Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/09/2023, 16:16

General

  • Target

    6fa3ea98b1b4983114433c2762498890759b5085a0470f76b71060d60c1b4b6e.exe

  • Size

    255KB

  • MD5

    36bf3ca7bff05bc29e138c172d2d274d

  • SHA1

    9a19411740c7fb267fa3ab38660e7c7cbdd83c7d

  • SHA256

    6fa3ea98b1b4983114433c2762498890759b5085a0470f76b71060d60c1b4b6e

  • SHA512

    cd89d7ec01fcabda2d75601f9c7aa7fc1e75a8df8089f38efae2bbe2def3267a6877cdf48c2aec15092f3d93cf7e4f8fb20bd74c8ed8153541a158ad68330216

  • SSDEEP

    6144:SAdjEF2jicP5iOo2T8VrSd/sUAOzilfrqldZDBI1Sa:SAdoqiG59ou9iRrqlHS1Sa

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://77.91.68.29/fks/

rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

0305

C2

185.215.113.25:10195

Attributes
  • auth_value

    c86205ff1cc37b2da12f0190adfda52c

Extracted

Family

smokeloader

Botnet

up3

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32
rc4.i32

Signatures

  • DcRat 3 IoCs

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Detect Fabookie payload 2 IoCs
  • Fabookie

    Fabookie is facebook account info stealer.

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 11 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Downloads MZ/PE file
  • Modifies Windows Firewall 1 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 11 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

  • Drops file in System32 directory 7 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\6fa3ea98b1b4983114433c2762498890759b5085a0470f76b71060d60c1b4b6e.exe
    "C:\Users\Admin\AppData\Local\Temp\6fa3ea98b1b4983114433c2762498890759b5085a0470f76b71060d60c1b4b6e.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4832
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      2⤵
      • DcRat
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:1592
  • C:\Users\Admin\AppData\Local\Temp\8623.exe
    C:\Users\Admin\AppData\Local\Temp\8623.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:2660
  • C:\Users\Admin\AppData\Local\Temp\87CA.exe
    C:\Users\Admin\AppData\Local\Temp\87CA.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:1124
  • C:\Users\Admin\AppData\Local\Temp\8FBA.exe
    C:\Users\Admin\AppData\Local\Temp\8FBA.exe
    1⤵
    • Checks computer location settings
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:3864
    • C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" -U /s ODX9Fs.KE
      2⤵
      • Loads dropped DLL
      PID:680
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\90F3.bat" "
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1728
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
      2⤵
      • Enumerates system info in registry
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:1920
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffcd78b46f8,0x7ffcd78b4708,0x7ffcd78b4718
        3⤵
          PID:2912
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,16098482274193927935,8565437145883292367,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
          3⤵
            PID:628
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,16098482274193927935,8565437145883292367,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
            3⤵
              PID:2184
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,16098482274193927935,8565437145883292367,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2676 /prefetch:8
              3⤵
                PID:4988
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16098482274193927935,8565437145883292367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
                3⤵
                  PID:4112
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16098482274193927935,8565437145883292367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
                  3⤵
                    PID:1164
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16098482274193927935,8565437145883292367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3900 /prefetch:1
                    3⤵
                      PID:3144
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16098482274193927935,8565437145883292367,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
                      3⤵
                        PID:2296
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16098482274193927935,8565437145883292367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
                        3⤵
                          PID:4748
                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,16098482274193927935,8565437145883292367,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5768 /prefetch:8
                          3⤵
                            PID:3364
                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,16098482274193927935,8565437145883292367,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5768 /prefetch:8
                            3⤵
                              PID:1860
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16098482274193927935,8565437145883292367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
                              3⤵
                                PID:4572
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16098482274193927935,8565437145883292367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
                                3⤵
                                  PID:4608
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16098482274193927935,8565437145883292367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
                                  3⤵
                                    PID:1836
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16098482274193927935,8565437145883292367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
                                    3⤵
                                      PID:4628
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16098482274193927935,8565437145883292367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
                                      3⤵
                                        PID:1924
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16098482274193927935,8565437145883292367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
                                        3⤵
                                          PID:4728
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16098482274193927935,8565437145883292367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5860 /prefetch:1
                                          3⤵
                                            PID:400
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16098482274193927935,8565437145883292367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:1
                                            3⤵
                                              PID:1032
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16098482274193927935,8565437145883292367,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
                                              3⤵
                                                PID:3464
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16098482274193927935,8565437145883292367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
                                                3⤵
                                                  PID:2276
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
                                                2⤵
                                                • Suspicious use of WriteProcessMemory
                                                PID:4356
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcd78b46f8,0x7ffcd78b4708,0x7ffcd78b4718
                                                  3⤵
                                                    PID:4016
                                              • C:\Users\Admin\AppData\Local\Temp\9EDF.exe
                                                C:\Users\Admin\AppData\Local\Temp\9EDF.exe
                                                1⤵
                                                • Checks computer location settings
                                                • Executes dropped EXE
                                                PID:4768
                                                • C:\Users\Admin\AppData\Local\Temp\ss41.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\ss41.exe"
                                                  2⤵
                                                  • Executes dropped EXE
                                                  PID:2292
                                                • C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
                                                  2⤵
                                                  • Executes dropped EXE
                                                  • Suspicious use of SetThreadContext
                                                  PID:1400
                                                  • C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
                                                    3⤵
                                                    • Executes dropped EXE
                                                    • Checks SCSI registry key(s)
                                                    • Suspicious behavior: MapViewOfSection
                                                    PID:1560
                                                • C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
                                                  2⤵
                                                  • Executes dropped EXE
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:2792
                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                    powershell -nologo -noprofile
                                                    3⤵
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:5848
                                                  • C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
                                                    3⤵
                                                    • Executes dropped EXE
                                                    • Adds Run key to start application
                                                    • Checks for VirtualBox DLLs, possible anti-VM trick
                                                    • Drops file in Windows directory
                                                    • Modifies data under HKEY_USERS
                                                    PID:5192
                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                      powershell -nologo -noprofile
                                                      4⤵
                                                      • Drops file in System32 directory
                                                      • Modifies data under HKEY_USERS
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:5332
                                                    • C:\Windows\system32\cmd.exe
                                                      C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                                                      4⤵
                                                        PID:4528
                                                        • C:\Windows\system32\netsh.exe
                                                          netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                                                          5⤵
                                                          • Modifies Windows Firewall
                                                          PID:1696
                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                        powershell -nologo -noprofile
                                                        4⤵
                                                        • Drops file in System32 directory
                                                        • Modifies data under HKEY_USERS
                                                        PID:3476
                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                        powershell -nologo -noprofile
                                                        4⤵
                                                        • Drops file in System32 directory
                                                        • Modifies data under HKEY_USERS
                                                        PID:2764
                                                      • C:\Windows\rss\csrss.exe
                                                        C:\Windows\rss\csrss.exe
                                                        4⤵
                                                        • Executes dropped EXE
                                                        • Adds Run key to start application
                                                        • Manipulates WinMonFS driver.
                                                        PID:4148
                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                          powershell -nologo -noprofile
                                                          5⤵
                                                          • Drops file in System32 directory
                                                          • Modifies data under HKEY_USERS
                                                          PID:1836
                                                        • C:\Windows\SYSTEM32\schtasks.exe
                                                          schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                                                          5⤵
                                                          • DcRat
                                                          • Creates scheduled task(s)
                                                          PID:2356
                                                        • C:\Windows\SYSTEM32\schtasks.exe
                                                          schtasks /delete /tn ScheduledUpdate /f
                                                          5⤵
                                                            PID:4712
                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                            powershell -nologo -noprofile
                                                            5⤵
                                                            • Drops file in System32 directory
                                                            • Modifies data under HKEY_USERS
                                                            PID:2616
                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                            powershell -nologo -noprofile
                                                            5⤵
                                                            • Drops file in System32 directory
                                                            • Modifies data under HKEY_USERS
                                                            PID:4220
                                                          • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                                                            C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                                                            5⤵
                                                            • Executes dropped EXE
                                                            PID:6112
                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                            schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                                                            5⤵
                                                            • DcRat
                                                            • Creates scheduled task(s)
                                                            PID:5368
                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                    1⤵
                                                      PID:1068
                                                    • C:\Windows\System32\CompPkgSrv.exe
                                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                      1⤵
                                                        PID:2840

                                                      Network

                                                      MITRE ATT&CK Enterprise v15

                                                      Replay Monitor

                                                      Loading Replay Monitor...

                                                      Downloads

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                        Filesize

                                                        152B

                                                        MD5

                                                        3d5af55f794f9a10c5943d2f80dde5c5

                                                        SHA1

                                                        5252adf87d6bd769f2c39b9e8eba77b087a0160d

                                                        SHA256

                                                        43e50edafcaaeae9fcd4dce5b99bf14fe79dae1401019443f31aa9ff81347764

                                                        SHA512

                                                        2e2e09a00db732ff934da1e6ab8617fb3c8de482f9667a2c987435d0a5d67550b4bfd66e8b4475012b60908c24e39dff58e2f2ffa55f13ffc55caae1be630c71

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                        Filesize

                                                        152B

                                                        MD5

                                                        3d5af55f794f9a10c5943d2f80dde5c5

                                                        SHA1

                                                        5252adf87d6bd769f2c39b9e8eba77b087a0160d

                                                        SHA256

                                                        43e50edafcaaeae9fcd4dce5b99bf14fe79dae1401019443f31aa9ff81347764

                                                        SHA512

                                                        2e2e09a00db732ff934da1e6ab8617fb3c8de482f9667a2c987435d0a5d67550b4bfd66e8b4475012b60908c24e39dff58e2f2ffa55f13ffc55caae1be630c71

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                        Filesize

                                                        152B

                                                        MD5

                                                        3d5af55f794f9a10c5943d2f80dde5c5

                                                        SHA1

                                                        5252adf87d6bd769f2c39b9e8eba77b087a0160d

                                                        SHA256

                                                        43e50edafcaaeae9fcd4dce5b99bf14fe79dae1401019443f31aa9ff81347764

                                                        SHA512

                                                        2e2e09a00db732ff934da1e6ab8617fb3c8de482f9667a2c987435d0a5d67550b4bfd66e8b4475012b60908c24e39dff58e2f2ffa55f13ffc55caae1be630c71

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                        Filesize

                                                        312B

                                                        MD5

                                                        ddc1bd6395cfdc620253c49cb9707308

                                                        SHA1

                                                        41fbb0ff20bda4e060f67305d79ed46e01fb419e

                                                        SHA256

                                                        136fced30d79d9fef866b49d425675518478e29ad10f877f866e827ae0a553a4

                                                        SHA512

                                                        dd7206fbb641a57da052d1eac360f5501ab8bba924be119bb985a1c62a89b375e068e3a006ab4937a9b9f389cb5056e1a89b173a6fde134083771b6a51597396

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                        Filesize

                                                        1KB

                                                        MD5

                                                        f34f11fcd6f291504e460e3789b04925

                                                        SHA1

                                                        c1b415adc084679e7c628a1ad1a81b8a74ca9e64

                                                        SHA256

                                                        e83fa05350aab2c4c57462e0ad6fb8e4a41747ccbf79e85c76fbc0755c3829cb

                                                        SHA512

                                                        e13c5ee5711dc1204a7228d6bba605737ab228fcadefc39cd36902efa9cfcc7264e0c04fefe43a60d82737dc9fb42c0e700cf65b2790473ce0da68bf03ea7c0f

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                        Filesize

                                                        7KB

                                                        MD5

                                                        55d8192b4c988227b09a20e1893e1537

                                                        SHA1

                                                        243c7c90506cf050e4e235302ed4a00ebb48cda0

                                                        SHA256

                                                        e0a025b217b3855366d10b5dd6f73ceb3d69ae87bc694f6fe649e3e5e4caccff

                                                        SHA512

                                                        8c54e076267b2bdcda8440fb595235b3dcd4b3a31d807538182377db173e44d1b82495d987b292ab1a42e72ca18e6dd25b4c719621cc8a1ab5edfd8fba21615e

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                        Filesize

                                                        5KB

                                                        MD5

                                                        b422bd0fbfbd3ee276e7b0c6ae3e383a

                                                        SHA1

                                                        30c72d595fa8a31d64fc778a9e91c82ce29fe6d1

                                                        SHA256

                                                        ce93eaaaae4263c65a5e85ba80146b15d15d176caddbda3a8ab9f983f9abe3f6

                                                        SHA512

                                                        38aaa963793df4b1612262b26b0888a226a80a023bb1c20810d19e13b6ddab48d8b981f8acd5373544d8e45a25483764c7b4c88ac6c9dc4f959db17009f19303

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                                                        Filesize

                                                        24KB

                                                        MD5

                                                        ea3eb562ae6832a2bf0785ceadcfec6b

                                                        SHA1

                                                        a55773b14d3350c6fdf9075dda3cba0f8d038247

                                                        SHA256

                                                        e27b73ea096a878a86c216f6903a35b06353f68379f9c9d000d9a32fe0d4def6

                                                        SHA512

                                                        a98bc0f24e22535bf59dee45e7aefbccd24ef9ee4bb9c866cb29653bda9bfe714405dabef18260b3209cd542f714df6e04c2d39478b0d22e98019a52b08b1649

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                        Filesize

                                                        16B

                                                        MD5

                                                        6752a1d65b201c13b62ea44016eb221f

                                                        SHA1

                                                        58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                        SHA256

                                                        0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                        SHA512

                                                        9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                        Filesize

                                                        10KB

                                                        MD5

                                                        1c0439b21d8965f3a8fb63eed5a1102a

                                                        SHA1

                                                        4122ede0e5207bfc5665e50632115ad6ce8a4878

                                                        SHA256

                                                        98231063ab32cd3db18a95e7c904f1887bd6033855ea73e95be8553dd57d29a8

                                                        SHA512

                                                        4f7468f4c39e20641dd7b99f68109ab3a1d1399ff38c62f149d14401b87d6abf897402200ef623beba23e3e7adf6383b318123507e1abbb430ea155d925a72e2

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                        Filesize

                                                        10KB

                                                        MD5

                                                        1c0439b21d8965f3a8fb63eed5a1102a

                                                        SHA1

                                                        4122ede0e5207bfc5665e50632115ad6ce8a4878

                                                        SHA256

                                                        98231063ab32cd3db18a95e7c904f1887bd6033855ea73e95be8553dd57d29a8

                                                        SHA512

                                                        4f7468f4c39e20641dd7b99f68109ab3a1d1399ff38c62f149d14401b87d6abf897402200ef623beba23e3e7adf6383b318123507e1abbb430ea155d925a72e2

                                                      • C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

                                                        Filesize

                                                        4.1MB

                                                        MD5

                                                        637f73095de9f62dc6fcfbe9b3f6d3d6

                                                        SHA1

                                                        708771d9413e7df69189d2a0c283ec72bd63d99e

                                                        SHA256

                                                        6a678e471f24d7560be7cda7a49a34b4f0c2cb279b779984e5f002be3dfacf1d

                                                        SHA512

                                                        00d4d05c7b894d4c52dcbc75d555c76f966defed1934747ffe4a29d8dc1b426fad021a02a5e221dd583ac86d67661a6b9cddde13ad1465546439f52ed567aeb5

                                                      • C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

                                                        Filesize

                                                        4.1MB

                                                        MD5

                                                        637f73095de9f62dc6fcfbe9b3f6d3d6

                                                        SHA1

                                                        708771d9413e7df69189d2a0c283ec72bd63d99e

                                                        SHA256

                                                        6a678e471f24d7560be7cda7a49a34b4f0c2cb279b779984e5f002be3dfacf1d

                                                        SHA512

                                                        00d4d05c7b894d4c52dcbc75d555c76f966defed1934747ffe4a29d8dc1b426fad021a02a5e221dd583ac86d67661a6b9cddde13ad1465546439f52ed567aeb5

                                                      • C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

                                                        Filesize

                                                        4.1MB

                                                        MD5

                                                        637f73095de9f62dc6fcfbe9b3f6d3d6

                                                        SHA1

                                                        708771d9413e7df69189d2a0c283ec72bd63d99e

                                                        SHA256

                                                        6a678e471f24d7560be7cda7a49a34b4f0c2cb279b779984e5f002be3dfacf1d

                                                        SHA512

                                                        00d4d05c7b894d4c52dcbc75d555c76f966defed1934747ffe4a29d8dc1b426fad021a02a5e221dd583ac86d67661a6b9cddde13ad1465546439f52ed567aeb5

                                                      • C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

                                                        Filesize

                                                        4.1MB

                                                        MD5

                                                        637f73095de9f62dc6fcfbe9b3f6d3d6

                                                        SHA1

                                                        708771d9413e7df69189d2a0c283ec72bd63d99e

                                                        SHA256

                                                        6a678e471f24d7560be7cda7a49a34b4f0c2cb279b779984e5f002be3dfacf1d

                                                        SHA512

                                                        00d4d05c7b894d4c52dcbc75d555c76f966defed1934747ffe4a29d8dc1b426fad021a02a5e221dd583ac86d67661a6b9cddde13ad1465546439f52ed567aeb5

                                                      • C:\Users\Admin\AppData\Local\Temp\8623.exe

                                                        Filesize

                                                        341KB

                                                        MD5

                                                        8669fe397a7225ede807202f6a9d8390

                                                        SHA1

                                                        04a806a5c4218cb703cba85d3e636d0c8cbae043

                                                        SHA256

                                                        1624a759791e49ce8f79dd249d3ac2aede589ffbe53db342e4c99e2fbbc1b90e

                                                        SHA512

                                                        29cad49434172a910ba7635058ecc02aacf43f648ee98b2c47c561332403a96847b5da817358095f7638295b238de8874bf34fb393670096bbf3caeb388a9c45

                                                      • C:\Users\Admin\AppData\Local\Temp\8623.exe

                                                        Filesize

                                                        341KB

                                                        MD5

                                                        8669fe397a7225ede807202f6a9d8390

                                                        SHA1

                                                        04a806a5c4218cb703cba85d3e636d0c8cbae043

                                                        SHA256

                                                        1624a759791e49ce8f79dd249d3ac2aede589ffbe53db342e4c99e2fbbc1b90e

                                                        SHA512

                                                        29cad49434172a910ba7635058ecc02aacf43f648ee98b2c47c561332403a96847b5da817358095f7638295b238de8874bf34fb393670096bbf3caeb388a9c45

                                                      • C:\Users\Admin\AppData\Local\Temp\87CA.exe

                                                        Filesize

                                                        412KB

                                                        MD5

                                                        5200fbe07521eb001f145afb95d40283

                                                        SHA1

                                                        df6cfdf15b58a0bb24255b3902886dc375f3346f

                                                        SHA256

                                                        00c3f29f9a8aec0774256501c562275e2d866f0130a2b8a58d74003c6c77e812

                                                        SHA512

                                                        c38359959ce1083f94d2206d1b4b317e8c5d493168013b4e8c406acb5a55fd4f85ec7ce4d5e400b9105fd82eae3d6301d52346f040a64c09981185c66f2cbf75

                                                      • C:\Users\Admin\AppData\Local\Temp\87CA.exe

                                                        Filesize

                                                        412KB

                                                        MD5

                                                        5200fbe07521eb001f145afb95d40283

                                                        SHA1

                                                        df6cfdf15b58a0bb24255b3902886dc375f3346f

                                                        SHA256

                                                        00c3f29f9a8aec0774256501c562275e2d866f0130a2b8a58d74003c6c77e812

                                                        SHA512

                                                        c38359959ce1083f94d2206d1b4b317e8c5d493168013b4e8c406acb5a55fd4f85ec7ce4d5e400b9105fd82eae3d6301d52346f040a64c09981185c66f2cbf75

                                                      • C:\Users\Admin\AppData\Local\Temp\8FBA.exe

                                                        Filesize

                                                        1.6MB

                                                        MD5

                                                        7d274ad84b931078f3673393c82db7f9

                                                        SHA1

                                                        66521bdbb10c9c57e6f9be39121c324b87fad1da

                                                        SHA256

                                                        c1e2f33e36ecdaf34a0669e9bcd1414a1fa3b4489db4f4af6ca7d6e236798110

                                                        SHA512

                                                        6c2300e961421f67d5d72dc42eb844298f33517667e0e36bc5ac761cad3da57178b20f106e57ddcac7dc59f2457bd2b20d40bf183834ebb4e9e1767a06666c31

                                                      • C:\Users\Admin\AppData\Local\Temp\8FBA.exe

                                                        Filesize

                                                        1.6MB

                                                        MD5

                                                        7d274ad84b931078f3673393c82db7f9

                                                        SHA1

                                                        66521bdbb10c9c57e6f9be39121c324b87fad1da

                                                        SHA256

                                                        c1e2f33e36ecdaf34a0669e9bcd1414a1fa3b4489db4f4af6ca7d6e236798110

                                                        SHA512

                                                        6c2300e961421f67d5d72dc42eb844298f33517667e0e36bc5ac761cad3da57178b20f106e57ddcac7dc59f2457bd2b20d40bf183834ebb4e9e1767a06666c31

                                                      • C:\Users\Admin\AppData\Local\Temp\90F3.bat

                                                        Filesize

                                                        79B

                                                        MD5

                                                        403991c4d18ac84521ba17f264fa79f2

                                                        SHA1

                                                        850cc068de0963854b0fe8f485d951072474fd45

                                                        SHA256

                                                        ef6e942aefe925fefac19fa816986ea25de6935c4f377c717e29b94e65f9019f

                                                        SHA512

                                                        a20aaa77065d30195e5893f2ff989979383c8d7f82d9e528d4833b1c1236aef4f85284f5250d0f190a174790b650280ffe1fbff7e00c98024ccf5ca746e5b576

                                                      • C:\Users\Admin\AppData\Local\Temp\9EDF.exe

                                                        Filesize

                                                        4.6MB

                                                        MD5

                                                        b32d5a382373d7df0c1fec9f15f0724a

                                                        SHA1

                                                        472fc4c27859f39e8b9a0bf784949f72944dc52b

                                                        SHA256

                                                        010fe481ba6275ebbf71e102e66d73f5d819252f2b4b1893d2acf53c04f4200f

                                                        SHA512

                                                        1320be23719f86e043beaeea8affa9ab125a68a1210f596c4424d4a5a2a9ef72eb572578897722842ad0586afe1d669ff816648ea3eeb3aa0b8379c9066da3a9

                                                      • C:\Users\Admin\AppData\Local\Temp\9EDF.exe

                                                        Filesize

                                                        4.6MB

                                                        MD5

                                                        b32d5a382373d7df0c1fec9f15f0724a

                                                        SHA1

                                                        472fc4c27859f39e8b9a0bf784949f72944dc52b

                                                        SHA256

                                                        010fe481ba6275ebbf71e102e66d73f5d819252f2b4b1893d2acf53c04f4200f

                                                        SHA512

                                                        1320be23719f86e043beaeea8affa9ab125a68a1210f596c4424d4a5a2a9ef72eb572578897722842ad0586afe1d669ff816648ea3eeb3aa0b8379c9066da3a9

                                                      • C:\Users\Admin\AppData\Local\Temp\ODX9Fs.KE

                                                        Filesize

                                                        1.4MB

                                                        MD5

                                                        df4c7378ffe26665a673aacd12926348

                                                        SHA1

                                                        3188efa5a477f960e0f975c3a007aefdbeeab5ea

                                                        SHA256

                                                        fe754138008fd4e3b5de5d923694de6ddc17d756c53030b8b163f60913f9462c

                                                        SHA512

                                                        904939de1a22adb848116a54cfcdf28f4f8af25cfd1239e88c76580eceffbd104012f85facb30f2bcc9f270f802397ec28cd44e50f230d6ce10a2d419c7e396a

                                                      • C:\Users\Admin\AppData\Local\Temp\OdX9Fs.KE

                                                        Filesize

                                                        1.4MB

                                                        MD5

                                                        df4c7378ffe26665a673aacd12926348

                                                        SHA1

                                                        3188efa5a477f960e0f975c3a007aefdbeeab5ea

                                                        SHA256

                                                        fe754138008fd4e3b5de5d923694de6ddc17d756c53030b8b163f60913f9462c

                                                        SHA512

                                                        904939de1a22adb848116a54cfcdf28f4f8af25cfd1239e88c76580eceffbd104012f85facb30f2bcc9f270f802397ec28cd44e50f230d6ce10a2d419c7e396a

                                                      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yp014ev5.nbm.ps1

                                                        Filesize

                                                        60B

                                                        MD5

                                                        d17fe0a3f47be24a6453e9ef58c94641

                                                        SHA1

                                                        6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                        SHA256

                                                        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                        SHA512

                                                        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                      • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

                                                        Filesize

                                                        281KB

                                                        MD5

                                                        d98e33b66343e7c96158444127a117f6

                                                        SHA1

                                                        bb716c5509a2bf345c6c1152f6e3e1452d39d50d

                                                        SHA256

                                                        5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

                                                        SHA512

                                                        705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

                                                      • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

                                                        Filesize

                                                        281KB

                                                        MD5

                                                        d98e33b66343e7c96158444127a117f6

                                                        SHA1

                                                        bb716c5509a2bf345c6c1152f6e3e1452d39d50d

                                                        SHA256

                                                        5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

                                                        SHA512

                                                        705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

                                                      • C:\Users\Admin\AppData\Local\Temp\ss41.exe

                                                        Filesize

                                                        298KB

                                                        MD5

                                                        8bd874c0500c7112d04cfad6fda75524

                                                        SHA1

                                                        d04a20e3bb7ffe5663f69c870457ad4edeb00192

                                                        SHA256

                                                        22aa36bd2f8ace8d959f22cf0e99bfe1d3fd655c075aa14a3232fb9e0f35adc2

                                                        SHA512

                                                        d6c43d5a5d1bfca1dddfb6283eafcd1f274e52812ccfee877298dfc74930fe6a8ec7035f95107600742ef19a630bee3ca3fab1fc7ab3ff717bea8f8c05e384d8

                                                      • C:\Users\Admin\AppData\Local\Temp\ss41.exe

                                                        Filesize

                                                        298KB

                                                        MD5

                                                        8bd874c0500c7112d04cfad6fda75524

                                                        SHA1

                                                        d04a20e3bb7ffe5663f69c870457ad4edeb00192

                                                        SHA256

                                                        22aa36bd2f8ace8d959f22cf0e99bfe1d3fd655c075aa14a3232fb9e0f35adc2

                                                        SHA512

                                                        d6c43d5a5d1bfca1dddfb6283eafcd1f274e52812ccfee877298dfc74930fe6a8ec7035f95107600742ef19a630bee3ca3fab1fc7ab3ff717bea8f8c05e384d8

                                                      • C:\Users\Admin\AppData\Local\Temp\ss41.exe

                                                        Filesize

                                                        298KB

                                                        MD5

                                                        8bd874c0500c7112d04cfad6fda75524

                                                        SHA1

                                                        d04a20e3bb7ffe5663f69c870457ad4edeb00192

                                                        SHA256

                                                        22aa36bd2f8ace8d959f22cf0e99bfe1d3fd655c075aa14a3232fb9e0f35adc2

                                                        SHA512

                                                        d6c43d5a5d1bfca1dddfb6283eafcd1f274e52812ccfee877298dfc74930fe6a8ec7035f95107600742ef19a630bee3ca3fab1fc7ab3ff717bea8f8c05e384d8

                                                      • C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

                                                        Filesize

                                                        227KB

                                                        MD5

                                                        fccd5785d54697b968ebe3c55641c4b3

                                                        SHA1

                                                        f3353f2cfb27100ea14ae6ad02a72f834694fbf3

                                                        SHA256

                                                        757568f5af7731014baf25b6941c179d14b2041d2aa8a43e482a942e99d86f82

                                                        SHA512

                                                        0360e3c3469219f6c13ab3bd0c47304c6bb1319463c4102433156400ebfbf468b88f9b469eeb01e78ed32021adb93d52e9dd410dcc9d44e5dbee67f9a51aed6d

                                                      • C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

                                                        Filesize

                                                        227KB

                                                        MD5

                                                        fccd5785d54697b968ebe3c55641c4b3

                                                        SHA1

                                                        f3353f2cfb27100ea14ae6ad02a72f834694fbf3

                                                        SHA256

                                                        757568f5af7731014baf25b6941c179d14b2041d2aa8a43e482a942e99d86f82

                                                        SHA512

                                                        0360e3c3469219f6c13ab3bd0c47304c6bb1319463c4102433156400ebfbf468b88f9b469eeb01e78ed32021adb93d52e9dd410dcc9d44e5dbee67f9a51aed6d

                                                      • C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

                                                        Filesize

                                                        227KB

                                                        MD5

                                                        fccd5785d54697b968ebe3c55641c4b3

                                                        SHA1

                                                        f3353f2cfb27100ea14ae6ad02a72f834694fbf3

                                                        SHA256

                                                        757568f5af7731014baf25b6941c179d14b2041d2aa8a43e482a942e99d86f82

                                                        SHA512

                                                        0360e3c3469219f6c13ab3bd0c47304c6bb1319463c4102433156400ebfbf468b88f9b469eeb01e78ed32021adb93d52e9dd410dcc9d44e5dbee67f9a51aed6d

                                                      • C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

                                                        Filesize

                                                        227KB

                                                        MD5

                                                        fccd5785d54697b968ebe3c55641c4b3

                                                        SHA1

                                                        f3353f2cfb27100ea14ae6ad02a72f834694fbf3

                                                        SHA256

                                                        757568f5af7731014baf25b6941c179d14b2041d2aa8a43e482a942e99d86f82

                                                        SHA512

                                                        0360e3c3469219f6c13ab3bd0c47304c6bb1319463c4102433156400ebfbf468b88f9b469eeb01e78ed32021adb93d52e9dd410dcc9d44e5dbee67f9a51aed6d

                                                      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                        Filesize

                                                        2KB

                                                        MD5

                                                        968cb9309758126772781b83adb8a28f

                                                        SHA1

                                                        8da30e71accf186b2ba11da1797cf67f8f78b47c

                                                        SHA256

                                                        92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

                                                        SHA512

                                                        4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

                                                      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                                                        Filesize

                                                        19KB

                                                        MD5

                                                        e1af3c135695958bf72676ec8411d98a

                                                        SHA1

                                                        abcdba1e399a971992a1bd2da6d510a1117ee693

                                                        SHA256

                                                        8a338e8d02fc0c100bf62c3a86851b4a314cdc2fef874c1ae69f1ae6bc0e2035

                                                        SHA512

                                                        744dc62d12d52cf238baf321ebb206c2c8df6079b851981306ec8ace3030c48eb29312cb694cc11888f9c75b6187ecb3563eaf2c284cea6c8634d56979075637

                                                      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                                                        Filesize

                                                        19KB

                                                        MD5

                                                        69597370a1a88ee4aa3754873ea5a8e7

                                                        SHA1

                                                        e5913b2ac304dc677cd4df17aecbb585161a26e1

                                                        SHA256

                                                        58d193016171bd079a6b5e4a31006990e239f378c49c65882a2b5412a308adea

                                                        SHA512

                                                        35a31337f7358524801c1213da5ca6ee21affc2c6819e7060ff7168d5b04ffd44a5c35f1c8b19bb36e1015aa2d33084a7dc2a5331d56177abd1d8763a58dd710

                                                      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                                                        Filesize

                                                        19KB

                                                        MD5

                                                        cecccf9ca5716c2eb7a4b823a92017ef

                                                        SHA1

                                                        4ad3a1772323f72d9faf812142120743dcc29a40

                                                        SHA256

                                                        7219bbecec5113765521006fd019f35ab8f0622cf1a1177788e199f917c96a90

                                                        SHA512

                                                        88ab918863f6897d43559b5cc601aba36249e9081b3854de73e8a87677a2072d91b38c31c6367767f790a66cb9ae35c5233895a288c0aa7d9cd03547e77db051

                                                      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                                                        Filesize

                                                        19KB

                                                        MD5

                                                        9ad8673aa08b773d2985e927615ce84e

                                                        SHA1

                                                        e87b1c0aa18853f1208668617ede5267f344f2e1

                                                        SHA256

                                                        139dc28fea096bbabc1b4af689a1c918808ebda1ca16dbae6e16094787f8c6bc

                                                        SHA512

                                                        c029f806ab14f720eb65957d72c95105ecd853fd74890f4f48d0e5342eeaed74456af8b2abe7669ab1390e1a45e6df58e03bf23ed4cc4ce7ed9d9dd0a6567b7c

                                                      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                                                        Filesize

                                                        19KB

                                                        MD5

                                                        f340c8c7f6f38fc1ad49d9531ab4d36e

                                                        SHA1

                                                        4453bc71f6af1373b79dc631bfea4c70eec53d8f

                                                        SHA256

                                                        6787ffeb5dc5438f80630879be586f9f3e0a0d721353fa1fb6440a2fb3da7d36

                                                        SHA512

                                                        dc5c3deb572715d2b8b35b9f5909d4e583f1de2860859d0cc73f6c52847681d9340a42ebddaecc384ef00f0dba7bdd0701cd83e5bf680cd31859a47d1fab01f8

                                                      • C:\Windows\rss\csrss.exe

                                                        Filesize

                                                        4.1MB

                                                        MD5

                                                        637f73095de9f62dc6fcfbe9b3f6d3d6

                                                        SHA1

                                                        708771d9413e7df69189d2a0c283ec72bd63d99e

                                                        SHA256

                                                        6a678e471f24d7560be7cda7a49a34b4f0c2cb279b779984e5f002be3dfacf1d

                                                        SHA512

                                                        00d4d05c7b894d4c52dcbc75d555c76f966defed1934747ffe4a29d8dc1b426fad021a02a5e221dd583ac86d67661a6b9cddde13ad1465546439f52ed567aeb5

                                                      • C:\Windows\rss\csrss.exe

                                                        Filesize

                                                        4.1MB

                                                        MD5

                                                        637f73095de9f62dc6fcfbe9b3f6d3d6

                                                        SHA1

                                                        708771d9413e7df69189d2a0c283ec72bd63d99e

                                                        SHA256

                                                        6a678e471f24d7560be7cda7a49a34b4f0c2cb279b779984e5f002be3dfacf1d

                                                        SHA512

                                                        00d4d05c7b894d4c52dcbc75d555c76f966defed1934747ffe4a29d8dc1b426fad021a02a5e221dd583ac86d67661a6b9cddde13ad1465546439f52ed567aeb5

                                                      • memory/680-165-0x0000000002BB0000-0x0000000002C95000-memory.dmp

                                                        Filesize

                                                        916KB

                                                      • memory/680-146-0x0000000002800000-0x00000000028FE000-memory.dmp

                                                        Filesize

                                                        1016KB

                                                      • memory/680-47-0x00000000010C0000-0x00000000010C6000-memory.dmp

                                                        Filesize

                                                        24KB

                                                      • memory/680-48-0x0000000010000000-0x0000000010164000-memory.dmp

                                                        Filesize

                                                        1.4MB

                                                      • memory/680-167-0x0000000002BB0000-0x0000000002C95000-memory.dmp

                                                        Filesize

                                                        916KB

                                                      • memory/680-161-0x0000000002BB0000-0x0000000002C95000-memory.dmp

                                                        Filesize

                                                        916KB

                                                      • memory/1124-43-0x00000000028E0000-0x00000000028E6000-memory.dmp

                                                        Filesize

                                                        24KB

                                                      • memory/1124-160-0x00000000088A0000-0x0000000008DCC000-memory.dmp

                                                        Filesize

                                                        5.2MB

                                                      • memory/1124-51-0x00000000028F0000-0x0000000002900000-memory.dmp

                                                        Filesize

                                                        64KB

                                                      • memory/1124-38-0x00000000005B0000-0x00000000005E0000-memory.dmp

                                                        Filesize

                                                        192KB

                                                      • memory/1124-166-0x00000000028F0000-0x0000000002900000-memory.dmp

                                                        Filesize

                                                        64KB

                                                      • memory/1124-341-0x00000000743C0000-0x0000000074B70000-memory.dmp

                                                        Filesize

                                                        7.7MB

                                                      • memory/1124-336-0x0000000008850000-0x00000000088A0000-memory.dmp

                                                        Filesize

                                                        320KB

                                                      • memory/1124-148-0x00000000743C0000-0x0000000074B70000-memory.dmp

                                                        Filesize

                                                        7.7MB

                                                      • memory/1124-151-0x0000000005350000-0x00000000053C6000-memory.dmp

                                                        Filesize

                                                        472KB

                                                      • memory/1124-44-0x00000000743C0000-0x0000000074B70000-memory.dmp

                                                        Filesize

                                                        7.7MB

                                                      • memory/1124-156-0x0000000006430000-0x00000000065F2000-memory.dmp

                                                        Filesize

                                                        1.8MB

                                                      • memory/1400-134-0x0000000000970000-0x0000000000979000-memory.dmp

                                                        Filesize

                                                        36KB

                                                      • memory/1400-132-0x0000000000990000-0x0000000000A90000-memory.dmp

                                                        Filesize

                                                        1024KB

                                                      • memory/1560-136-0x0000000000400000-0x0000000000409000-memory.dmp

                                                        Filesize

                                                        36KB

                                                      • memory/1560-131-0x0000000000400000-0x0000000000409000-memory.dmp

                                                        Filesize

                                                        36KB

                                                      • memory/1560-179-0x0000000000400000-0x0000000000409000-memory.dmp

                                                        Filesize

                                                        36KB

                                                      • memory/1592-4-0x0000000000400000-0x0000000000409000-memory.dmp

                                                        Filesize

                                                        36KB

                                                      • memory/1592-1-0x0000000000400000-0x0000000000409000-memory.dmp

                                                        Filesize

                                                        36KB

                                                      • memory/1592-0-0x0000000000400000-0x0000000000409000-memory.dmp

                                                        Filesize

                                                        36KB

                                                      • memory/2292-108-0x00007FF71C8F0000-0x00007FF71C93E000-memory.dmp

                                                        Filesize

                                                        312KB

                                                      • memory/2292-176-0x0000000003150000-0x00000000032C1000-memory.dmp

                                                        Filesize

                                                        1.4MB

                                                      • memory/2292-178-0x00000000032D0000-0x0000000003401000-memory.dmp

                                                        Filesize

                                                        1.2MB

                                                      • memory/2292-342-0x00000000032D0000-0x0000000003401000-memory.dmp

                                                        Filesize

                                                        1.2MB

                                                      • memory/2660-21-0x0000000007700000-0x0000000007710000-memory.dmp

                                                        Filesize

                                                        64KB

                                                      • memory/2660-26-0x0000000007A20000-0x0000000007A5C000-memory.dmp

                                                        Filesize

                                                        240KB

                                                      • memory/2660-24-0x00000000079C0000-0x00000000079D2000-memory.dmp

                                                        Filesize

                                                        72KB

                                                      • memory/2660-130-0x00000000743C0000-0x0000000074B70000-memory.dmp

                                                        Filesize

                                                        7.7MB

                                                      • memory/2660-27-0x0000000007A60000-0x0000000007AAC000-memory.dmp

                                                        Filesize

                                                        304KB

                                                      • memory/2660-23-0x00000000087F0000-0x0000000008E08000-memory.dmp

                                                        Filesize

                                                        6.1MB

                                                      • memory/2660-22-0x0000000007800000-0x000000000780A000-memory.dmp

                                                        Filesize

                                                        40KB

                                                      • memory/2660-13-0x00000000743C0000-0x0000000074B70000-memory.dmp

                                                        Filesize

                                                        7.7MB

                                                      • memory/2660-359-0x00000000743C0000-0x0000000074B70000-memory.dmp

                                                        Filesize

                                                        7.7MB

                                                      • memory/2660-162-0x000000000A9E0000-0x000000000A9FE000-memory.dmp

                                                        Filesize

                                                        120KB

                                                      • memory/2660-138-0x0000000007700000-0x0000000007710000-memory.dmp

                                                        Filesize

                                                        64KB

                                                      • memory/2660-25-0x0000000007AF0000-0x0000000007BFA000-memory.dmp

                                                        Filesize

                                                        1.0MB

                                                      • memory/2660-50-0x0000000008300000-0x0000000008366000-memory.dmp

                                                        Filesize

                                                        408KB

                                                      • memory/2660-20-0x0000000007730000-0x00000000077C2000-memory.dmp

                                                        Filesize

                                                        584KB

                                                      • memory/2660-19-0x0000000007C20000-0x00000000081C4000-memory.dmp

                                                        Filesize

                                                        5.6MB

                                                      • memory/2660-15-0x0000000000820000-0x000000000087A000-memory.dmp

                                                        Filesize

                                                        360KB

                                                      • memory/2792-314-0x0000000002950000-0x0000000002D51000-memory.dmp

                                                        Filesize

                                                        4.0MB

                                                      • memory/2792-145-0x0000000002950000-0x0000000002D51000-memory.dmp

                                                        Filesize

                                                        4.0MB

                                                      • memory/2792-377-0x0000000000400000-0x0000000000D1B000-memory.dmp

                                                        Filesize

                                                        9.1MB

                                                      • memory/2792-331-0x0000000000400000-0x0000000000D1B000-memory.dmp

                                                        Filesize

                                                        9.1MB

                                                      • memory/2792-147-0x0000000002D60000-0x000000000364B000-memory.dmp

                                                        Filesize

                                                        8.9MB

                                                      • memory/2792-152-0x0000000000400000-0x0000000000D1B000-memory.dmp

                                                        Filesize

                                                        9.1MB

                                                      • memory/2792-332-0x0000000002D60000-0x000000000364B000-memory.dmp

                                                        Filesize

                                                        8.9MB

                                                      • memory/3212-2-0x0000000002190000-0x00000000021A6000-memory.dmp

                                                        Filesize

                                                        88KB

                                                      • memory/3212-177-0x00000000026C0000-0x00000000026D6000-memory.dmp

                                                        Filesize

                                                        88KB

                                                      • memory/4148-562-0x0000000000400000-0x0000000000D1B000-memory.dmp

                                                        Filesize

                                                        9.1MB

                                                      • memory/4148-586-0x0000000000400000-0x0000000000D1B000-memory.dmp

                                                        Filesize

                                                        9.1MB

                                                      • memory/4148-588-0x0000000000400000-0x0000000000D1B000-memory.dmp

                                                        Filesize

                                                        9.1MB

                                                      • memory/4148-590-0x0000000000400000-0x0000000000D1B000-memory.dmp

                                                        Filesize

                                                        9.1MB

                                                      • memory/5192-432-0x0000000000400000-0x0000000000D1B000-memory.dmp

                                                        Filesize

                                                        9.1MB

                                                      • memory/5192-480-0x0000000000400000-0x0000000000D1B000-memory.dmp

                                                        Filesize

                                                        9.1MB

                                                      • memory/5848-324-0x0000000005BD0000-0x0000000005BF2000-memory.dmp

                                                        Filesize

                                                        136KB

                                                      • memory/5848-360-0x0000000007B30000-0x0000000007B3A000-memory.dmp

                                                        Filesize

                                                        40KB

                                                      • memory/5848-361-0x00000000743C0000-0x0000000074B70000-memory.dmp

                                                        Filesize

                                                        7.7MB

                                                      • memory/5848-362-0x0000000007C40000-0x0000000007CD6000-memory.dmp

                                                        Filesize

                                                        600KB

                                                      • memory/5848-363-0x0000000007B40000-0x0000000007B51000-memory.dmp

                                                        Filesize

                                                        68KB

                                                      • memory/5848-358-0x0000000007A50000-0x0000000007AF3000-memory.dmp

                                                        Filesize

                                                        652KB

                                                      • memory/5848-356-0x00000000079F0000-0x0000000007A0E000-memory.dmp

                                                        Filesize

                                                        120KB

                                                      • memory/5848-346-0x000000006F810000-0x000000006FB64000-memory.dmp

                                                        Filesize

                                                        3.3MB

                                                      • memory/5848-345-0x0000000070840000-0x000000007088C000-memory.dmp

                                                        Filesize

                                                        304KB

                                                      • memory/5848-344-0x0000000007A10000-0x0000000007A42000-memory.dmp

                                                        Filesize

                                                        200KB

                                                      • memory/5848-343-0x000000007F260000-0x000000007F270000-memory.dmp

                                                        Filesize

                                                        64KB

                                                      • memory/5848-338-0x0000000007840000-0x000000000785A000-memory.dmp

                                                        Filesize

                                                        104KB

                                                      • memory/5848-337-0x0000000007EA0000-0x000000000851A000-memory.dmp

                                                        Filesize

                                                        6.5MB

                                                      • memory/5848-335-0x0000000004F10000-0x0000000004F20000-memory.dmp

                                                        Filesize

                                                        64KB

                                                      • memory/5848-334-0x00000000069E0000-0x0000000006A24000-memory.dmp

                                                        Filesize

                                                        272KB

                                                      • memory/5848-333-0x0000000006470000-0x000000000648E000-memory.dmp

                                                        Filesize

                                                        120KB

                                                      • memory/5848-330-0x0000000006070000-0x00000000063C4000-memory.dmp

                                                        Filesize

                                                        3.3MB

                                                      • memory/5848-329-0x0000000005D70000-0x0000000005DD6000-memory.dmp

                                                        Filesize

                                                        408KB

                                                      • memory/5848-318-0x0000000005550000-0x0000000005B78000-memory.dmp

                                                        Filesize

                                                        6.2MB

                                                      • memory/5848-315-0x0000000004F10000-0x0000000004F20000-memory.dmp

                                                        Filesize

                                                        64KB

                                                      • memory/5848-313-0x0000000004F10000-0x0000000004F20000-memory.dmp

                                                        Filesize

                                                        64KB

                                                      • memory/5848-312-0x00000000743C0000-0x0000000074B70000-memory.dmp

                                                        Filesize

                                                        7.7MB

                                                      • memory/5848-311-0x0000000004E90000-0x0000000004EC6000-memory.dmp

                                                        Filesize

                                                        216KB