laplas | bf4cf1798ba35624c5f589e3cb81f752b35262fc7c6458082a7b0d44ba6510dc

Analysis

max time kernel
107s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
06-04-2023 12:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Setup.exe
Size

1023.0MB
MD5

20435727abd593f6db2379c748289799
SHA1

12db6bce4173a977c0ad4de36a16f152dbcf5e49
SHA256

0f28b51ca82edd77e6d7f3626c8b66e6f04f6dfe48ff594f77ec6746a3c91968
SHA512

df5bc6ec08ac446b4add78cf9d657c2d7339d1cc69ca34f5c0b1881da05f6c8001791367299bdb1429f79aba626bdc110dfe50de6f1348155de5cc28f7752c78
SSDEEP

196608:4+hMmu0Vro/dFqg4cF3VjgY7lEGpDltGgC891SWAo0G:41m3OMEljl7lPftGgPuDr

Score

10^/10

laplas vidar 49bd1304650cc9c7f3f131428d9e16c2 bootkit clipper discovery evasion persistence spyware stealer trojan

Malware Config

Extracted

Family

vidar

Version

3.3

Botnet

49bd1304650cc9c7f3f131428d9e16c2

https://steamcommunity.com/profiles/76561199492257783

https://t.me/justsometg

Attributes

profile_id_v2
49bd1304650cc9c7f3f131428d9e16c2
user_agent
Mozilla/5.0 (X11; Linux 3.5.4-1-ARCH i686; es) KHTML/4.9.1 (like Gecko) Konqueror/4.9

Extracted

Family

laplas

http://45.159.189.105

Attributes

api_key
6a2714906f1325d666e4cf9f6269c2352ccfb7e7f1a23c114287dc69ddf27cb0

Signatures

Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas

Suspicious use of NtCreateUserProcessOtherParentProcess 6 IoCs

description	pid	Process	procid_target
PID 3748 created 3152	3748	97095732896179926616.exe	46
PID 3748 created 3152	3748	97095732896179926616.exe	46
PID 3748 created 3152	3748	97095732896179926616.exe	46
PID 3748 created 3152	3748	97095732896179926616.exe	46
PID 3748 created 3152	3748	97095732896179926616.exe	46
PID 3652 created 3152	3652	updater.exe	46

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Setup.exe

Downloads MZ/PE file

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\drivers\etc\hosts	97095732896179926616.exe

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Setup.exe

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	Setup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	Setup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	72582125044977763627.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	72582125044977763627.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	svcservice.exe

Executes dropped EXE 6 IoCs

pid	Process
3404	60785919917096625484.exe
864	72582125044977763627.exe
3748	97095732896179926616.exe
3596	72582125044977763627.exe
3652	updater.exe
1688	svcservice.exe

Loads dropped DLL 2 IoCs

pid	Process
4772	Setup.exe
4772	Setup.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\telemetry = "C:\\Users\\Admin\\AppData\\Roaming\\telemetry\\svcservice.exe"	72582125044977763627.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Setup.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	Setup.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3372	Setup.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3372 set thread context of 4772	3372	Setup.exe	93
PID 864 set thread context of 3596	864	72582125044977763627.exe	106

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\updater.exe	97095732896179926616.exe

Launches sc.exe 10 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5052	sc.exe
3780	sc.exe
4756	sc.exe
2804	sc.exe
672	sc.exe
2844	sc.exe
2484	sc.exe
1280	sc.exe
544	sc.exe
3608	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Setup.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1792	timeout.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3372	Setup.exe
3372	Setup.exe
3560	powershell.exe
3560	powershell.exe
3372	Setup.exe
3372	Setup.exe
4772	Setup.exe
4772	Setup.exe
864	72582125044977763627.exe
864	72582125044977763627.exe
864	72582125044977763627.exe
864	72582125044977763627.exe
864	72582125044977763627.exe
864	72582125044977763627.exe
864	72582125044977763627.exe
864	72582125044977763627.exe
864	72582125044977763627.exe
864	72582125044977763627.exe
864	72582125044977763627.exe
864	72582125044977763627.exe
3368	powershell.exe
3368	powershell.exe
864	72582125044977763627.exe
864	72582125044977763627.exe
864	72582125044977763627.exe
864	72582125044977763627.exe
864	72582125044977763627.exe
864	72582125044977763627.exe
864	72582125044977763627.exe
864	72582125044977763627.exe
864	72582125044977763627.exe
864	72582125044977763627.exe
864	72582125044977763627.exe
864	72582125044977763627.exe
864	72582125044977763627.exe
864	72582125044977763627.exe
864	72582125044977763627.exe
864	72582125044977763627.exe
864	72582125044977763627.exe
864	72582125044977763627.exe
864	72582125044977763627.exe
864	72582125044977763627.exe
864	72582125044977763627.exe
864	72582125044977763627.exe
864	72582125044977763627.exe
864	72582125044977763627.exe
864	72582125044977763627.exe
864	72582125044977763627.exe
864	72582125044977763627.exe
864	72582125044977763627.exe
864	72582125044977763627.exe
864	72582125044977763627.exe
864	72582125044977763627.exe
864	72582125044977763627.exe
864	72582125044977763627.exe
864	72582125044977763627.exe
864	72582125044977763627.exe
864	72582125044977763627.exe
864	72582125044977763627.exe
864	72582125044977763627.exe
864	72582125044977763627.exe
864	72582125044977763627.exe
864	72582125044977763627.exe
864	72582125044977763627.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3560	powershell.exe
Token: SeDebugPrivilege	3372	Setup.exe
Token: SeDebugPrivilege	864	72582125044977763627.exe
Token: SeDebugPrivilege	3368	powershell.exe
Token: SeDebugPrivilege	3688	powershell.exe
Token: SeShutdownPrivilege	2920	powercfg.exe
Token: SeCreatePagefilePrivilege	2920	powercfg.exe
Token: SeDebugPrivilege	2924	powershell.exe
Token: SeShutdownPrivilege	3696	powercfg.exe
Token: SeCreatePagefilePrivilege	3696	powercfg.exe
Token: SeShutdownPrivilege	828	powercfg.exe
Token: SeCreatePagefilePrivilege	828	powercfg.exe
Token: SeShutdownPrivilege	2576	powercfg.exe
Token: SeCreatePagefilePrivilege	2576	powercfg.exe
Token: SeIncreaseQuotaPrivilege	2924	powershell.exe
Token: SeSecurityPrivilege	2924	powershell.exe
Token: SeTakeOwnershipPrivilege	2924	powershell.exe
Token: SeLoadDriverPrivilege	2924	powershell.exe
Token: SeSystemProfilePrivilege	2924	powershell.exe
Token: SeSystemtimePrivilege	2924	powershell.exe
Token: SeProfSingleProcessPrivilege	2924	powershell.exe
Token: SeIncBasePriorityPrivilege	2924	powershell.exe
Token: SeCreatePagefilePrivilege	2924	powershell.exe
Token: SeBackupPrivilege	2924	powershell.exe
Token: SeRestorePrivilege	2924	powershell.exe
Token: SeShutdownPrivilege	2924	powershell.exe
Token: SeDebugPrivilege	2924	powershell.exe
Token: SeSystemEnvironmentPrivilege	2924	powershell.exe
Token: SeRemoteShutdownPrivilege	2924	powershell.exe
Token: SeUndockPrivilege	2924	powershell.exe
Token: SeManageVolumePrivilege	2924	powershell.exe
Token: 33	2924	powershell.exe
Token: 34	2924	powershell.exe
Token: 35	2924	powershell.exe
Token: 36	2924	powershell.exe
Token: SeIncreaseQuotaPrivilege	2924	powershell.exe
Token: SeSecurityPrivilege	2924	powershell.exe
Token: SeTakeOwnershipPrivilege	2924	powershell.exe
Token: SeLoadDriverPrivilege	2924	powershell.exe
Token: SeSystemProfilePrivilege	2924	powershell.exe
Token: SeSystemtimePrivilege	2924	powershell.exe
Token: SeProfSingleProcessPrivilege	2924	powershell.exe
Token: SeIncBasePriorityPrivilege	2924	powershell.exe
Token: SeCreatePagefilePrivilege	2924	powershell.exe
Token: SeBackupPrivilege	2924	powershell.exe
Token: SeRestorePrivilege	2924	powershell.exe
Token: SeShutdownPrivilege	2924	powershell.exe
Token: SeDebugPrivilege	2924	powershell.exe
Token: SeSystemEnvironmentPrivilege	2924	powershell.exe
Token: SeRemoteShutdownPrivilege	2924	powershell.exe
Token: SeUndockPrivilege	2924	powershell.exe
Token: SeManageVolumePrivilege	2924	powershell.exe
Token: 33	2924	powershell.exe
Token: 34	2924	powershell.exe
Token: 35	2924	powershell.exe
Token: 36	2924	powershell.exe
Token: SeIncreaseQuotaPrivilege	2924	powershell.exe
Token: SeSecurityPrivilege	2924	powershell.exe
Token: SeTakeOwnershipPrivilege	2924	powershell.exe
Token: SeLoadDriverPrivilege	2924	powershell.exe
Token: SeSystemProfilePrivilege	2924	powershell.exe
Token: SeSystemtimePrivilege	2924	powershell.exe
Token: SeProfSingleProcessPrivilege	2924	powershell.exe
Token: SeIncBasePriorityPrivilege	2924	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3372 wrote to memory of 3560	3372	Setup.exe	89
PID 3372 wrote to memory of 3560	3372	Setup.exe	89
PID 3372 wrote to memory of 3560	3372	Setup.exe	89
PID 3372 wrote to memory of 1356	3372	Setup.exe	92
PID 3372 wrote to memory of 1356	3372	Setup.exe	92
PID 3372 wrote to memory of 1356	3372	Setup.exe	92
PID 3372 wrote to memory of 4772	3372	Setup.exe	93
PID 3372 wrote to memory of 4772	3372	Setup.exe	93
PID 3372 wrote to memory of 4772	3372	Setup.exe	93
PID 3372 wrote to memory of 4772	3372	Setup.exe	93
PID 3372 wrote to memory of 4772	3372	Setup.exe	93
PID 3372 wrote to memory of 4772	3372	Setup.exe	93
PID 3372 wrote to memory of 4772	3372	Setup.exe	93
PID 3372 wrote to memory of 4772	3372	Setup.exe	93
PID 3372 wrote to memory of 4772	3372	Setup.exe	93
PID 4772 wrote to memory of 3404	4772	Setup.exe	94
PID 4772 wrote to memory of 3404	4772	Setup.exe	94
PID 3404 wrote to memory of 2700	3404	60785919917096625484.exe	96
PID 3404 wrote to memory of 2700	3404	60785919917096625484.exe	96
PID 2700 wrote to memory of 3792	2700	cmd.exe	98
PID 2700 wrote to memory of 3792	2700	cmd.exe	98
PID 4772 wrote to memory of 864	4772	Setup.exe	99
PID 4772 wrote to memory of 864	4772	Setup.exe	99
PID 4772 wrote to memory of 864	4772	Setup.exe	99
PID 864 wrote to memory of 3368	864	72582125044977763627.exe	100
PID 864 wrote to memory of 3368	864	72582125044977763627.exe	100
PID 864 wrote to memory of 3368	864	72582125044977763627.exe	100
PID 4772 wrote to memory of 3748	4772	Setup.exe	102
PID 4772 wrote to memory of 3748	4772	Setup.exe	102
PID 4772 wrote to memory of 4924	4772	Setup.exe	103
PID 4772 wrote to memory of 4924	4772	Setup.exe	103
PID 4772 wrote to memory of 4924	4772	Setup.exe	103
PID 4924 wrote to memory of 1792	4924	cmd.exe	105
PID 4924 wrote to memory of 1792	4924	cmd.exe	105
PID 4924 wrote to memory of 1792	4924	cmd.exe	105
PID 864 wrote to memory of 3596	864	72582125044977763627.exe	106
PID 864 wrote to memory of 3596	864	72582125044977763627.exe	106
PID 864 wrote to memory of 3596	864	72582125044977763627.exe	106
PID 864 wrote to memory of 3596	864	72582125044977763627.exe	106
PID 864 wrote to memory of 3596	864	72582125044977763627.exe	106
PID 864 wrote to memory of 3596	864	72582125044977763627.exe	106
PID 864 wrote to memory of 3596	864	72582125044977763627.exe	106
PID 864 wrote to memory of 3596	864	72582125044977763627.exe	106
PID 864 wrote to memory of 3596	864	72582125044977763627.exe	106
PID 864 wrote to memory of 3596	864	72582125044977763627.exe	106
PID 840 wrote to memory of 672	840	cmd.exe	112
PID 840 wrote to memory of 672	840	cmd.exe	112
PID 840 wrote to memory of 2844	840	cmd.exe	113
PID 840 wrote to memory of 2844	840	cmd.exe	113
PID 840 wrote to memory of 2484	840	cmd.exe	114
PID 840 wrote to memory of 2484	840	cmd.exe	114
PID 840 wrote to memory of 5052	840	cmd.exe	115
PID 840 wrote to memory of 5052	840	cmd.exe	115
PID 840 wrote to memory of 1280	840	cmd.exe	116
PID 840 wrote to memory of 1280	840	cmd.exe	116
PID 3396 wrote to memory of 2920	3396	cmd.exe	121
PID 3396 wrote to memory of 2920	3396	cmd.exe	121
PID 3396 wrote to memory of 3696	3396	cmd.exe	122
PID 3396 wrote to memory of 3696	3396	cmd.exe	122
PID 3396 wrote to memory of 828	3396	cmd.exe	123
PID 3396 wrote to memory of 828	3396	cmd.exe	123
PID 3396 wrote to memory of 2576	3396	cmd.exe	124
PID 3396 wrote to memory of 2576	3396	cmd.exe	124
PID 3596 wrote to memory of 1688	3596	72582125044977763627.exe	107

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3152
- C:\Users\Admin\AppData\Local\Temp\Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Checks computer location settings
  - Checks whether UAC is enabled
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3372
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMQA1AA==
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3560
- - C:\Users\Admin\AppData\Local\Temp\Setup.exe
    C:\Users\Admin\AppData\Local\Temp\Setup.exe
    3⤵
    PID:1356
- - C:\Users\Admin\AppData\Local\Temp\Setup.exe
    C:\Users\Admin\AppData\Local\Temp\Setup.exe
    3⤵
    - Checks computer location settings
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4772
  - - C:\ProgramData\60785919917096625484.exe
      "C:\ProgramData\60785919917096625484.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3404
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /C choice /C Y /N /D Y /T 0 &Del C:\ProgramData\60785919917096625484.exe
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2700
      - C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 0
        6⤵
        
        PID:3792
  - - C:\ProgramData\72582125044977763627.exe
      "C:\ProgramData\72582125044977763627.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:864
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMQA1AA==
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3368
    - - C:\ProgramData\72582125044977763627.exe
        
        C:\ProgramData\72582125044977763627.exe
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:3596
      - C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe
        
        "C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:1688
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMQA1AA==
        7⤵
        
        PID:4164
        
        C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe
        
        C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe
        7⤵
        
        PID:216
  - - C:\ProgramData\97095732896179926616.exe
      "C:\ProgramData\97095732896179926616.exe"
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Drops file in Drivers directory
      Executes dropped EXE
      Drops file in Program Files directory
      PID:3748
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\Setup.exe" & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4924
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        5⤵
        Delays execution with timeout.exe
        
        PID:1792
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3688
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:840
- - C:\Windows\System32\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:672
- - C:\Windows\System32\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:2844
- - C:\Windows\System32\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:2484
- - C:\Windows\System32\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    PID:5052
- - C:\Windows\System32\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    PID:1280
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#rxejhfcm#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2924
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3396
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2920
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3696
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:828
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2576
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
  2⤵
  PID:2228
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  - Modifies data under HKEY_USERS
  PID:2256
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
  2⤵
  PID:3084
- - C:\Windows\System32\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:544
- - C:\Windows\System32\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:3780
- - C:\Windows\System32\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:4756
- - C:\Windows\System32\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    PID:2804
- - C:\Windows\System32\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    PID:3608
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
  2⤵
  PID:4200
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-ac 0
    3⤵
    PID:1376
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-dc 0
    3⤵
    PID:4712
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-ac 0
    3⤵
    PID:3692
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-dc 0
    3⤵
    PID:904
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#rxejhfcm#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
  2⤵
  PID:4696

C:\Program Files\Google\Chrome\updater.exe
"C:\Program Files\Google\Chrome\updater.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
PID:3652

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Google\Chrome\updater.exe

Filesize
9.9MB

MD5
6fa2a8de3fc30b9c80d12c2ac4ad2e3f

SHA1
32fd7a00979b4ec01c031fdfbf12677529e6c4fa

SHA256
a2c59381ca2fdba45f345eec78681fc417271e2f3fb65ff9ec06998d90abc9fd

SHA512
9c51ac0abcab4b8e40b476dbb8e7aaff7a6057caf07756a1a846193bf9d4924fbe0f3f0847237029ecb6f840f658eb41fe43bb89dc7c74be6727c3ee12fe953e

Download Submit
C:\ProgramData\60785919917096625484.exe

Filesize
13.9MB

MD5
0abca5a76379dc774f4c133a177cde59

SHA1
5c7c48d7f3fea2c5e5f950cf83492cda82fda838

SHA256
59a16f9faf29768ed027a33dced3dc1cd61c4be814b59070b3ce79e34bb6b963

SHA512
dd3176ce1e26992be85022a0a9825520496d20a3a7d09b44a4ddedc05511668411f16733efcb82f80f105fef94c2bfa59f9fe908ef281de65f585a1448b668c7

Download Submit
C:\ProgramData\60785919917096625484.exe

Filesize
13.9MB

MD5
0abca5a76379dc774f4c133a177cde59

SHA1
5c7c48d7f3fea2c5e5f950cf83492cda82fda838

SHA256
59a16f9faf29768ed027a33dced3dc1cd61c4be814b59070b3ce79e34bb6b963

SHA512
dd3176ce1e26992be85022a0a9825520496d20a3a7d09b44a4ddedc05511668411f16733efcb82f80f105fef94c2bfa59f9fe908ef281de65f585a1448b668c7

Download Submit
C:\ProgramData\60785919917096625484.exe

Filesize
13.9MB

MD5
0abca5a76379dc774f4c133a177cde59

SHA1
5c7c48d7f3fea2c5e5f950cf83492cda82fda838

SHA256
59a16f9faf29768ed027a33dced3dc1cd61c4be814b59070b3ce79e34bb6b963

SHA512
dd3176ce1e26992be85022a0a9825520496d20a3a7d09b44a4ddedc05511668411f16733efcb82f80f105fef94c2bfa59f9fe908ef281de65f585a1448b668c7

Download Submit
C:\ProgramData\72582125044977763627.exe

Filesize
5.9MB

MD5
aa57f0d7a099773175006624cc891b29

SHA1
44598d94dac6e9c72ffe65f9e17cf77c2c73e6fe

SHA256
6227df9ce53429b024cb2fa118a7a735ec1c048117cb1a46247e92f1b839814f

SHA512
e0fff8e7d8de1dc5b3d84bdea90828f9739499183aabb11eb5b7600af132f8fa0569bc49d4ca21ec5df925482ec2149d0134a88a4e8a632cb0326444a6bc31b0

Download Submit
C:\ProgramData\72582125044977763627.exe

Filesize
5.9MB

MD5
aa57f0d7a099773175006624cc891b29

SHA1
44598d94dac6e9c72ffe65f9e17cf77c2c73e6fe

SHA256
6227df9ce53429b024cb2fa118a7a735ec1c048117cb1a46247e92f1b839814f

SHA512
e0fff8e7d8de1dc5b3d84bdea90828f9739499183aabb11eb5b7600af132f8fa0569bc49d4ca21ec5df925482ec2149d0134a88a4e8a632cb0326444a6bc31b0

Download Submit
C:\ProgramData\72582125044977763627.exe

Filesize
5.9MB

MD5
aa57f0d7a099773175006624cc891b29

SHA1
44598d94dac6e9c72ffe65f9e17cf77c2c73e6fe

SHA256
6227df9ce53429b024cb2fa118a7a735ec1c048117cb1a46247e92f1b839814f

SHA512
e0fff8e7d8de1dc5b3d84bdea90828f9739499183aabb11eb5b7600af132f8fa0569bc49d4ca21ec5df925482ec2149d0134a88a4e8a632cb0326444a6bc31b0

Download Submit
C:\ProgramData\72582125044977763627.exe

Filesize
5.9MB

MD5
aa57f0d7a099773175006624cc891b29

SHA1
44598d94dac6e9c72ffe65f9e17cf77c2c73e6fe

SHA256
6227df9ce53429b024cb2fa118a7a735ec1c048117cb1a46247e92f1b839814f

SHA512
e0fff8e7d8de1dc5b3d84bdea90828f9739499183aabb11eb5b7600af132f8fa0569bc49d4ca21ec5df925482ec2149d0134a88a4e8a632cb0326444a6bc31b0

Download Submit
C:\ProgramData\97095732896179926616.exe

Filesize
9.9MB

MD5
6fa2a8de3fc30b9c80d12c2ac4ad2e3f

SHA1
32fd7a00979b4ec01c031fdfbf12677529e6c4fa

SHA256
a2c59381ca2fdba45f345eec78681fc417271e2f3fb65ff9ec06998d90abc9fd

SHA512
9c51ac0abcab4b8e40b476dbb8e7aaff7a6057caf07756a1a846193bf9d4924fbe0f3f0847237029ecb6f840f658eb41fe43bb89dc7c74be6727c3ee12fe953e

Download Submit
C:\ProgramData\97095732896179926616.exe

Filesize
9.9MB

MD5
6fa2a8de3fc30b9c80d12c2ac4ad2e3f

SHA1
32fd7a00979b4ec01c031fdfbf12677529e6c4fa

SHA256
a2c59381ca2fdba45f345eec78681fc417271e2f3fb65ff9ec06998d90abc9fd

SHA512
9c51ac0abcab4b8e40b476dbb8e7aaff7a6057caf07756a1a846193bf9d4924fbe0f3f0847237029ecb6f840f658eb41fe43bb89dc7c74be6727c3ee12fe953e

Download Submit
C:\ProgramData\97095732896179926616.exe

Filesize
9.9MB

MD5
6fa2a8de3fc30b9c80d12c2ac4ad2e3f

SHA1
32fd7a00979b4ec01c031fdfbf12677529e6c4fa

SHA256
a2c59381ca2fdba45f345eec78681fc417271e2f3fb65ff9ec06998d90abc9fd

SHA512
9c51ac0abcab4b8e40b476dbb8e7aaff7a6057caf07756a1a846193bf9d4924fbe0f3f0847237029ecb6f840f658eb41fe43bb89dc7c74be6727c3ee12fe953e

Download Submit
C:\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
622bf737a997b9a257f15dc3b9ee9da5

SHA1
6beba023f9c081393b64de079969e948a47be8be

SHA256
bcefb9a5dbc47579f8b52cc37fd7591a0e20f00f0a7867df0232088db90273d7

SHA512
c1833c09ef0b3e643b8657874e8a99d7d154ac255c326d85fccba53aa57679e7dad93e61b3b8419937cb7ad936eab727c5edd6c4be6b988982c1d61505305e77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
1KB

MD5
4280e36a29fa31c01e4d8b2ba726a0d8

SHA1
c485c2c9ce0a99747b18d899b71dfa9a64dabe32

SHA256
e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359

SHA512
494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
53KB

MD5
06ad34f9739c5159b4d92d702545bd49

SHA1
9152a0d4f153f3f40f7e606be75f81b582ee0c17

SHA256
474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba

SHA512
c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
16KB

MD5
e43ce2e13c3fd34b68f5102cd50dd42b

SHA1
2aab7ee1d38d6c421ed3cb5b6320efe9793970c8

SHA256
d62503f3a8e5662fa5d5d7d873146235b13d40a0842127cec5bf938a30be3e5a

SHA512
feca119dc004be29af8e97285b6339738047289c6610826157fa1ed67d8c25d8723e787d5b78de3eb741368900a82560cdb29742ba49d12960ee73216cf658d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
15KB

MD5
df18d0e4177ecbfb5419a14fa7b36cee

SHA1
00f0f004c5fb6d8c84fe528fc833c6cb962b44fe

SHA256
da8db5ffa16083afb1b6612b7fd78543e6e9f9c2c8bfff6bdc9986d4529cc112

SHA512
8399e54ff88a604d492683e40a50490ad85db337deda39179f732710b2837982094c2780a89d0d5c59976bd00497ab0203b97289c81f0324a446518838a8121b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
9b80cd7a712469a4c45fec564313d9eb

SHA1
6125c01bc10d204ca36ad1110afe714678655f2d

SHA256
5a9e4969c6cdb5d522c81ce55799effb7255c1b0a9966a936d1dc3ff8fe2112d

SHA512
ac280d2623c470c9dec94726a7af0612938723f3c7d60d727eb3c21f17be2f2049f97bc8303558be8b01f94406781ece0ada9a3bc51e930aff20bebb6ca17584

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
86798a85be626b523af4678231a63d32

SHA1
867b5fe8f4fa328794b832d48aec2a769790669b

SHA256
4584dd0e24edda81bd2893990332b4a2d567bba4889d0401ad48a6adf0bf6ef3

SHA512
89e07875abc0b40c5305db7c7b9218b41afe8a4b734fbe7c929ee20855429ad8ddade4f6bb53b1f5fd188b46f83af7e1bd610dfc9d26fabd17c64239a204d775

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xkztmmyk.yvz.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe

Filesize
522.4MB

MD5
6b24fc8db4462997bc5e3880e0edf0ba

SHA1
29dd23bee6de2936acf6a58081fdafba9be91ba1

SHA256
ca1ba8709d2d3f33858ef617e07fc0e298a54b251efa8ea408cfd76db0044718

SHA512
9d9f8fbf4c9846e277eadfb34fa0e06ac9e7860e98e229662147da483313dcf1ef1a588c76c680b306eb0af3abd56f9b1b92f2c328bf0a6080720d47db107b09

Download Submit
C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe

Filesize
521.2MB

MD5
11f73ade8d066d0ae81a80cbda4c514a

SHA1
d58d386bffe739cf3a3411f496ea79eb556832af

SHA256
7b8d5b2af50dc4663756fac1d4eea1b937b85f5f040837cba3802d8589a84e52

SHA512
66a45eebfe21b443699d600cbeb5229b4a4a4a52d1f122efbf3382a6b419c90396a870beeec9e8b27fc6e8100909f4c4af39a254768fdd9d2c22e22e77862bf5

Download Submit
C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe

Filesize
57.6MB

MD5
03e9aed5513ca3f7c0a2ed3b50126ebd

SHA1
c42760ea9ff3c2ae79ab296d7dbebe87cb4eb68f

SHA256
920e9e3bce99a20a40a63d0af9c70b859cfcf19fccab56208b82f5e248153a3f

SHA512
187ffafb86d7c18724f8aaf4b056259fa4984d78cc82106c557d12263e561b04f5af3056da153d50252b3cff18268383ae97046ee682290b801ad5ee7a3b9dbe

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
3KB

MD5
00930b40cba79465b7a38ed0449d1449

SHA1
4b25a89ee28b20ba162f23772ddaf017669092a5

SHA256
eda1aae2c8fce700e3bdbe0186cf3db88400cf0ac13ec736e84dacba61628a01

SHA512
cbe4760ec041e7da7ab86474d5c82969cfccb8ccc5dbdac9436862d5b1b86210ab90754d3c8da5724176570d8842e57a716a281acba8719e90098a6f61a17c62

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
4KB

MD5
bdb25c22d14ec917e30faf353826c5de

SHA1
6c2feb9cea9237bc28842ebf2fea68b3bd7ad190

SHA256
e3274ce8296f2cd20e3189576fbadbfa0f1817cdf313487945c80e968589a495

SHA512
b5eddbfd4748298a302e2963cfd12d849130b6dcb8f0f85a2a623caed0ff9bd88f4ec726f646dbebfca4964adc35f882ec205113920cb546cc08193739d6728c

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
b42c70c1dbf0d1d477ec86902db9e986

SHA1
1d1c0a670748b3d10bee8272e5d67a4fabefd31f

SHA256
8ed3b348989cdc967d1fc0e887b2a2f5a656680d8d14ebd3cb71a10c2f55867a

SHA512
57fb278a8b2e83d01fac2a031c90e0e2bd5e4c1a360cfa4308490eb07e1b9d265b1f28399d0f10b141a6438ba92dd5f9ce4f18530ec277fece0eb7678041cbc5

Download Submit
memory/216-453-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/216-448-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/216-446-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/864-311-0x0000000005440000-0x0000000005450000-memory.dmp

Filesize
64KB

Download
memory/864-286-0x0000000005440000-0x0000000005450000-memory.dmp

Filesize
64KB

Download
memory/864-285-0x00000000009A0000-0x0000000000BE8000-memory.dmp

Filesize
2.3MB

Download
memory/1356-171-0x0000000000910000-0x0000000001418000-memory.dmp

Filesize
11.0MB

Download
memory/1688-433-0x00000000050C0000-0x00000000050D0000-memory.dmp

Filesize
64KB

Download
memory/1688-392-0x00000000050C0000-0x00000000050D0000-memory.dmp

Filesize
64KB

Download
memory/2256-417-0x000002511AA70000-0x000002511AA8C000-memory.dmp

Filesize
112KB

Download
memory/2256-406-0x00000251000C0000-0x00000251000D0000-memory.dmp

Filesize
64KB

Download
memory/2256-438-0x00000251000C0000-0x00000251000D0000-memory.dmp

Filesize
64KB

Download
memory/2256-439-0x00000251000C0000-0x00000251000D0000-memory.dmp

Filesize
64KB

Download
memory/2256-427-0x000002517F520000-0x000002517F52A000-memory.dmp

Filesize
40KB

Download
memory/2256-434-0x000002517F950000-0x000002517F96A000-memory.dmp

Filesize
104KB

Download
memory/2256-430-0x00007FF4154E0000-0x00007FF4154F0000-memory.dmp

Filesize
64KB

Download
memory/2256-435-0x000002511AC90000-0x000002511AC96000-memory.dmp

Filesize
24KB

Download
memory/2256-405-0x00000251000C0000-0x00000251000D0000-memory.dmp

Filesize
64KB

Download
memory/2256-404-0x00000251000C0000-0x00000251000D0000-memory.dmp

Filesize
64KB

Download
memory/2924-382-0x000002BBEE690000-0x000002BBEE6A0000-memory.dmp

Filesize
64KB

Download
memory/2924-383-0x00007FF46CF20000-0x00007FF46CF30000-memory.dmp

Filesize
64KB

Download
memory/2924-381-0x000002BBEE690000-0x000002BBEE6A0000-memory.dmp

Filesize
64KB

Download
memory/2924-380-0x000002BBEE690000-0x000002BBEE6A0000-memory.dmp

Filesize
64KB

Download
memory/3368-312-0x0000000002F00000-0x0000000002F10000-memory.dmp

Filesize
64KB

Download
memory/3368-297-0x0000000002F00000-0x0000000002F10000-memory.dmp

Filesize
64KB

Download
memory/3368-313-0x0000000002F00000-0x0000000002F10000-memory.dmp

Filesize
64KB

Download
memory/3368-298-0x0000000002F00000-0x0000000002F10000-memory.dmp

Filesize
64KB

Download
memory/3372-135-0x0000000000910000-0x0000000001418000-memory.dmp

Filesize
11.0MB

Download
memory/3372-133-0x0000000000910000-0x0000000001418000-memory.dmp

Filesize
11.0MB

Download
memory/3372-160-0x0000000005600000-0x0000000005610000-memory.dmp

Filesize
64KB

Download
memory/3372-174-0x0000000000910000-0x0000000001418000-memory.dmp

Filesize
11.0MB

Download
memory/3372-159-0x0000000000910000-0x0000000001418000-memory.dmp

Filesize
11.0MB

Download
memory/3372-138-0x0000000005600000-0x0000000005610000-memory.dmp

Filesize
64KB

Download
memory/3372-137-0x0000000005AC0000-0x0000000005AE2000-memory.dmp

Filesize
136KB

Download
memory/3372-136-0x0000000000910000-0x0000000001418000-memory.dmp

Filesize
11.0MB

Download
memory/3404-273-0x00000000004E0000-0x0000000001330000-memory.dmp

Filesize
14.3MB

Download
memory/3560-157-0x0000000007800000-0x0000000007E7A000-memory.dmp

Filesize
6.5MB

Download
memory/3560-145-0x00000000051F0000-0x0000000005256000-memory.dmp

Filesize
408KB

Download
memory/3560-162-0x0000000004C70000-0x0000000004C80000-memory.dmp

Filesize
64KB

Download
memory/3560-140-0x0000000002990000-0x00000000029C6000-memory.dmp

Filesize
216KB

Download
memory/3560-141-0x0000000004C70000-0x0000000004C80000-memory.dmp

Filesize
64KB

Download
memory/3560-142-0x0000000004C70000-0x0000000004C80000-memory.dmp

Filesize
64KB

Download
memory/3560-163-0x0000000004C70000-0x0000000004C80000-memory.dmp

Filesize
64KB

Download
memory/3560-143-0x00000000052B0000-0x00000000058D8000-memory.dmp

Filesize
6.2MB

Download
memory/3560-144-0x0000000005050000-0x00000000050B6000-memory.dmp

Filesize
408KB

Download
memory/3560-158-0x0000000006490000-0x00000000064AA000-memory.dmp

Filesize
104KB

Download
memory/3560-155-0x0000000005F80000-0x0000000005F9E000-memory.dmp

Filesize
120KB

Download
memory/3560-156-0x0000000004C70000-0x0000000004C80000-memory.dmp

Filesize
64KB

Download
memory/3560-164-0x0000000004C70000-0x0000000004C80000-memory.dmp

Filesize
64KB

Download
memory/3596-391-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/3596-319-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/3596-316-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/3596-321-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/3596-320-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/3652-442-0x00007FF7B4D00000-0x00007FF7B56E5000-memory.dmp

Filesize
9.9MB

Download
memory/3652-455-0x00007FF7B4D00000-0x00007FF7B56E5000-memory.dmp

Filesize
9.9MB

Download
memory/3652-393-0x00007FF7B4D00000-0x00007FF7B56E5000-memory.dmp

Filesize
9.9MB

Download
memory/3652-394-0x00007FF7B4D00000-0x00007FF7B56E5000-memory.dmp

Filesize
9.9MB

Download
memory/3688-352-0x000001CB99DA0000-0x000001CB99DB0000-memory.dmp

Filesize
64KB

Download
memory/3688-356-0x000001CBFDF90000-0x000001CBFDF9A000-memory.dmp

Filesize
40KB

Download
memory/3688-330-0x000001CBFDFA0000-0x000001CBFDFC2000-memory.dmp

Filesize
136KB

Download
memory/3688-350-0x000001CBFDFD0000-0x000001CBFDFEC000-memory.dmp

Filesize
112KB

Download
memory/3688-353-0x00007FF460E90000-0x00007FF460EA0000-memory.dmp

Filesize
64KB

Download
memory/3688-351-0x000001CB99DA0000-0x000001CB99DB0000-memory.dmp

Filesize
64KB

Download
memory/3688-354-0x000001CBFDF80000-0x000001CBFDF8A000-memory.dmp

Filesize
40KB

Download
memory/3688-355-0x000001CB9A7B0000-0x000001CB9A7B8000-memory.dmp

Filesize
32KB

Download
memory/3748-314-0x00007FF6C22A0000-0x00007FF6C2C85000-memory.dmp

Filesize
9.9MB

Download
memory/3748-386-0x00007FF6C22A0000-0x00007FF6C2C85000-memory.dmp

Filesize
9.9MB

Download
memory/4164-429-0x0000000004A50000-0x0000000004A60000-memory.dmp

Filesize
64KB

Download
memory/4164-428-0x0000000004A50000-0x0000000004A60000-memory.dmp

Filesize
64KB

Download
memory/4696-456-0x0000025DCFBB0000-0x0000025DCFBC0000-memory.dmp

Filesize
64KB

Download
memory/4772-168-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/4772-186-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/4772-176-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/4772-175-0x0000000000910000-0x0000000001418000-memory.dmp

Filesize
11.0MB

Download
memory/4772-257-0x0000000000910000-0x0000000001418000-memory.dmp

Filesize
11.0MB

Download
memory/4772-308-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/4772-256-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/4772-172-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/4772-258-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/4772-169-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/4772-310-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download