amadey | 0875f2085b2f40b96db96d317cfdd1d870541182d4200de33fae9cbefaf07797

Analysis

max time kernel
150s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
12-06-2023 11:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

01242999.exe
Size

1.0MB
MD5

8a06751312436a705c6404180c8b1519
SHA1

2d1d3a9731159943463257ee2e94a070e39c3b36
SHA256

0875f2085b2f40b96db96d317cfdd1d870541182d4200de33fae9cbefaf07797
SHA512

f1a5b5fe6fe2a1d770dd0586f115b09f5d59d6a17ecf12b2a789a653c14542e35b1de5226264e6e2de09eb00f5530d01c6a90fc09df1615594d51c50b72b8a8c
SSDEEP

12288:aV8Jo5Xb+qCPuwvko4WzuqimH8ISEW4Wq4/OS7oS/8lTkJKaG0BHDKnn2yoSXkHN:aV84dM1DyqRrJ55KU882tMkHWiP

Score

10^/10

amadey fabookie gcleaner glupteba smokeloader pub5 up3 backdoor discovery dropper evasion loader persistence rootkit spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

3.83

45.9.74.80/0bjdn2Z/index.php

Extracted

Family

smokeloader

Botnet

pub5

Extracted

Family

smokeloader

Version

2022

http://aapu.at/tmp/

http://poudineh.com/tmp/

http://firsttrusteedrx.ru/tmp/

http://kingpirate.ru/tmp/

rc4.i32

Extracted

Family

gcleaner

45.12.253.56

45.12.253.72

45.12.253.98

45.12.253.75

Extracted

Family

smokeloader

Botnet

up3

Extracted

Family

smokeloader

Version

2020

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detect Fabookie payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1676-177-0x00000000033C0000-0x00000000034F2000-memory.dmp	family_fabookie
behavioral2/memory/1676-278-0x00000000033C0000-0x00000000034F2000-memory.dmp	family_fabookie

Fabookie
Fabookie is facebook account info stealer.
spyware stealer fabookie
GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner
Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 16 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4792-244-0x0000000004050000-0x000000000493B000-memory.dmp	family_glupteba
behavioral2/memory/4792-294-0x0000000000400000-0x0000000001EB5000-memory.dmp	family_glupteba
behavioral2/memory/4792-333-0x0000000000400000-0x0000000001EB5000-memory.dmp	family_glupteba
behavioral2/memory/4908-337-0x0000000000400000-0x0000000001EB5000-memory.dmp	family_glupteba
behavioral2/memory/4908-392-0x0000000000400000-0x0000000001EB5000-memory.dmp	family_glupteba
behavioral2/memory/4908-396-0x0000000000400000-0x0000000001EB5000-memory.dmp	family_glupteba
behavioral2/memory/4840-437-0x0000000000400000-0x0000000001EB5000-memory.dmp	family_glupteba
behavioral2/memory/4840-484-0x0000000000400000-0x0000000001EB5000-memory.dmp	family_glupteba
behavioral2/memory/4840-487-0x0000000000400000-0x0000000001EB5000-memory.dmp	family_glupteba
behavioral2/memory/4840-490-0x0000000000400000-0x0000000001EB5000-memory.dmp	family_glupteba
behavioral2/memory/4840-492-0x0000000000400000-0x0000000001EB5000-memory.dmp	family_glupteba
behavioral2/memory/4840-494-0x0000000000400000-0x0000000001EB5000-memory.dmp	family_glupteba
behavioral2/memory/4840-496-0x0000000000400000-0x0000000001EB5000-memory.dmp	family_glupteba
behavioral2/memory/4840-498-0x0000000000400000-0x0000000001EB5000-memory.dmp	family_glupteba
behavioral2/memory/4840-500-0x0000000000400000-0x0000000001EB5000-memory.dmp	family_glupteba
behavioral2/memory/4840-513-0x0000000000400000-0x0000000001EB5000-memory.dmp	family_glupteba

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Downloads MZ/PE file
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

1284 netsh.exe

pid	process
1284	netsh.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

01242999.exenewplayer.exeoneetx.exesetup.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	01242999.exe
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	newplayer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	oneetx.exe
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	setup.exe

Executes dropped EXE 17 IoCs

Processes:

ss41.exe2a344302.exenewplayer.exeoneetx.exe3eef203fb515bda85f514e168abb5973.exesetup.exetoolspub2.exetoolspub2.exeoneetx.exe3eef203fb515bda85f514e168abb5973.execsrss.exeinjector.exeoneetx.exeoneetx.exegfvbsuitrvbsuitrvbsui

pid	process
1676	ss41.exe
3256	2a344302.exe
2380	newplayer.exe
1848	oneetx.exe
4792	3eef203fb515bda85f514e168abb5973.exe
4072	setup.exe
4924	toolspub2.exe
4708	toolspub2.exe
1956	oneetx.exe
4908	3eef203fb515bda85f514e168abb5973.exe
4840	csrss.exe
4928	injector.exe
4876	oneetx.exe
1668	oneetx.exe
1236	gfvbsui
1232	trvbsui
3176	trvbsui

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

3eef203fb515bda85f514e168abb5973.execsrss.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	3eef203fb515bda85f514e168abb5973.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
rootkit evasion

Processes:

csrss.exe

description ioc process

File opened for modification \??\WinMonFS csrss.exe

description	ioc	process
File opened for modification	\??\WinMonFS	csrss.exe

Drops file in System32 directory 7 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

toolspub2.exetrvbsui

description	pid	process	target process
PID 4924 set thread context of 4708	4924	toolspub2.exe	toolspub2.exe
PID 1232 set thread context of 3176	1232	trvbsui	trvbsui

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery
T1082

Processes:

3eef203fb515bda85f514e168abb5973.exe

description ioc process

File opened (read-only) \??\VBoxMiniRdrDN 3eef203fb515bda85f514e168abb5973.exe

description	ioc	process
File opened (read-only)	\??\VBoxMiniRdrDN	3eef203fb515bda85f514e168abb5973.exe

Drops file in Windows directory 2 IoCs

Processes:

3eef203fb515bda85f514e168abb5973.exe

description	ioc	process
File opened for modification	C:\Windows\rss	3eef203fb515bda85f514e168abb5973.exe
File created	C:\Windows\rss\csrss.exe	3eef203fb515bda85f514e168abb5973.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 10 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
4584	4072	WerFault.exe	setup.exe
3596	4072	WerFault.exe	setup.exe
4752	4072	WerFault.exe	setup.exe
4588	4072	WerFault.exe	setup.exe
1540	4072	WerFault.exe	setup.exe
1600	4072	WerFault.exe	setup.exe
1740	4072	WerFault.exe	setup.exe
3888	4072	WerFault.exe	setup.exe
3124	4072	WerFault.exe	setup.exe
4520	4072	WerFault.exe	setup.exe

Checks SCSI registry key(s) 3 TTPs 9 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

2a344302.exetoolspub2.exegfvbsui

description	ioc	process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	2a344302.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	gfvbsui
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	gfvbsui
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	2a344302.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub2.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub2.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	gfvbsui
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	2a344302.exe

Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid process

1464 schtasks.exe
700 schtasks.exe
4292 schtasks.exe
Kills process with taskkill 3 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exe

pid process

3972 taskkill.exe
3460 taskkill.exe
3172 taskkill.exe

pid	process
1464	schtasks.exe
700	schtasks.exe
4292	schtasks.exe

pid	process
3972	taskkill.exe
3460	taskkill.exe
3172	taskkill.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exe3eef203fb515bda85f514e168abb5973.exepowershell.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2492 = "Aus Central W. Standard Time"	3eef203fb515bda85f514e168abb5973.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1801 = "Line Islands Daylight Time"	3eef203fb515bda85f514e168abb5973.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1892 = "Russia TZ 3 Standard Time"	3eef203fb515bda85f514e168abb5973.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-981 = "Kamchatka Daylight Time"	3eef203fb515bda85f514e168abb5973.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2182 = "Astrakhan Standard Time"	3eef203fb515bda85f514e168abb5973.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2452 = "Saint Pierre Standard Time"	3eef203fb515bda85f514e168abb5973.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-132 = "US Eastern Standard Time"	3eef203fb515bda85f514e168abb5973.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1871 = "Russia TZ 7 Daylight Time"	3eef203fb515bda85f514e168abb5973.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-272 = "Greenwich Standard Time"	3eef203fb515bda85f514e168abb5973.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-72 = "Newfoundland Standard Time"	3eef203fb515bda85f514e168abb5973.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-141 = "Canada Central Daylight Time"	3eef203fb515bda85f514e168abb5973.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-742 = "New Zealand Standard Time"	3eef203fb515bda85f514e168abb5973.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2591 = "Tocantins Daylight Time"	3eef203fb515bda85f514e168abb5973.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-449 = "Azerbaijan Standard Time"	3eef203fb515bda85f514e168abb5973.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2451 = "Saint Pierre Daylight Time"	3eef203fb515bda85f514e168abb5973.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-452 = "Caucasus Standard Time"	3eef203fb515bda85f514e168abb5973.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-662 = "Cen. Australia Standard Time"	3eef203fb515bda85f514e168abb5973.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1661 = "Bahia Daylight Time"	3eef203fb515bda85f514e168abb5973.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-492 = "India Standard Time"	3eef203fb515bda85f514e168abb5973.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1972 = "Belarus Standard Time"	3eef203fb515bda85f514e168abb5973.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-571 = "China Daylight Time"	3eef203fb515bda85f514e168abb5973.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1861 = "Russia TZ 6 Daylight Time"	3eef203fb515bda85f514e168abb5973.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1912 = "Russia TZ 10 Standard Time"	3eef203fb515bda85f514e168abb5973.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-461 = "Afghanistan Daylight Time"	3eef203fb515bda85f514e168abb5973.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-652 = "AUS Central Standard Time"	3eef203fb515bda85f514e168abb5973.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-162 = "Central Standard Time"	3eef203fb515bda85f514e168abb5973.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-122 = "SA Pacific Standard Time"	3eef203fb515bda85f514e168abb5973.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2891 = "Sudan Daylight Time"	3eef203fb515bda85f514e168abb5973.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2161 = "Altai Daylight Time"	3eef203fb515bda85f514e168abb5973.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1822 = "Russia TZ 1 Standard Time"	3eef203fb515bda85f514e168abb5973.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

2a344302.exe

pid	process
3256	2a344302.exe
3256	2a344302.exe
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

2a344302.exegfvbsui

pid process

3256 2a344302.exe
1236 gfvbsui

Suspicious use of AdjustPrivilegeToken 59 IoCs

Processes:

taskkill.exetaskkill.exepowershell.exetaskkill.exe3eef203fb515bda85f514e168abb5973.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.exe

description	pid	process
Token: SeDebugPrivilege	3460	taskkill.exe
Token: SeDebugPrivilege	3972	taskkill.exe
Token: SeShutdownPrivilege	3156
Token: SeCreatePagefilePrivilege	3156
Token: SeShutdownPrivilege	3156
Token: SeCreatePagefilePrivilege	3156
Token: SeDebugPrivilege	2724	powershell.exe
Token: SeShutdownPrivilege	3156
Token: SeCreatePagefilePrivilege	3156
Token: SeShutdownPrivilege	3156
Token: SeCreatePagefilePrivilege	3156
Token: SeShutdownPrivilege	3156
Token: SeCreatePagefilePrivilege	3156
Token: SeShutdownPrivilege	3156
Token: SeCreatePagefilePrivilege	3156
Token: SeShutdownPrivilege	3156
Token: SeCreatePagefilePrivilege	3156
Token: SeShutdownPrivilege	3156
Token: SeCreatePagefilePrivilege	3156
Token: SeShutdownPrivilege	3156
Token: SeCreatePagefilePrivilege	3156
Token: SeShutdownPrivilege	3156
Token: SeCreatePagefilePrivilege	3156
Token: SeDebugPrivilege	3172	taskkill.exe
Token: SeShutdownPrivilege	3156
Token: SeCreatePagefilePrivilege	3156
Token: SeShutdownPrivilege	3156
Token: SeCreatePagefilePrivilege	3156
Token: SeShutdownPrivilege	3156
Token: SeCreatePagefilePrivilege	3156
Token: SeDebugPrivilege	4792	3eef203fb515bda85f514e168abb5973.exe
Token: SeImpersonatePrivilege	4792	3eef203fb515bda85f514e168abb5973.exe
Token: SeDebugPrivilege	916	powershell.exe
Token: SeShutdownPrivilege	3156
Token: SeCreatePagefilePrivilege	3156
Token: SeShutdownPrivilege	3156
Token: SeCreatePagefilePrivilege	3156
Token: SeDebugPrivilege	4892	powershell.exe
Token: SeShutdownPrivilege	3156
Token: SeCreatePagefilePrivilege	3156
Token: SeDebugPrivilege	4152	powershell.exe
Token: SeShutdownPrivilege	3156
Token: SeCreatePagefilePrivilege	3156
Token: SeDebugPrivilege	2612	powershell.exe
Token: SeShutdownPrivilege	3156
Token: SeCreatePagefilePrivilege	3156
Token: SeDebugPrivilege	2992	powershell.exe
Token: SeShutdownPrivilege	3156
Token: SeCreatePagefilePrivilege	3156
Token: SeDebugPrivilege	1992	powershell.exe
Token: SeShutdownPrivilege	3156
Token: SeCreatePagefilePrivilege	3156
Token: SeSystemEnvironmentPrivilege	4840	csrss.exe
Token: SeShutdownPrivilege	3156
Token: SeCreatePagefilePrivilege	3156
Token: SeShutdownPrivilege	3156
Token: SeCreatePagefilePrivilege	3156
Token: SeShutdownPrivilege	3156
Token: SeCreatePagefilePrivilege	3156

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

newplayer.exe

pid process

2380 newplayer.exe

pid	process
2380	newplayer.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

01242999.exenewplayer.exeoneetx.execmd.exess41.exetoolspub2.exe3eef203fb515bda85f514e168abb5973.exesetup.execmd.exe3eef203fb515bda85f514e168abb5973.exe

description	pid	process	target process
PID 2128 wrote to memory of 1676	2128	01242999.exe	ss41.exe
PID 2128 wrote to memory of 1676	2128	01242999.exe	ss41.exe
PID 2128 wrote to memory of 3256	2128	01242999.exe	2a344302.exe
PID 2128 wrote to memory of 3256	2128	01242999.exe	2a344302.exe
PID 2128 wrote to memory of 3256	2128	01242999.exe	2a344302.exe
PID 2128 wrote to memory of 2380	2128	01242999.exe	newplayer.exe
PID 2128 wrote to memory of 2380	2128	01242999.exe	newplayer.exe
PID 2128 wrote to memory of 2380	2128	01242999.exe	newplayer.exe
PID 2380 wrote to memory of 1848	2380	newplayer.exe	oneetx.exe
PID 2380 wrote to memory of 1848	2380	newplayer.exe	oneetx.exe
PID 2380 wrote to memory of 1848	2380	newplayer.exe	oneetx.exe
PID 1848 wrote to memory of 1464	1848	oneetx.exe	schtasks.exe
PID 1848 wrote to memory of 1464	1848	oneetx.exe	schtasks.exe
PID 1848 wrote to memory of 1464	1848	oneetx.exe	schtasks.exe
PID 1848 wrote to memory of 4824	1848	oneetx.exe	cmd.exe
PID 1848 wrote to memory of 4824	1848	oneetx.exe	cmd.exe
PID 1848 wrote to memory of 4824	1848	oneetx.exe	cmd.exe
PID 4824 wrote to memory of 2392	4824	cmd.exe	cmd.exe
PID 4824 wrote to memory of 2392	4824	cmd.exe	cmd.exe
PID 4824 wrote to memory of 2392	4824	cmd.exe	cmd.exe
PID 4824 wrote to memory of 5016	4824	cmd.exe	cacls.exe
PID 4824 wrote to memory of 5016	4824	cmd.exe	cacls.exe
PID 4824 wrote to memory of 5016	4824	cmd.exe	cacls.exe
PID 4824 wrote to memory of 4748	4824	cmd.exe	cacls.exe
PID 4824 wrote to memory of 4748	4824	cmd.exe	cacls.exe
PID 4824 wrote to memory of 4748	4824	cmd.exe	cacls.exe
PID 4824 wrote to memory of 4544	4824	cmd.exe	cmd.exe
PID 4824 wrote to memory of 4544	4824	cmd.exe	cmd.exe
PID 4824 wrote to memory of 4544	4824	cmd.exe	cmd.exe
PID 4824 wrote to memory of 884	4824	cmd.exe	cacls.exe
PID 4824 wrote to memory of 884	4824	cmd.exe	cacls.exe
PID 4824 wrote to memory of 884	4824	cmd.exe	cacls.exe
PID 4824 wrote to memory of 3184	4824	cmd.exe	cacls.exe
PID 4824 wrote to memory of 3184	4824	cmd.exe	cacls.exe
PID 4824 wrote to memory of 3184	4824	cmd.exe	cacls.exe
PID 1676 wrote to memory of 3972	1676	ss41.exe	taskkill.exe
PID 1676 wrote to memory of 3972	1676	ss41.exe	taskkill.exe
PID 1676 wrote to memory of 3460	1676	ss41.exe	taskkill.exe
PID 1676 wrote to memory of 3460	1676	ss41.exe	taskkill.exe
PID 1848 wrote to memory of 4792	1848	oneetx.exe	3eef203fb515bda85f514e168abb5973.exe
PID 1848 wrote to memory of 4792	1848	oneetx.exe	3eef203fb515bda85f514e168abb5973.exe
PID 1848 wrote to memory of 4792	1848	oneetx.exe	3eef203fb515bda85f514e168abb5973.exe
PID 1848 wrote to memory of 4072	1848	oneetx.exe	setup.exe
PID 1848 wrote to memory of 4072	1848	oneetx.exe	setup.exe
PID 1848 wrote to memory of 4072	1848	oneetx.exe	setup.exe
PID 1848 wrote to memory of 4924	1848	oneetx.exe	toolspub2.exe
PID 1848 wrote to memory of 4924	1848	oneetx.exe	toolspub2.exe
PID 1848 wrote to memory of 4924	1848	oneetx.exe	toolspub2.exe
PID 4924 wrote to memory of 4708	4924	toolspub2.exe	toolspub2.exe
PID 4924 wrote to memory of 4708	4924	toolspub2.exe	toolspub2.exe
PID 4924 wrote to memory of 4708	4924	toolspub2.exe	toolspub2.exe
PID 4924 wrote to memory of 4708	4924	toolspub2.exe	toolspub2.exe
PID 4924 wrote to memory of 4708	4924	toolspub2.exe	toolspub2.exe
PID 4924 wrote to memory of 4708	4924	toolspub2.exe	toolspub2.exe
PID 4792 wrote to memory of 2724	4792	3eef203fb515bda85f514e168abb5973.exe	powershell.exe
PID 4792 wrote to memory of 2724	4792	3eef203fb515bda85f514e168abb5973.exe	powershell.exe
PID 4792 wrote to memory of 2724	4792	3eef203fb515bda85f514e168abb5973.exe	powershell.exe
PID 4072 wrote to memory of 4132	4072	setup.exe	cmd.exe
PID 4072 wrote to memory of 4132	4072	setup.exe	cmd.exe
PID 4072 wrote to memory of 4132	4072	setup.exe	cmd.exe
PID 4132 wrote to memory of 3172	4132	cmd.exe	taskkill.exe
PID 4132 wrote to memory of 3172	4132	cmd.exe	taskkill.exe
PID 4132 wrote to memory of 3172	4132	cmd.exe	taskkill.exe
PID 4908 wrote to memory of 916	4908	3eef203fb515bda85f514e168abb5973.exe	powershell.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\01242999.exe
"C:\Users\Admin\AppData\Local\Temp\01242999.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2128

C:\Users\Admin\AppData\Local\Temp\ss41.exe
"C:\Users\Admin\AppData\Local\Temp\ss41.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM chrome.exe /F
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3972

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM msedge.exe /F
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3460

C:\Users\Admin\AppData\Local\Temp\2a344302.exe
"C:\Users\Admin\AppData\Local\Temp\2a344302.exe"
2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3256

C:\Users\Admin\AppData\Local\Temp\newplayer.exe
"C:\Users\Admin\AppData\Local\Temp\newplayer.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2380

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
"C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe" /F
4⤵
- Creates scheduled task(s)
PID:1464

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\207aa4515d" /P "Admin:N"&&CACLS "..\207aa4515d" /P "Admin:R" /E&&Exit
4⤵
- Suspicious use of WriteProcessMemory
PID:4824

C:\Windows\SysWOW64\cacls.exe
CACLS "oneetx.exe" /P "Admin:N"
5⤵
PID:5016

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:2392

C:\Windows\SysWOW64\cacls.exe
CACLS "oneetx.exe" /P "Admin:R" /E
5⤵
PID:4748

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:4544

C:\Windows\SysWOW64\cacls.exe
CACLS "..\207aa4515d" /P "Admin:N"
5⤵
PID:884

C:\Windows\SysWOW64\cacls.exe
CACLS "..\207aa4515d" /P "Admin:R" /E
5⤵
PID:3184

C:\Users\Admin\AppData\Local\Temp\1000003001\3eef203fb515bda85f514e168abb5973.exe
"C:\Users\Admin\AppData\Local\Temp\1000003001\3eef203fb515bda85f514e168abb5973.exe"
4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4792

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:2724

C:\Users\Admin\AppData\Local\Temp\1000003001\3eef203fb515bda85f514e168abb5973.exe
"C:\Users\Admin\AppData\Local\Temp\1000003001\3eef203fb515bda85f514e168abb5973.exe"
5⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:4908

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:916

C:\Windows\system32\cmd.exe
C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
6⤵
PID:1740

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
7⤵
- Modifies Windows Firewall
PID:1284

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4892

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4152

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
6⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Suspicious use of AdjustPrivilegeToken
PID:4840

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
7⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2612

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
7⤵
- Creates scheduled task(s)
PID:700

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
7⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2992

C:\Windows\SYSTEM32\schtasks.exe
schtasks /delete /tn ScheduledUpdate /f
7⤵
PID:3532

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
7⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1992

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
7⤵
- Executes dropped EXE
PID:4928

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
7⤵
- Creates scheduled task(s)
PID:4292

C:\Users\Admin\AppData\Local\Temp\1000004001\setup.exe
"C:\Users\Admin\AppData\Local\Temp\1000004001\setup.exe"
4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4072 -s 624
5⤵
- Program crash
PID:4584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4072 -s 884
5⤵
- Program crash
PID:3596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4072 -s 892
5⤵
- Program crash
PID:4752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4072 -s 936
5⤵
- Program crash
PID:4588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4072 -s 944
5⤵
- Program crash
PID:1540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4072 -s 1104
5⤵
- Program crash
PID:1600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4072 -s 1140
5⤵
- Program crash
PID:1740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4072 -s 1172
5⤵
- Program crash
PID:3888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4072 -s 1480
5⤵
- Program crash
PID:3124

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "setup.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\1000004001\setup.exe" & exit
5⤵
- Suspicious use of WriteProcessMemory
PID:4132

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "setup.exe" /f
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4072 -s 676
5⤵
- Program crash
PID:4520

C:\Users\Admin\AppData\Local\Temp\1000005001\toolspub2.exe
"C:\Users\Admin\AppData\Local\Temp\1000005001\toolspub2.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4924

C:\Users\Admin\AppData\Local\Temp\1000005001\toolspub2.exe
"C:\Users\Admin\AppData\Local\Temp\1000005001\toolspub2.exe"
5⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 4072 -ip 4072
1⤵
PID:4348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4072 -ip 4072
1⤵
PID:1896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4072 -ip 4072
1⤵
PID:1556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4072 -ip 4072
1⤵
PID:4368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4072 -ip 4072
1⤵
PID:1380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4072 -ip 4072
1⤵
PID:868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4072 -ip 4072
1⤵
PID:3676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4072 -ip 4072
1⤵
PID:3984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4072 -ip 4072
1⤵
PID:2056

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
1⤵
- Executes dropped EXE
PID:1956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 4072 -ip 4072
1⤵
PID:1076

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
1⤵
- Executes dropped EXE
PID:4876

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
1⤵
- Executes dropped EXE
PID:1668

C:\Users\Admin\AppData\Roaming\gfvbsui
C:\Users\Admin\AppData\Roaming\gfvbsui
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:1236

C:\Users\Admin\AppData\Roaming\trvbsui
C:\Users\Admin\AppData\Roaming\trvbsui
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1232

C:\Users\Admin\AppData\Roaming\trvbsui
C:\Users\Admin\AppData\Roaming\trvbsui
2⤵
- Executes dropped EXE
PID:3176

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1000003001\3eef203fb515bda85f514e168abb5973.exe
Filesize
4.1MB

MD5
d82f58a3a66392e427af0c1ed193a436

SHA1
9400a04b6723f3c338dc783ee1f042c38b0ef7bb

SHA256
8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f

SHA512
8fd988b26e6c15bb35820ee880fc910bd765d7a7cd0776c370133a236ce9b1f4d558f922efb538a9e98c5c5d5c3a49a0cf4df59b7ea1383152cb15b824913fdb

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000003001\3eef203fb515bda85f514e168abb5973.exe
Filesize
4.1MB

MD5
d82f58a3a66392e427af0c1ed193a436

SHA1
9400a04b6723f3c338dc783ee1f042c38b0ef7bb

SHA256
8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f

SHA512
8fd988b26e6c15bb35820ee880fc910bd765d7a7cd0776c370133a236ce9b1f4d558f922efb538a9e98c5c5d5c3a49a0cf4df59b7ea1383152cb15b824913fdb

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000003001\3eef203fb515bda85f514e168abb5973.exe
Filesize
4.1MB

MD5
d82f58a3a66392e427af0c1ed193a436

SHA1
9400a04b6723f3c338dc783ee1f042c38b0ef7bb

SHA256
8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f

SHA512
8fd988b26e6c15bb35820ee880fc910bd765d7a7cd0776c370133a236ce9b1f4d558f922efb538a9e98c5c5d5c3a49a0cf4df59b7ea1383152cb15b824913fdb

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000003001\3eef203fb515bda85f514e168abb5973.exe
Filesize
4.1MB

MD5
d82f58a3a66392e427af0c1ed193a436

SHA1
9400a04b6723f3c338dc783ee1f042c38b0ef7bb

SHA256
8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f

SHA512
8fd988b26e6c15bb35820ee880fc910bd765d7a7cd0776c370133a236ce9b1f4d558f922efb538a9e98c5c5d5c3a49a0cf4df59b7ea1383152cb15b824913fdb

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000004001\setup.exe
Filesize
276KB

MD5
94a8cb37cf0aa2d1fedb893167f4dc67

SHA1
08b2d1d0ff9c73128faa4180377c7f1a0290252b

SHA256
0c66455c62f9e8d2755760f97d5e51e26267682cc9a6ec15bae1f1d0bbeaaa65

SHA512
52475d7a08673be460b4429692043aee04b1db9b6a700c96760d55bd339234574d8b739e8920fcb617da35a863eab1c21451b3b5b1fc5b2f85a25facc2c6a075

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000004001\setup.exe
Filesize
276KB

MD5
94a8cb37cf0aa2d1fedb893167f4dc67

SHA1
08b2d1d0ff9c73128faa4180377c7f1a0290252b

SHA256
0c66455c62f9e8d2755760f97d5e51e26267682cc9a6ec15bae1f1d0bbeaaa65

SHA512
52475d7a08673be460b4429692043aee04b1db9b6a700c96760d55bd339234574d8b739e8920fcb617da35a863eab1c21451b3b5b1fc5b2f85a25facc2c6a075

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000004001\setup.exe
Filesize
276KB

MD5
94a8cb37cf0aa2d1fedb893167f4dc67

SHA1
08b2d1d0ff9c73128faa4180377c7f1a0290252b

SHA256
0c66455c62f9e8d2755760f97d5e51e26267682cc9a6ec15bae1f1d0bbeaaa65

SHA512
52475d7a08673be460b4429692043aee04b1db9b6a700c96760d55bd339234574d8b739e8920fcb617da35a863eab1c21451b3b5b1fc5b2f85a25facc2c6a075

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000005001\toolspub2.exe
Filesize
205KB

MD5
46a85f9fb354c4a5c4ea7a321ee9c3b9

SHA1
ff3e925a9463283888189692865775205a0976a9

SHA256
cb3bc1b8b740f2b21baf6567c68cc9aaf7038b7e5394385a8c5d4b45cd433af4

SHA512
acbb500bbd9940f96c50292f4ecf8267e69730dc1db7fc33763a7f5d7afd353b572c2b687b1f63eb434501fd9c1fc315796da36a37cbb6425d42fa7d52f1fc22

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000005001\toolspub2.exe
Filesize
205KB

MD5
46a85f9fb354c4a5c4ea7a321ee9c3b9

SHA1
ff3e925a9463283888189692865775205a0976a9

SHA256
cb3bc1b8b740f2b21baf6567c68cc9aaf7038b7e5394385a8c5d4b45cd433af4

SHA512
acbb500bbd9940f96c50292f4ecf8267e69730dc1db7fc33763a7f5d7afd353b572c2b687b1f63eb434501fd9c1fc315796da36a37cbb6425d42fa7d52f1fc22

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000005001\toolspub2.exe
Filesize
205KB

MD5
46a85f9fb354c4a5c4ea7a321ee9c3b9

SHA1
ff3e925a9463283888189692865775205a0976a9

SHA256
cb3bc1b8b740f2b21baf6567c68cc9aaf7038b7e5394385a8c5d4b45cd433af4

SHA512
acbb500bbd9940f96c50292f4ecf8267e69730dc1db7fc33763a7f5d7afd353b572c2b687b1f63eb434501fd9c1fc315796da36a37cbb6425d42fa7d52f1fc22

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000005001\toolspub2.exe
Filesize
205KB

MD5
46a85f9fb354c4a5c4ea7a321ee9c3b9

SHA1
ff3e925a9463283888189692865775205a0976a9

SHA256
cb3bc1b8b740f2b21baf6567c68cc9aaf7038b7e5394385a8c5d4b45cd433af4

SHA512
acbb500bbd9940f96c50292f4ecf8267e69730dc1db7fc33763a7f5d7afd353b572c2b687b1f63eb434501fd9c1fc315796da36a37cbb6425d42fa7d52f1fc22

Download Submit
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
Filesize
198KB

MD5
f0033521f40c06dec473854c7d98fa8b

SHA1
28dadfe642a0c308e1f744b0d87a6d22dd6cd55a

SHA256
4458a9df5275bedd921127f4ff9dc63d4ac107f2e89cf46969e96f4c43d9f93e

SHA512
f6758814fd20b613fe6f3df7a0a60488dcae59680c3487344a701f59dca972acbb1dd8041bd3fa8d3f97279193796dab9c7f98f1cab3e25686ca34c65e349217

Download Submit
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
Filesize
198KB

MD5
f0033521f40c06dec473854c7d98fa8b

SHA1
28dadfe642a0c308e1f744b0d87a6d22dd6cd55a

SHA256
4458a9df5275bedd921127f4ff9dc63d4ac107f2e89cf46969e96f4c43d9f93e

SHA512
f6758814fd20b613fe6f3df7a0a60488dcae59680c3487344a701f59dca972acbb1dd8041bd3fa8d3f97279193796dab9c7f98f1cab3e25686ca34c65e349217

Download Submit
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
Filesize
198KB

MD5
f0033521f40c06dec473854c7d98fa8b

SHA1
28dadfe642a0c308e1f744b0d87a6d22dd6cd55a

SHA256
4458a9df5275bedd921127f4ff9dc63d4ac107f2e89cf46969e96f4c43d9f93e

SHA512
f6758814fd20b613fe6f3df7a0a60488dcae59680c3487344a701f59dca972acbb1dd8041bd3fa8d3f97279193796dab9c7f98f1cab3e25686ca34c65e349217

Download Submit
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
Filesize
198KB

MD5
f0033521f40c06dec473854c7d98fa8b

SHA1
28dadfe642a0c308e1f744b0d87a6d22dd6cd55a

SHA256
4458a9df5275bedd921127f4ff9dc63d4ac107f2e89cf46969e96f4c43d9f93e

SHA512
f6758814fd20b613fe6f3df7a0a60488dcae59680c3487344a701f59dca972acbb1dd8041bd3fa8d3f97279193796dab9c7f98f1cab3e25686ca34c65e349217

Download Submit
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
Filesize
198KB

MD5
f0033521f40c06dec473854c7d98fa8b

SHA1
28dadfe642a0c308e1f744b0d87a6d22dd6cd55a

SHA256
4458a9df5275bedd921127f4ff9dc63d4ac107f2e89cf46969e96f4c43d9f93e

SHA512
f6758814fd20b613fe6f3df7a0a60488dcae59680c3487344a701f59dca972acbb1dd8041bd3fa8d3f97279193796dab9c7f98f1cab3e25686ca34c65e349217

Download Submit
C:\Users\Admin\AppData\Local\Temp\2a344302.exe
Filesize
207KB

MD5
31e6d2018b345fe69bbc2cf8f69215b3

SHA1
7bd30d865386c349f3c29c9d85fda0a7ad76111d

SHA256
90e12268c6886da75cf395936df7635c52dfcd3bcf074396dd9c97fa55c9eb5b

SHA512
fb294895a68f47ec54f66aae54fe1eaff8de4851c2105abd840eb1221be216197edc19bd0f5e4b0b42b045ce42ab07135e52d6f1087c930c5d75312fd8ebb021

Download Submit
C:\Users\Admin\AppData\Local\Temp\2a344302.exe
Filesize
207KB

MD5
31e6d2018b345fe69bbc2cf8f69215b3

SHA1
7bd30d865386c349f3c29c9d85fda0a7ad76111d

SHA256
90e12268c6886da75cf395936df7635c52dfcd3bcf074396dd9c97fa55c9eb5b

SHA512
fb294895a68f47ec54f66aae54fe1eaff8de4851c2105abd840eb1221be216197edc19bd0f5e4b0b42b045ce42ab07135e52d6f1087c930c5d75312fd8ebb021

Download Submit
C:\Users\Admin\AppData\Local\Temp\2a344302.exe
Filesize
207KB

MD5
31e6d2018b345fe69bbc2cf8f69215b3

SHA1
7bd30d865386c349f3c29c9d85fda0a7ad76111d

SHA256
90e12268c6886da75cf395936df7635c52dfcd3bcf074396dd9c97fa55c9eb5b

SHA512
fb294895a68f47ec54f66aae54fe1eaff8de4851c2105abd840eb1221be216197edc19bd0f5e4b0b42b045ce42ab07135e52d6f1087c930c5d75312fd8ebb021

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ohlcbscz.unb.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
Filesize
281KB

MD5
d98e33b66343e7c96158444127a117f6

SHA1
bb716c5509a2bf345c6c1152f6e3e1452d39d50d

SHA256
5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

SHA512
705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
Filesize
281KB

MD5
d98e33b66343e7c96158444127a117f6

SHA1
bb716c5509a2bf345c6c1152f6e3e1452d39d50d

SHA256
5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

SHA512
705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

Download Submit
C:\Users\Admin\AppData\Local\Temp\newplayer.exe
Filesize
198KB

MD5
f0033521f40c06dec473854c7d98fa8b

SHA1
28dadfe642a0c308e1f744b0d87a6d22dd6cd55a

SHA256
4458a9df5275bedd921127f4ff9dc63d4ac107f2e89cf46969e96f4c43d9f93e

SHA512
f6758814fd20b613fe6f3df7a0a60488dcae59680c3487344a701f59dca972acbb1dd8041bd3fa8d3f97279193796dab9c7f98f1cab3e25686ca34c65e349217

Download Submit
C:\Users\Admin\AppData\Local\Temp\newplayer.exe
Filesize
198KB

MD5
f0033521f40c06dec473854c7d98fa8b

SHA1
28dadfe642a0c308e1f744b0d87a6d22dd6cd55a

SHA256
4458a9df5275bedd921127f4ff9dc63d4ac107f2e89cf46969e96f4c43d9f93e

SHA512
f6758814fd20b613fe6f3df7a0a60488dcae59680c3487344a701f59dca972acbb1dd8041bd3fa8d3f97279193796dab9c7f98f1cab3e25686ca34c65e349217

Download Submit
C:\Users\Admin\AppData\Local\Temp\newplayer.exe
Filesize
198KB

MD5
f0033521f40c06dec473854c7d98fa8b

SHA1
28dadfe642a0c308e1f744b0d87a6d22dd6cd55a

SHA256
4458a9df5275bedd921127f4ff9dc63d4ac107f2e89cf46969e96f4c43d9f93e

SHA512
f6758814fd20b613fe6f3df7a0a60488dcae59680c3487344a701f59dca972acbb1dd8041bd3fa8d3f97279193796dab9c7f98f1cab3e25686ca34c65e349217

Download Submit
C:\Users\Admin\AppData\Local\Temp\ss41.exe
Filesize
635KB

MD5
730f705fb43707395f4ff1c00e01f576

SHA1
7cba596e3912504bc4d87a03fbc0190aab7befe1

SHA256
b56459b00e75cd98b37de308113ff5d79584ee0715c82559f5dadd7539f2bc85

SHA512
73e62ed83978f508683d6b64568309f77590f94016ff3368285ceece30bf30f88cab9c3d5e233592361e30a6ec04633dd633d623b07c93410f9fc985db13025b

Download Submit
C:\Users\Admin\AppData\Local\Temp\ss41.exe
Filesize
635KB

MD5
730f705fb43707395f4ff1c00e01f576

SHA1
7cba596e3912504bc4d87a03fbc0190aab7befe1

SHA256
b56459b00e75cd98b37de308113ff5d79584ee0715c82559f5dadd7539f2bc85

SHA512
73e62ed83978f508683d6b64568309f77590f94016ff3368285ceece30bf30f88cab9c3d5e233592361e30a6ec04633dd633d623b07c93410f9fc985db13025b

Download Submit
C:\Users\Admin\AppData\Local\Temp\ss41.exe
Filesize
635KB

MD5
730f705fb43707395f4ff1c00e01f576

SHA1
7cba596e3912504bc4d87a03fbc0190aab7befe1

SHA256
b56459b00e75cd98b37de308113ff5d79584ee0715c82559f5dadd7539f2bc85

SHA512
73e62ed83978f508683d6b64568309f77590f94016ff3368285ceece30bf30f88cab9c3d5e233592361e30a6ec04633dd633d623b07c93410f9fc985db13025b

Download Submit
C:\Users\Admin\AppData\Roaming\gfvbsui
Filesize
207KB

MD5
31e6d2018b345fe69bbc2cf8f69215b3

SHA1
7bd30d865386c349f3c29c9d85fda0a7ad76111d

SHA256
90e12268c6886da75cf395936df7635c52dfcd3bcf074396dd9c97fa55c9eb5b

SHA512
fb294895a68f47ec54f66aae54fe1eaff8de4851c2105abd840eb1221be216197edc19bd0f5e4b0b42b045ce42ab07135e52d6f1087c930c5d75312fd8ebb021

Download Submit
C:\Users\Admin\AppData\Roaming\gfvbsui
Filesize
207KB

MD5
31e6d2018b345fe69bbc2cf8f69215b3

SHA1
7bd30d865386c349f3c29c9d85fda0a7ad76111d

SHA256
90e12268c6886da75cf395936df7635c52dfcd3bcf074396dd9c97fa55c9eb5b

SHA512
fb294895a68f47ec54f66aae54fe1eaff8de4851c2105abd840eb1221be216197edc19bd0f5e4b0b42b045ce42ab07135e52d6f1087c930c5d75312fd8ebb021

Download Submit
C:\Users\Admin\AppData\Roaming\trvbsui
Filesize
205KB

MD5
46a85f9fb354c4a5c4ea7a321ee9c3b9

SHA1
ff3e925a9463283888189692865775205a0976a9

SHA256
cb3bc1b8b740f2b21baf6567c68cc9aaf7038b7e5394385a8c5d4b45cd433af4

SHA512
acbb500bbd9940f96c50292f4ecf8267e69730dc1db7fc33763a7f5d7afd353b572c2b687b1f63eb434501fd9c1fc315796da36a37cbb6425d42fa7d52f1fc22

Download Submit
C:\Users\Admin\AppData\Roaming\trvbsui
Filesize
205KB

MD5
46a85f9fb354c4a5c4ea7a321ee9c3b9

SHA1
ff3e925a9463283888189692865775205a0976a9

SHA256
cb3bc1b8b740f2b21baf6567c68cc9aaf7038b7e5394385a8c5d4b45cd433af4

SHA512
acbb500bbd9940f96c50292f4ecf8267e69730dc1db7fc33763a7f5d7afd353b572c2b687b1f63eb434501fd9c1fc315796da36a37cbb6425d42fa7d52f1fc22

Download Submit
C:\Users\Admin\AppData\Roaming\trvbsui
Filesize
205KB

MD5
46a85f9fb354c4a5c4ea7a321ee9c3b9

SHA1
ff3e925a9463283888189692865775205a0976a9

SHA256
cb3bc1b8b740f2b21baf6567c68cc9aaf7038b7e5394385a8c5d4b45cd433af4

SHA512
acbb500bbd9940f96c50292f4ecf8267e69730dc1db7fc33763a7f5d7afd353b572c2b687b1f63eb434501fd9c1fc315796da36a37cbb6425d42fa7d52f1fc22

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
3d086a433708053f9bf9523e1d87a4e8

SHA1
b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

SHA256
6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

SHA512
931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
a6a79c2f97f6b931610305761cd93624

SHA1
bbebd81433ef2c59abfa6f1d34bc21582e8b1c36

SHA256
24449d0f0dd209c8d8904d2566dbdf6a1bd3f19c7c9aa67b74b10e0aa5d1fc07

SHA512
19fe350dae035bdede6cd25bd6c007a179daccd33945d7a62acb92fd38b34fe83de74e1f6627b4ab1f2eef3542316ea120cac83cd2ae7eb92180289cf6c45a05

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
2d442fa307e03d5f1d327762de537d6b

SHA1
17015cb2fd6af99dc746c77231e729d5754d3235

SHA256
64620f5b8acdd2cdb262930432099107edc31c5c1592cbfe9a07d0b72b4f8b60

SHA512
c44b18fcd9044f05d4473b7a65476a191adcaeb5ecc81b68e75fbc94d9236b2c79b9735160678938056920a8c0a1410fc5bfc469ead004f7f1f6071a23d693fe

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
34ff7e608ae9358767d79b9eb39d2d5a

SHA1
831104a781540d6a08f563a8e49487f2465c2ae0

SHA256
dd769fcda2f34a22975f61f5361cd4d085982849ba600ea8f1d5c52b91eb6699

SHA512
6362ed52ef1c8f065d1b6fb9bcea8acb0ff41ed418bb4abc05710a3dd6bab4cdba95d751a9a86a882e0b46191b558e9d7edde7c9d5e789e6cb1533e877dc3281

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
7e2e7011151afe5d26c2771927ebddaa

SHA1
12d24d71fc3c6e1d384cf87e18c104b38d0d886a

SHA256
2c7fcf8a3be0a26c015a689edd9ef3adc7a3abd1be5466cc5851d27582b6e6bb

SHA512
abfb31160e0a90e3f52d771d20a54a20a9cd8c9d5b506a7656b4fcc59b07dcd92a983f99bfabc9175cccd8288da7a9f51310d74ceb5bbc32a01da1d48f33e41e

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
39eac80a3bfa6e49b21d5f9279bedcee

SHA1
8fa6b55c8e194bb2b7d0b71125d3d756035ab6fe

SHA256
882f0fbd516f8dea7b0500073af5d87b82970d0aed0cd96cf5d624e5de37bc3a

SHA512
b0a9a98818cef5159f7bf08a29afdcc734877ece4971e80050673ceb546aecf00cf264ca209180080358e28403618a2095b9a6794da0a75afd9ed72eb3ed2255

Download Submit
C:\Windows\rss\csrss.exe
Filesize
4.1MB

MD5
d82f58a3a66392e427af0c1ed193a436

SHA1
9400a04b6723f3c338dc783ee1f042c38b0ef7bb

SHA256
8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f

SHA512
8fd988b26e6c15bb35820ee880fc910bd765d7a7cd0776c370133a236ce9b1f4d558f922efb538a9e98c5c5d5c3a49a0cf4df59b7ea1383152cb15b824913fdb

Download Submit
C:\Windows\rss\csrss.exe
Filesize
4.1MB

MD5
d82f58a3a66392e427af0c1ed193a436

SHA1
9400a04b6723f3c338dc783ee1f042c38b0ef7bb

SHA256
8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f

SHA512
8fd988b26e6c15bb35820ee880fc910bd765d7a7cd0776c370133a236ce9b1f4d558f922efb538a9e98c5c5d5c3a49a0cf4df59b7ea1383152cb15b824913fdb

Download Submit
memory/916-317-0x0000000003300000-0x0000000003310000-memory.dmp

Filesize
64KB

Download
memory/916-321-0x0000000073980000-0x00000000739CC000-memory.dmp

Filesize
304KB

Download
memory/916-306-0x0000000003300000-0x0000000003310000-memory.dmp

Filesize
64KB

Download
memory/916-316-0x0000000003300000-0x0000000003310000-memory.dmp

Filesize
64KB

Download
memory/916-322-0x0000000071540000-0x0000000071894000-memory.dmp

Filesize
3.3MB

Download
memory/916-332-0x000000007F420000-0x000000007F430000-memory.dmp

Filesize
64KB

Download
memory/1236-515-0x0000000000400000-0x00000000006DC000-memory.dmp

Filesize
2.9MB

Download
memory/1676-177-0x00000000033C0000-0x00000000034F2000-memory.dmp

Filesize
1.2MB

Download
memory/1676-176-0x0000000003240000-0x00000000033B1000-memory.dmp

Filesize
1.4MB

Download
memory/1676-278-0x00000000033C0000-0x00000000034F2000-memory.dmp

Filesize
1.2MB

Download
memory/1992-465-0x0000000004620000-0x0000000004630000-memory.dmp

Filesize
64KB

Download
memory/1992-466-0x0000000004620000-0x0000000004630000-memory.dmp

Filesize
64KB

Download
memory/1992-464-0x0000000004620000-0x0000000004630000-memory.dmp

Filesize
64KB

Download
memory/1992-467-0x00000000738E0000-0x000000007392C000-memory.dmp

Filesize
304KB

Download
memory/2128-133-0x0000000000090000-0x000000000019E000-memory.dmp

Filesize
1.1MB

Download
memory/2612-425-0x000000007F0D0000-0x000000007F0E0000-memory.dmp

Filesize
64KB

Download
memory/2612-411-0x0000000004A30000-0x0000000004A40000-memory.dmp

Filesize
64KB

Download
memory/2612-424-0x0000000004A30000-0x0000000004A40000-memory.dmp

Filesize
64KB

Download
memory/2612-414-0x00000000737A0000-0x0000000073AF4000-memory.dmp

Filesize
3.3MB

Download
memory/2612-413-0x00000000736F0000-0x000000007373C000-memory.dmp

Filesize
304KB

Download
memory/2612-412-0x0000000004A30000-0x0000000004A40000-memory.dmp

Filesize
64KB

Download
memory/2724-279-0x0000000007970000-0x00000000079A2000-memory.dmp

Filesize
200KB

Download
memory/2724-299-0x0000000007B50000-0x0000000007B6A000-memory.dmp

Filesize
104KB

Download
memory/2724-292-0x0000000007AA0000-0x0000000007AAA000-memory.dmp

Filesize
40KB

Download
memory/2724-291-0x0000000007950000-0x000000000796E000-memory.dmp

Filesize
120KB

Download
memory/2724-281-0x0000000071540000-0x0000000071894000-memory.dmp

Filesize
3.3MB

Download
memory/2724-280-0x00000000737D0000-0x000000007381C000-memory.dmp

Filesize
304KB

Download
memory/2724-261-0x0000000002B80000-0x0000000002B90000-memory.dmp

Filesize
64KB

Download
memory/2724-267-0x0000000006970000-0x00000000069B4000-memory.dmp

Filesize
272KB

Download
memory/2724-276-0x00000000077B0000-0x00000000077CA000-memory.dmp

Filesize
104KB

Download
memory/2724-295-0x000000007FBD0000-0x000000007FBE0000-memory.dmp

Filesize
64KB

Download
memory/2724-293-0x0000000007BB0000-0x0000000007C46000-memory.dmp

Filesize
600KB

Download
memory/2724-252-0x0000000005520000-0x0000000005542000-memory.dmp

Filesize
136KB

Download
memory/2724-274-0x0000000007E30000-0x00000000084AA000-memory.dmp

Filesize
6.5MB

Download
memory/2724-300-0x0000000007B40000-0x0000000007B48000-memory.dmp

Filesize
32KB

Download
memory/2724-296-0x0000000007AF0000-0x0000000007AFE000-memory.dmp

Filesize
56KB

Download
memory/2724-250-0x0000000002AB0000-0x0000000002AE6000-memory.dmp

Filesize
216KB

Download
memory/2724-251-0x00000000056B0000-0x0000000005CD8000-memory.dmp

Filesize
6.2MB

Download
memory/2724-275-0x0000000002B80000-0x0000000002B90000-memory.dmp

Filesize
64KB

Download
memory/2724-259-0x0000000005DC0000-0x0000000005E26000-memory.dmp

Filesize
408KB

Download
memory/2724-253-0x0000000005D50000-0x0000000005DB6000-memory.dmp

Filesize
408KB

Download
memory/2724-266-0x00000000063F0000-0x000000000640E000-memory.dmp

Filesize
120KB

Download
memory/2724-273-0x0000000007730000-0x00000000077A6000-memory.dmp

Filesize
472KB

Download
memory/2724-260-0x0000000002B80000-0x0000000002B90000-memory.dmp

Filesize
64KB

Download
memory/2992-451-0x000000007EED0000-0x000000007EEE0000-memory.dmp

Filesize
64KB

Download
memory/2992-439-0x0000000002A40000-0x0000000002A50000-memory.dmp

Filesize
64KB

Download
memory/2992-438-0x0000000002A40000-0x0000000002A50000-memory.dmp

Filesize
64KB

Download
memory/2992-440-0x00000000737E0000-0x000000007382C000-memory.dmp

Filesize
304KB

Download
memory/2992-441-0x00000000738F0000-0x0000000073C44000-memory.dmp

Filesize
3.3MB

Download
memory/3156-268-0x0000000002EA0000-0x0000000002EB6000-memory.dmp

Filesize
88KB

Download
memory/3156-197-0x0000000002E00000-0x0000000002E16000-memory.dmp

Filesize
88KB

Download
memory/3156-514-0x0000000002C10000-0x0000000002C26000-memory.dmp

Filesize
88KB

Download
memory/3176-511-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3256-163-0x0000000000820000-0x0000000000829000-memory.dmp

Filesize
36KB

Download
memory/3256-201-0x0000000000400000-0x00000000006DC000-memory.dmp

Filesize
2.9MB

Download
memory/4072-298-0x0000000000400000-0x00000000006ED000-memory.dmp

Filesize
2.9MB

Download
memory/4072-245-0x00000000009B0000-0x00000000009F0000-memory.dmp

Filesize
256KB

Download
memory/4152-391-0x000000007FCC0000-0x000000007FCD0000-memory.dmp

Filesize
64KB

Download
memory/4152-390-0x0000000004600000-0x0000000004610000-memory.dmp

Filesize
64KB

Download
memory/4152-380-0x0000000073970000-0x0000000073CC4000-memory.dmp

Filesize
3.3MB

Download
memory/4152-379-0x00000000736E0000-0x000000007372C000-memory.dmp

Filesize
304KB

Download
memory/4152-378-0x0000000004600000-0x0000000004610000-memory.dmp

Filesize
64KB

Download
memory/4708-249-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4708-246-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4708-269-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4792-294-0x0000000000400000-0x0000000001EB5000-memory.dmp

Filesize
26.7MB

Download
memory/4792-333-0x0000000000400000-0x0000000001EB5000-memory.dmp

Filesize
26.7MB

Download
memory/4792-244-0x0000000004050000-0x000000000493B000-memory.dmp

Filesize
8.9MB

Download
memory/4840-496-0x0000000000400000-0x0000000001EB5000-memory.dmp

Filesize
26.7MB

Download
memory/4840-500-0x0000000000400000-0x0000000001EB5000-memory.dmp

Filesize
26.7MB

Download
memory/4840-487-0x0000000000400000-0x0000000001EB5000-memory.dmp

Filesize
26.7MB

Download
memory/4840-513-0x0000000000400000-0x0000000001EB5000-memory.dmp

Filesize
26.7MB

Download
memory/4840-490-0x0000000000400000-0x0000000001EB5000-memory.dmp

Filesize
26.7MB

Download
memory/4840-492-0x0000000000400000-0x0000000001EB5000-memory.dmp

Filesize
26.7MB

Download
memory/4840-494-0x0000000000400000-0x0000000001EB5000-memory.dmp

Filesize
26.7MB

Download
memory/4840-437-0x0000000000400000-0x0000000001EB5000-memory.dmp

Filesize
26.7MB

Download
memory/4840-498-0x0000000000400000-0x0000000001EB5000-memory.dmp

Filesize
26.7MB

Download
memory/4840-484-0x0000000000400000-0x0000000001EB5000-memory.dmp

Filesize
26.7MB

Download
memory/4892-356-0x000000007F120000-0x000000007F130000-memory.dmp

Filesize
64KB

Download
memory/4892-354-0x00000000736F0000-0x000000007373C000-memory.dmp

Filesize
304KB

Download
memory/4892-355-0x00000000737A0000-0x0000000073AF4000-memory.dmp

Filesize
3.3MB

Download
memory/4892-338-0x0000000003380000-0x0000000003390000-memory.dmp

Filesize
64KB

Download
memory/4892-339-0x0000000003380000-0x0000000003390000-memory.dmp

Filesize
64KB

Download
memory/4892-353-0x0000000003380000-0x0000000003390000-memory.dmp

Filesize
64KB

Download
memory/4908-337-0x0000000000400000-0x0000000001EB5000-memory.dmp

Filesize
26.7MB

Download
memory/4908-392-0x0000000000400000-0x0000000001EB5000-memory.dmp

Filesize
26.7MB

Download
memory/4908-396-0x0000000000400000-0x0000000001EB5000-memory.dmp

Filesize
26.7MB

Download
memory/4924-248-0x0000000000750000-0x0000000000759000-memory.dmp

Filesize
36KB

Download