Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
18/09/2023, 16:16
Static task
static1
Behavioral task
behavioral1
Sample
6fa3ea98b1b4983114433c2762498890759b5085a0470f76b71060d60c1b4b6e.exe
Resource
win10v2004-20230915-en
General
-
Target
6fa3ea98b1b4983114433c2762498890759b5085a0470f76b71060d60c1b4b6e.exe
-
Size
255KB
-
MD5
36bf3ca7bff05bc29e138c172d2d274d
-
SHA1
9a19411740c7fb267fa3ab38660e7c7cbdd83c7d
-
SHA256
6fa3ea98b1b4983114433c2762498890759b5085a0470f76b71060d60c1b4b6e
-
SHA512
cd89d7ec01fcabda2d75601f9c7aa7fc1e75a8df8089f38efae2bbe2def3267a6877cdf48c2aec15092f3d93cf7e4f8fb20bd74c8ed8153541a158ad68330216
-
SSDEEP
6144:SAdjEF2jicP5iOo2T8VrSd/sUAOzilfrqldZDBI1Sa:SAdoqiG59ou9iRrqlHS1Sa
Malware Config
Extracted
smokeloader
2022
http://77.91.68.29/fks/
Extracted
redline
0305
185.215.113.25:10195
-
auth_value
c86205ff1cc37b2da12f0190adfda52c
Extracted
smokeloader
up3
Extracted
smokeloader
2020
http://host-file-host6.com/
http://host-host-file8.com/
Signatures
-
DcRat 3 IoCs
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
description ioc pid Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe 2356 schtasks.exe 5368 schtasks.exe -
Detect Fabookie payload 2 IoCs
resource yara_rule behavioral1/memory/2292-178-0x00000000032D0000-0x0000000003401000-memory.dmp family_fabookie behavioral1/memory/2292-342-0x00000000032D0000-0x0000000003401000-memory.dmp family_fabookie -
Glupteba payload 11 IoCs
resource yara_rule behavioral1/memory/2792-147-0x0000000002D60000-0x000000000364B000-memory.dmp family_glupteba behavioral1/memory/2792-152-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/2792-331-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/2792-332-0x0000000002D60000-0x000000000364B000-memory.dmp family_glupteba behavioral1/memory/2792-377-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/5192-432-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/5192-480-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/4148-562-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/4148-586-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/4148-588-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/4148-590-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 1696 netsh.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation 9EDF.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation 8FBA.exe -
Executes dropped EXE 11 IoCs
pid Process 2660 8623.exe 1124 87CA.exe 3864 8FBA.exe 4768 9EDF.exe 2292 ss41.exe 1400 toolspub2.exe 2792 31839b57a4f11171d6abc8bbc4451ee4.exe 1560 toolspub2.exe 5192 31839b57a4f11171d6abc8bbc4451ee4.exe 4148 csrss.exe 6112 injector.exe -
Loads dropped DLL 1 IoCs
pid Process 680 regsvr32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
description ioc Process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 7 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4832 set thread context of 1592 4832 6fa3ea98b1b4983114433c2762498890759b5085a0470f76b71060d60c1b4b6e.exe 87 PID 1400 set thread context of 1560 1400 toolspub2.exe 117 -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
description ioc Process File opened (read-only) \??\VBoxMiniRdrDN 31839b57a4f11171d6abc8bbc4451ee4.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\rss 31839b57a4f11171d6abc8bbc4451ee4.exe File created C:\Windows\rss\csrss.exe 31839b57a4f11171d6abc8bbc4451ee4.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspub2.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspub2.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspub2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5368 schtasks.exe 2356 schtasks.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-682 = "E. Australia Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2632 = "Norfolk Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-142 = "Canada Central Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-872 = "Pakistan Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2891 = "Sudan Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2752 = "Tomsk Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2751 = "Tomsk Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2412 = "Marquesas Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-871 = "Pakistan Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-512 = "Central Asia Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2411 = "Marquesas Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-214 = "Pacific Daylight Time (Mexico)" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-962 = "Paraguay Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-301 = "Romance Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-401 = "Arabic Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-12 = "Azores Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2591 = "Tocantins Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-541 = "Myanmar Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2491 = "Aus Central W. Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-342 = "Egypt Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-662 = "Cen. Australia Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-932 = "Coordinated Universal Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-72 = "Newfoundland Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-912 = "Mauritius Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-501 = "Nepal Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2371 = "Easter Island Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1592 AppLaunch.exe 1592 AppLaunch.exe 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3212 Process not Found -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 1592 AppLaunch.exe 1560 toolspub2.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs
pid Process 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3212 Process not Found Token: SeCreatePagefilePrivilege 3212 Process not Found Token: SeShutdownPrivilege 3212 Process not Found Token: SeCreatePagefilePrivilege 3212 Process not Found Token: SeShutdownPrivilege 3212 Process not Found Token: SeCreatePagefilePrivilege 3212 Process not Found Token: SeShutdownPrivilege 3212 Process not Found Token: SeCreatePagefilePrivilege 3212 Process not Found Token: SeDebugPrivilege 2660 8623.exe Token: SeShutdownPrivilege 3212 Process not Found Token: SeCreatePagefilePrivilege 3212 Process not Found Token: SeShutdownPrivilege 3212 Process not Found Token: SeCreatePagefilePrivilege 3212 Process not Found Token: SeShutdownPrivilege 3212 Process not Found Token: SeCreatePagefilePrivilege 3212 Process not Found Token: SeShutdownPrivilege 3212 Process not Found Token: SeCreatePagefilePrivilege 3212 Process not Found Token: SeShutdownPrivilege 3212 Process not Found Token: SeCreatePagefilePrivilege 3212 Process not Found Token: SeShutdownPrivilege 3212 Process not Found Token: SeCreatePagefilePrivilege 3212 Process not Found Token: SeShutdownPrivilege 3212 Process not Found Token: SeCreatePagefilePrivilege 3212 Process not Found Token: SeShutdownPrivilege 3212 Process not Found Token: SeCreatePagefilePrivilege 3212 Process not Found Token: SeDebugPrivilege 1124 87CA.exe Token: SeShutdownPrivilege 3212 Process not Found Token: SeCreatePagefilePrivilege 3212 Process not Found Token: SeShutdownPrivilege 3212 Process not Found Token: SeCreatePagefilePrivilege 3212 Process not Found Token: SeShutdownPrivilege 3212 Process not Found Token: SeCreatePagefilePrivilege 3212 Process not Found Token: SeShutdownPrivilege 3212 Process not Found Token: SeCreatePagefilePrivilege 3212 Process not Found Token: SeShutdownPrivilege 3212 Process not Found Token: SeCreatePagefilePrivilege 3212 Process not Found Token: SeShutdownPrivilege 3212 Process not Found Token: SeCreatePagefilePrivilege 3212 Process not Found Token: SeShutdownPrivilege 3212 Process not Found Token: SeCreatePagefilePrivilege 3212 Process not Found Token: SeShutdownPrivilege 3212 Process not Found Token: SeCreatePagefilePrivilege 3212 Process not Found Token: SeShutdownPrivilege 3212 Process not Found Token: SeCreatePagefilePrivilege 3212 Process not Found Token: SeShutdownPrivilege 3212 Process not Found Token: SeCreatePagefilePrivilege 3212 Process not Found Token: SeShutdownPrivilege 3212 Process not Found Token: SeCreatePagefilePrivilege 3212 Process not Found Token: SeShutdownPrivilege 3212 Process not Found Token: SeCreatePagefilePrivilege 3212 Process not Found Token: SeShutdownPrivilege 3212 Process not Found Token: SeCreatePagefilePrivilege 3212 Process not Found Token: SeDebugPrivilege 5848 powershell.exe Token: SeShutdownPrivilege 3212 Process not Found Token: SeCreatePagefilePrivilege 3212 Process not Found Token: SeShutdownPrivilege 3212 Process not Found Token: SeCreatePagefilePrivilege 3212 Process not Found Token: SeShutdownPrivilege 3212 Process not Found Token: SeCreatePagefilePrivilege 3212 Process not Found Token: SeDebugPrivilege 2792 31839b57a4f11171d6abc8bbc4451ee4.exe Token: SeImpersonatePrivilege 2792 31839b57a4f11171d6abc8bbc4451ee4.exe Token: SeDebugPrivilege 5332 powershell.exe Token: SeShutdownPrivilege 3212 Process not Found Token: SeCreatePagefilePrivilege 3212 Process not Found -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4832 wrote to memory of 1592 4832 6fa3ea98b1b4983114433c2762498890759b5085a0470f76b71060d60c1b4b6e.exe 87 PID 4832 wrote to memory of 1592 4832 6fa3ea98b1b4983114433c2762498890759b5085a0470f76b71060d60c1b4b6e.exe 87 PID 4832 wrote to memory of 1592 4832 6fa3ea98b1b4983114433c2762498890759b5085a0470f76b71060d60c1b4b6e.exe 87 PID 4832 wrote to memory of 1592 4832 6fa3ea98b1b4983114433c2762498890759b5085a0470f76b71060d60c1b4b6e.exe 87 PID 4832 wrote to memory of 1592 4832 6fa3ea98b1b4983114433c2762498890759b5085a0470f76b71060d60c1b4b6e.exe 87 PID 4832 wrote to memory of 1592 4832 6fa3ea98b1b4983114433c2762498890759b5085a0470f76b71060d60c1b4b6e.exe 87 PID 3212 wrote to memory of 2660 3212 Process not Found 93 PID 3212 wrote to memory of 2660 3212 Process not Found 93 PID 3212 wrote to memory of 2660 3212 Process not Found 93 PID 3212 wrote to memory of 1124 3212 Process not Found 94 PID 3212 wrote to memory of 1124 3212 Process not Found 94 PID 3212 wrote to memory of 1124 3212 Process not Found 94 PID 3212 wrote to memory of 3864 3212 Process not Found 96 PID 3212 wrote to memory of 3864 3212 Process not Found 96 PID 3212 wrote to memory of 3864 3212 Process not Found 96 PID 3212 wrote to memory of 1728 3212 Process not Found 97 PID 3212 wrote to memory of 1728 3212 Process not Found 97 PID 3864 wrote to memory of 680 3864 8FBA.exe 99 PID 3864 wrote to memory of 680 3864 8FBA.exe 99 PID 3864 wrote to memory of 680 3864 8FBA.exe 99 PID 1728 wrote to memory of 1920 1728 cmd.exe 100 PID 1728 wrote to memory of 1920 1728 cmd.exe 100 PID 1920 wrote to memory of 2912 1920 msedge.exe 102 PID 1920 wrote to memory of 2912 1920 msedge.exe 102 PID 1728 wrote to memory of 4356 1728 cmd.exe 103 PID 1728 wrote to memory of 4356 1728 cmd.exe 103 PID 4356 wrote to memory of 4016 4356 msedge.exe 104 PID 4356 wrote to memory of 4016 4356 msedge.exe 104 PID 1920 wrote to memory of 2184 1920 msedge.exe 106 PID 1920 wrote to memory of 2184 1920 msedge.exe 106 PID 1920 wrote to memory of 2184 1920 msedge.exe 106 PID 1920 wrote to memory of 2184 1920 msedge.exe 106 PID 1920 wrote to memory of 2184 1920 msedge.exe 106 PID 1920 wrote to memory of 2184 1920 msedge.exe 106 PID 1920 wrote to memory of 2184 1920 msedge.exe 106 PID 1920 wrote to memory of 2184 1920 msedge.exe 106 PID 1920 wrote to memory of 2184 1920 msedge.exe 106 PID 1920 wrote to memory of 2184 1920 msedge.exe 106 PID 1920 wrote to memory of 2184 1920 msedge.exe 106 PID 1920 wrote to memory of 2184 1920 msedge.exe 106 PID 1920 wrote to memory of 2184 1920 msedge.exe 106 PID 1920 wrote to memory of 2184 1920 msedge.exe 106 PID 1920 wrote to memory of 2184 1920 msedge.exe 106 PID 1920 wrote to memory of 2184 1920 msedge.exe 106 PID 1920 wrote to memory of 2184 1920 msedge.exe 106 PID 1920 wrote to memory of 2184 1920 msedge.exe 106 PID 1920 wrote to memory of 2184 1920 msedge.exe 106 PID 1920 wrote to memory of 2184 1920 msedge.exe 106 PID 1920 wrote to memory of 2184 1920 msedge.exe 106 PID 1920 wrote to memory of 2184 1920 msedge.exe 106 PID 1920 wrote to memory of 2184 1920 msedge.exe 106 PID 1920 wrote to memory of 2184 1920 msedge.exe 106 PID 1920 wrote to memory of 2184 1920 msedge.exe 106 PID 1920 wrote to memory of 2184 1920 msedge.exe 106 PID 1920 wrote to memory of 2184 1920 msedge.exe 106 PID 1920 wrote to memory of 2184 1920 msedge.exe 106 PID 1920 wrote to memory of 2184 1920 msedge.exe 106 PID 1920 wrote to memory of 2184 1920 msedge.exe 106 PID 1920 wrote to memory of 2184 1920 msedge.exe 106 PID 1920 wrote to memory of 2184 1920 msedge.exe 106 PID 1920 wrote to memory of 2184 1920 msedge.exe 106 PID 1920 wrote to memory of 2184 1920 msedge.exe 106 PID 1920 wrote to memory of 2184 1920 msedge.exe 106 PID 1920 wrote to memory of 2184 1920 msedge.exe 106 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\6fa3ea98b1b4983114433c2762498890759b5085a0470f76b71060d60c1b4b6e.exe"C:\Users\Admin\AppData\Local\Temp\6fa3ea98b1b4983114433c2762498890759b5085a0470f76b71060d60c1b4b6e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- DcRat
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1592
-
-
C:\Users\Admin\AppData\Local\Temp\8623.exeC:\Users\Admin\AppData\Local\Temp\8623.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2660
-
C:\Users\Admin\AppData\Local\Temp\87CA.exeC:\Users\Admin\AppData\Local\Temp\87CA.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1124
-
C:\Users\Admin\AppData\Local\Temp\8FBA.exeC:\Users\Admin\AppData\Local\Temp\8FBA.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" -U /s ODX9Fs.KE2⤵
- Loads dropped DLL
PID:680
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\90F3.bat" "1⤵
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login2⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffcd78b46f8,0x7ffcd78b4708,0x7ffcd78b47183⤵PID:2912
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,16098482274193927935,8565437145883292367,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:33⤵PID:628
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,16098482274193927935,8565437145883292367,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:23⤵PID:2184
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,16098482274193927935,8565437145883292367,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2676 /prefetch:83⤵PID:4988
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16098482274193927935,8565437145883292367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:13⤵PID:4112
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16098482274193927935,8565437145883292367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:13⤵PID:1164
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16098482274193927935,8565437145883292367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3900 /prefetch:13⤵PID:3144
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16098482274193927935,8565437145883292367,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:13⤵PID:2296
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16098482274193927935,8565437145883292367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:13⤵PID:4748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,16098482274193927935,8565437145883292367,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5768 /prefetch:83⤵PID:3364
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,16098482274193927935,8565437145883292367,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5768 /prefetch:83⤵PID:1860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16098482274193927935,8565437145883292367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:13⤵PID:4572
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16098482274193927935,8565437145883292367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:13⤵PID:4608
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16098482274193927935,8565437145883292367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:13⤵PID:1836
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16098482274193927935,8565437145883292367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:13⤵PID:4628
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16098482274193927935,8565437145883292367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:13⤵PID:1924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16098482274193927935,8565437145883292367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:13⤵PID:4728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16098482274193927935,8565437145883292367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5860 /prefetch:13⤵PID:400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16098482274193927935,8565437145883292367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:13⤵PID:1032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16098482274193927935,8565437145883292367,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:13⤵PID:3464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16098482274193927935,8565437145883292367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:13⤵PID:2276
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/2⤵
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcd78b46f8,0x7ffcd78b4708,0x7ffcd78b47183⤵PID:4016
-
-
-
C:\Users\Admin\AppData\Local\Temp\9EDF.exeC:\Users\Admin\AppData\Local\Temp\9EDF.exe1⤵
- Checks computer location settings
- Executes dropped EXE
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\ss41.exe"C:\Users\Admin\AppData\Local\Temp\ss41.exe"2⤵
- Executes dropped EXE
PID:2292
-
-
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:1560
-
-
-
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2792 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Suspicious use of AdjustPrivilegeToken
PID:5848
-
-
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:5192 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5332
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"4⤵PID:4528
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes5⤵
- Modifies Windows Firewall
PID:1696
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:3476
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2764
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
PID:4148 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1836
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F5⤵
- DcRat
- Creates scheduled task(s)
PID:2356
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f5⤵PID:4712
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2616
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4220
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll5⤵
- Executes dropped EXE
PID:6112
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F5⤵
- DcRat
- Creates scheduled task(s)
PID:5368
-
-
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1068
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2840
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD53d5af55f794f9a10c5943d2f80dde5c5
SHA15252adf87d6bd769f2c39b9e8eba77b087a0160d
SHA25643e50edafcaaeae9fcd4dce5b99bf14fe79dae1401019443f31aa9ff81347764
SHA5122e2e09a00db732ff934da1e6ab8617fb3c8de482f9667a2c987435d0a5d67550b4bfd66e8b4475012b60908c24e39dff58e2f2ffa55f13ffc55caae1be630c71
-
Filesize
152B
MD53d5af55f794f9a10c5943d2f80dde5c5
SHA15252adf87d6bd769f2c39b9e8eba77b087a0160d
SHA25643e50edafcaaeae9fcd4dce5b99bf14fe79dae1401019443f31aa9ff81347764
SHA5122e2e09a00db732ff934da1e6ab8617fb3c8de482f9667a2c987435d0a5d67550b4bfd66e8b4475012b60908c24e39dff58e2f2ffa55f13ffc55caae1be630c71
-
Filesize
152B
MD53d5af55f794f9a10c5943d2f80dde5c5
SHA15252adf87d6bd769f2c39b9e8eba77b087a0160d
SHA25643e50edafcaaeae9fcd4dce5b99bf14fe79dae1401019443f31aa9ff81347764
SHA5122e2e09a00db732ff934da1e6ab8617fb3c8de482f9667a2c987435d0a5d67550b4bfd66e8b4475012b60908c24e39dff58e2f2ffa55f13ffc55caae1be630c71
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize312B
MD5ddc1bd6395cfdc620253c49cb9707308
SHA141fbb0ff20bda4e060f67305d79ed46e01fb419e
SHA256136fced30d79d9fef866b49d425675518478e29ad10f877f866e827ae0a553a4
SHA512dd7206fbb641a57da052d1eac360f5501ab8bba924be119bb985a1c62a89b375e068e3a006ab4937a9b9f389cb5056e1a89b173a6fde134083771b6a51597396
-
Filesize
1KB
MD5f34f11fcd6f291504e460e3789b04925
SHA1c1b415adc084679e7c628a1ad1a81b8a74ca9e64
SHA256e83fa05350aab2c4c57462e0ad6fb8e4a41747ccbf79e85c76fbc0755c3829cb
SHA512e13c5ee5711dc1204a7228d6bba605737ab228fcadefc39cd36902efa9cfcc7264e0c04fefe43a60d82737dc9fb42c0e700cf65b2790473ce0da68bf03ea7c0f
-
Filesize
7KB
MD555d8192b4c988227b09a20e1893e1537
SHA1243c7c90506cf050e4e235302ed4a00ebb48cda0
SHA256e0a025b217b3855366d10b5dd6f73ceb3d69ae87bc694f6fe649e3e5e4caccff
SHA5128c54e076267b2bdcda8440fb595235b3dcd4b3a31d807538182377db173e44d1b82495d987b292ab1a42e72ca18e6dd25b4c719621cc8a1ab5edfd8fba21615e
-
Filesize
5KB
MD5b422bd0fbfbd3ee276e7b0c6ae3e383a
SHA130c72d595fa8a31d64fc778a9e91c82ce29fe6d1
SHA256ce93eaaaae4263c65a5e85ba80146b15d15d176caddbda3a8ab9f983f9abe3f6
SHA51238aaa963793df4b1612262b26b0888a226a80a023bb1c20810d19e13b6ddab48d8b981f8acd5373544d8e45a25483764c7b4c88ac6c9dc4f959db17009f19303
-
Filesize
24KB
MD5ea3eb562ae6832a2bf0785ceadcfec6b
SHA1a55773b14d3350c6fdf9075dda3cba0f8d038247
SHA256e27b73ea096a878a86c216f6903a35b06353f68379f9c9d000d9a32fe0d4def6
SHA512a98bc0f24e22535bf59dee45e7aefbccd24ef9ee4bb9c866cb29653bda9bfe714405dabef18260b3209cd542f714df6e04c2d39478b0d22e98019a52b08b1649
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD51c0439b21d8965f3a8fb63eed5a1102a
SHA14122ede0e5207bfc5665e50632115ad6ce8a4878
SHA25698231063ab32cd3db18a95e7c904f1887bd6033855ea73e95be8553dd57d29a8
SHA5124f7468f4c39e20641dd7b99f68109ab3a1d1399ff38c62f149d14401b87d6abf897402200ef623beba23e3e7adf6383b318123507e1abbb430ea155d925a72e2
-
Filesize
10KB
MD51c0439b21d8965f3a8fb63eed5a1102a
SHA14122ede0e5207bfc5665e50632115ad6ce8a4878
SHA25698231063ab32cd3db18a95e7c904f1887bd6033855ea73e95be8553dd57d29a8
SHA5124f7468f4c39e20641dd7b99f68109ab3a1d1399ff38c62f149d14401b87d6abf897402200ef623beba23e3e7adf6383b318123507e1abbb430ea155d925a72e2
-
Filesize
4.1MB
MD5637f73095de9f62dc6fcfbe9b3f6d3d6
SHA1708771d9413e7df69189d2a0c283ec72bd63d99e
SHA2566a678e471f24d7560be7cda7a49a34b4f0c2cb279b779984e5f002be3dfacf1d
SHA51200d4d05c7b894d4c52dcbc75d555c76f966defed1934747ffe4a29d8dc1b426fad021a02a5e221dd583ac86d67661a6b9cddde13ad1465546439f52ed567aeb5
-
Filesize
4.1MB
MD5637f73095de9f62dc6fcfbe9b3f6d3d6
SHA1708771d9413e7df69189d2a0c283ec72bd63d99e
SHA2566a678e471f24d7560be7cda7a49a34b4f0c2cb279b779984e5f002be3dfacf1d
SHA51200d4d05c7b894d4c52dcbc75d555c76f966defed1934747ffe4a29d8dc1b426fad021a02a5e221dd583ac86d67661a6b9cddde13ad1465546439f52ed567aeb5
-
Filesize
4.1MB
MD5637f73095de9f62dc6fcfbe9b3f6d3d6
SHA1708771d9413e7df69189d2a0c283ec72bd63d99e
SHA2566a678e471f24d7560be7cda7a49a34b4f0c2cb279b779984e5f002be3dfacf1d
SHA51200d4d05c7b894d4c52dcbc75d555c76f966defed1934747ffe4a29d8dc1b426fad021a02a5e221dd583ac86d67661a6b9cddde13ad1465546439f52ed567aeb5
-
Filesize
4.1MB
MD5637f73095de9f62dc6fcfbe9b3f6d3d6
SHA1708771d9413e7df69189d2a0c283ec72bd63d99e
SHA2566a678e471f24d7560be7cda7a49a34b4f0c2cb279b779984e5f002be3dfacf1d
SHA51200d4d05c7b894d4c52dcbc75d555c76f966defed1934747ffe4a29d8dc1b426fad021a02a5e221dd583ac86d67661a6b9cddde13ad1465546439f52ed567aeb5
-
Filesize
341KB
MD58669fe397a7225ede807202f6a9d8390
SHA104a806a5c4218cb703cba85d3e636d0c8cbae043
SHA2561624a759791e49ce8f79dd249d3ac2aede589ffbe53db342e4c99e2fbbc1b90e
SHA51229cad49434172a910ba7635058ecc02aacf43f648ee98b2c47c561332403a96847b5da817358095f7638295b238de8874bf34fb393670096bbf3caeb388a9c45
-
Filesize
341KB
MD58669fe397a7225ede807202f6a9d8390
SHA104a806a5c4218cb703cba85d3e636d0c8cbae043
SHA2561624a759791e49ce8f79dd249d3ac2aede589ffbe53db342e4c99e2fbbc1b90e
SHA51229cad49434172a910ba7635058ecc02aacf43f648ee98b2c47c561332403a96847b5da817358095f7638295b238de8874bf34fb393670096bbf3caeb388a9c45
-
Filesize
412KB
MD55200fbe07521eb001f145afb95d40283
SHA1df6cfdf15b58a0bb24255b3902886dc375f3346f
SHA25600c3f29f9a8aec0774256501c562275e2d866f0130a2b8a58d74003c6c77e812
SHA512c38359959ce1083f94d2206d1b4b317e8c5d493168013b4e8c406acb5a55fd4f85ec7ce4d5e400b9105fd82eae3d6301d52346f040a64c09981185c66f2cbf75
-
Filesize
412KB
MD55200fbe07521eb001f145afb95d40283
SHA1df6cfdf15b58a0bb24255b3902886dc375f3346f
SHA25600c3f29f9a8aec0774256501c562275e2d866f0130a2b8a58d74003c6c77e812
SHA512c38359959ce1083f94d2206d1b4b317e8c5d493168013b4e8c406acb5a55fd4f85ec7ce4d5e400b9105fd82eae3d6301d52346f040a64c09981185c66f2cbf75
-
Filesize
1.6MB
MD57d274ad84b931078f3673393c82db7f9
SHA166521bdbb10c9c57e6f9be39121c324b87fad1da
SHA256c1e2f33e36ecdaf34a0669e9bcd1414a1fa3b4489db4f4af6ca7d6e236798110
SHA5126c2300e961421f67d5d72dc42eb844298f33517667e0e36bc5ac761cad3da57178b20f106e57ddcac7dc59f2457bd2b20d40bf183834ebb4e9e1767a06666c31
-
Filesize
1.6MB
MD57d274ad84b931078f3673393c82db7f9
SHA166521bdbb10c9c57e6f9be39121c324b87fad1da
SHA256c1e2f33e36ecdaf34a0669e9bcd1414a1fa3b4489db4f4af6ca7d6e236798110
SHA5126c2300e961421f67d5d72dc42eb844298f33517667e0e36bc5ac761cad3da57178b20f106e57ddcac7dc59f2457bd2b20d40bf183834ebb4e9e1767a06666c31
-
Filesize
79B
MD5403991c4d18ac84521ba17f264fa79f2
SHA1850cc068de0963854b0fe8f485d951072474fd45
SHA256ef6e942aefe925fefac19fa816986ea25de6935c4f377c717e29b94e65f9019f
SHA512a20aaa77065d30195e5893f2ff989979383c8d7f82d9e528d4833b1c1236aef4f85284f5250d0f190a174790b650280ffe1fbff7e00c98024ccf5ca746e5b576
-
Filesize
4.6MB
MD5b32d5a382373d7df0c1fec9f15f0724a
SHA1472fc4c27859f39e8b9a0bf784949f72944dc52b
SHA256010fe481ba6275ebbf71e102e66d73f5d819252f2b4b1893d2acf53c04f4200f
SHA5121320be23719f86e043beaeea8affa9ab125a68a1210f596c4424d4a5a2a9ef72eb572578897722842ad0586afe1d669ff816648ea3eeb3aa0b8379c9066da3a9
-
Filesize
4.6MB
MD5b32d5a382373d7df0c1fec9f15f0724a
SHA1472fc4c27859f39e8b9a0bf784949f72944dc52b
SHA256010fe481ba6275ebbf71e102e66d73f5d819252f2b4b1893d2acf53c04f4200f
SHA5121320be23719f86e043beaeea8affa9ab125a68a1210f596c4424d4a5a2a9ef72eb572578897722842ad0586afe1d669ff816648ea3eeb3aa0b8379c9066da3a9
-
Filesize
1.4MB
MD5df4c7378ffe26665a673aacd12926348
SHA13188efa5a477f960e0f975c3a007aefdbeeab5ea
SHA256fe754138008fd4e3b5de5d923694de6ddc17d756c53030b8b163f60913f9462c
SHA512904939de1a22adb848116a54cfcdf28f4f8af25cfd1239e88c76580eceffbd104012f85facb30f2bcc9f270f802397ec28cd44e50f230d6ce10a2d419c7e396a
-
Filesize
1.4MB
MD5df4c7378ffe26665a673aacd12926348
SHA13188efa5a477f960e0f975c3a007aefdbeeab5ea
SHA256fe754138008fd4e3b5de5d923694de6ddc17d756c53030b8b163f60913f9462c
SHA512904939de1a22adb848116a54cfcdf28f4f8af25cfd1239e88c76580eceffbd104012f85facb30f2bcc9f270f802397ec28cd44e50f230d6ce10a2d419c7e396a
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
Filesize
298KB
MD58bd874c0500c7112d04cfad6fda75524
SHA1d04a20e3bb7ffe5663f69c870457ad4edeb00192
SHA25622aa36bd2f8ace8d959f22cf0e99bfe1d3fd655c075aa14a3232fb9e0f35adc2
SHA512d6c43d5a5d1bfca1dddfb6283eafcd1f274e52812ccfee877298dfc74930fe6a8ec7035f95107600742ef19a630bee3ca3fab1fc7ab3ff717bea8f8c05e384d8
-
Filesize
298KB
MD58bd874c0500c7112d04cfad6fda75524
SHA1d04a20e3bb7ffe5663f69c870457ad4edeb00192
SHA25622aa36bd2f8ace8d959f22cf0e99bfe1d3fd655c075aa14a3232fb9e0f35adc2
SHA512d6c43d5a5d1bfca1dddfb6283eafcd1f274e52812ccfee877298dfc74930fe6a8ec7035f95107600742ef19a630bee3ca3fab1fc7ab3ff717bea8f8c05e384d8
-
Filesize
298KB
MD58bd874c0500c7112d04cfad6fda75524
SHA1d04a20e3bb7ffe5663f69c870457ad4edeb00192
SHA25622aa36bd2f8ace8d959f22cf0e99bfe1d3fd655c075aa14a3232fb9e0f35adc2
SHA512d6c43d5a5d1bfca1dddfb6283eafcd1f274e52812ccfee877298dfc74930fe6a8ec7035f95107600742ef19a630bee3ca3fab1fc7ab3ff717bea8f8c05e384d8
-
Filesize
227KB
MD5fccd5785d54697b968ebe3c55641c4b3
SHA1f3353f2cfb27100ea14ae6ad02a72f834694fbf3
SHA256757568f5af7731014baf25b6941c179d14b2041d2aa8a43e482a942e99d86f82
SHA5120360e3c3469219f6c13ab3bd0c47304c6bb1319463c4102433156400ebfbf468b88f9b469eeb01e78ed32021adb93d52e9dd410dcc9d44e5dbee67f9a51aed6d
-
Filesize
227KB
MD5fccd5785d54697b968ebe3c55641c4b3
SHA1f3353f2cfb27100ea14ae6ad02a72f834694fbf3
SHA256757568f5af7731014baf25b6941c179d14b2041d2aa8a43e482a942e99d86f82
SHA5120360e3c3469219f6c13ab3bd0c47304c6bb1319463c4102433156400ebfbf468b88f9b469eeb01e78ed32021adb93d52e9dd410dcc9d44e5dbee67f9a51aed6d
-
Filesize
227KB
MD5fccd5785d54697b968ebe3c55641c4b3
SHA1f3353f2cfb27100ea14ae6ad02a72f834694fbf3
SHA256757568f5af7731014baf25b6941c179d14b2041d2aa8a43e482a942e99d86f82
SHA5120360e3c3469219f6c13ab3bd0c47304c6bb1319463c4102433156400ebfbf468b88f9b469eeb01e78ed32021adb93d52e9dd410dcc9d44e5dbee67f9a51aed6d
-
Filesize
227KB
MD5fccd5785d54697b968ebe3c55641c4b3
SHA1f3353f2cfb27100ea14ae6ad02a72f834694fbf3
SHA256757568f5af7731014baf25b6941c179d14b2041d2aa8a43e482a942e99d86f82
SHA5120360e3c3469219f6c13ab3bd0c47304c6bb1319463c4102433156400ebfbf468b88f9b469eeb01e78ed32021adb93d52e9dd410dcc9d44e5dbee67f9a51aed6d
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5e1af3c135695958bf72676ec8411d98a
SHA1abcdba1e399a971992a1bd2da6d510a1117ee693
SHA2568a338e8d02fc0c100bf62c3a86851b4a314cdc2fef874c1ae69f1ae6bc0e2035
SHA512744dc62d12d52cf238baf321ebb206c2c8df6079b851981306ec8ace3030c48eb29312cb694cc11888f9c75b6187ecb3563eaf2c284cea6c8634d56979075637
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD569597370a1a88ee4aa3754873ea5a8e7
SHA1e5913b2ac304dc677cd4df17aecbb585161a26e1
SHA25658d193016171bd079a6b5e4a31006990e239f378c49c65882a2b5412a308adea
SHA51235a31337f7358524801c1213da5ca6ee21affc2c6819e7060ff7168d5b04ffd44a5c35f1c8b19bb36e1015aa2d33084a7dc2a5331d56177abd1d8763a58dd710
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5cecccf9ca5716c2eb7a4b823a92017ef
SHA14ad3a1772323f72d9faf812142120743dcc29a40
SHA2567219bbecec5113765521006fd019f35ab8f0622cf1a1177788e199f917c96a90
SHA51288ab918863f6897d43559b5cc601aba36249e9081b3854de73e8a87677a2072d91b38c31c6367767f790a66cb9ae35c5233895a288c0aa7d9cd03547e77db051
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD59ad8673aa08b773d2985e927615ce84e
SHA1e87b1c0aa18853f1208668617ede5267f344f2e1
SHA256139dc28fea096bbabc1b4af689a1c918808ebda1ca16dbae6e16094787f8c6bc
SHA512c029f806ab14f720eb65957d72c95105ecd853fd74890f4f48d0e5342eeaed74456af8b2abe7669ab1390e1a45e6df58e03bf23ed4cc4ce7ed9d9dd0a6567b7c
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5f340c8c7f6f38fc1ad49d9531ab4d36e
SHA14453bc71f6af1373b79dc631bfea4c70eec53d8f
SHA2566787ffeb5dc5438f80630879be586f9f3e0a0d721353fa1fb6440a2fb3da7d36
SHA512dc5c3deb572715d2b8b35b9f5909d4e583f1de2860859d0cc73f6c52847681d9340a42ebddaecc384ef00f0dba7bdd0701cd83e5bf680cd31859a47d1fab01f8
-
Filesize
4.1MB
MD5637f73095de9f62dc6fcfbe9b3f6d3d6
SHA1708771d9413e7df69189d2a0c283ec72bd63d99e
SHA2566a678e471f24d7560be7cda7a49a34b4f0c2cb279b779984e5f002be3dfacf1d
SHA51200d4d05c7b894d4c52dcbc75d555c76f966defed1934747ffe4a29d8dc1b426fad021a02a5e221dd583ac86d67661a6b9cddde13ad1465546439f52ed567aeb5
-
Filesize
4.1MB
MD5637f73095de9f62dc6fcfbe9b3f6d3d6
SHA1708771d9413e7df69189d2a0c283ec72bd63d99e
SHA2566a678e471f24d7560be7cda7a49a34b4f0c2cb279b779984e5f002be3dfacf1d
SHA51200d4d05c7b894d4c52dcbc75d555c76f966defed1934747ffe4a29d8dc1b426fad021a02a5e221dd583ac86d67661a6b9cddde13ad1465546439f52ed567aeb5