.exe PID 4836 wrote to memory of 2788 4836 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe tmpAF5F.tmp.exe PID 2788 wrote to memory of 392 2788 tmpAF5F.tmp.exe tmpAF5F.tmp.exe PID 2788 wrote to memory of 392 2788 tmpAF5F.tmp.exe tmpAF5F.tmp.exe PID 2788 wrote to memory of 392 2788 tmpAF5F.tmp.exe tmpAF5F.tmp.exe PID 2788 wrote to memory of 392 2788 tmpAF5F.tmp.exe tmpAF5F.tmp.exe PID 2788 wrote to memory of 392 2788 tmpAF5F.tmp.exe tmpAF5F.tmp.exe PID 2788 wrote to memory of 392 2788 tmpAF5F.tmp.exe tmpAF5F.tmp.exe PID 2788 wrote to memory of 392 2788 tmpAF5F.tmp.exe tmpAF5F.tmp.exe PID 4836 wrote to memory of 4108 4836 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe powershell.exe PID 4836 wrote to memory of 4108 4836 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe powershell.exe PID 4836 wrote to memory of 888 4836 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe powershell.exe PID 4836 wrote to memory of 888 4836 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe powershell.exe PID 4836 wrote to memory of 1868 4836 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe powershell.exe PID 4836 wrote to memory of 1868 4836 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe powershell.exe PID 4836 wrote to memory of 4756 4836 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe powershell.exe PID 4836 wrote to memory of 4756 4836 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe powershell.exe PID 4836 wrote to memory of 4384 4836 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe powershell.exe PID 4836 wrote to memory of 4384 4836 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe powershell.exe PID 4836 wrote to memory of 4680 4836 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe powershell.exe PID 4836 wrote to memory of 4680 4836 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe powershell.exe PID 4836 wrote to memory of 1008 4836 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe powershell.exe PID 4836 wrote to memory of 1008 4836 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe powershell.exe PID 4836 wrote to memory of 1088 4836 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe powershell.exe PID 4836 wrote to memory of 1088 4836 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe powershell.exe PID 4836 wrote to memory of 5004 4836 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe powershell.exe PID 4836 wrote to memory of 5004 4836 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe powershell.exe PID 4836 wrote to memory of 3384 4836 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe powershell.exe PID 4836 wrote to memory of 3384 4836 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe powershell.exe PID 4836 wrote to memory of 928 4836 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe powershell.exe PID 4836 wrote to memory of 928 4836 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe powershell.exe PID 4836 wrote to memory of 4444 4836 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe powershell.exe PID 4836 wrote to memory of 4444 4836 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe powershell.exe PID 4836 wrote to memory of 5076 4836 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe cmd.exe PID 4836 wrote to memory of 5076 4836 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe cmd.exe PID 5076 wrote to memory of 1812 5076 cmd.exe w32tm.exe PID 5076 wrote to memory of 1812 5076 cmd.exe w32tm.exe PID 5076 wrote to memory of 1680 5076 cmd.exe 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe PID 5076 wrote to memory of 1680 5076 cmd.exe 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe PID 1680 wrote to memory of 4376 1680 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe tmpE7E4.tmp.exe PID 1680 wrote to memory of 4376 1680 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe tmpE7E4.tmp.exe PID 1680 wrote to memory of 4376 1680 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe tmpE7E4.tmp.exe PID 4376 wrote to memory of 2016 4376 tmpE7E4.tmp.exe tmpE7E4.tmp.exe PID 4376 wrote to memory of 2016 4376 tmpE7E4.tmp.exe tmpE7E4.tmp.exe PID 4376 wrote to memory of 2016 4376 tmpE7E4.tmp.exe tmpE7E4.tmp.exe PID 4376 wrote to memory of 2016 4376 tmpE7E4.tmp.exe tmpE7E4.tmp.exe PID 4376 wrote to memory of 2016 4376 tmpE7E4.tmp.exe tmpE7E4.tmp.exe PID 4376 wrote to memory of 2016 4376 tmpE7E4.tmp.exe tmpE7E4.tmp.exe PID 4376 wrote to memory of 2016 4376 tmpE7E4.tmp.exe tmpE7E4.tmp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe"C:\Users\Admin\AppData\Local\Temp\148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmpAF5F.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpAF5F.tmp.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmpAF5F.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpAF5F.tmp.exe"3⤵
- Executes dropped EXE
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/odt/'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\70ii7DKPqj.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:23⤵
-
C:\Recovery\WindowsRE\148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe"C:\Recovery\WindowsRE\148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmpE7E4.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE7E4.tmp.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmpE7E4.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE7E4.tmp.exe"5⤵
- Executes dropped EXE
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec11" /sc MINUTE /mo 5 /tr "'C:\Users\Public\Videos\148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1" /sc ONLOGON /tr "'C:\Users\Public\Videos\148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec11" /sc MINUTE /mo 5 /tr "'C:\Users\Public\Videos\148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\odt\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 12 /tr "'C:\odt\WmiPrvSE.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 12 /tr "'C:\odt\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec11" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec11" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\explorer.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\Default User\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\odt\explorer.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\odt\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\odt\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec11" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec11" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 5 /tr "'C:\Windows\twain_32\OfficeClickToRun.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Windows\twain_32\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 14 /tr "'C:\Windows\twain_32\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Program Files\Java\jre1.8.0_66\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Java\jre1.8.0_66\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Program Files\Java\jre1.8.0_66\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Windows\Tasks\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Windows\Tasks\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\Tasks\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Recovery\WindowsRE\148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exeFilesize
2.0MB
MD5443880cbb37d23e8c3846e0b3c7f7358
SHA10824425675beced43463ee3943f745f4dd4f9110
SHA256148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1
SHA5125ca14e9a0ab251e30deb47383f20f8d288e34086bbf2e75438e6907e31e9128a49373dba29cedaef95e5cb228efdd69b39a4e14ef761b7d95dabd3b33ad0c766
-
C:\Recovery\WindowsRE\148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exeFilesize
2.0MB
MD5443880cbb37d23e8c3846e0b3c7f7358
SHA10824425675beced43463ee3943f745f4dd4f9110
SHA256148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1
SHA5125ca14e9a0ab251e30deb47383f20f8d288e34086bbf2e75438e6907e31e9128a49373dba29cedaef95e5cb228efdd69b39a4e14ef761b7d95dabd3b33ad0c766
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe.logFilesize
1KB
MD5952ebf2048b5eee2cdfb9cd132672817
SHA1401e59f2113dbbcc9c13fcb5fe8464c95868ea29
SHA2567c847fe07d8d61c3a994c4bcf0e2bdd527d168121d8497769945e778be23c1ac
SHA512f86fceee3e28a75a866a31a52dc092d95c272ad175fc1445ff3168a09ed1c55d75404ff3cea023c2a9fb99263cb1bce860e27bda6a3cfa4f4834e27fae94d188
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5e8ce785f8ccc6d202d56fefc59764945
SHA1ca032c62ddc5e0f26d84eff9895eb87f14e15960
SHA256d85c19fc6b9d25e2168a2cc50ff38bd226fbf4f02aa7ac038a5f319522d2ffa4
SHA51266460aec4afee582556270f8ee6048d130a090f1c12a2632ed71a99a4073e9931e9e1cc286e32debffb95a90bd955f0f0d6ec891b1c5cd2f0aae41eb6d25832f
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5ecceac16628651c18879d836acfcb062
SHA1420502b3e5220a01586c59504e94aa1ee11982c9
SHA25658238de09a8817ed9f894ed8e5bf06a897fd08e0b0bd77e508d37b2598edd2a9
SHA512be3c7cb529cafb00f58790a6f8b35c4ff6db9f7f43a507d2218fd80cebc88413e46f71b1bc35b8afcc36b68f9409c946470d1e74a4fe225400eeb6f3f898f5b3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD53a6bad9528f8e23fb5c77fbd81fa28e8
SHA1f127317c3bc6407f536c0f0600dcbcf1aabfba36
SHA256986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
SHA512846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD53a6bad9528f8e23fb5c77fbd81fa28e8
SHA1f127317c3bc6407f536c0f0600dcbcf1aabfba36
SHA256986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
SHA512846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5e243a38635ff9a06c87c2a61a2200656
SHA1ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc
SHA256af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f
SHA5124418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5e243a38635ff9a06c87c2a61a2200656
SHA1ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc
SHA256af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f
SHA5124418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5e243a38635ff9a06c87c2a61a2200656
SHA1ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc
SHA256af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f
SHA5124418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5ecceac16628651c18879d836acfcb062
SHA1420502b3e5220a01586c59504e94aa1ee11982c9
SHA25658238de09a8817ed9f894ed8e5bf06a897fd08e0b0bd77e508d37b2598edd2a9
SHA512be3c7cb529cafb00f58790a6f8b35c4ff6db9f7f43a507d2218fd80cebc88413e46f71b1bc35b8afcc36b68f9409c946470d1e74a4fe225400eeb6f3f898f5b3
-
C:\Users\Admin\AppData\Local\Temp\70ii7DKPqj.batFilesize
255B
MD5f14e56cac8885e9a33b61fa3e74b0751
SHA1f216c91e62d34ea6e9ea5fdefd5fe201ac7012e2
SHA256ee41ed79c136032912191f1e0b23b35f9db706da6f55400372f663dedc0cb526
SHA51253a168021d061fd8c9d55bff7827a2daf8f0c8838085b70cf379cc8828c62ebfeb00273a4e03b896f4117726129f108e0c99387f2f097440f886fb760a6ff0e1
-
C:\Users\Admin\AppData\Local\Temp\tmpAF5F.tmp.exeFilesize
52KB
MD5d8e1495b46cded57eb1423b8bb789834
SHA1db64bc20550e51c602dbb92d07c8f02842efebcc
SHA256aa2d97b5be06be67ec04774ad681da6113ee2b4929c0539929bbac19926682c8
SHA5128b785d7f8d5fdf12dd9a5414050d403e861fd3f9ac09bceebc57b2f178c6f145389783ed1035b5e6f9b627b3d4d978f3ad9bf8195d92e20f585ef92667e4cabb
-
C:\Users\Admin\AppData\Local\Temp\tmpAF5F.tmp.exeFilesize
52KB
MD5d8e1495b46cded57eb1423b8bb789834
SHA1db64bc20550e51c602dbb92d07c8f02842efebcc
SHA256aa2d97b5be06be67ec04774ad681da6113ee2b4929c0539929bbac19926682c8
SHA5128b785d7f8d5fdf12dd9a5414050d403e861fd3f9ac09bceebc57b2f178c6f145389783ed1035b5e6f9b627b3d4d978f3ad9bf8195d92e20f585ef92667e4cabb
-
C:\Users\Admin\AppData\Local\Temp\tmpAF5F.tmp.exeFilesize
52KB
MD5d8e1495b46cded57eb1423b8bb789834
SHA1db64bc20550e51c602dbb92d07c8f02842efebcc
SHA256aa2d97b5be06be67ec04774ad681da6113ee2b4929c0539929bbac19926682c8
SHA5128b785d7f8d5fdf12dd9a5414050d403e861fd3f9ac09bceebc57b2f178c6f145389783ed1035b5e6f9b627b3d4d978f3ad9bf8195d92e20f585ef92667e4cabb
-
C:\Users\Admin\AppData\Local\Temp\tmpE7E4.tmp.exeFilesize
52KB
MD5d8e1495b46cded57eb1423b8bb789834
SHA1db64bc20550e51c602dbb92d07c8f02842efebcc
SHA256aa2d97b5be06be67ec04774ad681da6113ee2b4929c0539929bbac19926682c8
SHA5128b785d7f8d5fdf12dd9a5414050d403e861fd3f9ac09bceebc57b2f178c6f145389783ed1035b5e6f9b627b3d4d978f3ad9bf8195d92e20f585ef92667e4cabb
-
C:\Users\Admin\AppData\Local\Temp\tmpE7E4.tmp.exeFilesize
52KB
MD5d8e1495b46cded57eb1423b8bb789834
SHA1db64bc20550e51c602dbb92d07c8f02842efebcc
SHA256aa2d97b5be06be67ec04774ad681da6113ee2b4929c0539929bbac19926682c8
SHA5128b785d7f8d5fdf12dd9a5414050d403e861fd3f9ac09bceebc57b2f178c6f145389783ed1035b5e6f9b627b3d4d978f3ad9bf8195d92e20f585ef92667e4cabb
-
C:\Users\Admin\AppData\Local\Temp\tmpE7E4.tmp.exeFilesize
52KB
MD5d8e1495b46cded57eb1423b8bb789834
SHA1db64bc20550e51c602dbb92d07c8f02842efebcc
SHA256aa2d97b5be06be67ec04774ad681da6113ee2b4929c0539929bbac19926682c8
SHA5128b785d7f8d5fdf12dd9a5414050d403e861fd3f9ac09bceebc57b2f178c6f145389783ed1035b5e6f9b627b3d4d978f3ad9bf8195d92e20f585ef92667e4cabb
-
memory/392-142-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/392-144-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/392-141-0x0000000000000000-mapping.dmp
-
memory/888-146-0x0000000000000000-mapping.dmp
-
memory/888-164-0x00007FFCEED30000-0x00007FFCEF7F1000-memory.dmpFilesize
10.8MB
-
memory/888-178-0x00007FFCEED30000-0x00007FFCEF7F1000-memory.dmpFilesize
10.8MB
-
memory/928-191-0x00007FFCEED30000-0x00007FFCEF7F1000-memory.dmpFilesize
10.8MB
-
memory/928-155-0x0000000000000000-mapping.dmp
-
memory/928-172-0x00007FFCEED30000-0x00007FFCEF7F1000-memory.dmpFilesize
10.8MB
-
memory/1008-186-0x00007FFCEED30000-0x00007FFCEF7F1000-memory.dmpFilesize
10.8MB
-
memory/1008-151-0x0000000000000000-mapping.dmp
-
memory/1008-168-0x00007FFCEED30000-0x00007FFCEF7F1000-memory.dmpFilesize
10.8MB
-
memory/1088-185-0x00007FFCEED30000-0x00007FFCEF7F1000-memory.dmpFilesize
10.8MB
-
memory/1088-166-0x00007FFCEED30000-0x00007FFCEF7F1000-memory.dmpFilesize
10.8MB
-
memory/1088-152-0x0000000000000000-mapping.dmp
-
memory/1680-206-0x00007FFCEE9E0000-0x00007FFCEF4A1000-memory.dmpFilesize
10.8MB
-
memory/1680-195-0x0000000000000000-mapping.dmp
-
memory/1680-207-0x00007FFCEE9E0000-0x00007FFCEF4A1000-memory.dmpFilesize
10.8MB
-
memory/1680-199-0x00007FFCEE9E0000-0x00007FFCEF4A1000-memory.dmpFilesize
10.8MB
-
memory/1812-171-0x0000000000000000-mapping.dmp
-
memory/1868-147-0x0000000000000000-mapping.dmp
-
memory/1868-160-0x00007FFCEED30000-0x00007FFCEF7F1000-memory.dmpFilesize
10.8MB
-
memory/1868-176-0x00007FFCEED30000-0x00007FFCEF7F1000-memory.dmpFilesize
10.8MB
-
memory/1868-156-0x0000025F40100000-0x0000025F40122000-memory.dmpFilesize
136KB
-
memory/2016-203-0x0000000000000000-mapping.dmp
-
memory/2788-137-0x0000000000000000-mapping.dmp
-
memory/3384-154-0x0000000000000000-mapping.dmp
-
memory/3384-169-0x00007FFCEED30000-0x00007FFCEF7F1000-memory.dmpFilesize
10.8MB
-
memory/3384-192-0x00007FFCEED30000-0x00007FFCEF7F1000-memory.dmpFilesize
10.8MB
-
memory/4108-145-0x0000000000000000-mapping.dmp
-
memory/4108-159-0x00007FFCEED30000-0x00007FFCEF7F1000-memory.dmpFilesize
10.8MB
-
memory/4108-179-0x00007FFCEED30000-0x00007FFCEF7F1000-memory.dmpFilesize
10.8MB
-
memory/4376-200-0x0000000000000000-mapping.dmp
-
memory/4384-183-0x00007FFCEED30000-0x00007FFCEF7F1000-memory.dmpFilesize
10.8MB
-
memory/4384-149-0x0000000000000000-mapping.dmp
-
memory/4384-162-0x00007FFCEED30000-0x00007FFCEF7F1000-memory.dmpFilesize
10.8MB
-
memory/4444-173-0x00007FFCEED30000-0x00007FFCEF7F1000-memory.dmpFilesize
10.8MB
-
memory/4444-194-0x00007FFCEED30000-0x00007FFCEF7F1000-memory.dmpFilesize
10.8MB
-
memory/4444-157-0x0000000000000000-mapping.dmp
-
memory/4680-165-0x00007FFCEED30000-0x00007FFCEF7F1000-memory.dmpFilesize
10.8MB
-
memory/4680-150-0x0000000000000000-mapping.dmp
-
memory/4680-181-0x00007FFCEED30000-0x00007FFCEF7F1000-memory.dmpFilesize
10.8MB
-
memory/4756-148-0x0000000000000000-mapping.dmp
-
memory/4756-163-0x00007FFCEED30000-0x00007FFCEF7F1000-memory.dmpFilesize
10.8MB
-
memory/4756-180-0x00007FFCEED30000-0x00007FFCEF7F1000-memory.dmpFilesize
10.8MB
-
memory/4836-161-0x00007FFCEED30000-0x00007FFCEF7F1000-memory.dmpFilesize
10.8MB
-
memory/4836-135-0x0000000000C00000-0x0000000000E04000-memory.dmpFilesize
2.0MB
-
memory/4836-140-0x000000001CB50000-0x000000001CBA0000-memory.dmpFilesize
320KB
-
memory/4836-136-0x00007FFCEED30000-0x00007FFCEF7F1000-memory.dmpFilesize
10.8MB
-
memory/5004-153-0x0000000000000000-mapping.dmp
-
memory/5004-190-0x00007FFCEED30000-0x00007FFCEF7F1000-memory.dmpFilesize
10.8MB
-
memory/5004-170-0x00007FFCEED30000-0x00007FFCEF7F1000-memory.dmpFilesize
10.8MB
-
memory/5076-158-0x0000000000000000-mapping.dmp