Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
17/09/2023, 08:45
Static task
static1
Behavioral task
behavioral1
Sample
617bbc2f92c2f99cb9958a079822510e0a4269616924d3b966741b40f16cad84exe_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
617bbc2f92c2f99cb9958a079822510e0a4269616924d3b966741b40f16cad84exe_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
617bbc2f92c2f99cb9958a079822510e0a4269616924d3b966741b40f16cad84exe_JC.exe
-
Size
272KB
-
MD5
20b8b9466e5792188d0f309824fb13b2
-
SHA1
7849b0bd1eadfc32b8a6128985b7ac50702fd958
-
SHA256
617bbc2f92c2f99cb9958a079822510e0a4269616924d3b966741b40f16cad84
-
SHA512
7a9141fb2e9a73a6024416da31b285837d4803cfbc12bebcd9643c9cf8daa584beef0d9d77042af8b3ab3a14c30885b49aba2698510906876725d7ca00a3c2aa
-
SSDEEP
3072:L828Zg0gv68cKavf0L4japEVh62h2g9gwqqZbORwVrTJe4pxNZ:o286v68cKavf0cjapL2h2bYORWpe4pF
Malware Config
Extracted
smokeloader
2022
http://potunulit.org/
http://hutnilior.net/
http://bulimu55t.net/
http://soryytlic4.net/
http://novanosa5org.org/
http://nuljjjnuli.org/
http://tolilolihul.net/
http://somatoka51hub.net/
http://hujukui3.net/
http://bukubuka1.net/
http://golilopaster.org/
http://newzelannd66.org/
http://otriluyttn.org/
Extracted
djvu
http://zexeq.com/raud/get.php
http://zexeq.com/lancer/get.php
-
extension
.ooza
-
offline_id
dhL6XvokZotUzL67Na5WfNIBufODsob7eYc3mzt1
-
payload_url
http://colisumy.com/dl/build2.exe
http://zexeq.com/files/1/build3.exe
-
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-XA1LckrLRP Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0785Okhu
Extracted
redline
lux3
176.123.9.142:14845
-
auth_value
e94dff9a76da90d6b000642c4a52574b
Extracted
redline
38.181.25.43:3325
-
auth_value
082cde17c5630749ecb0376734fe99c9
Extracted
redline
LogsDiller Cloud (TG: @logsdillabot)
51.38.95.107:42494
-
auth_value
3a050df92d0cf082b2cdaf87863616be
Extracted
smokeloader
pub1
Signatures
-
Detect Fabookie payload 1 IoCs
resource yara_rule behavioral2/memory/3548-236-0x0000000003530000-0x0000000003661000-memory.dmp family_fabookie -
Detected Djvu ransomware 27 IoCs
resource yara_rule behavioral2/memory/1492-22-0x0000000002460000-0x000000000257B000-memory.dmp family_djvu behavioral2/memory/4044-26-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/4044-30-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/4044-24-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/4044-31-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/2416-60-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/2416-62-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/3724-57-0x00000000024E0000-0x00000000025FB000-memory.dmp family_djvu behavioral2/memory/2416-64-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/2416-65-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/2416-90-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/4724-101-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/4724-104-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/4724-106-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/4044-114-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/4044-115-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/1908-123-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/1908-124-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/1908-126-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/4864-186-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/4864-188-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/4864-191-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/4864-203-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/2080-209-0x0000000000A20000-0x0000000000AB9000-memory.dmp family_djvu behavioral2/memory/2008-219-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/2008-218-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/2008-221-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu -
Detects LgoogLoader payload 1 IoCs
resource yara_rule behavioral2/memory/2120-200-0x0000000000E80000-0x0000000000E8D000-memory.dmp family_lgoogloader -
Djvu Ransomware
Ransomware which is a variant of the STOP family.
-
Glupteba payload 4 IoCs
resource yara_rule behavioral2/memory/2156-180-0x0000000002DE0000-0x00000000036CB000-memory.dmp family_glupteba behavioral2/memory/2156-181-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/2156-223-0x0000000002DE0000-0x00000000036CB000-memory.dmp family_glupteba behavioral2/memory/2156-229-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba -
LgoogLoader
A downloader capable of dropping and executing other malware families.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 2736 netsh.exe -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation 3F9.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation BD9.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation CF4A.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation C7A5.exe -
Executes dropped EXE 25 IoCs
pid Process 1492 C7A5.exe 2796 C95C.exe 4044 C7A5.exe 3952 CA86.exe 4284 CCA9.exe 3724 CF4A.exe 2416 CF4A.exe 4228 CF4A.exe 4724 CF4A.exe 4408 C7A5.exe 1908 C7A5.exe 4376 3F9.exe 3548 aafg31.exe 3504 toolspub2.exe 2156 31839b57a4f11171d6abc8bbc4451ee4.exe 3332 BD9.exe 4864 BD9.exe 4244 131E.exe 2080 BD9.exe 924 1BBA.exe 2008 BD9.exe 560 toolspub2.exe 1660 31839b57a4f11171d6abc8bbc4451ee4.exe 3012 csrss.exe 2472 injector.exe -
Loads dropped DLL 3 IoCs
pid Process 2796 C95C.exe 2796 C95C.exe 2136 regsvr32.exe -
Modifies file permissions 1 TTPs 1 IoCs
pid Process 492 icacls.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\f0c9d2ab-7bbd-44f4-a4e6-02d54a3e0b32\\C7A5.exe\" --AutoStart" C7A5.exe Set value (str) \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 38 api.2ip.ua 39 api.2ip.ua 45 api.2ip.ua 76 api.2ip.ua -
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
description ioc Process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 7 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Suspicious use of SetThreadContext 9 IoCs
description pid Process procid_target PID 1492 set thread context of 4044 1492 C7A5.exe 90 PID 3724 set thread context of 2416 3724 CF4A.exe 98 PID 4284 set thread context of 1444 4284 CCA9.exe 106 PID 4228 set thread context of 4724 4228 CF4A.exe 107 PID 4408 set thread context of 1908 4408 C7A5.exe 112 PID 3332 set thread context of 4864 3332 BD9.exe 120 PID 4244 set thread context of 2120 4244 131E.exe 123 PID 2080 set thread context of 2008 2080 BD9.exe 126 PID 3504 set thread context of 560 3504 toolspub2.exe 131 -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
description ioc Process File opened (read-only) \??\VBoxMiniRdrDN 31839b57a4f11171d6abc8bbc4451ee4.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\rss 31839b57a4f11171d6abc8bbc4451ee4.exe File created C:\Windows\rss\csrss.exe 31839b57a4f11171d6abc8bbc4451ee4.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 4 IoCs
pid pid_target Process procid_target 3868 2796 WerFault.exe 88 3552 4724 WerFault.exe 107 4620 1908 WerFault.exe 112 2400 2008 WerFault.exe 126 -
Checks SCSI registry key(s) 3 TTPs 9 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspub2.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspub2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 617bbc2f92c2f99cb9958a079822510e0a4269616924d3b966741b40f16cad84exe_JC.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 617bbc2f92c2f99cb9958a079822510e0a4269616924d3b966741b40f16cad84exe_JC.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 617bbc2f92c2f99cb9958a079822510e0a4269616924d3b966741b40f16cad84exe_JC.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 1BBA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspub2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 1BBA.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 1BBA.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4772 schtasks.exe 3964 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-652 = "AUS Central Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1841 = "Russia TZ 4 Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-371 = "Jerusalem Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-182 = "Mountain Standard Time (Mexico)" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2061 = "North Korea Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2391 = "Aleutian Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-542 = "Myanmar Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2871 = "Magallanes Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-31 = "Mid-Atlantic Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2322 = "Sakhalin Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2002 = "Cabo Verde Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-502 = "Nepal Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-201 = "US Mountain Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2492 = "Aus Central W. Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-435 = "Georgian Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-722 = "Central Pacific Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-871 = "Pakistan Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1472 = "Magadan Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-364 = "Middle East Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2892 = "Sudan Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-11 = "Azores Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1832 = "Russia TZ 2 Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-391 = "Arab Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-112 = "Eastern Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-431 = "Iran Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1471 = "Magadan Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1912 = "Russia TZ 10 Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-602 = "Taipei Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-52 = "Greenland Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-981 = "Kamchatka Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1931 = "Russia TZ 11 Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2182 = "Astrakhan Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-662 = "Cen. Australia Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-434 = "Georgian Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-741 = "New Zealand Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1662 = "Bahia Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1096 617bbc2f92c2f99cb9958a079822510e0a4269616924d3b966741b40f16cad84exe_JC.exe 1096 617bbc2f92c2f99cb9958a079822510e0a4269616924d3b966741b40f16cad84exe_JC.exe 776 Process not Found 776 Process not Found 776 Process not Found 776 Process not Found 776 Process not Found 776 Process not Found 776 Process not Found 776 Process not Found 776 Process not Found 776 Process not Found 776 Process not Found 776 Process not Found 776 Process not Found 776 Process not Found 776 Process not Found 776 Process not Found 776 Process not Found 776 Process not Found 776 Process not Found 776 Process not Found 776 Process not Found 776 Process not Found 776 Process not Found 776 Process not Found 776 Process not Found 776 Process not Found 776 Process not Found 776 Process not Found 776 Process not Found 776 Process not Found 776 Process not Found 776 Process not Found 776 Process not Found 776 Process not Found 776 Process not Found 776 Process not Found 776 Process not Found 776 Process not Found 776 Process not Found 776 Process not Found 776 Process not Found 776 Process not Found 776 Process not Found 776 Process not Found 776 Process not Found 776 Process not Found 776 Process not Found 776 Process not Found 776 Process not Found 776 Process not Found 776 Process not Found 776 Process not Found 776 Process not Found 776 Process not Found 776 Process not Found 776 Process not Found 776 Process not Found 776 Process not Found 776 Process not Found 776 Process not Found 776 Process not Found 776 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 776 Process not Found -
Suspicious behavior: MapViewOfSection 3 IoCs
pid Process 1096 617bbc2f92c2f99cb9958a079822510e0a4269616924d3b966741b40f16cad84exe_JC.exe 924 1BBA.exe 560 toolspub2.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 776 Process not Found Token: SeCreatePagefilePrivilege 776 Process not Found Token: SeShutdownPrivilege 776 Process not Found Token: SeCreatePagefilePrivilege 776 Process not Found Token: SeShutdownPrivilege 776 Process not Found Token: SeCreatePagefilePrivilege 776 Process not Found Token: SeShutdownPrivilege 776 Process not Found Token: SeCreatePagefilePrivilege 776 Process not Found Token: SeShutdownPrivilege 776 Process not Found Token: SeCreatePagefilePrivilege 776 Process not Found Token: SeShutdownPrivilege 776 Process not Found Token: SeCreatePagefilePrivilege 776 Process not Found Token: SeShutdownPrivilege 776 Process not Found Token: SeCreatePagefilePrivilege 776 Process not Found Token: SeShutdownPrivilege 776 Process not Found Token: SeCreatePagefilePrivilege 776 Process not Found Token: SeShutdownPrivilege 776 Process not Found Token: SeCreatePagefilePrivilege 776 Process not Found Token: SeShutdownPrivilege 776 Process not Found Token: SeCreatePagefilePrivilege 776 Process not Found Token: SeShutdownPrivilege 776 Process not Found Token: SeCreatePagefilePrivilege 776 Process not Found Token: SeShutdownPrivilege 776 Process not Found Token: SeCreatePagefilePrivilege 776 Process not Found Token: SeShutdownPrivilege 776 Process not Found Token: SeCreatePagefilePrivilege 776 Process not Found Token: SeShutdownPrivilege 776 Process not Found Token: SeCreatePagefilePrivilege 776 Process not Found Token: SeShutdownPrivilege 776 Process not Found Token: SeCreatePagefilePrivilege 776 Process not Found Token: SeShutdownPrivilege 776 Process not Found Token: SeCreatePagefilePrivilege 776 Process not Found Token: SeShutdownPrivilege 776 Process not Found Token: SeCreatePagefilePrivilege 776 Process not Found Token: SeShutdownPrivilege 776 Process not Found Token: SeCreatePagefilePrivilege 776 Process not Found Token: SeShutdownPrivilege 776 Process not Found Token: SeCreatePagefilePrivilege 776 Process not Found Token: SeDebugPrivilege 1444 AppLaunch.exe Token: SeShutdownPrivilege 776 Process not Found Token: SeCreatePagefilePrivilege 776 Process not Found Token: SeShutdownPrivilege 776 Process not Found Token: SeCreatePagefilePrivilege 776 Process not Found Token: SeShutdownPrivilege 776 Process not Found Token: SeCreatePagefilePrivilege 776 Process not Found Token: SeShutdownPrivilege 776 Process not Found Token: SeCreatePagefilePrivilege 776 Process not Found Token: SeShutdownPrivilege 776 Process not Found Token: SeCreatePagefilePrivilege 776 Process not Found Token: SeShutdownPrivilege 776 Process not Found Token: SeCreatePagefilePrivilege 776 Process not Found Token: SeShutdownPrivilege 776 Process not Found Token: SeCreatePagefilePrivilege 776 Process not Found Token: SeShutdownPrivilege 776 Process not Found Token: SeCreatePagefilePrivilege 776 Process not Found Token: SeDebugPrivilege 3840 powershell.exe Token: SeShutdownPrivilege 776 Process not Found Token: SeCreatePagefilePrivilege 776 Process not Found Token: SeShutdownPrivilege 776 Process not Found Token: SeCreatePagefilePrivilege 776 Process not Found Token: SeDebugPrivilege 2156 31839b57a4f11171d6abc8bbc4451ee4.exe Token: SeImpersonatePrivilege 2156 31839b57a4f11171d6abc8bbc4451ee4.exe Token: SeDebugPrivilege 1224 powershell.exe Token: SeShutdownPrivilege 776 Process not Found -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 776 Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 776 wrote to memory of 1492 776 Process not Found 87 PID 776 wrote to memory of 1492 776 Process not Found 87 PID 776 wrote to memory of 1492 776 Process not Found 87 PID 776 wrote to memory of 2796 776 Process not Found 88 PID 776 wrote to memory of 2796 776 Process not Found 88 PID 776 wrote to memory of 2796 776 Process not Found 88 PID 1492 wrote to memory of 4044 1492 C7A5.exe 90 PID 1492 wrote to memory of 4044 1492 C7A5.exe 90 PID 1492 wrote to memory of 4044 1492 C7A5.exe 90 PID 1492 wrote to memory of 4044 1492 C7A5.exe 90 PID 1492 wrote to memory of 4044 1492 C7A5.exe 90 PID 1492 wrote to memory of 4044 1492 C7A5.exe 90 PID 1492 wrote to memory of 4044 1492 C7A5.exe 90 PID 1492 wrote to memory of 4044 1492 C7A5.exe 90 PID 1492 wrote to memory of 4044 1492 C7A5.exe 90 PID 1492 wrote to memory of 4044 1492 C7A5.exe 90 PID 776 wrote to memory of 3952 776 Process not Found 91 PID 776 wrote to memory of 3952 776 Process not Found 91 PID 776 wrote to memory of 3952 776 Process not Found 91 PID 776 wrote to memory of 4284 776 Process not Found 94 PID 776 wrote to memory of 4284 776 Process not Found 94 PID 776 wrote to memory of 4284 776 Process not Found 94 PID 776 wrote to memory of 3724 776 Process not Found 96 PID 776 wrote to memory of 3724 776 Process not Found 96 PID 776 wrote to memory of 3724 776 Process not Found 96 PID 3724 wrote to memory of 2416 3724 CF4A.exe 98 PID 3724 wrote to memory of 2416 3724 CF4A.exe 98 PID 3724 wrote to memory of 2416 3724 CF4A.exe 98 PID 776 wrote to memory of 3024 776 Process not Found 99 PID 776 wrote to memory of 3024 776 Process not Found 99 PID 3724 wrote to memory of 2416 3724 CF4A.exe 98 PID 3724 wrote to memory of 2416 3724 CF4A.exe 98 PID 3724 wrote to memory of 2416 3724 CF4A.exe 98 PID 3724 wrote to memory of 2416 3724 CF4A.exe 98 PID 3724 wrote to memory of 2416 3724 CF4A.exe 98 PID 3724 wrote to memory of 2416 3724 CF4A.exe 98 PID 3724 wrote to memory of 2416 3724 CF4A.exe 98 PID 3024 wrote to memory of 2136 3024 regsvr32.exe 100 PID 3024 wrote to memory of 2136 3024 regsvr32.exe 100 PID 3024 wrote to memory of 2136 3024 regsvr32.exe 100 PID 4044 wrote to memory of 492 4044 C7A5.exe 102 PID 4044 wrote to memory of 492 4044 C7A5.exe 102 PID 4044 wrote to memory of 492 4044 C7A5.exe 102 PID 2416 wrote to memory of 4228 2416 CF4A.exe 104 PID 2416 wrote to memory of 4228 2416 CF4A.exe 104 PID 2416 wrote to memory of 4228 2416 CF4A.exe 104 PID 4284 wrote to memory of 1444 4284 CCA9.exe 106 PID 4284 wrote to memory of 1444 4284 CCA9.exe 106 PID 4284 wrote to memory of 1444 4284 CCA9.exe 106 PID 4284 wrote to memory of 1444 4284 CCA9.exe 106 PID 4284 wrote to memory of 1444 4284 CCA9.exe 106 PID 4284 wrote to memory of 1444 4284 CCA9.exe 106 PID 4284 wrote to memory of 1444 4284 CCA9.exe 106 PID 4284 wrote to memory of 1444 4284 CCA9.exe 106 PID 4228 wrote to memory of 4724 4228 CF4A.exe 107 PID 4228 wrote to memory of 4724 4228 CF4A.exe 107 PID 4228 wrote to memory of 4724 4228 CF4A.exe 107 PID 4228 wrote to memory of 4724 4228 CF4A.exe 107 PID 4228 wrote to memory of 4724 4228 CF4A.exe 107 PID 4228 wrote to memory of 4724 4228 CF4A.exe 107 PID 4228 wrote to memory of 4724 4228 CF4A.exe 107 PID 4228 wrote to memory of 4724 4228 CF4A.exe 107 PID 4228 wrote to memory of 4724 4228 CF4A.exe 107 PID 4228 wrote to memory of 4724 4228 CF4A.exe 107 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\617bbc2f92c2f99cb9958a079822510e0a4269616924d3b966741b40f16cad84exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\617bbc2f92c2f99cb9958a079822510e0a4269616924d3b966741b40f16cad84exe_JC.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1096
-
C:\Users\Admin\AppData\Local\Temp\C7A5.exeC:\Users\Admin\AppData\Local\Temp\C7A5.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\C7A5.exeC:\Users\Admin\AppData\Local\Temp\C7A5.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\f0c9d2ab-7bbd-44f4-a4e6-02d54a3e0b32" /deny *S-1-1-0:(OI)(CI)(DE,DC)3⤵
- Modifies file permissions
PID:492
-
-
C:\Users\Admin\AppData\Local\Temp\C7A5.exe"C:\Users\Admin\AppData\Local\Temp\C7A5.exe" --Admin IsNotAutoStart IsNotTask3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\C7A5.exe"C:\Users\Admin\AppData\Local\Temp\C7A5.exe" --Admin IsNotAutoStart IsNotTask4⤵
- Executes dropped EXE
PID:1908 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1908 -s 5685⤵
- Program crash
PID:4620
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\C95C.exeC:\Users\Admin\AppData\Local\Temp\C95C.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2796 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2796 -s 8522⤵
- Program crash
PID:3868
-
-
C:\Users\Admin\AppData\Local\Temp\CA86.exeC:\Users\Admin\AppData\Local\Temp\CA86.exe1⤵
- Executes dropped EXE
PID:3952
-
C:\Users\Admin\AppData\Local\Temp\CCA9.exeC:\Users\Admin\AppData\Local\Temp\CCA9.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1444
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2796 -ip 27961⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\CF4A.exeC:\Users\Admin\AppData\Local\Temp\CF4A.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\CF4A.exeC:\Users\Admin\AppData\Local\Temp\CF4A.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\CF4A.exe"C:\Users\Admin\AppData\Local\Temp\CF4A.exe" --Admin IsNotAutoStart IsNotTask3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\CF4A.exe"C:\Users\Admin\AppData\Local\Temp\CF4A.exe" --Admin IsNotAutoStart IsNotTask4⤵
- Executes dropped EXE
PID:4724 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4724 -s 5685⤵
- Program crash
PID:3552
-
-
-
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\D362.dll1⤵
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\D362.dll2⤵
- Loads dropped DLL
PID:2136
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4724 -ip 47241⤵PID:4968
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1908 -ip 19081⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\3F9.exeC:\Users\Admin\AppData\Local\Temp\3F9.exe1⤵
- Checks computer location settings
- Executes dropped EXE
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\aafg31.exe"C:\Users\Admin\AppData\Local\Temp\aafg31.exe"2⤵
- Executes dropped EXE
PID:3548
-
-
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:560
-
-
-
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2156 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3840
-
-
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1660 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1224
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"4⤵PID:4968
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes5⤵
- Modifies Windows Firewall
PID:2736
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1444
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1344
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
PID:3012 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2232
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F5⤵
- Creates scheduled task(s)
PID:4772
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f5⤵PID:2912
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4220
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:3080
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll5⤵
- Executes dropped EXE
PID:2472
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F5⤵
- Creates scheduled task(s)
PID:3964
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\BD9.exeC:\Users\Admin\AppData\Local\Temp\BD9.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\BD9.exeC:\Users\Admin\AppData\Local\Temp\BD9.exe2⤵
- Checks computer location settings
- Executes dropped EXE
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\BD9.exe"C:\Users\Admin\AppData\Local\Temp\BD9.exe" --Admin IsNotAutoStart IsNotTask3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\BD9.exe"C:\Users\Admin\AppData\Local\Temp\BD9.exe" --Admin IsNotAutoStart IsNotTask4⤵
- Executes dropped EXE
PID:2008 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 5685⤵
- Program crash
PID:2400
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\131E.exeC:\Users\Admin\AppData\Local\Temp\131E.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4244 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵PID:2120
-
-
C:\Users\Admin\AppData\Local\Temp\1BBA.exeC:\Users\Admin\AppData\Local\Temp\1BBA.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:924
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2008 -ip 20081⤵PID:1000
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
Filesize2KB
MD5bcf9c82a8e06cd4dbc7c6f8166b03d62
SHA1aa072fd0adc30bc7d45952443a137972eaea0499
SHA25632b64ccb43add6147056e3f68bd46c762c8b38dea72735355fc422160a0f417d
SHA5127a26e9797da034f01a08a1b62e4e7e39de67526257d015a0ef7590968af690fecb1852a0f3ee05f64bbf571344eb74ef4d404d2f145f7e7dd36f6a21816ba4a0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
Filesize2KB
MD5bcf9c82a8e06cd4dbc7c6f8166b03d62
SHA1aa072fd0adc30bc7d45952443a137972eaea0499
SHA25632b64ccb43add6147056e3f68bd46c762c8b38dea72735355fc422160a0f417d
SHA5127a26e9797da034f01a08a1b62e4e7e39de67526257d015a0ef7590968af690fecb1852a0f3ee05f64bbf571344eb74ef4d404d2f145f7e7dd36f6a21816ba4a0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
Filesize1KB
MD5fa4ae5fcb44bfaf845b845961180d250
SHA18257ee68bdd2bc3ea2723eda7aeba404195d46bf
SHA256574c66c19561773196a88f115168cf5d73b71fd26f9034606fe38a5535d4df96
SHA512ad1de0c1d0f5a4a7e3615b48537f75250779368b388520b001d96367d5aa19fa88a9f471d1212e679ab9eaae854374445807877891bf1b803fa6c7886877d253
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
Filesize488B
MD55fccdebe7a1e85b120509db93f19936a
SHA161b41c63c27f09af3a49563796b78ac6cdf8cbd7
SHA256c25acbb7ce3ac0cefe15488f440ab4b5b2f02a28974f1794cf4be3ca4b7caf04
SHA51226554dde7407bca45abc24e297d02c4a421d040c731fa706e62ea25547f4b99aa5c52b974f1ffb438dd727edf8dafb7efbbd95f5a0ac84815b20436b6beab2ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
Filesize488B
MD56a8467b3b82ee56b8e1f92db74fd0685
SHA1c39c8d7462446f157ec3614293e71e075e4d8db2
SHA2563cf82578856fa804d18c00329bdd556b86488bb47959a4b7734a8a59df4219e2
SHA512edf5a531e9adcf825ae9c82c4efcd25334ee4ecc3b552dcd7c731eb246261f785a006f26006f9e07475962544f2f21ac3807a0f5237f4602a1a188a91eaf0089
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
Filesize482B
MD59dc88446ecbd9a0001112f4dd81be5f3
SHA19bceb2377268d18fbbe4d6f4c6b337230077a87f
SHA256a503b0b94d77941d9bad8a3d3ff438ed3dc22cc833bc2744722ac8825c2a4365
SHA512d12846c05f7b548398e83b30f72698e9b4d2f9ee1ea3bfe66b51e9764755c277a59206e1f6d61ab1003b079e01b1064f2bc76f62f1a453b469b5433366a1369e
-
Filesize
2KB
MD57f305d024899e4809fb6f4ae00da304c
SHA1f88a0812d36e0562ede3732ab511f459a09faff8
SHA2568fe1088ad55d05a3c2149648c8c1ce55862e925580308afe4a4ff6cfb089c769
SHA512bc40698582400427cd47cf80dcf39202a74148b69ed179483160b4023368d53301fa12fe6d530d9c7cdfe5f78d19ee87a285681f537950334677f8af8dfeb2ae
-
Filesize
3.4MB
MD5bba7cf3a70a424ea0626bb9a8bb9295b
SHA1a001759346c5a9f799fac6b1d6b35d286131d4df
SHA256f5a6cabc167d6ae3999dc047e6d45076468446f334cbb334e3f5220365acec63
SHA51298f766637cf46baa26e9490363148edd7b15d15eb57a3ba81626c409d3dc509d74ded40a1acdc1df14875b3e509dc8cce0fed0cd61286e6cd0be2b8a1f7e51c4
-
Filesize
3.4MB
MD5bba7cf3a70a424ea0626bb9a8bb9295b
SHA1a001759346c5a9f799fac6b1d6b35d286131d4df
SHA256f5a6cabc167d6ae3999dc047e6d45076468446f334cbb334e3f5220365acec63
SHA51298f766637cf46baa26e9490363148edd7b15d15eb57a3ba81626c409d3dc509d74ded40a1acdc1df14875b3e509dc8cce0fed0cd61286e6cd0be2b8a1f7e51c4
-
Filesize
252KB
MD5ac27a064e7a23ac80f1bb8e7cbe4b067
SHA101c13b49f5627069d3e737f2c528ae85c95c995d
SHA25611b725378fa36c9454f8d8c004e01aea95023f67507841f4a2d74424fbedc870
SHA512ea2132592915cb3a166e1cf173d575ffb94b2059d66ec767693fdf0bb5f796afef2669d03daff1a1bd7a9704494af70c486b1d1333c336e40e17c682278dcaad
-
Filesize
252KB
MD5ac27a064e7a23ac80f1bb8e7cbe4b067
SHA101c13b49f5627069d3e737f2c528ae85c95c995d
SHA25611b725378fa36c9454f8d8c004e01aea95023f67507841f4a2d74424fbedc870
SHA512ea2132592915cb3a166e1cf173d575ffb94b2059d66ec767693fdf0bb5f796afef2669d03daff1a1bd7a9704494af70c486b1d1333c336e40e17c682278dcaad
-
Filesize
4.2MB
MD5b481ad9378b2cdaacf6ca532cf681672
SHA17de35d7b0495dbb9f05b142bcd592a8fc84cc8ef
SHA25623dfda2b393522bd4fc0e55476ae221479ce487425aa2eba172ab0aa35c68551
SHA512c8836ba50b9ee7725d207ad81ab140b1491cdc22273b7ff24f2dcf302af690a7285dfff8fde1ba6e37b0d60d05dacbbdd8de357d43f607b5ebd83640a8d79d80
-
Filesize
4.2MB
MD5b481ad9378b2cdaacf6ca532cf681672
SHA17de35d7b0495dbb9f05b142bcd592a8fc84cc8ef
SHA25623dfda2b393522bd4fc0e55476ae221479ce487425aa2eba172ab0aa35c68551
SHA512c8836ba50b9ee7725d207ad81ab140b1491cdc22273b7ff24f2dcf302af690a7285dfff8fde1ba6e37b0d60d05dacbbdd8de357d43f607b5ebd83640a8d79d80
-
Filesize
4.2MB
MD5b481ad9378b2cdaacf6ca532cf681672
SHA17de35d7b0495dbb9f05b142bcd592a8fc84cc8ef
SHA25623dfda2b393522bd4fc0e55476ae221479ce487425aa2eba172ab0aa35c68551
SHA512c8836ba50b9ee7725d207ad81ab140b1491cdc22273b7ff24f2dcf302af690a7285dfff8fde1ba6e37b0d60d05dacbbdd8de357d43f607b5ebd83640a8d79d80
-
Filesize
4.2MB
MD5b481ad9378b2cdaacf6ca532cf681672
SHA17de35d7b0495dbb9f05b142bcd592a8fc84cc8ef
SHA25623dfda2b393522bd4fc0e55476ae221479ce487425aa2eba172ab0aa35c68551
SHA512c8836ba50b9ee7725d207ad81ab140b1491cdc22273b7ff24f2dcf302af690a7285dfff8fde1ba6e37b0d60d05dacbbdd8de357d43f607b5ebd83640a8d79d80
-
Filesize
5.2MB
MD53bffffda1e470fede020d005d03929da
SHA142bffdd24aa6e60b3b0807ff2aa5d321c9e3d9c6
SHA2564c4e0c61380662adc756d147f9c51ead1d3a6913f49510eae2766270b778f427
SHA512efd5e2fcf4c4f1dd07b3e6fde1394259c549dfc62f6530dda61abab40f7f8316604ee6eacea28407c6add8b3e2c8438b4bff38b598961cd425142685dd382d74
-
Filesize
5.2MB
MD53bffffda1e470fede020d005d03929da
SHA142bffdd24aa6e60b3b0807ff2aa5d321c9e3d9c6
SHA2564c4e0c61380662adc756d147f9c51ead1d3a6913f49510eae2766270b778f427
SHA512efd5e2fcf4c4f1dd07b3e6fde1394259c549dfc62f6530dda61abab40f7f8316604ee6eacea28407c6add8b3e2c8438b4bff38b598961cd425142685dd382d74
-
Filesize
761KB
MD563de455550db62c30b4e77469250c6f8
SHA1b401b0d3b3bd758c72df372a363b7ca6f1bd815d
SHA256e9569e9acbf5cb55edddd5e63d123933b0e007e4e617b448ac0582671eaaedb8
SHA5123fe5cb15265c59530a3f3a7aa122152e1e4c8d1db07984610e60ba8e3ddc136ac26d35d775f3bd67b2db5e4b7c8026c82adde1a15dbc74af63eda07f415318b4
-
Filesize
761KB
MD563de455550db62c30b4e77469250c6f8
SHA1b401b0d3b3bd758c72df372a363b7ca6f1bd815d
SHA256e9569e9acbf5cb55edddd5e63d123933b0e007e4e617b448ac0582671eaaedb8
SHA5123fe5cb15265c59530a3f3a7aa122152e1e4c8d1db07984610e60ba8e3ddc136ac26d35d775f3bd67b2db5e4b7c8026c82adde1a15dbc74af63eda07f415318b4
-
Filesize
761KB
MD563de455550db62c30b4e77469250c6f8
SHA1b401b0d3b3bd758c72df372a363b7ca6f1bd815d
SHA256e9569e9acbf5cb55edddd5e63d123933b0e007e4e617b448ac0582671eaaedb8
SHA5123fe5cb15265c59530a3f3a7aa122152e1e4c8d1db07984610e60ba8e3ddc136ac26d35d775f3bd67b2db5e4b7c8026c82adde1a15dbc74af63eda07f415318b4
-
Filesize
761KB
MD563de455550db62c30b4e77469250c6f8
SHA1b401b0d3b3bd758c72df372a363b7ca6f1bd815d
SHA256e9569e9acbf5cb55edddd5e63d123933b0e007e4e617b448ac0582671eaaedb8
SHA5123fe5cb15265c59530a3f3a7aa122152e1e4c8d1db07984610e60ba8e3ddc136ac26d35d775f3bd67b2db5e4b7c8026c82adde1a15dbc74af63eda07f415318b4
-
Filesize
761KB
MD563de455550db62c30b4e77469250c6f8
SHA1b401b0d3b3bd758c72df372a363b7ca6f1bd815d
SHA256e9569e9acbf5cb55edddd5e63d123933b0e007e4e617b448ac0582671eaaedb8
SHA5123fe5cb15265c59530a3f3a7aa122152e1e4c8d1db07984610e60ba8e3ddc136ac26d35d775f3bd67b2db5e4b7c8026c82adde1a15dbc74af63eda07f415318b4
-
Filesize
761KB
MD563de455550db62c30b4e77469250c6f8
SHA1b401b0d3b3bd758c72df372a363b7ca6f1bd815d
SHA256e9569e9acbf5cb55edddd5e63d123933b0e007e4e617b448ac0582671eaaedb8
SHA5123fe5cb15265c59530a3f3a7aa122152e1e4c8d1db07984610e60ba8e3ddc136ac26d35d775f3bd67b2db5e4b7c8026c82adde1a15dbc74af63eda07f415318b4
-
Filesize
761KB
MD563de455550db62c30b4e77469250c6f8
SHA1b401b0d3b3bd758c72df372a363b7ca6f1bd815d
SHA256e9569e9acbf5cb55edddd5e63d123933b0e007e4e617b448ac0582671eaaedb8
SHA5123fe5cb15265c59530a3f3a7aa122152e1e4c8d1db07984610e60ba8e3ddc136ac26d35d775f3bd67b2db5e4b7c8026c82adde1a15dbc74af63eda07f415318b4
-
Filesize
761KB
MD563de455550db62c30b4e77469250c6f8
SHA1b401b0d3b3bd758c72df372a363b7ca6f1bd815d
SHA256e9569e9acbf5cb55edddd5e63d123933b0e007e4e617b448ac0582671eaaedb8
SHA5123fe5cb15265c59530a3f3a7aa122152e1e4c8d1db07984610e60ba8e3ddc136ac26d35d775f3bd67b2db5e4b7c8026c82adde1a15dbc74af63eda07f415318b4
-
Filesize
761KB
MD563de455550db62c30b4e77469250c6f8
SHA1b401b0d3b3bd758c72df372a363b7ca6f1bd815d
SHA256e9569e9acbf5cb55edddd5e63d123933b0e007e4e617b448ac0582671eaaedb8
SHA5123fe5cb15265c59530a3f3a7aa122152e1e4c8d1db07984610e60ba8e3ddc136ac26d35d775f3bd67b2db5e4b7c8026c82adde1a15dbc74af63eda07f415318b4
-
Filesize
761KB
MD563de455550db62c30b4e77469250c6f8
SHA1b401b0d3b3bd758c72df372a363b7ca6f1bd815d
SHA256e9569e9acbf5cb55edddd5e63d123933b0e007e4e617b448ac0582671eaaedb8
SHA5123fe5cb15265c59530a3f3a7aa122152e1e4c8d1db07984610e60ba8e3ddc136ac26d35d775f3bd67b2db5e4b7c8026c82adde1a15dbc74af63eda07f415318b4
-
Filesize
761KB
MD563de455550db62c30b4e77469250c6f8
SHA1b401b0d3b3bd758c72df372a363b7ca6f1bd815d
SHA256e9569e9acbf5cb55edddd5e63d123933b0e007e4e617b448ac0582671eaaedb8
SHA5123fe5cb15265c59530a3f3a7aa122152e1e4c8d1db07984610e60ba8e3ddc136ac26d35d775f3bd67b2db5e4b7c8026c82adde1a15dbc74af63eda07f415318b4
-
Filesize
261KB
MD5eda1b6f6e01f038267413b3ae9d3eb23
SHA16e71d68c3496b513ba4f1b924fd46ddfdfb2c305
SHA2567c34d3d22db889dfe3f1ab7e5810a04436330824da5a8fdecc03a987876d66da
SHA512420b4cda1ab0ce3293a4954283cb12c53882f50b5aa5f0921b1bd915257694508d79420cb680ba36ef88636bc479e98e054549ca67d17f0e63d8f38d384b0c30
-
Filesize
261KB
MD5eda1b6f6e01f038267413b3ae9d3eb23
SHA16e71d68c3496b513ba4f1b924fd46ddfdfb2c305
SHA2567c34d3d22db889dfe3f1ab7e5810a04436330824da5a8fdecc03a987876d66da
SHA512420b4cda1ab0ce3293a4954283cb12c53882f50b5aa5f0921b1bd915257694508d79420cb680ba36ef88636bc479e98e054549ca67d17f0e63d8f38d384b0c30
-
Filesize
261KB
MD5eda1b6f6e01f038267413b3ae9d3eb23
SHA16e71d68c3496b513ba4f1b924fd46ddfdfb2c305
SHA2567c34d3d22db889dfe3f1ab7e5810a04436330824da5a8fdecc03a987876d66da
SHA512420b4cda1ab0ce3293a4954283cb12c53882f50b5aa5f0921b1bd915257694508d79420cb680ba36ef88636bc479e98e054549ca67d17f0e63d8f38d384b0c30
-
Filesize
261KB
MD5eda1b6f6e01f038267413b3ae9d3eb23
SHA16e71d68c3496b513ba4f1b924fd46ddfdfb2c305
SHA2567c34d3d22db889dfe3f1ab7e5810a04436330824da5a8fdecc03a987876d66da
SHA512420b4cda1ab0ce3293a4954283cb12c53882f50b5aa5f0921b1bd915257694508d79420cb680ba36ef88636bc479e98e054549ca67d17f0e63d8f38d384b0c30
-
Filesize
261KB
MD5aaa35a5dd28fb6dcd151ccb0b9ed270d
SHA108a9dbe8c26691836f34eab89f1c500085b6efc5
SHA256902b165bc7d6facfcda550144157b58d122d3c38abe5f5cfe630ad5eea8f8557
SHA512155c3c6554268664afa1144fed18551de9f1787b787693f0d41697b4819b8f635eff6b82eafd690e19c351fe4e6349f34f9a74e45cf86ddc074a085aaf4fabed
-
Filesize
261KB
MD5aaa35a5dd28fb6dcd151ccb0b9ed270d
SHA108a9dbe8c26691836f34eab89f1c500085b6efc5
SHA256902b165bc7d6facfcda550144157b58d122d3c38abe5f5cfe630ad5eea8f8557
SHA512155c3c6554268664afa1144fed18551de9f1787b787693f0d41697b4819b8f635eff6b82eafd690e19c351fe4e6349f34f9a74e45cf86ddc074a085aaf4fabed
-
Filesize
393KB
MD5556da5275de73a738b146b51fea5a4ec
SHA1da32df559ab4da0348c51cc4126fe2a105e0062d
SHA256ef13668ac68ff21d2e3c7e4d00cbc953a82702042b7562d04ddbb9a25e4e8edd
SHA512ee9395e8a5b2c24dea7cd6a414e206f55321c3cba4cb13fa2e3a88ada5d618701263b34a9f5b468b6ad5034554c36a07409d56da561c589bb3e2ebe67f49ec69
-
Filesize
393KB
MD5556da5275de73a738b146b51fea5a4ec
SHA1da32df559ab4da0348c51cc4126fe2a105e0062d
SHA256ef13668ac68ff21d2e3c7e4d00cbc953a82702042b7562d04ddbb9a25e4e8edd
SHA512ee9395e8a5b2c24dea7cd6a414e206f55321c3cba4cb13fa2e3a88ada5d618701263b34a9f5b468b6ad5034554c36a07409d56da561c589bb3e2ebe67f49ec69
-
Filesize
785KB
MD53072823dbaed000b576999825ff648cf
SHA1ed56a4e46dbd0f07e9552c573eb6a59b40059574
SHA256745fa5b4fefcaa8f992d5f518a267dd2b2777fe60d727df48ef7b3502a17bbce
SHA512619a2ba810f269ff069a5362163bdfd52f12a2aaaf455d9834c5ca778477645d6b221c2b26c01f1be90fa03f2bc7cec70d45b3a26b2a4e7546070334d8452d47
-
Filesize
785KB
MD53072823dbaed000b576999825ff648cf
SHA1ed56a4e46dbd0f07e9552c573eb6a59b40059574
SHA256745fa5b4fefcaa8f992d5f518a267dd2b2777fe60d727df48ef7b3502a17bbce
SHA512619a2ba810f269ff069a5362163bdfd52f12a2aaaf455d9834c5ca778477645d6b221c2b26c01f1be90fa03f2bc7cec70d45b3a26b2a4e7546070334d8452d47
-
Filesize
785KB
MD53072823dbaed000b576999825ff648cf
SHA1ed56a4e46dbd0f07e9552c573eb6a59b40059574
SHA256745fa5b4fefcaa8f992d5f518a267dd2b2777fe60d727df48ef7b3502a17bbce
SHA512619a2ba810f269ff069a5362163bdfd52f12a2aaaf455d9834c5ca778477645d6b221c2b26c01f1be90fa03f2bc7cec70d45b3a26b2a4e7546070334d8452d47
-
Filesize
785KB
MD53072823dbaed000b576999825ff648cf
SHA1ed56a4e46dbd0f07e9552c573eb6a59b40059574
SHA256745fa5b4fefcaa8f992d5f518a267dd2b2777fe60d727df48ef7b3502a17bbce
SHA512619a2ba810f269ff069a5362163bdfd52f12a2aaaf455d9834c5ca778477645d6b221c2b26c01f1be90fa03f2bc7cec70d45b3a26b2a4e7546070334d8452d47
-
Filesize
785KB
MD53072823dbaed000b576999825ff648cf
SHA1ed56a4e46dbd0f07e9552c573eb6a59b40059574
SHA256745fa5b4fefcaa8f992d5f518a267dd2b2777fe60d727df48ef7b3502a17bbce
SHA512619a2ba810f269ff069a5362163bdfd52f12a2aaaf455d9834c5ca778477645d6b221c2b26c01f1be90fa03f2bc7cec70d45b3a26b2a4e7546070334d8452d47
-
Filesize
2.7MB
MD5d7bc2923dc1072484904a48b0441ad27
SHA194045c24ca38394bdd8a03d9b375599d03c7999a
SHA2561905aadfc6ecfb37b7dd9170642e35b1b8d8cc9ffd04d194b166d6c2b03004e0
SHA512e4241239fff67bbf6724c4865c969cd9674788a5519e41e3dba1d068d247b9b474e3eba414150b7665cf32736d5ef9bf5385c46073832d9b05675d20e2a8fe71
-
Filesize
2.7MB
MD5d7bc2923dc1072484904a48b0441ad27
SHA194045c24ca38394bdd8a03d9b375599d03c7999a
SHA2561905aadfc6ecfb37b7dd9170642e35b1b8d8cc9ffd04d194b166d6c2b03004e0
SHA512e4241239fff67bbf6724c4865c969cd9674788a5519e41e3dba1d068d247b9b474e3eba414150b7665cf32736d5ef9bf5385c46073832d9b05675d20e2a8fe71
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
860KB
MD57d1513a2e30fbdd54baedf5fcb0e143d
SHA1cd455a669076044d8449015387aecd98aff79eb9
SHA25607ec937d9091de355c0b2c788a70e8897ce75ebc162e78d92c94de5147d5022d
SHA5125ef4e7c4581744af686e346342480c8bc9e4e0bb8e5143e66649a514781a91cac6f81d7946d88b8182fcc33c9af01a019b9901cc4610ffeb76ca0d031a3118fa
-
Filesize
860KB
MD57d1513a2e30fbdd54baedf5fcb0e143d
SHA1cd455a669076044d8449015387aecd98aff79eb9
SHA25607ec937d9091de355c0b2c788a70e8897ce75ebc162e78d92c94de5147d5022d
SHA5125ef4e7c4581744af686e346342480c8bc9e4e0bb8e5143e66649a514781a91cac6f81d7946d88b8182fcc33c9af01a019b9901cc4610ffeb76ca0d031a3118fa
-
Filesize
860KB
MD57d1513a2e30fbdd54baedf5fcb0e143d
SHA1cd455a669076044d8449015387aecd98aff79eb9
SHA25607ec937d9091de355c0b2c788a70e8897ce75ebc162e78d92c94de5147d5022d
SHA5125ef4e7c4581744af686e346342480c8bc9e4e0bb8e5143e66649a514781a91cac6f81d7946d88b8182fcc33c9af01a019b9901cc4610ffeb76ca0d031a3118fa
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
Filesize
190KB
MD5a137245d8bc8109c4bc3df6e2b37d327
SHA1ed8973e65b2aacb60683787831de37e7c805fa6c
SHA256f342950ea78a3910911df852de530912090acea09b895e299d4ba0132ee146ee
SHA5125d83e91ac5862c62d5b90418a75feaedcffb01aa2a396d1cb71c11d9dfbfb0e415d38687ce0736b7159f874835ace02f27d11067b2ab6b81f58a948f10fabc00
-
Filesize
190KB
MD5a137245d8bc8109c4bc3df6e2b37d327
SHA1ed8973e65b2aacb60683787831de37e7c805fa6c
SHA256f342950ea78a3910911df852de530912090acea09b895e299d4ba0132ee146ee
SHA5125d83e91ac5862c62d5b90418a75feaedcffb01aa2a396d1cb71c11d9dfbfb0e415d38687ce0736b7159f874835ace02f27d11067b2ab6b81f58a948f10fabc00
-
Filesize
190KB
MD5a137245d8bc8109c4bc3df6e2b37d327
SHA1ed8973e65b2aacb60683787831de37e7c805fa6c
SHA256f342950ea78a3910911df852de530912090acea09b895e299d4ba0132ee146ee
SHA5125d83e91ac5862c62d5b90418a75feaedcffb01aa2a396d1cb71c11d9dfbfb0e415d38687ce0736b7159f874835ace02f27d11067b2ab6b81f58a948f10fabc00
-
Filesize
190KB
MD5a137245d8bc8109c4bc3df6e2b37d327
SHA1ed8973e65b2aacb60683787831de37e7c805fa6c
SHA256f342950ea78a3910911df852de530912090acea09b895e299d4ba0132ee146ee
SHA5125d83e91ac5862c62d5b90418a75feaedcffb01aa2a396d1cb71c11d9dfbfb0e415d38687ce0736b7159f874835ace02f27d11067b2ab6b81f58a948f10fabc00
-
Filesize
761KB
MD563de455550db62c30b4e77469250c6f8
SHA1b401b0d3b3bd758c72df372a363b7ca6f1bd815d
SHA256e9569e9acbf5cb55edddd5e63d123933b0e007e4e617b448ac0582671eaaedb8
SHA5123fe5cb15265c59530a3f3a7aa122152e1e4c8d1db07984610e60ba8e3ddc136ac26d35d775f3bd67b2db5e4b7c8026c82adde1a15dbc74af63eda07f415318b4
-
Filesize
252KB
MD5ac27a064e7a23ac80f1bb8e7cbe4b067
SHA101c13b49f5627069d3e737f2c528ae85c95c995d
SHA25611b725378fa36c9454f8d8c004e01aea95023f67507841f4a2d74424fbedc870
SHA512ea2132592915cb3a166e1cf173d575ffb94b2059d66ec767693fdf0bb5f796afef2669d03daff1a1bd7a9704494af70c486b1d1333c336e40e17c682278dcaad
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD544ec8b75fa377aa494b93709b4f95d0f
SHA1e33fa5e3676f1e39d40a70acfb7c70cea46f5fca
SHA25636577bdc2464cb17581430a26bd89c9c9a5528059ad48f052cec525ec178f5b7
SHA512a8d3aab33787a88c72dbc0e802e148f6ec13213e860833758e6885aa1e973f464cbd0660e0d4413744011a604d75c19704d588cc23f46b527ebad274beb9681f
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5a8030d932e6668ca62f5b216e740c582
SHA1f1dd566f0b84c46ba6b15a10fe53cb5773d93e6b
SHA256960b4fe6688cf9223cacaffd4fec68cd74d079ec9cdb07adf2c979a6802594ba
SHA5127dca6af4857ae711177de99633b463b6f25cca9fba72205aba585d615cd1fd0af590d3f731546e418f1fbd8946e074010c8820c5ada190bb0d8788b972b2e7ae
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD57be10e55fcf5f4c96791d543a5a01789
SHA11f4c027bdb1ae23a9e50b6e1da089f94090caace
SHA2561bdf17a61915cd351d02a17e27fc13ebd45b7bd3ba55be81d958a9b3c495b920
SHA51296cca4bf7f5628570bdd851aa04d634619d1a0e519cb5d59ba0d8b78efaf99e729005ce4b0c0fcb771326c1750d0e42b599a64372f0a109d38082dc4a99bf07b
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD599574785a5693e9363776a8bf1d1dd16
SHA15ce744d2301c61caefcd4e4c2afd0ac83795365c
SHA2568664b0b397bf20487fdde234b23ccdffec33b2e4fd3d267fc32ee92e7c8ed0a6
SHA512dbc1e2d5b115853ae776a8bdac05b2cd1d0ece30b98eacfc516b83f335f26445245b736996246d435e33cc31cec7123f8eb9ebb8ba29a7ffcee3d2a7a87d670a
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5f9b60f409077cecb15f729a968ba38e9
SHA155702213e1b38ef8735fe2f9d83e4470fd8a606c
SHA25653dd32d9f3551ad2e5c06c608c499858843f53280aac25496738ec2af3216046
SHA5127bdf5654f710c982386d072b69648c1f9a3f8239dd87b482f43cba6993f6ed7207980966029763ac7acdb5485aef5f40101c04c7d5a6725d85b8b20f55c009b0
-
Filesize
4.2MB
MD5b481ad9378b2cdaacf6ca532cf681672
SHA17de35d7b0495dbb9f05b142bcd592a8fc84cc8ef
SHA25623dfda2b393522bd4fc0e55476ae221479ce487425aa2eba172ab0aa35c68551
SHA512c8836ba50b9ee7725d207ad81ab140b1491cdc22273b7ff24f2dcf302af690a7285dfff8fde1ba6e37b0d60d05dacbbdd8de357d43f607b5ebd83640a8d79d80
-
Filesize
4.2MB
MD5b481ad9378b2cdaacf6ca532cf681672
SHA17de35d7b0495dbb9f05b142bcd592a8fc84cc8ef
SHA25623dfda2b393522bd4fc0e55476ae221479ce487425aa2eba172ab0aa35c68551
SHA512c8836ba50b9ee7725d207ad81ab140b1491cdc22273b7ff24f2dcf302af690a7285dfff8fde1ba6e37b0d60d05dacbbdd8de357d43f607b5ebd83640a8d79d80