Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-1703_x64 -
resource
win10-20230915-en -
resource tags
arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system -
submitted
01-10-2023 12:15
Static task
static1
Behavioral task
behavioral1
Sample
60b2c0f0bed64270fb7928882bb5823c892c49591980c6daa973f682e48506c0.exe
Resource
win10-20230915-en
General
-
Target
60b2c0f0bed64270fb7928882bb5823c892c49591980c6daa973f682e48506c0.exe
-
Size
194KB
-
MD5
c9120d1ff73f3997246cdc11fedba08b
-
SHA1
3efd656d91b4b22295b3a58257b3e5bc684f87b6
-
SHA256
60b2c0f0bed64270fb7928882bb5823c892c49591980c6daa973f682e48506c0
-
SHA512
7e30ee0f38f454879326bd04fce5357d8b0e3fe584c79d103b5684ea0b34836547bc80aa9851c17e3efc092337473c9fc06ba300e05c2273cc025d0933cf04ba
-
SSDEEP
3072:0v2B8/x/rq24bCK6NjJHhIGBgB09I6HYmbpHYASMG68KxZ5NHfPdPgY/BQDC13wo:3B8h4bFej0GBgaIcba2t8IVPm0WTRX6
Malware Config
Extracted
smokeloader
2022
http://77.91.68.29/fks/
Extracted
redline
lada
77.91.124.55:19071
Extracted
amadey
3.89
http://77.91.124.1/theme/index.php
-
install_dir
fefffe8cea
-
install_file
explothe.exe
-
strings_key
36a96139c1118a354edf72b1080d4b2f
Extracted
smokeloader
up3
Extracted
redline
@ytlogsbot
176.123.4.46:33783
-
auth_value
295b226f1b63bcd55148625381b27b19
Extracted
smokeloader
2020
http://host-file-host6.com/
http://host-host-file8.com/
Extracted
fabookie
http://app.nnnaajjjgc.com/check/safe
Signatures
-
DcRat 4 IoCs
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
Processes:
schtasks.exeschtasks.exeschtasks.exeAppLaunch.exepid process 4904 schtasks.exe 4156 schtasks.exe 3996 schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe -
Detect Fabookie payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1108-330-0x00000000036B0000-0x00000000037E1000-memory.dmp family_fabookie behavioral1/memory/1108-900-0x00000000036B0000-0x00000000037E1000-memory.dmp family_fabookie -
Detects Healer an antivirus disabler dropper 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\EA73.exe healer behavioral1/memory/2092-80-0x00000000009E0000-0x00000000009EA000-memory.dmp healer C:\Users\Admin\AppData\Local\Temp\EA73.exe healer -
Glupteba payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/4120-204-0x0000000004B40000-0x000000000542B000-memory.dmp family_glupteba behavioral1/memory/4120-216-0x0000000000400000-0x000000000298D000-memory.dmp family_glupteba behavioral1/memory/4120-343-0x0000000000400000-0x000000000298D000-memory.dmp family_glupteba -
Processes:
EA73.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" EA73.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" EA73.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" EA73.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" EA73.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" EA73.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1620-86-0x0000000000400000-0x000000000043E000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Processes:
31839b57a4f11171d6abc8bbc4451ee4.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\31839b57a4f11171d6abc8bbc4451ee4.exe = "0" 31839b57a4f11171d6abc8bbc4451ee4.exe -
Downloads MZ/PE file
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
cmd.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000\Control Panel\International\Geo\Nation cmd.exe -
Executes dropped EXE 30 IoCs
Processes:
E251.exex9435037.exex7886351.exeE456.exex4902647.exex4718039.exeg8315913.exeE959.exeEA73.exeEC97.exeexplothe.exeFFB4.exess41.exetoolspub2.exe31839b57a4f11171d6abc8bbc4451ee4.exetoolspub2.exe562.exekos1.exeset16.exeis-KKEUM.tmpkos.exepreviewer.exepreviewer.exe31839b57a4f11171d6abc8bbc4451ee4.exeexplothe.execsrss.exeinjector.exewindefender.exewindefender.exeexplothe.exepid process 4632 E251.exe 3564 x9435037.exe 3204 x7886351.exe 3872 E456.exe 4328 x4902647.exe 4648 x4718039.exe 1800 g8315913.exe 1544 E959.exe 2092 EA73.exe 4628 EC97.exe 4352 explothe.exe 4940 FFB4.exe 1108 ss41.exe 1916 toolspub2.exe 4120 31839b57a4f11171d6abc8bbc4451ee4.exe 1484 toolspub2.exe 5108 562.exe 2104 kos1.exe 3920 set16.exe 4824 is-KKEUM.tmp 5316 kos.exe 5504 previewer.exe 5724 previewer.exe 5568 31839b57a4f11171d6abc8bbc4451ee4.exe 6036 explothe.exe 5228 csrss.exe 4460 injector.exe 5756 windefender.exe 6016 windefender.exe 1956 explothe.exe -
Loads dropped DLL 4 IoCs
Processes:
is-KKEUM.tmprundll32.exepid process 4824 is-KKEUM.tmp 4824 is-KKEUM.tmp 4824 is-KKEUM.tmp 6024 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Uses the VBS compiler for execution 1 TTPs
-
Processes:
31839b57a4f11171d6abc8bbc4451ee4.exeEA73.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\31839b57a4f11171d6abc8bbc4451ee4.exe = "0" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" EA73.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0" 31839b57a4f11171d6abc8bbc4451ee4.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 7 IoCs
Processes:
E251.exex9435037.exex7886351.exex4902647.exex4718039.exe31839b57a4f11171d6abc8bbc4451ee4.execsrss.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" E251.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" x9435037.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" x7886351.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" x4902647.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" x4718039.exe Set value (str) \REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
Processes:
csrss.exedescription ioc process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 7 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Suspicious use of SetThreadContext 6 IoCs
Processes:
60b2c0f0bed64270fb7928882bb5823c892c49591980c6daa973f682e48506c0.exeE456.exeg8315913.exeE959.exetoolspub2.exe562.exedescription pid process target process PID 3104 set thread context of 2100 3104 60b2c0f0bed64270fb7928882bb5823c892c49591980c6daa973f682e48506c0.exe AppLaunch.exe PID 3872 set thread context of 4024 3872 E456.exe AppLaunch.exe PID 1800 set thread context of 2188 1800 g8315913.exe AppLaunch.exe PID 1544 set thread context of 1620 1544 E959.exe AppLaunch.exe PID 1916 set thread context of 1484 1916 toolspub2.exe toolspub2.exe PID 5108 set thread context of 4540 5108 562.exe vbc.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
Processes:
31839b57a4f11171d6abc8bbc4451ee4.exedescription ioc process File opened (read-only) \??\VBoxMiniRdrDN 31839b57a4f11171d6abc8bbc4451ee4.exe -
Drops file in Program Files directory 7 IoCs
Processes:
is-KKEUM.tmpdescription ioc process File opened for modification C:\Program Files (x86)\PA Previewer\previewer.exe is-KKEUM.tmp File created C:\Program Files (x86)\PA Previewer\unins000.dat is-KKEUM.tmp File created C:\Program Files (x86)\PA Previewer\is-KVSN7.tmp is-KKEUM.tmp File created C:\Program Files (x86)\PA Previewer\is-LTF5F.tmp is-KKEUM.tmp File created C:\Program Files (x86)\PA Previewer\is-OATR0.tmp is-KKEUM.tmp File created C:\Program Files (x86)\PA Previewer\is-U4BDT.tmp is-KKEUM.tmp File opened for modification C:\Program Files (x86)\PA Previewer\unins000.dat is-KKEUM.tmp -
Drops file in Windows directory 13 IoCs
Processes:
MicrosoftEdgeCP.exe31839b57a4f11171d6abc8bbc4451ee4.execsrss.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exedescription ioc process File created C:\Windows\rescache\_merged\3720402701\2219095117.pri MicrosoftEdgeCP.exe File created C:\Windows\rss\csrss.exe 31839b57a4f11171d6abc8bbc4451ee4.exe File created C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\windefender.exe csrss.exe File created C:\Windows\rescache\_merged\3720402701\2219095117.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\2219095117.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\2219095117.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\2219095117.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\2219095117.pri MicrosoftEdgeCP.exe File opened for modification C:\Windows\rss 31839b57a4f11171d6abc8bbc4451ee4.exe File created C:\Windows\rescache\_merged\3720402701\2219095117.pri MicrosoftEdge.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File created C:\Windows\rescache\_merged\3720402701\2219095117.pri MicrosoftEdgeCP.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 4628 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 4 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 424 3104 WerFault.exe 60b2c0f0bed64270fb7928882bb5823c892c49591980c6daa973f682e48506c0.exe 236 3872 WerFault.exe E456.exe 3496 1800 WerFault.exe g8315913.exe 212 2188 WerFault.exe AppLaunch.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
toolspub2.exeAppLaunch.exedescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspub2.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspub2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspub2.exe -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 4156 schtasks.exe 3996 schtasks.exe 4904 schtasks.exe -
Processes:
browser_broker.exeMicrosoftEdgeCP.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
31839b57a4f11171d6abc8bbc4451ee4.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-151 = "Central America Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1912 = "Russia TZ 10 Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-391 = "Arab Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-282 = "Central Europe Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-911 = "Mauritius Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2061 = "North Korea Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-842 = "Argentina Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1472 = "Magadan Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-532 = "Sri Lanka Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1021 = "Bangladesh Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2062 = "North Korea Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-222 = "Alaskan Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2322 = "Sakhalin Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-742 = "New Zealand Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-91 = "Pacific SA Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-731 = "Fiji Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2002 = "Cabo Verde Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-681 = "E. Australia Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-12 = "Azores Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-242 = "Samoa Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-161 = "Central Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-432 = "Iran Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-452 = "Caucasus Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-215 = "Pacific Standard Time (Mexico)" 31839b57a4f11171d6abc8bbc4451ee4.exe -
Modifies registry class 64 IoCs
Processes:
MicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CacheLimit = "1" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\FileNames\en-US = "en-US.1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = 01000000fc6efd5ace419d8d4ed536e2c1f62e6a84fe671f42a3083dfb80337ed183bcb644a7747af5b80283d00f255b5e32e18c053f40c2aae150f531e2 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\FileNames\ MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\"" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\Certificates MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\NextUpdateDate = "402976139" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Extensible Cache MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 8a48f33061f4d901 MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\Next Rating Prompt = b022f5971c1bda01 MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$http://www.typepad.com/ MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "395205405" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\CRLs MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies\CacheLimit = "1" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\NextUpdateDate = "402944148" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\FileVersion = "2016061511" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\Certificates MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3 MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer\Main\OperationalData = "1" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory\NextBrowserDataLogTime = 60a9fe7a93f4d901 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\Rating Prompt Shown = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$MediaWiki MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$WordPress MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "268435456" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 0000000000000000 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CacheLimit = "1" MicrosoftEdgeCP.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
AppLaunch.exepid process 2100 AppLaunch.exe 2100 AppLaunch.exe 3220 3220 3220 3220 3220 3220 3220 3220 3220 3220 3220 3220 3220 3220 3220 3220 3220 3220 3220 3220 3220 3220 3220 3220 3220 3220 3220 3220 3220 3220 3220 3220 3220 3220 3220 3220 3220 3220 3220 3220 3220 3220 3220 3220 3220 3220 3220 3220 3220 3220 3220 3220 3220 3220 3220 3220 3220 3220 3220 3220 3220 3220 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3220 -
Suspicious behavior: MapViewOfSection 14 IoCs
Processes:
AppLaunch.exeMicrosoftEdgeCP.exetoolspub2.exepid process 2100 AppLaunch.exe 760 MicrosoftEdgeCP.exe 760 MicrosoftEdgeCP.exe 1484 toolspub2.exe 760 MicrosoftEdgeCP.exe 760 MicrosoftEdgeCP.exe 760 MicrosoftEdgeCP.exe 760 MicrosoftEdgeCP.exe 760 MicrosoftEdgeCP.exe 760 MicrosoftEdgeCP.exe 760 MicrosoftEdgeCP.exe 760 MicrosoftEdgeCP.exe 760 MicrosoftEdgeCP.exe 760 MicrosoftEdgeCP.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
EA73.exeMicrosoftEdgeCP.exekos.exedescription pid process Token: SeShutdownPrivilege 3220 Token: SeCreatePagefilePrivilege 3220 Token: SeShutdownPrivilege 3220 Token: SeCreatePagefilePrivilege 3220 Token: SeShutdownPrivilege 3220 Token: SeCreatePagefilePrivilege 3220 Token: SeShutdownPrivilege 3220 Token: SeCreatePagefilePrivilege 3220 Token: SeShutdownPrivilege 3220 Token: SeCreatePagefilePrivilege 3220 Token: SeShutdownPrivilege 3220 Token: SeCreatePagefilePrivilege 3220 Token: SeShutdownPrivilege 3220 Token: SeCreatePagefilePrivilege 3220 Token: SeShutdownPrivilege 3220 Token: SeCreatePagefilePrivilege 3220 Token: SeShutdownPrivilege 3220 Token: SeCreatePagefilePrivilege 3220 Token: SeShutdownPrivilege 3220 Token: SeCreatePagefilePrivilege 3220 Token: SeShutdownPrivilege 3220 Token: SeCreatePagefilePrivilege 3220 Token: SeShutdownPrivilege 3220 Token: SeCreatePagefilePrivilege 3220 Token: SeShutdownPrivilege 3220 Token: SeCreatePagefilePrivilege 3220 Token: SeDebugPrivilege 2092 EA73.exe Token: SeShutdownPrivilege 3220 Token: SeCreatePagefilePrivilege 3220 Token: SeShutdownPrivilege 3220 Token: SeCreatePagefilePrivilege 3220 Token: SeShutdownPrivilege 3220 Token: SeCreatePagefilePrivilege 3220 Token: SeShutdownPrivilege 3220 Token: SeCreatePagefilePrivilege 3220 Token: SeDebugPrivilege 220 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 220 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 220 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 220 MicrosoftEdgeCP.exe Token: SeShutdownPrivilege 3220 Token: SeCreatePagefilePrivilege 3220 Token: SeShutdownPrivilege 3220 Token: SeCreatePagefilePrivilege 3220 Token: SeShutdownPrivilege 3220 Token: SeCreatePagefilePrivilege 3220 Token: SeShutdownPrivilege 3220 Token: SeCreatePagefilePrivilege 3220 Token: SeShutdownPrivilege 3220 Token: SeCreatePagefilePrivilege 3220 Token: SeShutdownPrivilege 3220 Token: SeCreatePagefilePrivilege 3220 Token: SeShutdownPrivilege 3220 Token: SeCreatePagefilePrivilege 3220 Token: SeShutdownPrivilege 3220 Token: SeCreatePagefilePrivilege 3220 Token: SeShutdownPrivilege 3220 Token: SeCreatePagefilePrivilege 3220 Token: SeShutdownPrivilege 3220 Token: SeCreatePagefilePrivilege 3220 Token: SeShutdownPrivilege 3220 Token: SeCreatePagefilePrivilege 3220 Token: SeDebugPrivilege 5316 kos.exe Token: SeShutdownPrivilege 3220 Token: SeCreatePagefilePrivilege 3220 -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exepid process 3940 MicrosoftEdge.exe 760 MicrosoftEdgeCP.exe 220 MicrosoftEdgeCP.exe 760 MicrosoftEdgeCP.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
60b2c0f0bed64270fb7928882bb5823c892c49591980c6daa973f682e48506c0.exeE251.exex9435037.exex7886351.exex4902647.exex4718039.exeE456.exeg8315913.exeE959.exedescription pid process target process PID 3104 wrote to memory of 2100 3104 60b2c0f0bed64270fb7928882bb5823c892c49591980c6daa973f682e48506c0.exe AppLaunch.exe PID 3104 wrote to memory of 2100 3104 60b2c0f0bed64270fb7928882bb5823c892c49591980c6daa973f682e48506c0.exe AppLaunch.exe PID 3104 wrote to memory of 2100 3104 60b2c0f0bed64270fb7928882bb5823c892c49591980c6daa973f682e48506c0.exe AppLaunch.exe PID 3104 wrote to memory of 2100 3104 60b2c0f0bed64270fb7928882bb5823c892c49591980c6daa973f682e48506c0.exe AppLaunch.exe PID 3104 wrote to memory of 2100 3104 60b2c0f0bed64270fb7928882bb5823c892c49591980c6daa973f682e48506c0.exe AppLaunch.exe PID 3104 wrote to memory of 2100 3104 60b2c0f0bed64270fb7928882bb5823c892c49591980c6daa973f682e48506c0.exe AppLaunch.exe PID 3220 wrote to memory of 4632 3220 E251.exe PID 3220 wrote to memory of 4632 3220 E251.exe PID 3220 wrote to memory of 4632 3220 E251.exe PID 4632 wrote to memory of 3564 4632 E251.exe x9435037.exe PID 4632 wrote to memory of 3564 4632 E251.exe x9435037.exe PID 4632 wrote to memory of 3564 4632 E251.exe x9435037.exe PID 3564 wrote to memory of 3204 3564 x9435037.exe x7886351.exe PID 3564 wrote to memory of 3204 3564 x9435037.exe x7886351.exe PID 3564 wrote to memory of 3204 3564 x9435037.exe x7886351.exe PID 3220 wrote to memory of 3872 3220 E456.exe PID 3220 wrote to memory of 3872 3220 E456.exe PID 3220 wrote to memory of 3872 3220 E456.exe PID 3204 wrote to memory of 4328 3204 x7886351.exe x4902647.exe PID 3204 wrote to memory of 4328 3204 x7886351.exe x4902647.exe PID 3204 wrote to memory of 4328 3204 x7886351.exe x4902647.exe PID 4328 wrote to memory of 4648 4328 x4902647.exe x4718039.exe PID 4328 wrote to memory of 4648 4328 x4902647.exe x4718039.exe PID 4328 wrote to memory of 4648 4328 x4902647.exe x4718039.exe PID 4648 wrote to memory of 1800 4648 x4718039.exe g8315913.exe PID 4648 wrote to memory of 1800 4648 x4718039.exe g8315913.exe PID 4648 wrote to memory of 1800 4648 x4718039.exe g8315913.exe PID 3220 wrote to memory of 656 3220 cmd.exe PID 3220 wrote to memory of 656 3220 cmd.exe PID 3872 wrote to memory of 4024 3872 E456.exe AppLaunch.exe PID 3872 wrote to memory of 4024 3872 E456.exe AppLaunch.exe PID 3872 wrote to memory of 4024 3872 E456.exe AppLaunch.exe PID 3872 wrote to memory of 4024 3872 E456.exe AppLaunch.exe PID 3872 wrote to memory of 4024 3872 E456.exe AppLaunch.exe PID 3872 wrote to memory of 4024 3872 E456.exe AppLaunch.exe PID 3872 wrote to memory of 4024 3872 E456.exe AppLaunch.exe PID 3872 wrote to memory of 4024 3872 E456.exe AppLaunch.exe PID 3872 wrote to memory of 4024 3872 E456.exe AppLaunch.exe PID 3872 wrote to memory of 4024 3872 E456.exe AppLaunch.exe PID 1800 wrote to memory of 2188 1800 g8315913.exe AppLaunch.exe PID 1800 wrote to memory of 2188 1800 g8315913.exe AppLaunch.exe PID 1800 wrote to memory of 2188 1800 g8315913.exe AppLaunch.exe PID 1800 wrote to memory of 2188 1800 g8315913.exe AppLaunch.exe PID 1800 wrote to memory of 2188 1800 g8315913.exe AppLaunch.exe PID 1800 wrote to memory of 2188 1800 g8315913.exe AppLaunch.exe PID 1800 wrote to memory of 2188 1800 g8315913.exe AppLaunch.exe PID 1800 wrote to memory of 2188 1800 g8315913.exe AppLaunch.exe PID 1800 wrote to memory of 2188 1800 g8315913.exe AppLaunch.exe PID 1800 wrote to memory of 2188 1800 g8315913.exe AppLaunch.exe PID 3220 wrote to memory of 1544 3220 E959.exe PID 3220 wrote to memory of 1544 3220 E959.exe PID 3220 wrote to memory of 1544 3220 E959.exe PID 3220 wrote to memory of 2092 3220 EA73.exe PID 3220 wrote to memory of 2092 3220 EA73.exe PID 1544 wrote to memory of 1620 1544 E959.exe AppLaunch.exe PID 1544 wrote to memory of 1620 1544 E959.exe AppLaunch.exe PID 1544 wrote to memory of 1620 1544 E959.exe AppLaunch.exe PID 1544 wrote to memory of 1620 1544 E959.exe AppLaunch.exe PID 1544 wrote to memory of 1620 1544 E959.exe AppLaunch.exe PID 1544 wrote to memory of 1620 1544 E959.exe AppLaunch.exe PID 1544 wrote to memory of 1620 1544 E959.exe AppLaunch.exe PID 1544 wrote to memory of 1620 1544 E959.exe AppLaunch.exe PID 3220 wrote to memory of 4628 3220 EC97.exe PID 3220 wrote to memory of 4628 3220 EC97.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\60b2c0f0bed64270fb7928882bb5823c892c49591980c6daa973f682e48506c0.exe"C:\Users\Admin\AppData\Local\Temp\60b2c0f0bed64270fb7928882bb5823c892c49591980c6daa973f682e48506c0.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- DcRat
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3104 -s 1442⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\E251.exeC:\Users\Admin\AppData\Local\Temp\E251.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9435037.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9435037.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x7886351.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x7886351.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x4902647.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x4902647.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\x4718039.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\x4718039.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\g8315913.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\g8315913.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2188 -s 1768⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 2207⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\E456.exeC:\Users\Admin\AppData\Local\Temp\E456.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3872 -s 3562⤵
- Program crash
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\E62C.bat" "1⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\E959.exeC:\Users\Admin\AppData\Local\Temp\E959.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\EA73.exeC:\Users\Admin\AppData\Local\Temp\EA73.exe1⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\EC97.exeC:\Users\Admin\AppData\Local\Temp\EC97.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F3⤵
- DcRat
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "explothe.exe" /P "Admin:N"4⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "explothe.exe" /P "Admin:R" /E4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:N"4⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:R" /E4⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main3⤵
- Loads dropped DLL
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\FFB4.exeC:\Users\Admin\AppData\Local\Temp\FFB4.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\ss41.exe"C:\Users\Admin\AppData\Local\Temp\ss41.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
-
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"3⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\System32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"4⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes5⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F5⤵
- DcRat
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll5⤵
- Executes dropped EXE
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F5⤵
- DcRat
- Creates scheduled task(s)
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)7⤵
- Launches sc.exe
-
C:\Users\Admin\AppData\Local\Temp\kos1.exe"C:\Users\Admin\AppData\Local\Temp\kos1.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\set16.exe"C:\Users\Admin\AppData\Local\Temp\set16.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-8U68B.tmp\is-KKEUM.tmp"C:\Users\Admin\AppData\Local\Temp\is-8U68B.tmp\is-KKEUM.tmp" /SL4 $20382 "C:\Users\Admin\AppData\Local\Temp\set16.exe" 1232936 522244⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
-
C:\Program Files (x86)\PA Previewer\previewer.exe"C:\Program Files (x86)\PA Previewer\previewer.exe" -i5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 85⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 86⤵
-
C:\Program Files (x86)\PA Previewer\previewer.exe"C:\Program Files (x86)\PA Previewer\previewer.exe" -s5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\kos.exe"C:\Users\Admin\AppData\Local\Temp\kos.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\562.exeC:\Users\Admin\AppData\Local\Temp\562.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe1⤵
- Executes dropped EXE
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Defense Evasion
Modify Registry
5Impair Defenses
3Disable or Modify Tools
3Scripting
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\PA Previewer\previewer.exeFilesize
1.9MB
MD527b85a95804a760da4dbee7ca800c9b4
SHA1f03136226bf3dd38ba0aa3aad1127ccab380197c
SHA256f98b98404ecf3871a10a290ade21ad77d0b2633f47247debc53d094b9bdff245
SHA512e760a15370272aa9541f1afceaaf4f5a8068dad21c6a8d50ebd01514e16bbc8f867c8af349080f3d1fa7a19eafe7cde74921d01716dea69ef801da1b74eae4a7
-
C:\Program Files (x86)\PA Previewer\previewer.exeFilesize
1.9MB
MD527b85a95804a760da4dbee7ca800c9b4
SHA1f03136226bf3dd38ba0aa3aad1127ccab380197c
SHA256f98b98404ecf3871a10a290ade21ad77d0b2633f47247debc53d094b9bdff245
SHA512e760a15370272aa9541f1afceaaf4f5a8068dad21c6a8d50ebd01514e16bbc8f867c8af349080f3d1fa7a19eafe7cde74921d01716dea69ef801da1b74eae4a7
-
C:\Program Files (x86)\PA Previewer\previewer.exeFilesize
1.9MB
MD527b85a95804a760da4dbee7ca800c9b4
SHA1f03136226bf3dd38ba0aa3aad1127ccab380197c
SHA256f98b98404ecf3871a10a290ade21ad77d0b2633f47247debc53d094b9bdff245
SHA512e760a15370272aa9541f1afceaaf4f5a8068dad21c6a8d50ebd01514e16bbc8f867c8af349080f3d1fa7a19eafe7cde74921d01716dea69ef801da1b74eae4a7
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\PZQ0K35H\edgecompatviewlist[1].xmlFilesize
74KB
MD5d4fc49dc14f63895d997fa4940f24378
SHA13efb1437a7c5e46034147cbbc8db017c69d02c31
SHA256853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1
SHA512cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\PWTOA31O\B8BxsscfVBr[1].icoFilesize
1KB
MD5e508eca3eafcc1fc2d7f19bafb29e06b
SHA1a62fc3c2a027870d99aedc241e7d5babba9a891f
SHA256e6d1d77403cd9f14fd2377d07e84350cfe768e3353e402bf42ebdc8593a58c9a
SHA51249e3f31fd73e52ba274db9c7d306cc188e09c3ae683827f420fbb17534d197a503460e7ec2f1af46065f8d0b33f37400659bfa2ae165e502f97a8150e184a38c
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\U81Z0UB5\suggestions[1].en-USFilesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\WAKBKSWP.cookieFilesize
130B
MD52f821d5d04af04dd7bd1a68c6792bde9
SHA1d1f6b6fbdb38a30b8002245e8e75620c58f35fe9
SHA25666fcad2e84c3aa013d394b7d93197f89d97e8cb1876caa021e6f42bdacd4d8a9
SHA512c7550b0820e90139ab6bbcc24c4a35fefdfe54093f024032e771271768e36d198da8b83fe142e1e169e2157826d914be409c132580f3bfe824663d7175877615
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAFilesize
1KB
MD515901c001a3213e965cab5486eef9bef
SHA1c9a0bb05c146b383e6ae2d52700afbfaf9922a86
SHA256f15b234f32db5f8a34980c5a627b65aa179d7d4febcdd35c28e3a22c9295a443
SHA512e8bfb2672ce4ac7bdb7e8cbf04c585906196075663c26ff264a24f2d8cb37a7bbc98519c8a5d026d555ad1af7f1e4d3a112e24a57b4e2df38a6d7c153bf7eeaf
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_88B06D18F336F4573DA4CD16EEF01E99Filesize
471B
MD53c85c63522b8d9311fd17b60cc3f0245
SHA105c4621bf02336bf463bc9247c63e2cf7ea7afca
SHA2563c7cbe3679e411d320ca86d457cfc507d2f4b8e127d8d2748b9758fd79b0c7b4
SHA512f548fa65114b27ce881e4782b43f0fe5478d3f6264ef286a9fb57a9996c706bad089096aa87650a26d3fa14361903c14c6c2eb0dc7bc6b1f9c6e6c273666676e
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAFilesize
724B
MD5ac89a852c2aaa3d389b2d2dd312ad367
SHA18f421dd6493c61dbda6b839e2debb7b50a20c930
SHA2560b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45
SHA512c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_87DCDABBB68171FA19C9A78DBA85E190Filesize
471B
MD5b1cf120be2efdd1a92dddf06102485e1
SHA1fb67695566bb32911be1e6ad5cd75c7b7b6f0b22
SHA2565ce88da4f811b34d9bbdbe7c8ec8cc21a5266c50ca5fb5d790f9a80185e3a83d
SHA512193bde138d37bee0173b5f2887536996c36e43ef865434a12e50bcdca5a8cc8938571a9e4a506994e014a989157018b3a41bcc4d31598a05fb42551ef38add5c
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAFilesize
410B
MD527f2e3ba0eb7b822f08f82d015a34e30
SHA1421acd6adf10af21a0d01a9ca2252d54a6d55675
SHA256933dddb8bf3f860c130b051f81f9a39894c0fc8b55d512a2691cbadbcd756a31
SHA5125f2a26a6d8ac2728bb4d47c45b629bbf98b4fc381fc938add5db0749e334d080c7237ee62613bec99bf1f8238c875b193f1814d9cf2b208480dea4abbd9d35a0
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_88B06D18F336F4573DA4CD16EEF01E99Filesize
406B
MD54e0c585029c39465ec2fe6b89e77ce5c
SHA124fe0c8c0ef41469dd82288cf87d91777c72f853
SHA256a94b27fa2a7953b5cb8a38ad0b696eebb95d135846cf0f728197dbdf7364f6ef
SHA512f5898f8b0a084faf6a0d26725c01679b0b6fff942e85b88783dd321afc7761aaf50c24f9a8c5e93fb6ce5130ca58e2af8203355e4c1a62ec4a7ce9c1191993d7
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAFilesize
392B
MD5f5ba9e724387f51e60c1c7a1ef58a074
SHA1127b49918c7a5953ed0355daeee3f027e2769185
SHA2560069b8de43b53d70321d65baaa923440eb19a74588a1357604e511406b7abc14
SHA5121979b9c2102da34edbeb98f0efe6681b5c8dd0aa1ab1c8f3495e9c923c67fd06322abf4b07a01c80c8ef98d771aff720ab22f23bd2d64dca780cbcbfa46d8737
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_87DCDABBB68171FA19C9A78DBA85E190Filesize
406B
MD559101fc85d2cf9dbf3756438d5d87920
SHA155fd8a0587e09c1b97707ea2e6c3875712ad58ad
SHA25633074c7c40b43b6998b8f86bae99798b102a493e446c600c7bbef192b4bbd926
SHA512e9357dd31d2c040e6d5555582860e638b9e3a1642aa12c63aa30c4b0bb990f7fb851f4c035e6c4282914d4b72fe34cd17badde70d999f468cb27803b59db2e7a
-
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exeFilesize
4.2MB
MD57ea584dc49967de03bebdacec829b18d
SHA13d47f0e88c7473bedeed2f14d7a8db1318b93852
SHA25679232c763bddf5c7fc4ca2e1597b8a5cd38902241d689ac1e69f7418a8077a53
SHA512ed57aca6b892cb0229708690df16739e0a976ce28112128c9b4f4e4f06019c4fbe6675cb82a639837ae3374acdc0ee9fdb86b5b28151ccc8c7ed2aeff350fcb0
-
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exeFilesize
4.2MB
MD57ea584dc49967de03bebdacec829b18d
SHA13d47f0e88c7473bedeed2f14d7a8db1318b93852
SHA25679232c763bddf5c7fc4ca2e1597b8a5cd38902241d689ac1e69f7418a8077a53
SHA512ed57aca6b892cb0229708690df16739e0a976ce28112128c9b4f4e4f06019c4fbe6675cb82a639837ae3374acdc0ee9fdb86b5b28151ccc8c7ed2aeff350fcb0
-
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exeFilesize
4.2MB
MD57ea584dc49967de03bebdacec829b18d
SHA13d47f0e88c7473bedeed2f14d7a8db1318b93852
SHA25679232c763bddf5c7fc4ca2e1597b8a5cd38902241d689ac1e69f7418a8077a53
SHA512ed57aca6b892cb0229708690df16739e0a976ce28112128c9b4f4e4f06019c4fbe6675cb82a639837ae3374acdc0ee9fdb86b5b28151ccc8c7ed2aeff350fcb0
-
C:\Users\Admin\AppData\Local\Temp\562.exeFilesize
1.4MB
MD5965fcf373f3e95995f8ae35df758eca1
SHA1a62d2494f6ba8a02a80a02017e7c347f76b18fa6
SHA25682eab1b2cab9f16d77c242e4ff1eb983d7e0a64b78b5dc69d87af2a4016f4f39
SHA51255e9fefbe2a1ed92034573f3c4bb03fe29b0d345ebe834f2f9192d5ddd2237f1bb8e4fb5f9516852e7e0efa42a3122a11d2f0db7c9633b1566901cdd7862ff52
-
C:\Users\Admin\AppData\Local\Temp\562.exeFilesize
1.4MB
MD5965fcf373f3e95995f8ae35df758eca1
SHA1a62d2494f6ba8a02a80a02017e7c347f76b18fa6
SHA25682eab1b2cab9f16d77c242e4ff1eb983d7e0a64b78b5dc69d87af2a4016f4f39
SHA51255e9fefbe2a1ed92034573f3c4bb03fe29b0d345ebe834f2f9192d5ddd2237f1bb8e4fb5f9516852e7e0efa42a3122a11d2f0db7c9633b1566901cdd7862ff52
-
C:\Users\Admin\AppData\Local\Temp\E251.exeFilesize
1.0MB
MD538245a63ed4c5c803fc8bde8967a88ff
SHA138b412cde27ec02e05f7eb2d61983b74f50ae289
SHA256f09056b42deee674a96cf34a57a8247a1485b559ce5afbffae4942057f5135ab
SHA512e92f5e1a07afbcad8ae829b914ce60edcca7d65128ae1261f1e2715dcd5c30f07aee8263bd2f516205737b52c9178b8d3555a96e7b105fe427a716235b42dcb3
-
C:\Users\Admin\AppData\Local\Temp\E251.exeFilesize
1.0MB
MD538245a63ed4c5c803fc8bde8967a88ff
SHA138b412cde27ec02e05f7eb2d61983b74f50ae289
SHA256f09056b42deee674a96cf34a57a8247a1485b559ce5afbffae4942057f5135ab
SHA512e92f5e1a07afbcad8ae829b914ce60edcca7d65128ae1261f1e2715dcd5c30f07aee8263bd2f516205737b52c9178b8d3555a96e7b105fe427a716235b42dcb3
-
C:\Users\Admin\AppData\Local\Temp\E456.exeFilesize
304KB
MD5fcc9fd8995cf85e5dcd90b6181b34dc7
SHA1359fb769a5f8f4569d1e045e87e3cbc8b92f3f78
SHA256bae667ab9c4c87e83a2822d1b809ba141f13ea62746c7aa35ca439d77cf66b39
SHA5125124a405ff3fb97b3715bd75db85c6178a32bcdcd03e4261d98ac05e8caa92434da978bf703282658db61cdd9f5b2d6aded82520faff47cf344e307cb199dd33
-
C:\Users\Admin\AppData\Local\Temp\E456.exeFilesize
304KB
MD5fcc9fd8995cf85e5dcd90b6181b34dc7
SHA1359fb769a5f8f4569d1e045e87e3cbc8b92f3f78
SHA256bae667ab9c4c87e83a2822d1b809ba141f13ea62746c7aa35ca439d77cf66b39
SHA5125124a405ff3fb97b3715bd75db85c6178a32bcdcd03e4261d98ac05e8caa92434da978bf703282658db61cdd9f5b2d6aded82520faff47cf344e307cb199dd33
-
C:\Users\Admin\AppData\Local\Temp\E62C.batFilesize
79B
MD5403991c4d18ac84521ba17f264fa79f2
SHA1850cc068de0963854b0fe8f485d951072474fd45
SHA256ef6e942aefe925fefac19fa816986ea25de6935c4f377c717e29b94e65f9019f
SHA512a20aaa77065d30195e5893f2ff989979383c8d7f82d9e528d4833b1c1236aef4f85284f5250d0f190a174790b650280ffe1fbff7e00c98024ccf5ca746e5b576
-
C:\Users\Admin\AppData\Local\Temp\E959.exeFilesize
386KB
MD5b2f74506c29b008e4f76d55593ac3d74
SHA116c9a77d8f4b55710d1756e9983ae030903f2ff5
SHA2563cc8a757b5a6a4d5dbb5bb34165de99d8b4a81602920bf0172299789f6b55a1c
SHA512bf3508b475e1f34b540283bdffab415b842d9fc49bf3a7e534a1def9b87cfe9942dd881ef32d93113323bd1765070883bf58d49a6e8f079745bdeb345078868a
-
C:\Users\Admin\AppData\Local\Temp\E959.exeFilesize
386KB
MD5b2f74506c29b008e4f76d55593ac3d74
SHA116c9a77d8f4b55710d1756e9983ae030903f2ff5
SHA2563cc8a757b5a6a4d5dbb5bb34165de99d8b4a81602920bf0172299789f6b55a1c
SHA512bf3508b475e1f34b540283bdffab415b842d9fc49bf3a7e534a1def9b87cfe9942dd881ef32d93113323bd1765070883bf58d49a6e8f079745bdeb345078868a
-
C:\Users\Admin\AppData\Local\Temp\EA73.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\EA73.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\EC97.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\EC97.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\FFB4.exeFilesize
6.4MB
MD53c81534d635fbe4bfab2861d98422f70
SHA19cc995fa42313cd82eacaad9e3fe818cd3805f58
SHA25688921dad96a51ff9f15a1d93b51910b2ac75589020fbb75956b6f090381d4d4f
SHA512132fa532fad96b512b795cf4786245cc24bbdbbab433bf34925cf20401a819cab7bed92771e7f0b4c970535804d42f7f1d2887765ed8f999c99a0e15d93a0136
-
C:\Users\Admin\AppData\Local\Temp\FFB4.exeFilesize
6.4MB
MD53c81534d635fbe4bfab2861d98422f70
SHA19cc995fa42313cd82eacaad9e3fe818cd3805f58
SHA25688921dad96a51ff9f15a1d93b51910b2ac75589020fbb75956b6f090381d4d4f
SHA512132fa532fad96b512b795cf4786245cc24bbdbbab433bf34925cf20401a819cab7bed92771e7f0b4c970535804d42f7f1d2887765ed8f999c99a0e15d93a0136
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9435037.exeFilesize
974KB
MD58b8e02e778b926266ef60ea128fd4246
SHA1c2fba20814c9a6b00e10ebd7e6617dfad269de85
SHA256740d0a84b01bd96dd973514f061f71fddcdbbf0da221fd9cdc0738872b5893fa
SHA512c7b0ebeb8cd51cea6f9c098d9c06ccc178f881a2e77e865fd848a57a85c6271c8038ebe4107ef92f3b1bba719a23b350a4c2b25f7236f3a9b118919e8df17758
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9435037.exeFilesize
974KB
MD58b8e02e778b926266ef60ea128fd4246
SHA1c2fba20814c9a6b00e10ebd7e6617dfad269de85
SHA256740d0a84b01bd96dd973514f061f71fddcdbbf0da221fd9cdc0738872b5893fa
SHA512c7b0ebeb8cd51cea6f9c098d9c06ccc178f881a2e77e865fd848a57a85c6271c8038ebe4107ef92f3b1bba719a23b350a4c2b25f7236f3a9b118919e8df17758
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x7886351.exeFilesize
792KB
MD5918aa4d929aa61a54588a18f72b49c8c
SHA17a8ac5c2944b9b4a250b475bd010a15b5cf5ad3a
SHA256d03d28985143381cd0a1ffe527e7c7a7f6c0d761e4947c6ae60a7d612a3f1a0b
SHA5125dbf3f616d90d3d2cc0a5702787141413cd6ac04647aa2adff1fba2c22571f6db869369b9773392e644e975cfd652093bc0fcc54cd4b716731323adfbb72188e
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x7886351.exeFilesize
792KB
MD5918aa4d929aa61a54588a18f72b49c8c
SHA17a8ac5c2944b9b4a250b475bd010a15b5cf5ad3a
SHA256d03d28985143381cd0a1ffe527e7c7a7f6c0d761e4947c6ae60a7d612a3f1a0b
SHA5125dbf3f616d90d3d2cc0a5702787141413cd6ac04647aa2adff1fba2c22571f6db869369b9773392e644e975cfd652093bc0fcc54cd4b716731323adfbb72188e
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x4902647.exeFilesize
529KB
MD5297dd12ccc8eac76a2a9a92dde3807c5
SHA1022a71fa1156e98be31066f99059335b9d99416c
SHA256b4168d6ca0886cbd37d7a4415db937f0cd07b569aa812d3166d4d324b9de2a7f
SHA5121e5629758619fd1ce7628c3175c097ab5ecf88b81d83513d3c7c8e4b7574b951ec0dce04d12975209988bd912417280acdc1d1c9e1b22e2772aedea538d80de4
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x4902647.exeFilesize
529KB
MD5297dd12ccc8eac76a2a9a92dde3807c5
SHA1022a71fa1156e98be31066f99059335b9d99416c
SHA256b4168d6ca0886cbd37d7a4415db937f0cd07b569aa812d3166d4d324b9de2a7f
SHA5121e5629758619fd1ce7628c3175c097ab5ecf88b81d83513d3c7c8e4b7574b951ec0dce04d12975209988bd912417280acdc1d1c9e1b22e2772aedea538d80de4
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\x4718039.exeFilesize
364KB
MD5fc08cbb6100631b04e4bc11cd851d71a
SHA17c011b471bbfd2a5fab5f7ccf133c69db1261b09
SHA256c34fb765bd3fb1c98079f29352354a90f43bcf9ea27a31bde6fb45bbee4024d3
SHA512f758e0598cb1b071a86a2b53cf928038719a7147a4c7abd08818b4548c5fda69c8673559f4910f192037b7f47bc26eb4adbf9d646b9db59641e19856dfa81992
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\x4718039.exeFilesize
364KB
MD5fc08cbb6100631b04e4bc11cd851d71a
SHA17c011b471bbfd2a5fab5f7ccf133c69db1261b09
SHA256c34fb765bd3fb1c98079f29352354a90f43bcf9ea27a31bde6fb45bbee4024d3
SHA512f758e0598cb1b071a86a2b53cf928038719a7147a4c7abd08818b4548c5fda69c8673559f4910f192037b7f47bc26eb4adbf9d646b9db59641e19856dfa81992
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\g8315913.exeFilesize
304KB
MD5fcc9fd8995cf85e5dcd90b6181b34dc7
SHA1359fb769a5f8f4569d1e045e87e3cbc8b92f3f78
SHA256bae667ab9c4c87e83a2822d1b809ba141f13ea62746c7aa35ca439d77cf66b39
SHA5125124a405ff3fb97b3715bd75db85c6178a32bcdcd03e4261d98ac05e8caa92434da978bf703282658db61cdd9f5b2d6aded82520faff47cf344e307cb199dd33
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\g8315913.exeFilesize
304KB
MD5fcc9fd8995cf85e5dcd90b6181b34dc7
SHA1359fb769a5f8f4569d1e045e87e3cbc8b92f3f78
SHA256bae667ab9c4c87e83a2822d1b809ba141f13ea62746c7aa35ca439d77cf66b39
SHA5125124a405ff3fb97b3715bd75db85c6178a32bcdcd03e4261d98ac05e8caa92434da978bf703282658db61cdd9f5b2d6aded82520faff47cf344e307cb199dd33
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\g8315913.exeFilesize
304KB
MD5fcc9fd8995cf85e5dcd90b6181b34dc7
SHA1359fb769a5f8f4569d1e045e87e3cbc8b92f3f78
SHA256bae667ab9c4c87e83a2822d1b809ba141f13ea62746c7aa35ca439d77cf66b39
SHA5125124a405ff3fb97b3715bd75db85c6178a32bcdcd03e4261d98ac05e8caa92434da978bf703282658db61cdd9f5b2d6aded82520faff47cf344e307cb199dd33
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kfisv0ph.vlj.ps1Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\is-8U68B.tmp\is-KKEUM.tmpFilesize
647KB
MD52fba5642cbcaa6857c3995ccb5d2ee2a
SHA191fe8cd860cba7551fbf78bc77cc34e34956e8cc
SHA256ddec51f3741f3988b9cc792f6f8fc0dfa2098ef0eb84c6a2af7f8da5a72b40fa
SHA51230613b43427d17115134798506f197c0f5f8b2b9f247668fa25b9dd4853bbd97ac1e27f4e3325dec4f6dfc0e448ebbddb2969ad1a1781aa59ebf522d436aed7c
-
C:\Users\Admin\AppData\Local\Temp\is-8U68B.tmp\is-KKEUM.tmpFilesize
647KB
MD52fba5642cbcaa6857c3995ccb5d2ee2a
SHA191fe8cd860cba7551fbf78bc77cc34e34956e8cc
SHA256ddec51f3741f3988b9cc792f6f8fc0dfa2098ef0eb84c6a2af7f8da5a72b40fa
SHA51230613b43427d17115134798506f197c0f5f8b2b9f247668fa25b9dd4853bbd97ac1e27f4e3325dec4f6dfc0e448ebbddb2969ad1a1781aa59ebf522d436aed7c
-
C:\Users\Admin\AppData\Local\Temp\kos.exeFilesize
8KB
MD5076ab7d1cc5150a5e9f8745cc5f5fb6c
SHA17b40783a27a38106e2cc91414f2bc4d8b484c578
SHA256d1b71081d7ba414b589338329f278ba51c6ccf542d74f131f96c2337ee0a4c90
SHA51275e274a654e88feb0d66156f387bc5e420811f4f62939396a7455d12e835d7e134b2579ab59976c591b416d1ec1acdf05e9eb290c8f01383c6a50bf43854420b
-
C:\Users\Admin\AppData\Local\Temp\kos.exeFilesize
8KB
MD5076ab7d1cc5150a5e9f8745cc5f5fb6c
SHA17b40783a27a38106e2cc91414f2bc4d8b484c578
SHA256d1b71081d7ba414b589338329f278ba51c6ccf542d74f131f96c2337ee0a4c90
SHA51275e274a654e88feb0d66156f387bc5e420811f4f62939396a7455d12e835d7e134b2579ab59976c591b416d1ec1acdf05e9eb290c8f01383c6a50bf43854420b
-
C:\Users\Admin\AppData\Local\Temp\kos1.exeFilesize
1.4MB
MD585b698363e74ba3c08fc16297ddc284e
SHA1171cfea4a82a7365b241f16aebdb2aad29f4f7c0
SHA25678efcbb0c6eb6a4c76c036adc65154b8ff028849f79d508e45babfb527cb7cfe
SHA5127e4816c43e0addba088709948e8aedc9e39d6802c74a75cfbc2a0e739b44c5b5eef2bb2453b7032c758b0bdb38e4e7a598aa29be015796361b81d7f9e8027796
-
C:\Users\Admin\AppData\Local\Temp\kos1.exeFilesize
1.4MB
MD585b698363e74ba3c08fc16297ddc284e
SHA1171cfea4a82a7365b241f16aebdb2aad29f4f7c0
SHA25678efcbb0c6eb6a4c76c036adc65154b8ff028849f79d508e45babfb527cb7cfe
SHA5127e4816c43e0addba088709948e8aedc9e39d6802c74a75cfbc2a0e739b44c5b5eef2bb2453b7032c758b0bdb38e4e7a598aa29be015796361b81d7f9e8027796
-
C:\Users\Admin\AppData\Local\Temp\set16.exeFilesize
1.4MB
MD522d5269955f256a444bd902847b04a3b
SHA141a83de3273270c3bd5b2bd6528bdc95766aa268
SHA256ab16986253bd187e3134f27495ef0db4b648f769721bc8c84b708c7ba69156fd
SHA512d85ada5d8c2c02932a79241a484b088ba70bda0497fd8ad638300935a16841d7cbc8258be93055907cb533bc534fdd48c7c91109fa22f87e65a6b374cd51055c
-
C:\Users\Admin\AppData\Local\Temp\set16.exeFilesize
1.4MB
MD522d5269955f256a444bd902847b04a3b
SHA141a83de3273270c3bd5b2bd6528bdc95766aa268
SHA256ab16986253bd187e3134f27495ef0db4b648f769721bc8c84b708c7ba69156fd
SHA512d85ada5d8c2c02932a79241a484b088ba70bda0497fd8ad638300935a16841d7cbc8258be93055907cb533bc534fdd48c7c91109fa22f87e65a6b374cd51055c
-
C:\Users\Admin\AppData\Local\Temp\ss41.exeFilesize
416KB
MD583330cf6e88ad32365183f31b1fd3bda
SHA11c5b47be2b8713746de64b39390636a81626d264
SHA2567ce942cdc58ba5fa628d97f991c8a794294c2acfb724efbf0ac887c47942a31e
SHA512e28a9c47f690b0b0f0dd3b946d9cd59c761803f3826a382208a5b92be1293067b37a39f1141ddda13247b96138a108ce2f85b83de0143d48d4acc94f69a11908
-
C:\Users\Admin\AppData\Local\Temp\ss41.exeFilesize
416KB
MD583330cf6e88ad32365183f31b1fd3bda
SHA11c5b47be2b8713746de64b39390636a81626d264
SHA2567ce942cdc58ba5fa628d97f991c8a794294c2acfb724efbf0ac887c47942a31e
SHA512e28a9c47f690b0b0f0dd3b946d9cd59c761803f3826a382208a5b92be1293067b37a39f1141ddda13247b96138a108ce2f85b83de0143d48d4acc94f69a11908
-
C:\Users\Admin\AppData\Local\Temp\toolspub2.exeFilesize
338KB
MD5528b5dc5ede359f683b73a684b9c19f6
SHA18bff4feae6dbdaafac1f9f373f15850d08e0a206
SHA2563a53bd59537190f8dc2c1ce266eb3b6c699c96ee929e2d4f90555fea5c6441f9
SHA51287cb867d3f47346730ee04b8b611afeac60616040a84c85b1369b739df217a528aa148a807d653d543bcb4ed25dac42ab98ad38d705331725a71ec2d6f010cbb
-
C:\Users\Admin\AppData\Local\Temp\toolspub2.exeFilesize
338KB
MD5528b5dc5ede359f683b73a684b9c19f6
SHA18bff4feae6dbdaafac1f9f373f15850d08e0a206
SHA2563a53bd59537190f8dc2c1ce266eb3b6c699c96ee929e2d4f90555fea5c6441f9
SHA51287cb867d3f47346730ee04b8b611afeac60616040a84c85b1369b739df217a528aa148a807d653d543bcb4ed25dac42ab98ad38d705331725a71ec2d6f010cbb
-
C:\Users\Admin\AppData\Local\Temp\toolspub2.exeFilesize
338KB
MD5528b5dc5ede359f683b73a684b9c19f6
SHA18bff4feae6dbdaafac1f9f373f15850d08e0a206
SHA2563a53bd59537190f8dc2c1ce266eb3b6c699c96ee929e2d4f90555fea5c6441f9
SHA51287cb867d3f47346730ee04b8b611afeac60616040a84c85b1369b739df217a528aa148a807d653d543bcb4ed25dac42ab98ad38d705331725a71ec2d6f010cbb
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
273B
MD5a5b509a3fb95cc3c8d89cd39fc2a30fb
SHA15aff4266a9c0f2af440f28aa865cebc5ddb9cd5c
SHA2565f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529
SHA5123cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9
-
C:\Users\Admin\AppData\Roaming\abjrhsjFilesize
338KB
MD5528b5dc5ede359f683b73a684b9c19f6
SHA18bff4feae6dbdaafac1f9f373f15850d08e0a206
SHA2563a53bd59537190f8dc2c1ce266eb3b6c699c96ee929e2d4f90555fea5c6441f9
SHA51287cb867d3f47346730ee04b8b611afeac60616040a84c85b1369b739df217a528aa148a807d653d543bcb4ed25dac42ab98ad38d705331725a71ec2d6f010cbb
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD51c19c16e21c97ed42d5beabc93391fc5
SHA18ad83f8e0b3acf8dfbbf87931e41f0d664c4df68
SHA2561bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05
SHA5127d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
18KB
MD50d372dd931966a74a2ed42bd29dcbced
SHA1566a484059a83a1ab4ac2996d3bf813b9980055e
SHA256e9290e6fe62de73fbcda300baf9dd7d602866353e154fe41136e59e831931e18
SHA512184a1841df821c6238861e33ef000eb53b709dc20bfb5c6f71e1bc228b7ad59a3480af01f0a773ad18ecaccfa6ae90dac8a74d089a9d3a64bff867038cc95770
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
18KB
MD5f57e6afc99f1add9ab16a7179537c036
SHA1a6d22a3e2d205f2608f0ea97e53b3880c2abcbb0
SHA256d81a8402a2357d73b578ed97e3342bd9a24bc304b3de977735e52d6c9043024b
SHA512218ba843324afb695d01ddf21413fe25a017d4dca97c2b73eb38f6e254cbee7a303b1068fa7261c3ea828214237bded6844ffed3585b553afe082664d3972773
-
C:\Windows\rss\csrss.exeFilesize
4.2MB
MD57ea584dc49967de03bebdacec829b18d
SHA13d47f0e88c7473bedeed2f14d7a8db1318b93852
SHA25679232c763bddf5c7fc4ca2e1597b8a5cd38902241d689ac1e69f7418a8077a53
SHA512ed57aca6b892cb0229708690df16739e0a976ce28112128c9b4f4e4f06019c4fbe6675cb82a639837ae3374acdc0ee9fdb86b5b28151ccc8c7ed2aeff350fcb0
-
\Users\Admin\AppData\Local\Temp\is-U73M7.tmp\_isetup\_iscrypt.dllFilesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
\Users\Admin\AppData\Local\Temp\is-U73M7.tmp\_isetup\_isdecmp.dllFilesize
32KB
MD5b4786eb1e1a93633ad1b4c112514c893
SHA1734750b771d0809c88508e4feb788d7701e6dada
SHA2562ae4169f721beb389a661e6dbb18bc84ef38556af1f46807da9d87aec2a6f06f
SHA5120882d2aa163ece22796f837111db0d55158098035005e57cd2e9b8d59dc2e582207840bf98bee534b81c368acf60ab5d8ecbe762209273bda067a215cdb2c0c6
-
\Users\Admin\AppData\Local\Temp\is-U73M7.tmp\_isetup\_isdecmp.dllFilesize
32KB
MD5b4786eb1e1a93633ad1b4c112514c893
SHA1734750b771d0809c88508e4feb788d7701e6dada
SHA2562ae4169f721beb389a661e6dbb18bc84ef38556af1f46807da9d87aec2a6f06f
SHA5120882d2aa163ece22796f837111db0d55158098035005e57cd2e9b8d59dc2e582207840bf98bee534b81c368acf60ab5d8ecbe762209273bda067a215cdb2c0c6
-
\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
memory/992-321-0x0000023DB6850000-0x0000023DB6852000-memory.dmpFilesize
8KB
-
memory/992-323-0x0000023DB6870000-0x0000023DB6872000-memory.dmpFilesize
8KB
-
memory/992-315-0x0000023DB6810000-0x0000023DB6812000-memory.dmpFilesize
8KB
-
memory/1108-900-0x00000000036B0000-0x00000000037E1000-memory.dmpFilesize
1.2MB
-
memory/1108-328-0x0000000003530000-0x00000000036A1000-memory.dmpFilesize
1.4MB
-
memory/1108-330-0x00000000036B0000-0x00000000037E1000-memory.dmpFilesize
1.2MB
-
memory/1108-168-0x00007FF733770000-0x00007FF7337DA000-memory.dmpFilesize
424KB
-
memory/1484-182-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1484-257-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1484-180-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1620-142-0x000000000B760000-0x000000000B79E000-memory.dmpFilesize
248KB
-
memory/1620-116-0x00000000726A0000-0x0000000072D8E000-memory.dmpFilesize
6.9MB
-
memory/1620-86-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1620-210-0x000000000B750000-0x000000000B760000-memory.dmpFilesize
64KB
-
memory/1620-133-0x000000000B980000-0x000000000BE7E000-memory.dmpFilesize
5.0MB
-
memory/1620-194-0x00000000726A0000-0x0000000072D8E000-memory.dmpFilesize
6.9MB
-
memory/1620-136-0x000000000B520000-0x000000000B5B2000-memory.dmpFilesize
584KB
-
memory/1620-143-0x000000000B700000-0x000000000B74B000-memory.dmpFilesize
300KB
-
memory/1620-137-0x000000000B750000-0x000000000B760000-memory.dmpFilesize
64KB
-
memory/1620-141-0x000000000B6D0000-0x000000000B6E2000-memory.dmpFilesize
72KB
-
memory/1620-140-0x000000000BE80000-0x000000000BF8A000-memory.dmpFilesize
1.0MB
-
memory/1620-139-0x000000000C490000-0x000000000CA96000-memory.dmpFilesize
6.0MB
-
memory/1620-138-0x000000000B490000-0x000000000B49A000-memory.dmpFilesize
40KB
-
memory/1916-178-0x00000000026B0000-0x00000000026B9000-memory.dmpFilesize
36KB
-
memory/1916-177-0x00000000026C0000-0x00000000027C0000-memory.dmpFilesize
1024KB
-
memory/2092-263-0x00007FF886110000-0x00007FF886AFC000-memory.dmpFilesize
9.9MB
-
memory/2092-187-0x00007FF886110000-0x00007FF886AFC000-memory.dmpFilesize
9.9MB
-
memory/2092-81-0x00007FF886110000-0x00007FF886AFC000-memory.dmpFilesize
9.9MB
-
memory/2092-80-0x00000000009E0000-0x00000000009EA000-memory.dmpFilesize
40KB
-
memory/2100-0-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2100-6-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2100-3-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2104-208-0x00000000726A0000-0x0000000072D8E000-memory.dmpFilesize
6.9MB
-
memory/2104-303-0x00000000726A0000-0x0000000072D8E000-memory.dmpFilesize
6.9MB
-
memory/2104-193-0x0000000000E60000-0x0000000000FD4000-memory.dmpFilesize
1.5MB
-
memory/2188-66-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/2188-69-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/2188-67-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3220-4-0x0000000000650000-0x0000000000666000-memory.dmpFilesize
88KB
-
memory/3220-255-0x0000000002830000-0x0000000002846000-memory.dmpFilesize
88KB
-
memory/3920-224-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/3920-554-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/3940-132-0x00000204F6E90000-0x00000204F6E92000-memory.dmpFilesize
8KB
-
memory/3940-82-0x00000204F6D20000-0x00000204F6D30000-memory.dmpFilesize
64KB
-
memory/3940-107-0x00000204F7500000-0x00000204F7510000-memory.dmpFilesize
64KB
-
memory/4024-62-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4024-75-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4024-60-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4024-61-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4024-57-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4120-343-0x0000000000400000-0x000000000298D000-memory.dmpFilesize
37.6MB
-
memory/4120-216-0x0000000000400000-0x000000000298D000-memory.dmpFilesize
37.6MB
-
memory/4120-324-0x0000000004730000-0x0000000004B38000-memory.dmpFilesize
4.0MB
-
memory/4120-196-0x0000000004730000-0x0000000004B38000-memory.dmpFilesize
4.0MB
-
memory/4120-204-0x0000000004B40000-0x000000000542B000-memory.dmpFilesize
8.9MB
-
memory/4540-436-0x000000000E760000-0x000000000E7D6000-memory.dmpFilesize
472KB
-
memory/4540-215-0x0000000000A90000-0x0000000000A96000-memory.dmpFilesize
24KB
-
memory/4540-434-0x00000000090F0000-0x0000000009100000-memory.dmpFilesize
64KB
-
memory/4540-439-0x00000000726A0000-0x0000000072D8E000-memory.dmpFilesize
6.9MB
-
memory/4540-462-0x000000000E920000-0x000000000E986000-memory.dmpFilesize
408KB
-
memory/4540-201-0x00000000007C0000-0x00000000007F0000-memory.dmpFilesize
192KB
-
memory/4540-218-0x00000000726A0000-0x0000000072D8E000-memory.dmpFilesize
6.9MB
-
memory/4540-217-0x00000000090F0000-0x0000000009100000-memory.dmpFilesize
64KB
-
memory/4824-272-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/4824-626-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/5108-214-0x0000000001190000-0x000000000134D000-memory.dmpFilesize
1.7MB
-
memory/5108-188-0x0000000001190000-0x000000000134D000-memory.dmpFilesize
1.7MB
-
memory/5316-289-0x000000001AF20000-0x000000001AF30000-memory.dmpFilesize
64KB
-
memory/5316-288-0x00007FF886110000-0x00007FF886AFC000-memory.dmpFilesize
9.9MB
-
memory/5316-284-0x0000000000190000-0x0000000000198000-memory.dmpFilesize
32KB
-
memory/5316-444-0x00007FF886110000-0x00007FF886AFC000-memory.dmpFilesize
9.9MB
-
memory/5504-313-0x0000000000400000-0x00000000005F1000-memory.dmpFilesize
1.9MB
-
memory/5504-307-0x0000000000400000-0x00000000005F1000-memory.dmpFilesize
1.9MB
-
memory/5504-302-0x0000000000400000-0x00000000005F1000-memory.dmpFilesize
1.9MB
-
memory/5712-904-0x00000000726A0000-0x0000000072D8E000-memory.dmpFilesize
6.9MB
-
memory/5712-932-0x0000000007940000-0x0000000007962000-memory.dmpFilesize
136KB
-
memory/5712-916-0x0000000007250000-0x0000000007878000-memory.dmpFilesize
6.2MB
-
memory/5712-913-0x0000000006C10000-0x0000000006C20000-memory.dmpFilesize
64KB
-
memory/5712-939-0x00000000079F0000-0x0000000007A56000-memory.dmpFilesize
408KB
-
memory/5712-908-0x0000000006C10000-0x0000000006C20000-memory.dmpFilesize
64KB
-
memory/5712-948-0x0000000007BD0000-0x0000000007F20000-memory.dmpFilesize
3.3MB
-
memory/5712-967-0x0000000006EC0000-0x0000000006EDC000-memory.dmpFilesize
112KB
-
memory/5712-906-0x0000000006BB0000-0x0000000006BE6000-memory.dmpFilesize
216KB
-
memory/5724-346-0x0000000000400000-0x00000000005F1000-memory.dmpFilesize
1.9MB