Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    95s
  • max time network
    135s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/04/2023, 01:43

General

  • Target

    10f3989e8fa0f2b29e1aabdc9f2b6d8112217c3c34409837f3fe4ae5f2b0f9c4.exe

  • Size

    196KB

  • MD5

    29fec1cacff20e1697d9fc3347841d9c

  • SHA1

    6d5304c9243553fa1f8c12a04528a8e924afefa9

  • SHA256

    10f3989e8fa0f2b29e1aabdc9f2b6d8112217c3c34409837f3fe4ae5f2b0f9c4

  • SHA512

    252849e48dd241d16432b85d442c1ea8925f9c2601361996b8e391a90780b71222cee262153f7dcd170feaaa68c3ae9d0a47e7f9c6ccd22b2a78bd434f3fe130

  • SSDEEP

    3072:GW28cPNh3QNGTQOXDjsKWQB0K/js5DOFfgxPZaSkLrkGrGib:L28uMqQO8HARkOFfy7k0Ja

Malware Config

Extracted

Family

smokeloader

Botnet

sprg

Extracted

Family

smokeloader

Version

2022

C2

http://hoh0aeghwugh2gie.com/

http://hie7doodohpae4na.com/

http://aek0aicifaloh1yo.com/

http://yic0oosaeiy7ahng.com/

http://wa5zu7sekai8xeih.com/

rc4.i32
rc4.i32

Extracted

Family

vidar

Version

3.4

Botnet

e749025c61b2caca10aa829a9e1a65a1

C2

https://steamcommunity.com/profiles/76561199494593681

https://t.me/auftriebs

Attributes
  • profile_id_v2

    e749025c61b2caca10aa829a9e1a65a1

  • user_agent

    Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:105.0) Gecko/20100101 Firefox/105.0

Extracted

Family

redline

Botnet

build03

C2

65.21.3.192:32845

Attributes
  • auth_value

    688766d7eb9d4a5fde1dec6cdf7c3d9e

Extracted

Family

laplas

C2

http://185.106.92.74

Attributes
  • api_key

    bc2dceabe69fa26dbf4dd8295d65e03e1990633a88c1c8410825c9266b239396

Signatures

  • Laplas Clipper

    Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Downloads MZ/PE file
  • Stops running service(s) 3 TTPs
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Launches sc.exe 5 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 19 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\10f3989e8fa0f2b29e1aabdc9f2b6d8112217c3c34409837f3fe4ae5f2b0f9c4.exe
    "C:\Users\Admin\AppData\Local\Temp\10f3989e8fa0f2b29e1aabdc9f2b6d8112217c3c34409837f3fe4ae5f2b0f9c4.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:4704
  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3236
    • C:\Users\Admin\AppData\Local\Temp\E043.exe
      C:\Users\Admin\AppData\Local\Temp\E043.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks processor information in registry
      • Suspicious use of WriteProcessMemory
      PID:3040
      • C:\ProgramData\46997604058517522986.exe
        "C:\ProgramData\46997604058517522986.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:524
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /C choice /C Y /N /D Y /T 0 &Del C:\ProgramData\46997604058517522986.exe
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4616
          • C:\Windows\system32\choice.exe
            choice /C Y /N /D Y /T 0
            5⤵
              PID:2648
        • C:\ProgramData\09487942395356987957.exe
          "C:\ProgramData\09487942395356987957.exe"
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious use of WriteProcessMemory
          PID:4608
          • C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe
            "C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            PID:1788
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\E043.exe" & exit
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2072
          • C:\Windows\SysWOW64\timeout.exe
            timeout /t 6
            4⤵
            • Delays execution with timeout.exe
            PID:4048
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3040 -s 1920
          3⤵
          • Program crash
          PID:2780
      • C:\Users\Admin\AppData\Local\Temp\F785.exe
        C:\Users\Admin\AppData\Local\Temp\F785.exe
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4668
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2484
        • C:\Users\Admin\AppData\Local\Temp\Tzairumea840.exe
          "C:\Users\Admin\AppData\Local\Temp\Tzairumea840.exe"
          3⤵
          • Suspicious use of NtCreateUserProcessOtherParentProcess
          • Executes dropped EXE
          PID:4924
        • C:\Users\Admin\AppData\Local\Temp\F785.exe
          C:\Users\Admin\AppData\Local\Temp\F785.exe
          3⤵
          • Executes dropped EXE
          PID:4060
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        2⤵
          PID:888
        • C:\Windows\explorer.exe
          C:\Windows\explorer.exe
          2⤵
            PID:1252
          • C:\Windows\SysWOW64\explorer.exe
            C:\Windows\SysWOW64\explorer.exe
            2⤵
              PID:1604
            • C:\Windows\explorer.exe
              C:\Windows\explorer.exe
              2⤵
                PID:3700
              • C:\Windows\SysWOW64\explorer.exe
                C:\Windows\SysWOW64\explorer.exe
                2⤵
                  PID:4284
                • C:\Windows\SysWOW64\explorer.exe
                  C:\Windows\SysWOW64\explorer.exe
                  2⤵
                    PID:4716
                  • C:\Windows\SysWOW64\explorer.exe
                    C:\Windows\SysWOW64\explorer.exe
                    2⤵
                      PID:952
                    • C:\Windows\explorer.exe
                      C:\Windows\explorer.exe
                      2⤵
                        PID:2864
                      • C:\Windows\SysWOW64\explorer.exe
                        C:\Windows\SysWOW64\explorer.exe
                        2⤵
                          PID:4408
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
                          2⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3044
                        • C:\Windows\System32\cmd.exe
                          C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
                          2⤵
                            PID:3876
                            • C:\Windows\System32\powercfg.exe
                              powercfg /x -hibernate-timeout-ac 0
                              3⤵
                                PID:4952
                              • C:\Windows\System32\powercfg.exe
                                powercfg /x -hibernate-timeout-dc 0
                                3⤵
                                  PID:5024
                                • C:\Windows\System32\powercfg.exe
                                  powercfg /x -standby-timeout-ac 0
                                  3⤵
                                    PID:1264
                                  • C:\Windows\System32\powercfg.exe
                                    powercfg /x -standby-timeout-dc 0
                                    3⤵
                                      PID:2940
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#mmwusnu#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }
                                    2⤵
                                      PID:1864
                                    • C:\Windows\System32\cmd.exe
                                      C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
                                      2⤵
                                        PID:464
                                        • C:\Windows\System32\sc.exe
                                          sc stop UsoSvc
                                          3⤵
                                          • Launches sc.exe
                                          PID:3048
                                        • C:\Windows\System32\sc.exe
                                          sc stop WaaSMedicSvc
                                          3⤵
                                          • Launches sc.exe
                                          PID:2712
                                        • C:\Windows\System32\sc.exe
                                          sc stop wuauserv
                                          3⤵
                                          • Launches sc.exe
                                          PID:2660
                                        • C:\Windows\System32\sc.exe
                                          sc stop bits
                                          3⤵
                                          • Launches sc.exe
                                          PID:4604
                                        • C:\Windows\System32\reg.exe
                                          reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
                                          3⤵
                                            PID:4624
                                          • C:\Windows\System32\reg.exe
                                            reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
                                            3⤵
                                              PID:4920
                                            • C:\Windows\System32\reg.exe
                                              reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
                                              3⤵
                                                PID:868
                                              • C:\Windows\System32\reg.exe
                                                reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
                                                3⤵
                                                  PID:4344
                                                • C:\Windows\System32\reg.exe
                                                  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
                                                  3⤵
                                                    PID:4964
                                                  • C:\Windows\System32\sc.exe
                                                    sc stop dosvc
                                                    3⤵
                                                    • Launches sc.exe
                                                    PID:4936
                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#yqhkxrl#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachineQC" } Else { "C:\Program Files\Google\Chrome\updater.exe" }
                                                  2⤵
                                                    PID:2980
                                                    • C:\Windows\system32\schtasks.exe
                                                      "C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachineQC
                                                      3⤵
                                                        PID:4084
                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
                                                      2⤵
                                                        PID:1228
                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3040 -ip 3040
                                                      1⤵
                                                        PID:5112
                                                      • C:\Program Files\Google\Chrome\updater.exe
                                                        "C:\Program Files\Google\Chrome\updater.exe"
                                                        1⤵
                                                          PID:4180

                                                        Network

                                                        MITRE ATT&CK Enterprise v6

                                                        Replay Monitor

                                                        Loading Replay Monitor...

                                                        Downloads

                                                        • C:\Program Files\Google\Chrome\updater.exe

                                                          Filesize

                                                          3.6MB

                                                          MD5

                                                          58fe5c1f5bb97d2ab8c07d9b2165d291

                                                          SHA1

                                                          7fa1fd096e3e299a1d12620afb5f0e8bbac501fc

                                                          SHA256

                                                          9ec7b6c726d9cafca8ab233f83133e06adf5a8af6898197ffc7c5ef54b402694

                                                          SHA512

                                                          ee7532ef1d4903eb4a6fddca47774358a67904ec49cbc700a2161c9f1f372bd02679fbeb4bada5cb6d940946084b080f7bbc138d4a8202fdbed5b9a8bc377e01

                                                        • C:\ProgramData\09487942395356987957.exe

                                                          Filesize

                                                          7.2MB

                                                          MD5

                                                          c5e0fb4ecaa8a7481a283099d604f7a0

                                                          SHA1

                                                          df4b0c0cc823da2b0443076650c292b43dd9de33

                                                          SHA256

                                                          c6c03e97c5de0c9eb264e4914d8c7f64d7e3528cc696f613e451a294262f3c42

                                                          SHA512

                                                          375677d0cc802b09c7d1532d162a91a8eec4679f7639ef38dca9a9d3a03e20b3ab54707af7ffb138d00ec93ea4b34b6db0b33f365dc888ff9056c808a239bc57

                                                        • C:\ProgramData\09487942395356987957.exe

                                                          Filesize

                                                          7.2MB

                                                          MD5

                                                          c5e0fb4ecaa8a7481a283099d604f7a0

                                                          SHA1

                                                          df4b0c0cc823da2b0443076650c292b43dd9de33

                                                          SHA256

                                                          c6c03e97c5de0c9eb264e4914d8c7f64d7e3528cc696f613e451a294262f3c42

                                                          SHA512

                                                          375677d0cc802b09c7d1532d162a91a8eec4679f7639ef38dca9a9d3a03e20b3ab54707af7ffb138d00ec93ea4b34b6db0b33f365dc888ff9056c808a239bc57

                                                        • C:\ProgramData\09487942395356987957.exe

                                                          Filesize

                                                          7.2MB

                                                          MD5

                                                          c5e0fb4ecaa8a7481a283099d604f7a0

                                                          SHA1

                                                          df4b0c0cc823da2b0443076650c292b43dd9de33

                                                          SHA256

                                                          c6c03e97c5de0c9eb264e4914d8c7f64d7e3528cc696f613e451a294262f3c42

                                                          SHA512

                                                          375677d0cc802b09c7d1532d162a91a8eec4679f7639ef38dca9a9d3a03e20b3ab54707af7ffb138d00ec93ea4b34b6db0b33f365dc888ff9056c808a239bc57

                                                        • C:\ProgramData\46997604058517522986.exe

                                                          Filesize

                                                          4.3MB

                                                          MD5

                                                          c4ab3149ef02a36d663699a8c541933e

                                                          SHA1

                                                          67088f5eff9ec575775b711c9e3650d12d7f4d5c

                                                          SHA256

                                                          0a0fbd6af9e5d110118f02b87f9a92f9f58fb100f6d9883d55a6aae6c548b4ce

                                                          SHA512

                                                          88b10f81b2cd273fefeffb4c2078807e89b4b756d50110b61e9f89092715f29ba8d1803f64bc971c1293dc624b92d0b7f05612ae661dd8d24e47d39047a4b7b4

                                                        • C:\ProgramData\46997604058517522986.exe

                                                          Filesize

                                                          4.3MB

                                                          MD5

                                                          c4ab3149ef02a36d663699a8c541933e

                                                          SHA1

                                                          67088f5eff9ec575775b711c9e3650d12d7f4d5c

                                                          SHA256

                                                          0a0fbd6af9e5d110118f02b87f9a92f9f58fb100f6d9883d55a6aae6c548b4ce

                                                          SHA512

                                                          88b10f81b2cd273fefeffb4c2078807e89b4b756d50110b61e9f89092715f29ba8d1803f64bc971c1293dc624b92d0b7f05612ae661dd8d24e47d39047a4b7b4

                                                        • C:\ProgramData\46997604058517522986.exe

                                                          Filesize

                                                          4.3MB

                                                          MD5

                                                          c4ab3149ef02a36d663699a8c541933e

                                                          SHA1

                                                          67088f5eff9ec575775b711c9e3650d12d7f4d5c

                                                          SHA256

                                                          0a0fbd6af9e5d110118f02b87f9a92f9f58fb100f6d9883d55a6aae6c548b4ce

                                                          SHA512

                                                          88b10f81b2cd273fefeffb4c2078807e89b4b756d50110b61e9f89092715f29ba8d1803f64bc971c1293dc624b92d0b7f05612ae661dd8d24e47d39047a4b7b4

                                                        • C:\ProgramData\mozglue.dll

                                                          Filesize

                                                          593KB

                                                          MD5

                                                          c8fd9be83bc728cc04beffafc2907fe9

                                                          SHA1

                                                          95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                                                          SHA256

                                                          ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                                                          SHA512

                                                          fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                                                        • C:\ProgramData\nss3.dll

                                                          Filesize

                                                          2.0MB

                                                          MD5

                                                          1cc453cdf74f31e4d913ff9c10acdde2

                                                          SHA1

                                                          6e85eae544d6e965f15fa5c39700fa7202f3aafe

                                                          SHA256

                                                          ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                                                          SHA512

                                                          dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                          Filesize

                                                          2KB

                                                          MD5

                                                          f39d3c5975feb9c06ef0604241d49f4c

                                                          SHA1

                                                          0a4b0cbff8372154e2ee23df5f38b2a4917ff737

                                                          SHA256

                                                          4407818257d34e1aeb8ca1676a2281652617ff96a28a3739d5564951f3975ccf

                                                          SHA512

                                                          e516a03b4eebb84e134da53d567ca962a9b7d9039d34d4aead4bcabbc7c2a25fc3a5da50cd945bf9a7f88c445dd50298f6b25179feb99bccb8009fc7e4cc744a

                                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\F785.exe.log

                                                          Filesize

                                                          1KB

                                                          MD5

                                                          13b08803e0bb671919478d178f19d6e2

                                                          SHA1

                                                          9f8c1d2a16446f9ee1e3244f48d372aecccf4dd9

                                                          SHA256

                                                          bab001392f6a9fc257a302cf557c9f571c7b352f41aedda14b049976ee5fd1c9

                                                          SHA512

                                                          2fe208b9958329734a5c6ce6aa526ee20d2c02d351927e75f85f27c2ffdc3c9e3413c17dc6e0dd9eefc3fb379e936b6bef2984a6e44ffafdc7600f590398016f

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

                                                          Filesize

                                                          53KB

                                                          MD5

                                                          06ad34f9739c5159b4d92d702545bd49

                                                          SHA1

                                                          9152a0d4f153f3f40f7e606be75f81b582ee0c17

                                                          SHA256

                                                          474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba

                                                          SHA512

                                                          c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                          Filesize

                                                          16KB

                                                          MD5

                                                          1bc0d74087948dd1b720edbb049df4a6

                                                          SHA1

                                                          6c013cc1d6b985015b8f98c6d80d36b8a7f855a1

                                                          SHA256

                                                          3b723e3178cf3d61ba90da0fb8d7be5c1d807cf53d87e246ad1f115e54c28685

                                                          SHA512

                                                          3bcabf68363b66e15cdc535055cab5743c9dd058d39e6024daf449cd94c2153c02bef06a88589614f4a1ad0e898a7902f9eac701f0c15b9a9411b84d3f27138e

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                          Filesize

                                                          944B

                                                          MD5

                                                          a6685e02d4224799097fe9c6627fb607

                                                          SHA1

                                                          ec2d18e25513a559eed359a82c0d99e81ff41d54

                                                          SHA256

                                                          a5090285f71bb4d53010b60b446726b9257b54271c6f2e7d708ec78e335e15a9

                                                          SHA512

                                                          5e3111b2bcd3020d00d793ae3df269737ac3648d6374e18629860c455a023700f53effbc31bd3d6b5f359811de0f51a38eda248e5fd652675e6337b18cf2969e

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                          Filesize

                                                          1KB

                                                          MD5

                                                          58f473558345c4d2feab48d4999b148a

                                                          SHA1

                                                          a58fec1ddadb3cb692cd1bac3d21d09592ec58ee

                                                          SHA256

                                                          69496654c76a65ba517bb7ee3bacb598a1e778aa7ee7807bf7318087d8d39d22

                                                          SHA512

                                                          f19f50701c05d050fa114e29544e77ce620c4f05619262781eb5a12906f3e4a0219d79ea574e2ace3bdad8c25346f2dad71e9768f64361321e9299061b7b87d0

                                                        • C:\Users\Admin\AppData\Local\Temp\E043.exe

                                                          Filesize

                                                          322KB

                                                          MD5

                                                          3264a6e51f9d609ef286a7f581517715

                                                          SHA1

                                                          f9bb7a1f54635b4c04ae37b713b66d9de290409d

                                                          SHA256

                                                          4c84138f8d3657891efb9be5c4c42028dce408b9150db82bc9d0beffb7f881f3

                                                          SHA512

                                                          b9dae3edee94a54998a2fcf85e3eab83f6b91c53a8f43c7898cc8a9744bbf90cbc4c7c9f4028c65a1ecf18cc4644cb56cbb1095a29df048635724eb1420adbf5

                                                        • C:\Users\Admin\AppData\Local\Temp\E043.exe

                                                          Filesize

                                                          322KB

                                                          MD5

                                                          3264a6e51f9d609ef286a7f581517715

                                                          SHA1

                                                          f9bb7a1f54635b4c04ae37b713b66d9de290409d

                                                          SHA256

                                                          4c84138f8d3657891efb9be5c4c42028dce408b9150db82bc9d0beffb7f881f3

                                                          SHA512

                                                          b9dae3edee94a54998a2fcf85e3eab83f6b91c53a8f43c7898cc8a9744bbf90cbc4c7c9f4028c65a1ecf18cc4644cb56cbb1095a29df048635724eb1420adbf5

                                                        • C:\Users\Admin\AppData\Local\Temp\F785.exe

                                                          Filesize

                                                          1.4MB

                                                          MD5

                                                          04a05e3080aba5e333c816493ef2635d

                                                          SHA1

                                                          28d558491a0756f871b986130f0e7f86639877a2

                                                          SHA256

                                                          95aee7feb92f8e8f236f65399712ed5be9ca5f52c6dbec65ab650c6db63f24fb

                                                          SHA512

                                                          a5316921db7096ca827d48b42c6aafd18dedfc6f5f4ccff73cec2bbd860f1ad2abefc6d97251ba3bff5d73f3ac72bd31ee092fec40d747a893baf614fd0ff498

                                                        • C:\Users\Admin\AppData\Local\Temp\F785.exe

                                                          Filesize

                                                          1.4MB

                                                          MD5

                                                          04a05e3080aba5e333c816493ef2635d

                                                          SHA1

                                                          28d558491a0756f871b986130f0e7f86639877a2

                                                          SHA256

                                                          95aee7feb92f8e8f236f65399712ed5be9ca5f52c6dbec65ab650c6db63f24fb

                                                          SHA512

                                                          a5316921db7096ca827d48b42c6aafd18dedfc6f5f4ccff73cec2bbd860f1ad2abefc6d97251ba3bff5d73f3ac72bd31ee092fec40d747a893baf614fd0ff498

                                                        • C:\Users\Admin\AppData\Local\Temp\F785.exe

                                                          Filesize

                                                          1.4MB

                                                          MD5

                                                          04a05e3080aba5e333c816493ef2635d

                                                          SHA1

                                                          28d558491a0756f871b986130f0e7f86639877a2

                                                          SHA256

                                                          95aee7feb92f8e8f236f65399712ed5be9ca5f52c6dbec65ab650c6db63f24fb

                                                          SHA512

                                                          a5316921db7096ca827d48b42c6aafd18dedfc6f5f4ccff73cec2bbd860f1ad2abefc6d97251ba3bff5d73f3ac72bd31ee092fec40d747a893baf614fd0ff498

                                                        • C:\Users\Admin\AppData\Local\Temp\Tzairumea840.exe

                                                          Filesize

                                                          3.6MB

                                                          MD5

                                                          58fe5c1f5bb97d2ab8c07d9b2165d291

                                                          SHA1

                                                          7fa1fd096e3e299a1d12620afb5f0e8bbac501fc

                                                          SHA256

                                                          9ec7b6c726d9cafca8ab233f83133e06adf5a8af6898197ffc7c5ef54b402694

                                                          SHA512

                                                          ee7532ef1d4903eb4a6fddca47774358a67904ec49cbc700a2161c9f1f372bd02679fbeb4bada5cb6d940946084b080f7bbc138d4a8202fdbed5b9a8bc377e01

                                                        • C:\Users\Admin\AppData\Local\Temp\Tzairumea840.exe

                                                          Filesize

                                                          3.6MB

                                                          MD5

                                                          58fe5c1f5bb97d2ab8c07d9b2165d291

                                                          SHA1

                                                          7fa1fd096e3e299a1d12620afb5f0e8bbac501fc

                                                          SHA256

                                                          9ec7b6c726d9cafca8ab233f83133e06adf5a8af6898197ffc7c5ef54b402694

                                                          SHA512

                                                          ee7532ef1d4903eb4a6fddca47774358a67904ec49cbc700a2161c9f1f372bd02679fbeb4bada5cb6d940946084b080f7bbc138d4a8202fdbed5b9a8bc377e01

                                                        • C:\Users\Admin\AppData\Local\Temp\Tzairumea840.exe

                                                          Filesize

                                                          3.6MB

                                                          MD5

                                                          58fe5c1f5bb97d2ab8c07d9b2165d291

                                                          SHA1

                                                          7fa1fd096e3e299a1d12620afb5f0e8bbac501fc

                                                          SHA256

                                                          9ec7b6c726d9cafca8ab233f83133e06adf5a8af6898197ffc7c5ef54b402694

                                                          SHA512

                                                          ee7532ef1d4903eb4a6fddca47774358a67904ec49cbc700a2161c9f1f372bd02679fbeb4bada5cb6d940946084b080f7bbc138d4a8202fdbed5b9a8bc377e01

                                                        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ggezojiw.302.ps1

                                                          Filesize

                                                          60B

                                                          MD5

                                                          d17fe0a3f47be24a6453e9ef58c94641

                                                          SHA1

                                                          6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                          SHA256

                                                          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                          SHA512

                                                          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                        • C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe

                                                          Filesize

                                                          730.6MB

                                                          MD5

                                                          776b1f42da0a3c3bfa26a761b9d039d2

                                                          SHA1

                                                          b5be09804cdb7892459f687d81010d3154313bdf

                                                          SHA256

                                                          dfdaefba8bee5692246ab61e74c96a84f397d0d25b71a473cbcdcbabcc499860

                                                          SHA512

                                                          0d263ae1fa1e18e7d1f81876c346059cebd12b8d09771d466cd4bad5722157ec78d06ab77b74d5b0d89e325ac11ed226c79c64c14d1b2ebc0f7e0867ec618222

                                                        • C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe

                                                          Filesize

                                                          721.4MB

                                                          MD5

                                                          26bc7f9e58ef3baaa587fc891610ddb9

                                                          SHA1

                                                          c59fac6a08b742246484eb3e2dd61283b8812256

                                                          SHA256

                                                          cd92a6c8e8d04b9a7c9874150021ccb972c212464a40ff72b17955d066e9f3c6

                                                          SHA512

                                                          993c027ed92f0d027efac3b2a3ce5d3540422d5439c0bd3a07a232fd9e83a934cc4245f4794cec5557c6cac9ee9a9c69f117a52c627164c724c2af7ae0d32352

                                                        • memory/524-297-0x0000000000870000-0x00000000016D3000-memory.dmp

                                                          Filesize

                                                          14.4MB

                                                        • memory/524-294-0x0000000000870000-0x00000000016D3000-memory.dmp

                                                          Filesize

                                                          14.4MB

                                                        • memory/888-312-0x0000000000F80000-0x0000000000F87000-memory.dmp

                                                          Filesize

                                                          28KB

                                                        • memory/888-238-0x0000000000F70000-0x0000000000F7B000-memory.dmp

                                                          Filesize

                                                          44KB

                                                        • memory/888-237-0x0000000000F80000-0x0000000000F87000-memory.dmp

                                                          Filesize

                                                          28KB

                                                        • memory/888-220-0x0000000000F70000-0x0000000000F7B000-memory.dmp

                                                          Filesize

                                                          44KB

                                                        • memory/952-279-0x0000000000D60000-0x0000000000D6B000-memory.dmp

                                                          Filesize

                                                          44KB

                                                        • memory/952-337-0x0000000000D70000-0x0000000000D76000-memory.dmp

                                                          Filesize

                                                          24KB

                                                        • memory/952-287-0x0000000000D60000-0x0000000000D6B000-memory.dmp

                                                          Filesize

                                                          44KB

                                                        • memory/952-285-0x0000000000D70000-0x0000000000D76000-memory.dmp

                                                          Filesize

                                                          24KB

                                                        • memory/1252-320-0x0000000000500000-0x0000000000509000-memory.dmp

                                                          Filesize

                                                          36KB

                                                        • memory/1252-239-0x00000000004F0000-0x00000000004FF000-memory.dmp

                                                          Filesize

                                                          60KB

                                                        • memory/1252-241-0x0000000000500000-0x0000000000509000-memory.dmp

                                                          Filesize

                                                          36KB

                                                        • memory/1252-242-0x00000000004F0000-0x00000000004FF000-memory.dmp

                                                          Filesize

                                                          60KB

                                                        • memory/1604-321-0x0000000000BB0000-0x0000000000BB5000-memory.dmp

                                                          Filesize

                                                          20KB

                                                        • memory/1604-244-0x0000000000BB0000-0x0000000000BB5000-memory.dmp

                                                          Filesize

                                                          20KB

                                                        • memory/1604-243-0x0000000000BA0000-0x0000000000BA9000-memory.dmp

                                                          Filesize

                                                          36KB

                                                        • memory/1604-245-0x0000000000BA0000-0x0000000000BA9000-memory.dmp

                                                          Filesize

                                                          36KB

                                                        • memory/1788-352-0x0000000000160000-0x0000000000C9A000-memory.dmp

                                                          Filesize

                                                          11.2MB

                                                        • memory/1788-351-0x0000000001080000-0x0000000001081000-memory.dmp

                                                          Filesize

                                                          4KB

                                                        • memory/1788-350-0x0000000001070000-0x0000000001071000-memory.dmp

                                                          Filesize

                                                          4KB

                                                        • memory/2484-292-0x0000000007310000-0x000000000798A000-memory.dmp

                                                          Filesize

                                                          6.5MB

                                                        • memory/2484-291-0x0000000002110000-0x0000000002120000-memory.dmp

                                                          Filesize

                                                          64KB

                                                        • memory/2484-262-0x0000000002110000-0x0000000002120000-memory.dmp

                                                          Filesize

                                                          64KB

                                                        • memory/2484-293-0x0000000005FB0000-0x0000000005FCA000-memory.dmp

                                                          Filesize

                                                          104KB

                                                        • memory/2484-264-0x00000000051F0000-0x0000000005256000-memory.dmp

                                                          Filesize

                                                          408KB

                                                        • memory/2484-328-0x0000000002110000-0x0000000002120000-memory.dmp

                                                          Filesize

                                                          64KB

                                                        • memory/2484-329-0x0000000002110000-0x0000000002120000-memory.dmp

                                                          Filesize

                                                          64KB

                                                        • memory/2484-265-0x0000000005410000-0x0000000005476000-memory.dmp

                                                          Filesize

                                                          408KB

                                                        • memory/2484-261-0x0000000002110000-0x0000000002120000-memory.dmp

                                                          Filesize

                                                          64KB

                                                        • memory/2484-276-0x0000000005AC0000-0x0000000005ADE000-memory.dmp

                                                          Filesize

                                                          120KB

                                                        • memory/2484-251-0x0000000002120000-0x0000000002156000-memory.dmp

                                                          Filesize

                                                          216KB

                                                        • memory/2484-252-0x0000000004B50000-0x0000000005178000-memory.dmp

                                                          Filesize

                                                          6.2MB

                                                        • memory/2864-290-0x0000000000FE0000-0x0000000000FED000-memory.dmp

                                                          Filesize

                                                          52KB

                                                        • memory/2864-338-0x0000000000FF0000-0x0000000000FF7000-memory.dmp

                                                          Filesize

                                                          28KB

                                                        • memory/2864-296-0x0000000000FE0000-0x0000000000FED000-memory.dmp

                                                          Filesize

                                                          52KB

                                                        • memory/2864-295-0x0000000000FF0000-0x0000000000FF7000-memory.dmp

                                                          Filesize

                                                          28KB

                                                        • memory/3040-150-0x00000000020F0000-0x0000000002147000-memory.dmp

                                                          Filesize

                                                          348KB

                                                        • memory/3040-160-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                                                          Filesize

                                                          972KB

                                                        • memory/3040-318-0x0000000000400000-0x00000000004C0000-memory.dmp

                                                          Filesize

                                                          768KB

                                                        • memory/3040-256-0x0000000000400000-0x00000000004C0000-memory.dmp

                                                          Filesize

                                                          768KB

                                                        • memory/3044-399-0x00000277F3AD0000-0x00000277F3AD8000-memory.dmp

                                                          Filesize

                                                          32KB

                                                        • memory/3044-384-0x00000277F2050000-0x00000277F2060000-memory.dmp

                                                          Filesize

                                                          64KB

                                                        • memory/3044-377-0x00000277F1FB0000-0x00000277F1FD2000-memory.dmp

                                                          Filesize

                                                          136KB

                                                        • memory/3044-397-0x00000277F2020000-0x00000277F203C000-memory.dmp

                                                          Filesize

                                                          112KB

                                                        • memory/3044-398-0x00000277F2040000-0x00000277F204A000-memory.dmp

                                                          Filesize

                                                          40KB

                                                        • memory/3044-385-0x00000277F2050000-0x00000277F2060000-memory.dmp

                                                          Filesize

                                                          64KB

                                                        • memory/3044-387-0x00000277F2050000-0x00000277F2060000-memory.dmp

                                                          Filesize

                                                          64KB

                                                        • memory/3044-401-0x00000277F3AE0000-0x00000277F3AEA000-memory.dmp

                                                          Filesize

                                                          40KB

                                                        • memory/3236-135-0x0000000000390000-0x00000000003A6000-memory.dmp

                                                          Filesize

                                                          88KB

                                                        • memory/3700-247-0x00000000001F0000-0x00000000001FC000-memory.dmp

                                                          Filesize

                                                          48KB

                                                        • memory/3700-248-0x0000000000480000-0x0000000000486000-memory.dmp

                                                          Filesize

                                                          24KB

                                                        • memory/3700-249-0x00000000001F0000-0x00000000001FC000-memory.dmp

                                                          Filesize

                                                          48KB

                                                        • memory/3700-323-0x0000000000480000-0x0000000000486000-memory.dmp

                                                          Filesize

                                                          24KB

                                                        • memory/4060-370-0x000000000A910000-0x000000000A94C000-memory.dmp

                                                          Filesize

                                                          240KB

                                                        • memory/4060-371-0x0000000005440000-0x0000000005450000-memory.dmp

                                                          Filesize

                                                          64KB

                                                        • memory/4060-369-0x0000000005420000-0x0000000005432000-memory.dmp

                                                          Filesize

                                                          72KB

                                                        • memory/4060-417-0x000000000C770000-0x000000000CC9C000-memory.dmp

                                                          Filesize

                                                          5.2MB

                                                        • memory/4060-361-0x0000000000400000-0x000000000042E000-memory.dmp

                                                          Filesize

                                                          184KB

                                                        • memory/4060-415-0x000000000C070000-0x000000000C232000-memory.dmp

                                                          Filesize

                                                          1.8MB

                                                        • memory/4060-400-0x000000000AC20000-0x000000000AC96000-memory.dmp

                                                          Filesize

                                                          472KB

                                                        • memory/4060-366-0x000000000AEF0000-0x000000000B508000-memory.dmp

                                                          Filesize

                                                          6.1MB

                                                        • memory/4060-367-0x000000000A9E0000-0x000000000AAEA000-memory.dmp

                                                          Filesize

                                                          1.0MB

                                                        • memory/4180-454-0x00007FF609C30000-0x00007FF609FC8000-memory.dmp

                                                          Filesize

                                                          3.6MB

                                                        • memory/4180-455-0x00007FF609C30000-0x00007FF609FC8000-memory.dmp

                                                          Filesize

                                                          3.6MB

                                                        • memory/4284-258-0x0000000000AE0000-0x0000000000B07000-memory.dmp

                                                          Filesize

                                                          156KB

                                                        • memory/4284-250-0x0000000000AE0000-0x0000000000B07000-memory.dmp

                                                          Filesize

                                                          156KB

                                                        • memory/4284-257-0x0000000000B10000-0x0000000000B32000-memory.dmp

                                                          Filesize

                                                          136KB

                                                        • memory/4284-327-0x0000000000B10000-0x0000000000B32000-memory.dmp

                                                          Filesize

                                                          136KB

                                                        • memory/4408-300-0x0000000000370000-0x000000000037B000-memory.dmp

                                                          Filesize

                                                          44KB

                                                        • memory/4408-339-0x0000000000380000-0x0000000000388000-memory.dmp

                                                          Filesize

                                                          32KB

                                                        • memory/4408-299-0x0000000000380000-0x0000000000388000-memory.dmp

                                                          Filesize

                                                          32KB

                                                        • memory/4408-298-0x0000000000370000-0x000000000037B000-memory.dmp

                                                          Filesize

                                                          44KB

                                                        • memory/4608-313-0x00000000006E0000-0x00000000006E1000-memory.dmp

                                                          Filesize

                                                          4KB

                                                        • memory/4608-315-0x00000000009F0000-0x000000000152A000-memory.dmp

                                                          Filesize

                                                          11.2MB

                                                        • memory/4608-314-0x00000000009D0000-0x00000000009D1000-memory.dmp

                                                          Filesize

                                                          4KB

                                                        • memory/4668-345-0x00000000057B0000-0x0000000005842000-memory.dmp

                                                          Filesize

                                                          584KB

                                                        • memory/4668-234-0x0000000000390000-0x00000000004F4000-memory.dmp

                                                          Filesize

                                                          1.4MB

                                                        • memory/4668-346-0x0000000007B70000-0x0000000008114000-memory.dmp

                                                          Filesize

                                                          5.6MB

                                                        • memory/4668-319-0x0000000004CF0000-0x0000000004D00000-memory.dmp

                                                          Filesize

                                                          64KB

                                                        • memory/4668-246-0x0000000007290000-0x00000000072B2000-memory.dmp

                                                          Filesize

                                                          136KB

                                                        • memory/4668-240-0x0000000004CF0000-0x0000000004D00000-memory.dmp

                                                          Filesize

                                                          64KB

                                                        • memory/4704-134-0x0000000000560000-0x0000000000569000-memory.dmp

                                                          Filesize

                                                          36KB

                                                        • memory/4704-136-0x0000000000400000-0x00000000004A0000-memory.dmp

                                                          Filesize

                                                          640KB

                                                        • memory/4716-335-0x0000000000FA0000-0x0000000000FA5000-memory.dmp

                                                          Filesize

                                                          20KB

                                                        • memory/4716-277-0x0000000000FA0000-0x0000000000FA5000-memory.dmp

                                                          Filesize

                                                          20KB

                                                        • memory/4716-275-0x0000000000F90000-0x0000000000F99000-memory.dmp

                                                          Filesize

                                                          36KB

                                                        • memory/4716-278-0x0000000000F90000-0x0000000000F99000-memory.dmp

                                                          Filesize

                                                          36KB

                                                        • memory/4924-431-0x00007FF7E2450000-0x00007FF7E27E8000-memory.dmp

                                                          Filesize

                                                          3.6MB

                                                        • memory/4924-368-0x00007FF7E2450000-0x00007FF7E27E8000-memory.dmp

                                                          Filesize

                                                          3.6MB

                                                        • memory/4924-437-0x00007FF7E2450000-0x00007FF7E27E8000-memory.dmp

                                                          Filesize

                                                          3.6MB

                                                        • memory/4924-386-0x00007FF7E2450000-0x00007FF7E27E8000-memory.dmp

                                                          Filesize

                                                          3.6MB