Analysis
-
max time kernel
86s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
06-10-2023 06:41
Static task
static1
General
-
Target
70af1a1c350554270883747e70ff85910cb2cc2c02d3ec133b4457100a05694d.exe
-
Size
15.7MB
-
MD5
3141032e3b1e4f3ee0d0a1fe68ccc6e8
-
SHA1
37adc7f63e2c38b2ad803c49d2782be701da9b56
-
SHA256
70af1a1c350554270883747e70ff85910cb2cc2c02d3ec133b4457100a05694d
-
SHA512
d063301b2c07d8722594dd2eec9fbcb100385bcaac9843c5f329537845888803c3a6ae68ac33983b9ea429bb15d74b43a189ef4bc359c80dbb19e46ae938f0e5
-
SSDEEP
393216:g8EDE090yXtcYODN8EDE090yXtcYODCef/GyF3ibKL4BCXtU/PS:gjg09jtcYyjg09jtcYyxFSbi4StU6
Malware Config
Extracted
smokeloader
up3
Extracted
smokeloader
2020
http://host-file-host6.com/
http://host-host-file8.com/
Signatures
-
Glupteba payload 23 IoCs
Processes:
resource yara_rule behavioral1/memory/824-118-0x00000000047C0000-0x00000000050AB000-memory.dmp family_glupteba behavioral1/memory/824-138-0x0000000000400000-0x0000000002675000-memory.dmp family_glupteba behavioral1/memory/1028-147-0x0000000004780000-0x000000000506B000-memory.dmp family_glupteba behavioral1/memory/1028-149-0x0000000000400000-0x0000000002675000-memory.dmp family_glupteba behavioral1/memory/824-152-0x0000000000400000-0x0000000002675000-memory.dmp family_glupteba behavioral1/memory/1028-160-0x0000000000400000-0x0000000002675000-memory.dmp family_glupteba behavioral1/memory/824-164-0x0000000000400000-0x0000000002675000-memory.dmp family_glupteba behavioral1/memory/1028-167-0x0000000000400000-0x0000000002675000-memory.dmp family_glupteba behavioral1/memory/824-174-0x0000000000400000-0x0000000002675000-memory.dmp family_glupteba behavioral1/memory/824-206-0x0000000000400000-0x0000000002675000-memory.dmp family_glupteba behavioral1/memory/1028-210-0x0000000000400000-0x0000000002675000-memory.dmp family_glupteba behavioral1/memory/824-238-0x0000000000400000-0x0000000002675000-memory.dmp family_glupteba behavioral1/memory/1028-240-0x0000000000400000-0x0000000002675000-memory.dmp family_glupteba behavioral1/memory/1028-310-0x0000000000400000-0x0000000002675000-memory.dmp family_glupteba behavioral1/memory/824-311-0x0000000000400000-0x0000000002675000-memory.dmp family_glupteba behavioral1/memory/1736-351-0x0000000000400000-0x0000000002675000-memory.dmp family_glupteba behavioral1/memory/928-352-0x0000000000400000-0x0000000002675000-memory.dmp family_glupteba behavioral1/memory/1736-387-0x0000000000400000-0x0000000002675000-memory.dmp family_glupteba behavioral1/memory/928-390-0x0000000000400000-0x0000000002675000-memory.dmp family_glupteba behavioral1/memory/1736-455-0x0000000000400000-0x0000000002675000-memory.dmp family_glupteba behavioral1/memory/928-457-0x0000000000400000-0x0000000002675000-memory.dmp family_glupteba behavioral1/memory/1736-535-0x0000000000400000-0x0000000002675000-memory.dmp family_glupteba behavioral1/memory/928-537-0x0000000000400000-0x0000000002675000-memory.dmp family_glupteba -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 5 IoCs
Processes:
latestX.exedescription pid process target process PID 4768 created 3164 4768 latestX.exe Explorer.EXE PID 4768 created 3164 4768 latestX.exe Explorer.EXE PID 4768 created 3164 4768 latestX.exe Explorer.EXE PID 4768 created 3164 4768 latestX.exe Explorer.EXE PID 4768 created 3164 4768 latestX.exe Explorer.EXE -
Drops file in Drivers directory 1 IoCs
Processes:
latestX.exedescription ioc process File created C:\Windows\System32\drivers\etc\hosts latestX.exe -
Modifies Windows Firewall 1 TTPs 2 IoCs
-
Stops running service(s) 3 TTPs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
70af1a1c350554270883747e70ff85910cb2cc2c02d3ec133b4457100a05694d.exekos1.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation 70af1a1c350554270883747e70ff85910cb2cc2c02d3ec133b4457100a05694d.exe Key value queried \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation kos1.exe -
Executes dropped EXE 14 IoCs
Processes:
toolspub2.exee0cbefcb1af40c7d4aff4aca26621a98.exekos1.exelatestX.exeset16.exe31839b57a4f11171d6abc8bbc4451ee4.exesvchost.exeis-6B7R1.tmptoolspub2.exepreviewer.exepreviewer.exe31839b57a4f11171d6abc8bbc4451ee4.exee0cbefcb1af40c7d4aff4aca26621a98.exeupdater.exepid process 2396 toolspub2.exe 824 e0cbefcb1af40c7d4aff4aca26621a98.exe 4112 kos1.exe 4768 latestX.exe 1952 set16.exe 1028 31839b57a4f11171d6abc8bbc4451ee4.exe 344 svchost.exe 4448 is-6B7R1.tmp 3892 toolspub2.exe 2976 previewer.exe 4620 previewer.exe 1736 31839b57a4f11171d6abc8bbc4451ee4.exe 928 e0cbefcb1af40c7d4aff4aca26621a98.exe 4488 updater.exe -
Loads dropped DLL 3 IoCs
Processes:
is-6B7R1.tmppid process 4448 is-6B7R1.tmp 4448 is-6B7R1.tmp 4448 is-6B7R1.tmp -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Drops file in System32 directory 3 IoCs
Processes:
powershell.exepowershell.exedescription ioc process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
toolspub2.exedescription pid process target process PID 2396 set thread context of 3892 2396 toolspub2.exe toolspub2.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 2 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
Processes:
e0cbefcb1af40c7d4aff4aca26621a98.exe31839b57a4f11171d6abc8bbc4451ee4.exedescription ioc process File opened (read-only) \??\VBoxMiniRdrDN e0cbefcb1af40c7d4aff4aca26621a98.exe File opened (read-only) \??\VBoxMiniRdrDN 31839b57a4f11171d6abc8bbc4451ee4.exe -
Drops file in Program Files directory 8 IoCs
Processes:
is-6B7R1.tmplatestX.exedescription ioc process File opened for modification C:\Program Files (x86)\PA Previewer\previewer.exe is-6B7R1.tmp File created C:\Program Files\Google\Chrome\updater.exe latestX.exe File created C:\Program Files (x86)\PA Previewer\unins000.dat is-6B7R1.tmp File created C:\Program Files (x86)\PA Previewer\is-4ACBC.tmp is-6B7R1.tmp File created C:\Program Files (x86)\PA Previewer\is-2Q8OO.tmp is-6B7R1.tmp File created C:\Program Files (x86)\PA Previewer\is-S373S.tmp is-6B7R1.tmp File created C:\Program Files (x86)\PA Previewer\is-QVO4O.tmp is-6B7R1.tmp File opened for modification C:\Program Files (x86)\PA Previewer\unins000.dat is-6B7R1.tmp -
Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exepid process 3936 sc.exe 4148 sc.exe 3444 sc.exe 4652 sc.exe 448 sc.exe 1420 sc.exe 3396 sc.exe 2356 sc.exe 4744 sc.exe 3148 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 2392 824 WerFault.exe e0cbefcb1af40c7d4aff4aca26621a98.exe 5068 1736 WerFault.exe 31839b57a4f11171d6abc8bbc4451ee4.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
toolspub2.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspub2.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspub2.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspub2.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 4608 schtasks.exe 3964 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
powershell.exe31839b57a4f11171d6abc8bbc4451ee4.exepowershell.exepowershell.exepowershell.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2532 = "Chatham Islands Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-871 = "Pakistan Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-212 = "Pacific Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-11 = "Azores Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-371 = "Jerusalem Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1042 = "Ulaanbaatar Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1022 = "Bangladesh Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1021 = "Bangladesh Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-271 = "Greenwich Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2341 = "Haiti Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-181 = "Mountain Daylight Time (Mexico)" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-342 = "Egypt Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-435 = "Georgian Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-132 = "US Eastern Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-672 = "AUS Eastern Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-384 = "Namibia Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2772 = "Omsk Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-232 = "Hawaiian Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-592 = "Malay Peninsula Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-292 = "Central European Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2162 = "Altai Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2372 = "Easter Island Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-392 = "Arab Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2002 = "Cabo Verde Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-981 = "Kamchatka Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1802 = "Line Islands Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-3052 = "Qyzylorda Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-202 = "US Mountain Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-449 = "Azerbaijan Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2432 = "Cuba Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1822 = "Russia TZ 1 Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-931 = "Coordinated Universal Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1662 = "Bahia Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-571 = "China Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-92 = "Pacific SA Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-962 = "Paraguay Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-662 = "Cen. Australia Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-741 = "New Zealand Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2041 = "Eastern Daylight Time (Mexico)" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2871 = "Magallanes Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-152 = "Central America Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-32 = "Mid-Atlantic Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
toolspub2.exeExplorer.EXEpid process 3892 toolspub2.exe 3892 toolspub2.exe 3164 Explorer.EXE 3164 Explorer.EXE 3164 Explorer.EXE 3164 Explorer.EXE 3164 Explorer.EXE 3164 Explorer.EXE 3164 Explorer.EXE 3164 Explorer.EXE 3164 Explorer.EXE 3164 Explorer.EXE 3164 Explorer.EXE 3164 Explorer.EXE 3164 Explorer.EXE 3164 Explorer.EXE 3164 Explorer.EXE 3164 Explorer.EXE 3164 Explorer.EXE 3164 Explorer.EXE 3164 Explorer.EXE 3164 Explorer.EXE 3164 Explorer.EXE 3164 Explorer.EXE 3164 Explorer.EXE 3164 Explorer.EXE 3164 Explorer.EXE 3164 Explorer.EXE 3164 Explorer.EXE 3164 Explorer.EXE 3164 Explorer.EXE 3164 Explorer.EXE 3164 Explorer.EXE 3164 Explorer.EXE 3164 Explorer.EXE 3164 Explorer.EXE 3164 Explorer.EXE 3164 Explorer.EXE 3164 Explorer.EXE 3164 Explorer.EXE 3164 Explorer.EXE 3164 Explorer.EXE 3164 Explorer.EXE 3164 Explorer.EXE 3164 Explorer.EXE 3164 Explorer.EXE 3164 Explorer.EXE 3164 Explorer.EXE 3164 Explorer.EXE 3164 Explorer.EXE 3164 Explorer.EXE 3164 Explorer.EXE 3164 Explorer.EXE 3164 Explorer.EXE 3164 Explorer.EXE 3164 Explorer.EXE 3164 Explorer.EXE 3164 Explorer.EXE 3164 Explorer.EXE 3164 Explorer.EXE 3164 Explorer.EXE 3164 Explorer.EXE 3164 Explorer.EXE 3164 Explorer.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3164 Explorer.EXE -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
toolspub2.exepid process 3892 toolspub2.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
svchost.exepreviewer.exeExplorer.EXEpreviewer.exepowershell.exepowershell.exepowershell.exepowershell.exeWerFault.exepowercfg.exesc.exepowercfg.exedescription pid process Token: SeDebugPrivilege 344 svchost.exe Token: SeDebugPrivilege 2976 previewer.exe Token: SeShutdownPrivilege 3164 Explorer.EXE Token: SeCreatePagefilePrivilege 3164 Explorer.EXE Token: SeShutdownPrivilege 3164 Explorer.EXE Token: SeCreatePagefilePrivilege 3164 Explorer.EXE Token: SeShutdownPrivilege 3164 Explorer.EXE Token: SeCreatePagefilePrivilege 3164 Explorer.EXE Token: SeShutdownPrivilege 3164 Explorer.EXE Token: SeCreatePagefilePrivilege 3164 Explorer.EXE Token: SeShutdownPrivilege 3164 Explorer.EXE Token: SeCreatePagefilePrivilege 3164 Explorer.EXE Token: SeDebugPrivilege 4620 previewer.exe Token: SeShutdownPrivilege 3164 Explorer.EXE Token: SeCreatePagefilePrivilege 3164 Explorer.EXE Token: SeDebugPrivilege 2044 powershell.exe Token: SeDebugPrivilege 5040 powershell.exe Token: SeDebugPrivilege 4612 powershell.exe Token: SeDebugPrivilege 3260 powershell.exe Token: SeShutdownPrivilege 1364 WerFault.exe Token: SeCreatePagefilePrivilege 1364 WerFault.exe Token: SeShutdownPrivilege 852 powercfg.exe Token: SeCreatePagefilePrivilege 852 powercfg.exe Token: SeShutdownPrivilege 4652 sc.exe Token: SeCreatePagefilePrivilege 4652 sc.exe Token: SeShutdownPrivilege 2596 powercfg.exe Token: SeCreatePagefilePrivilege 2596 powercfg.exe Token: SeIncreaseQuotaPrivilege 3260 powershell.exe Token: SeSecurityPrivilege 3260 powershell.exe Token: SeTakeOwnershipPrivilege 3260 powershell.exe Token: SeLoadDriverPrivilege 3260 powershell.exe Token: SeSystemProfilePrivilege 3260 powershell.exe Token: SeSystemtimePrivilege 3260 powershell.exe Token: SeProfSingleProcessPrivilege 3260 powershell.exe Token: SeIncBasePriorityPrivilege 3260 powershell.exe Token: SeCreatePagefilePrivilege 3260 powershell.exe Token: SeBackupPrivilege 3260 powershell.exe Token: SeRestorePrivilege 3260 powershell.exe Token: SeShutdownPrivilege 3260 powershell.exe Token: SeDebugPrivilege 3260 powershell.exe Token: SeSystemEnvironmentPrivilege 3260 powershell.exe Token: SeRemoteShutdownPrivilege 3260 powershell.exe Token: SeUndockPrivilege 3260 powershell.exe Token: SeManageVolumePrivilege 3260 powershell.exe Token: 33 3260 powershell.exe Token: 34 3260 powershell.exe Token: 35 3260 powershell.exe Token: 36 3260 powershell.exe Token: SeIncreaseQuotaPrivilege 3260 powershell.exe Token: SeSecurityPrivilege 3260 powershell.exe Token: SeTakeOwnershipPrivilege 3260 powershell.exe Token: SeLoadDriverPrivilege 3260 powershell.exe Token: SeSystemProfilePrivilege 3260 powershell.exe Token: SeSystemtimePrivilege 3260 powershell.exe Token: SeProfSingleProcessPrivilege 3260 powershell.exe Token: SeIncBasePriorityPrivilege 3260 powershell.exe Token: SeCreatePagefilePrivilege 3260 powershell.exe Token: SeBackupPrivilege 3260 powershell.exe Token: SeRestorePrivilege 3260 powershell.exe Token: SeShutdownPrivilege 3260 powershell.exe Token: SeDebugPrivilege 3260 powershell.exe Token: SeSystemEnvironmentPrivilege 3260 powershell.exe Token: SeRemoteShutdownPrivilege 3260 powershell.exe Token: SeUndockPrivilege 3260 powershell.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
70af1a1c350554270883747e70ff85910cb2cc2c02d3ec133b4457100a05694d.exekos1.exeset16.exetoolspub2.exeis-6B7R1.tmpnet.exe31839b57a4f11171d6abc8bbc4451ee4.exee0cbefcb1af40c7d4aff4aca26621a98.execmd.execmd.exedescription pid process target process PID 2772 wrote to memory of 2396 2772 70af1a1c350554270883747e70ff85910cb2cc2c02d3ec133b4457100a05694d.exe toolspub2.exe PID 2772 wrote to memory of 2396 2772 70af1a1c350554270883747e70ff85910cb2cc2c02d3ec133b4457100a05694d.exe toolspub2.exe PID 2772 wrote to memory of 2396 2772 70af1a1c350554270883747e70ff85910cb2cc2c02d3ec133b4457100a05694d.exe toolspub2.exe PID 2772 wrote to memory of 824 2772 70af1a1c350554270883747e70ff85910cb2cc2c02d3ec133b4457100a05694d.exe e0cbefcb1af40c7d4aff4aca26621a98.exe PID 2772 wrote to memory of 824 2772 70af1a1c350554270883747e70ff85910cb2cc2c02d3ec133b4457100a05694d.exe e0cbefcb1af40c7d4aff4aca26621a98.exe PID 2772 wrote to memory of 824 2772 70af1a1c350554270883747e70ff85910cb2cc2c02d3ec133b4457100a05694d.exe e0cbefcb1af40c7d4aff4aca26621a98.exe PID 2772 wrote to memory of 4112 2772 70af1a1c350554270883747e70ff85910cb2cc2c02d3ec133b4457100a05694d.exe kos1.exe PID 2772 wrote to memory of 4112 2772 70af1a1c350554270883747e70ff85910cb2cc2c02d3ec133b4457100a05694d.exe kos1.exe PID 2772 wrote to memory of 4112 2772 70af1a1c350554270883747e70ff85910cb2cc2c02d3ec133b4457100a05694d.exe kos1.exe PID 2772 wrote to memory of 4768 2772 70af1a1c350554270883747e70ff85910cb2cc2c02d3ec133b4457100a05694d.exe latestX.exe PID 2772 wrote to memory of 4768 2772 70af1a1c350554270883747e70ff85910cb2cc2c02d3ec133b4457100a05694d.exe latestX.exe PID 2772 wrote to memory of 1028 2772 70af1a1c350554270883747e70ff85910cb2cc2c02d3ec133b4457100a05694d.exe 31839b57a4f11171d6abc8bbc4451ee4.exe PID 2772 wrote to memory of 1028 2772 70af1a1c350554270883747e70ff85910cb2cc2c02d3ec133b4457100a05694d.exe 31839b57a4f11171d6abc8bbc4451ee4.exe PID 2772 wrote to memory of 1028 2772 70af1a1c350554270883747e70ff85910cb2cc2c02d3ec133b4457100a05694d.exe 31839b57a4f11171d6abc8bbc4451ee4.exe PID 4112 wrote to memory of 1952 4112 kos1.exe set16.exe PID 4112 wrote to memory of 1952 4112 kos1.exe set16.exe PID 4112 wrote to memory of 1952 4112 kos1.exe set16.exe PID 4112 wrote to memory of 344 4112 kos1.exe svchost.exe PID 4112 wrote to memory of 344 4112 kos1.exe svchost.exe PID 1952 wrote to memory of 4448 1952 set16.exe is-6B7R1.tmp PID 1952 wrote to memory of 4448 1952 set16.exe is-6B7R1.tmp PID 1952 wrote to memory of 4448 1952 set16.exe is-6B7R1.tmp PID 2396 wrote to memory of 3892 2396 toolspub2.exe toolspub2.exe PID 2396 wrote to memory of 3892 2396 toolspub2.exe toolspub2.exe PID 2396 wrote to memory of 3892 2396 toolspub2.exe toolspub2.exe PID 2396 wrote to memory of 3892 2396 toolspub2.exe toolspub2.exe PID 2396 wrote to memory of 3892 2396 toolspub2.exe toolspub2.exe PID 2396 wrote to memory of 3892 2396 toolspub2.exe toolspub2.exe PID 4448 wrote to memory of 2272 4448 is-6B7R1.tmp net.exe PID 4448 wrote to memory of 2272 4448 is-6B7R1.tmp net.exe PID 4448 wrote to memory of 2272 4448 is-6B7R1.tmp net.exe PID 4448 wrote to memory of 2976 4448 is-6B7R1.tmp previewer.exe PID 4448 wrote to memory of 2976 4448 is-6B7R1.tmp previewer.exe PID 4448 wrote to memory of 2976 4448 is-6B7R1.tmp previewer.exe PID 4448 wrote to memory of 4620 4448 is-6B7R1.tmp previewer.exe PID 4448 wrote to memory of 4620 4448 is-6B7R1.tmp previewer.exe PID 4448 wrote to memory of 4620 4448 is-6B7R1.tmp previewer.exe PID 2272 wrote to memory of 2488 2272 net.exe net1.exe PID 2272 wrote to memory of 2488 2272 net.exe net1.exe PID 2272 wrote to memory of 2488 2272 net.exe net1.exe PID 1028 wrote to memory of 2044 1028 31839b57a4f11171d6abc8bbc4451ee4.exe powershell.exe PID 1028 wrote to memory of 2044 1028 31839b57a4f11171d6abc8bbc4451ee4.exe powershell.exe PID 1028 wrote to memory of 2044 1028 31839b57a4f11171d6abc8bbc4451ee4.exe powershell.exe PID 824 wrote to memory of 5040 824 e0cbefcb1af40c7d4aff4aca26621a98.exe powershell.exe PID 824 wrote to memory of 5040 824 e0cbefcb1af40c7d4aff4aca26621a98.exe powershell.exe PID 824 wrote to memory of 5040 824 e0cbefcb1af40c7d4aff4aca26621a98.exe powershell.exe PID 772 wrote to memory of 3148 772 cmd.exe sc.exe PID 772 wrote to memory of 3148 772 cmd.exe sc.exe PID 772 wrote to memory of 448 772 cmd.exe sc.exe PID 772 wrote to memory of 448 772 cmd.exe sc.exe PID 772 wrote to memory of 3936 772 cmd.exe sc.exe PID 772 wrote to memory of 3936 772 cmd.exe sc.exe PID 772 wrote to memory of 1420 772 cmd.exe sc.exe PID 772 wrote to memory of 1420 772 cmd.exe sc.exe PID 772 wrote to memory of 4148 772 cmd.exe sc.exe PID 772 wrote to memory of 4148 772 cmd.exe sc.exe PID 4772 wrote to memory of 1364 4772 cmd.exe WerFault.exe PID 4772 wrote to memory of 1364 4772 cmd.exe WerFault.exe PID 4772 wrote to memory of 852 4772 cmd.exe powercfg.exe PID 4772 wrote to memory of 852 4772 cmd.exe powercfg.exe PID 4772 wrote to memory of 4652 4772 cmd.exe sc.exe PID 4772 wrote to memory of 4652 4772 cmd.exe sc.exe PID 4772 wrote to memory of 2596 4772 cmd.exe powercfg.exe PID 4772 wrote to memory of 2596 4772 cmd.exe powercfg.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\70af1a1c350554270883747e70ff85910cb2cc2c02d3ec133b4457100a05694d.exe"C:\Users\Admin\AppData\Local\Temp\70af1a1c350554270883747e70ff85910cb2cc2c02d3ec133b4457100a05694d.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"4⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\e0cbefcb1af40c7d4aff4aca26621a98.exe"C:\Users\Admin\AppData\Local\Temp\e0cbefcb1af40c7d4aff4aca26621a98.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\e0cbefcb1af40c7d4aff4aca26621a98.exe"C:\Users\Admin\AppData\Local\Temp\e0cbefcb1af40c7d4aff4aca26621a98.exe"4⤵
- Executes dropped EXE
- Checks for VirtualBox DLLs, possible anti-VM trick
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"5⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes6⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 824 -s 7324⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\kos1.exe"C:\Users\Admin\AppData\Local\Temp\kos1.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\set16.exe"C:\Users\Admin\AppData\Local\Temp\set16.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-2S7UN.tmp\is-6B7R1.tmp"C:\Users\Admin\AppData\Local\Temp\is-2S7UN.tmp\is-6B7R1.tmp" /SL4 $60176 "C:\Users\Admin\AppData\Local\Temp\set16.exe" 1232936 522245⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\PA Previewer\previewer.exe"C:\Program Files (x86)\PA Previewer\previewer.exe" -i6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 86⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 87⤵
-
C:\Program Files (x86)\PA Previewer\previewer.exe"C:\Program Files (x86)\PA Previewer\previewer.exe" -s6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\kos.exe"C:\Users\Admin\AppData\Local\Temp\kos.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\latestX.exe"C:\Users\Admin\AppData\Local\Temp\latestX.exe"3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"4⤵
- Executes dropped EXE
- Checks for VirtualBox DLLs, possible anti-VM trick
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"5⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes6⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F6⤵
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f6⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll6⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F6⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 8645⤵
- Program crash
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop bits3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop dosvc3⤵
- Launches sc.exe
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc2⤵
-
C:\Windows\System32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop bits3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop dosvc3⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }2⤵
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe2⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\updater.exe"C:\Program Files\Google\Chrome\updater.exe"1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 824 -ip 8241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1736 -ip 17361⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\PA Previewer\previewer.exeFilesize
1.9MB
MD527b85a95804a760da4dbee7ca800c9b4
SHA1f03136226bf3dd38ba0aa3aad1127ccab380197c
SHA256f98b98404ecf3871a10a290ade21ad77d0b2633f47247debc53d094b9bdff245
SHA512e760a15370272aa9541f1afceaaf4f5a8068dad21c6a8d50ebd01514e16bbc8f867c8af349080f3d1fa7a19eafe7cde74921d01716dea69ef801da1b74eae4a7
-
C:\Program Files (x86)\PA Previewer\previewer.exeFilesize
1.9MB
MD527b85a95804a760da4dbee7ca800c9b4
SHA1f03136226bf3dd38ba0aa3aad1127ccab380197c
SHA256f98b98404ecf3871a10a290ade21ad77d0b2633f47247debc53d094b9bdff245
SHA512e760a15370272aa9541f1afceaaf4f5a8068dad21c6a8d50ebd01514e16bbc8f867c8af349080f3d1fa7a19eafe7cde74921d01716dea69ef801da1b74eae4a7
-
C:\Program Files (x86)\PA Previewer\previewer.exeFilesize
1.9MB
MD527b85a95804a760da4dbee7ca800c9b4
SHA1f03136226bf3dd38ba0aa3aad1127ccab380197c
SHA256f98b98404ecf3871a10a290ade21ad77d0b2633f47247debc53d094b9bdff245
SHA512e760a15370272aa9541f1afceaaf4f5a8068dad21c6a8d50ebd01514e16bbc8f867c8af349080f3d1fa7a19eafe7cde74921d01716dea69ef801da1b74eae4a7
-
C:\Program Files\Google\Chrome\updater.exeFilesize
5.6MB
MD5bae29e49e8190bfbbf0d77ffab8de59d
SHA14a6352bb47c7e1666a60c76f9b17ca4707872bd9
SHA256f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87
SHA5129e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2
-
C:\Program Files\Google\Chrome\updater.exeFilesize
5.6MB
MD5bae29e49e8190bfbbf0d77ffab8de59d
SHA14a6352bb47c7e1666a60c76f9b17ca4707872bd9
SHA256f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87
SHA5129e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
21KB
MD54a9ff82e60fcb5c7695a783a17500fcd
SHA18175edae4c4279f210a7832c007130564357934a
SHA256d7c1d20f1d9d690dad4bbd2b090e1f506ca8f52caf746c4e2dd125ffabfd5abf
SHA512a315cb682c042e5a0284ac1dc32b228a5a3c43e502255b01983fb57b75bd16cd34676ee4f09ddd7bef6a9aac8104e71a665e8a912562f5a52b7191ca58972afa
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5bd5940f08d0be56e65e5f2aaf47c538e
SHA1d7e31b87866e5e383ab5499da64aba50f03e8443
SHA2562d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6
SHA512c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406
-
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exeFilesize
4.2MB
MD5906e8dd59115761a98c0308313a2ad3b
SHA1b2f9debeea9624b2e64e8062bf40382318cc42bd
SHA25656d6788b4b40af4a7c0329a9d91b1b4407beef8bd9395ef852851f53a3d36dcf
SHA51218cbbddc8e85acb236cd15c122adaa9537efc18216c394ba368ab0e391afe40b3dd6130dc1c60bb812da616f37897725c0ea6a695a93e9b25eb665f82bca870e
-
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exeFilesize
4.2MB
MD5906e8dd59115761a98c0308313a2ad3b
SHA1b2f9debeea9624b2e64e8062bf40382318cc42bd
SHA25656d6788b4b40af4a7c0329a9d91b1b4407beef8bd9395ef852851f53a3d36dcf
SHA51218cbbddc8e85acb236cd15c122adaa9537efc18216c394ba368ab0e391afe40b3dd6130dc1c60bb812da616f37897725c0ea6a695a93e9b25eb665f82bca870e
-
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exeFilesize
4.2MB
MD5906e8dd59115761a98c0308313a2ad3b
SHA1b2f9debeea9624b2e64e8062bf40382318cc42bd
SHA25656d6788b4b40af4a7c0329a9d91b1b4407beef8bd9395ef852851f53a3d36dcf
SHA51218cbbddc8e85acb236cd15c122adaa9537efc18216c394ba368ab0e391afe40b3dd6130dc1c60bb812da616f37897725c0ea6a695a93e9b25eb665f82bca870e
-
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exeFilesize
4.2MB
MD5906e8dd59115761a98c0308313a2ad3b
SHA1b2f9debeea9624b2e64e8062bf40382318cc42bd
SHA25656d6788b4b40af4a7c0329a9d91b1b4407beef8bd9395ef852851f53a3d36dcf
SHA51218cbbddc8e85acb236cd15c122adaa9537efc18216c394ba368ab0e391afe40b3dd6130dc1c60bb812da616f37897725c0ea6a695a93e9b25eb665f82bca870e
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exeFilesize
116B
MD5ec6aae2bb7d8781226ea61adca8f0586
SHA1d82b3bad240f263c1b887c7c0cc4c2ff0e86dfe3
SHA256b02fffaba9e664ff7840c82b102d6851ec0bb148cec462cef40999545309e599
SHA512aa62a8cd02a03e4f462f76ae6ff2e43849052ce77cca3a2ccf593f6669425830d0910afac3cf2c46dd385454a6fb3b4bd604ae13b9586087d6f22de644f9dfc7
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_15ezfewy.k5y.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Users\Admin\AppData\Local\Temp\e0cbefcb1af40c7d4aff4aca26621a98.exeFilesize
4.2MB
MD54c05c54dd3007dced398eb41ab68992f
SHA11a737edff587c6acc830c8897ccf6128c718530c
SHA2567a0417d7440e50f8156d6487b9e58fd1c5cb55eafe6e2dc95ab1627f7b099e6a
SHA51271c1ebd7b0e6038fda5d970af409bf1a00171c44ade366482226348907e335abbd32c4daa89b0e3407f272e0302a9c0900120aec5ff57041fc26c91951815ca0
-
C:\Users\Admin\AppData\Local\Temp\e0cbefcb1af40c7d4aff4aca26621a98.exeFilesize
4.2MB
MD54c05c54dd3007dced398eb41ab68992f
SHA11a737edff587c6acc830c8897ccf6128c718530c
SHA2567a0417d7440e50f8156d6487b9e58fd1c5cb55eafe6e2dc95ab1627f7b099e6a
SHA51271c1ebd7b0e6038fda5d970af409bf1a00171c44ade366482226348907e335abbd32c4daa89b0e3407f272e0302a9c0900120aec5ff57041fc26c91951815ca0
-
C:\Users\Admin\AppData\Local\Temp\e0cbefcb1af40c7d4aff4aca26621a98.exeFilesize
4.2MB
MD54c05c54dd3007dced398eb41ab68992f
SHA11a737edff587c6acc830c8897ccf6128c718530c
SHA2567a0417d7440e50f8156d6487b9e58fd1c5cb55eafe6e2dc95ab1627f7b099e6a
SHA51271c1ebd7b0e6038fda5d970af409bf1a00171c44ade366482226348907e335abbd32c4daa89b0e3407f272e0302a9c0900120aec5ff57041fc26c91951815ca0
-
C:\Users\Admin\AppData\Local\Temp\e0cbefcb1af40c7d4aff4aca26621a98.exeFilesize
4.2MB
MD54c05c54dd3007dced398eb41ab68992f
SHA11a737edff587c6acc830c8897ccf6128c718530c
SHA2567a0417d7440e50f8156d6487b9e58fd1c5cb55eafe6e2dc95ab1627f7b099e6a
SHA51271c1ebd7b0e6038fda5d970af409bf1a00171c44ade366482226348907e335abbd32c4daa89b0e3407f272e0302a9c0900120aec5ff57041fc26c91951815ca0
-
C:\Users\Admin\AppData\Local\Temp\is-2S7UN.tmp\is-6B7R1.tmpFilesize
647KB
MD52fba5642cbcaa6857c3995ccb5d2ee2a
SHA191fe8cd860cba7551fbf78bc77cc34e34956e8cc
SHA256ddec51f3741f3988b9cc792f6f8fc0dfa2098ef0eb84c6a2af7f8da5a72b40fa
SHA51230613b43427d17115134798506f197c0f5f8b2b9f247668fa25b9dd4853bbd97ac1e27f4e3325dec4f6dfc0e448ebbddb2969ad1a1781aa59ebf522d436aed7c
-
C:\Users\Admin\AppData\Local\Temp\is-2S7UN.tmp\is-6B7R1.tmpFilesize
647KB
MD52fba5642cbcaa6857c3995ccb5d2ee2a
SHA191fe8cd860cba7551fbf78bc77cc34e34956e8cc
SHA256ddec51f3741f3988b9cc792f6f8fc0dfa2098ef0eb84c6a2af7f8da5a72b40fa
SHA51230613b43427d17115134798506f197c0f5f8b2b9f247668fa25b9dd4853bbd97ac1e27f4e3325dec4f6dfc0e448ebbddb2969ad1a1781aa59ebf522d436aed7c
-
C:\Users\Admin\AppData\Local\Temp\is-IIAQU.tmp\_isetup\_iscrypt.dllFilesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
C:\Users\Admin\AppData\Local\Temp\is-IIAQU.tmp\_isetup\_isdecmp.dllFilesize
32KB
MD5b4786eb1e1a93633ad1b4c112514c893
SHA1734750b771d0809c88508e4feb788d7701e6dada
SHA2562ae4169f721beb389a661e6dbb18bc84ef38556af1f46807da9d87aec2a6f06f
SHA5120882d2aa163ece22796f837111db0d55158098035005e57cd2e9b8d59dc2e582207840bf98bee534b81c368acf60ab5d8ecbe762209273bda067a215cdb2c0c6
-
C:\Users\Admin\AppData\Local\Temp\is-IIAQU.tmp\_isetup\_isdecmp.dllFilesize
32KB
MD5b4786eb1e1a93633ad1b4c112514c893
SHA1734750b771d0809c88508e4feb788d7701e6dada
SHA2562ae4169f721beb389a661e6dbb18bc84ef38556af1f46807da9d87aec2a6f06f
SHA5120882d2aa163ece22796f837111db0d55158098035005e57cd2e9b8d59dc2e582207840bf98bee534b81c368acf60ab5d8ecbe762209273bda067a215cdb2c0c6
-
C:\Users\Admin\AppData\Local\Temp\kos.exeFilesize
8KB
MD5076ab7d1cc5150a5e9f8745cc5f5fb6c
SHA17b40783a27a38106e2cc91414f2bc4d8b484c578
SHA256d1b71081d7ba414b589338329f278ba51c6ccf542d74f131f96c2337ee0a4c90
SHA51275e274a654e88feb0d66156f387bc5e420811f4f62939396a7455d12e835d7e134b2579ab59976c591b416d1ec1acdf05e9eb290c8f01383c6a50bf43854420b
-
C:\Users\Admin\AppData\Local\Temp\kos.exeFilesize
8KB
MD5076ab7d1cc5150a5e9f8745cc5f5fb6c
SHA17b40783a27a38106e2cc91414f2bc4d8b484c578
SHA256d1b71081d7ba414b589338329f278ba51c6ccf542d74f131f96c2337ee0a4c90
SHA51275e274a654e88feb0d66156f387bc5e420811f4f62939396a7455d12e835d7e134b2579ab59976c591b416d1ec1acdf05e9eb290c8f01383c6a50bf43854420b
-
C:\Users\Admin\AppData\Local\Temp\kos.exeFilesize
8KB
MD5076ab7d1cc5150a5e9f8745cc5f5fb6c
SHA17b40783a27a38106e2cc91414f2bc4d8b484c578
SHA256d1b71081d7ba414b589338329f278ba51c6ccf542d74f131f96c2337ee0a4c90
SHA51275e274a654e88feb0d66156f387bc5e420811f4f62939396a7455d12e835d7e134b2579ab59976c591b416d1ec1acdf05e9eb290c8f01383c6a50bf43854420b
-
C:\Users\Admin\AppData\Local\Temp\kos1.exeFilesize
1.4MB
MD585b698363e74ba3c08fc16297ddc284e
SHA1171cfea4a82a7365b241f16aebdb2aad29f4f7c0
SHA25678efcbb0c6eb6a4c76c036adc65154b8ff028849f79d508e45babfb527cb7cfe
SHA5127e4816c43e0addba088709948e8aedc9e39d6802c74a75cfbc2a0e739b44c5b5eef2bb2453b7032c758b0bdb38e4e7a598aa29be015796361b81d7f9e8027796
-
C:\Users\Admin\AppData\Local\Temp\kos1.exeFilesize
1.4MB
MD585b698363e74ba3c08fc16297ddc284e
SHA1171cfea4a82a7365b241f16aebdb2aad29f4f7c0
SHA25678efcbb0c6eb6a4c76c036adc65154b8ff028849f79d508e45babfb527cb7cfe
SHA5127e4816c43e0addba088709948e8aedc9e39d6802c74a75cfbc2a0e739b44c5b5eef2bb2453b7032c758b0bdb38e4e7a598aa29be015796361b81d7f9e8027796
-
C:\Users\Admin\AppData\Local\Temp\kos1.exeFilesize
1.4MB
MD585b698363e74ba3c08fc16297ddc284e
SHA1171cfea4a82a7365b241f16aebdb2aad29f4f7c0
SHA25678efcbb0c6eb6a4c76c036adc65154b8ff028849f79d508e45babfb527cb7cfe
SHA5127e4816c43e0addba088709948e8aedc9e39d6802c74a75cfbc2a0e739b44c5b5eef2bb2453b7032c758b0bdb38e4e7a598aa29be015796361b81d7f9e8027796
-
C:\Users\Admin\AppData\Local\Temp\latestX.exeFilesize
5.6MB
MD5bae29e49e8190bfbbf0d77ffab8de59d
SHA14a6352bb47c7e1666a60c76f9b17ca4707872bd9
SHA256f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87
SHA5129e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2
-
C:\Users\Admin\AppData\Local\Temp\latestX.exeFilesize
5.6MB
MD5bae29e49e8190bfbbf0d77ffab8de59d
SHA14a6352bb47c7e1666a60c76f9b17ca4707872bd9
SHA256f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87
SHA5129e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2
-
C:\Users\Admin\AppData\Local\Temp\latestX.exeFilesize
5.6MB
MD5bae29e49e8190bfbbf0d77ffab8de59d
SHA14a6352bb47c7e1666a60c76f9b17ca4707872bd9
SHA256f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87
SHA5129e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2
-
C:\Users\Admin\AppData\Local\Temp\set16.exeFilesize
1.4MB
MD522d5269955f256a444bd902847b04a3b
SHA141a83de3273270c3bd5b2bd6528bdc95766aa268
SHA256ab16986253bd187e3134f27495ef0db4b648f769721bc8c84b708c7ba69156fd
SHA512d85ada5d8c2c02932a79241a484b088ba70bda0497fd8ad638300935a16841d7cbc8258be93055907cb533bc534fdd48c7c91109fa22f87e65a6b374cd51055c
-
C:\Users\Admin\AppData\Local\Temp\set16.exeFilesize
1.4MB
MD522d5269955f256a444bd902847b04a3b
SHA141a83de3273270c3bd5b2bd6528bdc95766aa268
SHA256ab16986253bd187e3134f27495ef0db4b648f769721bc8c84b708c7ba69156fd
SHA512d85ada5d8c2c02932a79241a484b088ba70bda0497fd8ad638300935a16841d7cbc8258be93055907cb533bc534fdd48c7c91109fa22f87e65a6b374cd51055c
-
C:\Users\Admin\AppData\Local\Temp\set16.exeFilesize
1.4MB
MD522d5269955f256a444bd902847b04a3b
SHA141a83de3273270c3bd5b2bd6528bdc95766aa268
SHA256ab16986253bd187e3134f27495ef0db4b648f769721bc8c84b708c7ba69156fd
SHA512d85ada5d8c2c02932a79241a484b088ba70bda0497fd8ad638300935a16841d7cbc8258be93055907cb533bc534fdd48c7c91109fa22f87e65a6b374cd51055c
-
C:\Users\Admin\AppData\Local\Temp\toolspub2.exeFilesize
292KB
MD539baa178f1fc5ec2111eb95008ee6e38
SHA18a36b6d95d6453e9eed8df12eaed71580384f2a3
SHA2560990c73e4389e3b912fff43e2ed3363e9f9af367741fc285b3aa5168b5646c74
SHA5123b50e27da905b4c8cd8a5dcc7c4c37015d1c1bc3187f1572d3bea7caffdd278a00f73844024cc04d06f47374425fc4c7cbfa4752678f9f40269d2979369b2d74
-
C:\Users\Admin\AppData\Local\Temp\toolspub2.exeFilesize
292KB
MD539baa178f1fc5ec2111eb95008ee6e38
SHA18a36b6d95d6453e9eed8df12eaed71580384f2a3
SHA2560990c73e4389e3b912fff43e2ed3363e9f9af367741fc285b3aa5168b5646c74
SHA5123b50e27da905b4c8cd8a5dcc7c4c37015d1c1bc3187f1572d3bea7caffdd278a00f73844024cc04d06f47374425fc4c7cbfa4752678f9f40269d2979369b2d74
-
C:\Users\Admin\AppData\Local\Temp\toolspub2.exeFilesize
292KB
MD539baa178f1fc5ec2111eb95008ee6e38
SHA18a36b6d95d6453e9eed8df12eaed71580384f2a3
SHA2560990c73e4389e3b912fff43e2ed3363e9f9af367741fc285b3aa5168b5646c74
SHA5123b50e27da905b4c8cd8a5dcc7c4c37015d1c1bc3187f1572d3bea7caffdd278a00f73844024cc04d06f47374425fc4c7cbfa4752678f9f40269d2979369b2d74
-
C:\Users\Admin\AppData\Local\Temp\toolspub2.exeFilesize
292KB
MD539baa178f1fc5ec2111eb95008ee6e38
SHA18a36b6d95d6453e9eed8df12eaed71580384f2a3
SHA2560990c73e4389e3b912fff43e2ed3363e9f9af367741fc285b3aa5168b5646c74
SHA5123b50e27da905b4c8cd8a5dcc7c4c37015d1c1bc3187f1572d3bea7caffdd278a00f73844024cc04d06f47374425fc4c7cbfa4752678f9f40269d2979369b2d74
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD543a8efe1440b186b5bd060882efb921a
SHA1bb4423afc7c1a73397f2beb2ecb6f0170c246b57
SHA2561186155a3c341f0b1261b9fdcba53973fdae921bfe184d0aad293657b81d9302
SHA5127c4b2ec0e59a1e28677412f35bb5275540f1f6d7b1dd03bb51ec6b8e39a8ee7adfc451cf7da56c1d02fd0bc1f3eeace39a787b92e745dd148bc93b13cddf42f2
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD543a8efe1440b186b5bd060882efb921a
SHA1bb4423afc7c1a73397f2beb2ecb6f0170c246b57
SHA2561186155a3c341f0b1261b9fdcba53973fdae921bfe184d0aad293657b81d9302
SHA5127c4b2ec0e59a1e28677412f35bb5275540f1f6d7b1dd03bb51ec6b8e39a8ee7adfc451cf7da56c1d02fd0bc1f3eeace39a787b92e745dd148bc93b13cddf42f2
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5a728ebb394a13b4716f881a5a7b24ced
SHA182f74f9efb10e3ba5125bab8a7b6853f42477c90
SHA256d6d1e129391709cb56e1792c0722145a6995e12fd3b4959d69d10960cd2e6b74
SHA512ab1e6c4ab85b018c7f125e2e111660f3f6c94a58c0996890bd87d1bcc8ecc9a9b7d39a10b539052d854d6e7ff2ffb1748f1bdc503aa5a00abb950567e663451c
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5a728ebb394a13b4716f881a5a7b24ced
SHA182f74f9efb10e3ba5125bab8a7b6853f42477c90
SHA256d6d1e129391709cb56e1792c0722145a6995e12fd3b4959d69d10960cd2e6b74
SHA512ab1e6c4ab85b018c7f125e2e111660f3f6c94a58c0996890bd87d1bcc8ecc9a9b7d39a10b539052d854d6e7ff2ffb1748f1bdc503aa5a00abb950567e663451c
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5baafcace010d470fafa38dcaca700d10
SHA1b2494ef534c935895af28e6bfb3e10f63df506cb
SHA256d478e04e4b730ecaa9f2e17d8e9b70df29d013af4064987063e27d8a4aca8394
SHA51227e48d7bd6df0500e308192e0026d22d179dae36e155df3df47438379ae195b4b0e234d355eafd69c9f356629ea62a2c2b24c0369565a98e41c4b07324e79932
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5baafcace010d470fafa38dcaca700d10
SHA1b2494ef534c935895af28e6bfb3e10f63df506cb
SHA256d478e04e4b730ecaa9f2e17d8e9b70df29d013af4064987063e27d8a4aca8394
SHA51227e48d7bd6df0500e308192e0026d22d179dae36e155df3df47438379ae195b4b0e234d355eafd69c9f356629ea62a2c2b24c0369565a98e41c4b07324e79932
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5c3f06fcd8e8601719d6ca3570b273691
SHA12be52f315e35e47469cd382b0c4b887c8d72dc34
SHA25675d503173b0e85d87d0fe57b6c4dd8b0e8af1b2808df17f403879fd3c5af1706
SHA5128328d0b8ce0572135ff76c0bd922246d459cc2edd588cfeeb7aca5e44cd993b705a833cc86669af916e7b52ddaca5af00e1327220ba7cc364cdac205f4d1ba3a
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD533d8b61a2dd3ae34445c324180452b0e
SHA1b864dc490006dea76f07c7c0e6031eb98276a3d8
SHA2561cdac96940e798afc76a22b94d312a19cb0a0baf4d030c167c0359ab380472d8
SHA51282d5e62c183f3c17ca5c0d2605d2c2c5895e486948fb09fc4d5715bcbfb14401c8c04b3bb05131986c3f5e8001e0acfe61b76ece7ca0778d85fb4a57ce372d3e
-
C:\Windows\System32\drivers\etc\hostsFilesize
3KB
MD500930b40cba79465b7a38ed0449d1449
SHA14b25a89ee28b20ba162f23772ddaf017669092a5
SHA256eda1aae2c8fce700e3bdbe0186cf3db88400cf0ac13ec736e84dacba61628a01
SHA512cbe4760ec041e7da7ab86474d5c82969cfccb8ccc5dbdac9436862d5b1b86210ab90754d3c8da5724176570d8842e57a716a281acba8719e90098a6f61a17c62
-
C:\Windows\rss\csrss.exeFilesize
4.2MB
MD5906e8dd59115761a98c0308313a2ad3b
SHA1b2f9debeea9624b2e64e8062bf40382318cc42bd
SHA25656d6788b4b40af4a7c0329a9d91b1b4407beef8bd9395ef852851f53a3d36dcf
SHA51218cbbddc8e85acb236cd15c122adaa9537efc18216c394ba368ab0e391afe40b3dd6130dc1c60bb812da616f37897725c0ea6a695a93e9b25eb665f82bca870e
-
C:\Windows\rss\csrss.exeFilesize
4.2MB
MD5906e8dd59115761a98c0308313a2ad3b
SHA1b2f9debeea9624b2e64e8062bf40382318cc42bd
SHA25656d6788b4b40af4a7c0329a9d91b1b4407beef8bd9395ef852851f53a3d36dcf
SHA51218cbbddc8e85acb236cd15c122adaa9537efc18216c394ba368ab0e391afe40b3dd6130dc1c60bb812da616f37897725c0ea6a695a93e9b25eb665f82bca870e
-
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
4KB
MD5bdb25c22d14ec917e30faf353826c5de
SHA16c2feb9cea9237bc28842ebf2fea68b3bd7ad190
SHA256e3274ce8296f2cd20e3189576fbadbfa0f1817cdf313487945c80e968589a495
SHA512b5eddbfd4748298a302e2963cfd12d849130b6dcb8f0f85a2a623caed0ff9bd88f4ec726f646dbebfca4964adc35f882ec205113920cb546cc08193739d6728c
-
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5b42c70c1dbf0d1d477ec86902db9e986
SHA11d1c0a670748b3d10bee8272e5d67a4fabefd31f
SHA2568ed3b348989cdc967d1fc0e887b2a2f5a656680d8d14ebd3cb71a10c2f55867a
SHA51257fb278a8b2e83d01fac2a031c90e0e2bd5e4c1a360cfa4308490eb07e1b9d265b1f28399d0f10b141a6438ba92dd5f9ce4f18530ec277fece0eb7678041cbc5
-
memory/344-144-0x00007FFDA01E0000-0x00007FFDA0CA1000-memory.dmpFilesize
10.8MB
-
memory/344-171-0x00007FFDA01E0000-0x00007FFDA0CA1000-memory.dmpFilesize
10.8MB
-
memory/344-91-0x000000001B690000-0x000000001B6A0000-memory.dmpFilesize
64KB
-
memory/344-87-0x00007FFDA01E0000-0x00007FFDA0CA1000-memory.dmpFilesize
10.8MB
-
memory/344-148-0x000000001B690000-0x000000001B6A0000-memory.dmpFilesize
64KB
-
memory/344-82-0x0000000000B80000-0x0000000000B88000-memory.dmpFilesize
32KB
-
memory/824-174-0x0000000000400000-0x0000000002675000-memory.dmpFilesize
34.5MB
-
memory/824-172-0x00000000042B0000-0x00000000046B8000-memory.dmpFilesize
4.0MB
-
memory/824-152-0x0000000000400000-0x0000000002675000-memory.dmpFilesize
34.5MB
-
memory/824-164-0x0000000000400000-0x0000000002675000-memory.dmpFilesize
34.5MB
-
memory/824-118-0x00000000047C0000-0x00000000050AB000-memory.dmpFilesize
8.9MB
-
memory/824-115-0x00000000042B0000-0x00000000046B8000-memory.dmpFilesize
4.0MB
-
memory/824-206-0x0000000000400000-0x0000000002675000-memory.dmpFilesize
34.5MB
-
memory/824-311-0x0000000000400000-0x0000000002675000-memory.dmpFilesize
34.5MB
-
memory/824-238-0x0000000000400000-0x0000000002675000-memory.dmpFilesize
34.5MB
-
memory/824-138-0x0000000000400000-0x0000000002675000-memory.dmpFilesize
34.5MB
-
memory/928-390-0x0000000000400000-0x0000000002675000-memory.dmpFilesize
34.5MB
-
memory/928-352-0x0000000000400000-0x0000000002675000-memory.dmpFilesize
34.5MB
-
memory/928-537-0x0000000000400000-0x0000000002675000-memory.dmpFilesize
34.5MB
-
memory/928-457-0x0000000000400000-0x0000000002675000-memory.dmpFilesize
34.5MB
-
memory/1028-143-0x0000000004270000-0x0000000004673000-memory.dmpFilesize
4.0MB
-
memory/1028-149-0x0000000000400000-0x0000000002675000-memory.dmpFilesize
34.5MB
-
memory/1028-160-0x0000000000400000-0x0000000002675000-memory.dmpFilesize
34.5MB
-
memory/1028-167-0x0000000000400000-0x0000000002675000-memory.dmpFilesize
34.5MB
-
memory/1028-210-0x0000000000400000-0x0000000002675000-memory.dmpFilesize
34.5MB
-
memory/1028-310-0x0000000000400000-0x0000000002675000-memory.dmpFilesize
34.5MB
-
memory/1028-240-0x0000000000400000-0x0000000002675000-memory.dmpFilesize
34.5MB
-
memory/1028-147-0x0000000004780000-0x000000000506B000-memory.dmpFilesize
8.9MB
-
memory/1028-205-0x0000000004270000-0x0000000004673000-memory.dmpFilesize
4.0MB
-
memory/1736-535-0x0000000000400000-0x0000000002675000-memory.dmpFilesize
34.5MB
-
memory/1736-387-0x0000000000400000-0x0000000002675000-memory.dmpFilesize
34.5MB
-
memory/1736-455-0x0000000000400000-0x0000000002675000-memory.dmpFilesize
34.5MB
-
memory/1736-351-0x0000000000400000-0x0000000002675000-memory.dmpFilesize
34.5MB
-
memory/1952-81-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/1952-146-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2044-177-0x0000000073740000-0x0000000073EF0000-memory.dmpFilesize
7.7MB
-
memory/2044-243-0x0000000073740000-0x0000000073EF0000-memory.dmpFilesize
7.7MB
-
memory/2044-247-0x0000000004B90000-0x0000000004BA0000-memory.dmpFilesize
64KB
-
memory/2044-203-0x0000000005B90000-0x0000000005EE4000-memory.dmpFilesize
3.3MB
-
memory/2044-184-0x0000000005A20000-0x0000000005A86000-memory.dmpFilesize
408KB
-
memory/2044-228-0x0000000006470000-0x00000000064B4000-memory.dmpFilesize
272KB
-
memory/2044-245-0x0000000004B90000-0x0000000004BA0000-memory.dmpFilesize
64KB
-
memory/2044-181-0x0000000004B90000-0x0000000004BA0000-memory.dmpFilesize
64KB
-
memory/2044-231-0x0000000004B90000-0x0000000004BA0000-memory.dmpFilesize
64KB
-
memory/2044-207-0x00000000060B0000-0x00000000060CE000-memory.dmpFilesize
120KB
-
memory/2044-235-0x0000000007260000-0x00000000072D6000-memory.dmpFilesize
472KB
-
memory/2044-236-0x0000000007960000-0x0000000007FDA000-memory.dmpFilesize
6.5MB
-
memory/2044-237-0x0000000007200000-0x000000000721A000-memory.dmpFilesize
104KB
-
memory/2044-175-0x00000000051D0000-0x00000000057F8000-memory.dmpFilesize
6.2MB
-
memory/2044-179-0x0000000004B90000-0x0000000004BA0000-memory.dmpFilesize
64KB
-
memory/2396-93-0x00000000022F0000-0x00000000023F0000-memory.dmpFilesize
1024KB
-
memory/2396-92-0x00000000022E0000-0x00000000022E9000-memory.dmpFilesize
36KB
-
memory/2772-0-0x0000000074E70000-0x0000000075620000-memory.dmpFilesize
7.7MB
-
memory/2772-1-0x0000000000F70000-0x0000000001F28000-memory.dmpFilesize
15.7MB
-
memory/2772-78-0x0000000074E70000-0x0000000075620000-memory.dmpFilesize
7.7MB
-
memory/2976-141-0x0000000000400000-0x00000000005F1000-memory.dmpFilesize
1.9MB
-
memory/2976-137-0x0000000000400000-0x00000000005F1000-memory.dmpFilesize
1.9MB
-
memory/3164-151-0x0000000007D60000-0x0000000007D76000-memory.dmpFilesize
88KB
-
memory/3892-153-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3892-96-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3892-94-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/4112-35-0x0000000000A80000-0x0000000000BF4000-memory.dmpFilesize
1.5MB
-
memory/4112-37-0x0000000074E70000-0x0000000075620000-memory.dmpFilesize
7.7MB
-
memory/4112-85-0x0000000074E70000-0x0000000075620000-memory.dmpFilesize
7.7MB
-
memory/4448-109-0x0000000000750000-0x0000000000751000-memory.dmpFilesize
4KB
-
memory/4448-162-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/4448-169-0x0000000000750000-0x0000000000751000-memory.dmpFilesize
4KB
-
memory/4488-353-0x00007FF79A020000-0x00007FF79A5C1000-memory.dmpFilesize
5.6MB
-
memory/4488-538-0x00007FF79A020000-0x00007FF79A5C1000-memory.dmpFilesize
5.6MB
-
memory/4612-213-0x000001E3DA4F0000-0x000001E3DA500000-memory.dmpFilesize
64KB
-
memory/4612-215-0x00007FFD9FDF0000-0x00007FFDA08B1000-memory.dmpFilesize
10.8MB
-
memory/4612-234-0x00007FFD9FDF0000-0x00007FFDA08B1000-memory.dmpFilesize
10.8MB
-
memory/4612-214-0x000001E3DA4F0000-0x000001E3DA500000-memory.dmpFilesize
64KB
-
memory/4612-227-0x000001E3DA4F0000-0x000001E3DA500000-memory.dmpFilesize
64KB
-
memory/4612-226-0x000001E3DAEF0000-0x000001E3DAF12000-memory.dmpFilesize
136KB
-
memory/4620-516-0x0000000000400000-0x00000000005F1000-memory.dmpFilesize
1.9MB
-
memory/4620-328-0x0000000000400000-0x00000000005F1000-memory.dmpFilesize
1.9MB
-
memory/4620-385-0x0000000000400000-0x00000000005F1000-memory.dmpFilesize
1.9MB
-
memory/4620-449-0x0000000000400000-0x00000000005F1000-memory.dmpFilesize
1.9MB
-
memory/4620-294-0x0000000000400000-0x00000000005F1000-memory.dmpFilesize
1.9MB
-
memory/4620-216-0x0000000000400000-0x00000000005F1000-memory.dmpFilesize
1.9MB
-
memory/4620-150-0x0000000000400000-0x00000000005F1000-memory.dmpFilesize
1.9MB
-
memory/4620-229-0x0000000000400000-0x00000000005F1000-memory.dmpFilesize
1.9MB
-
memory/4620-163-0x0000000000400000-0x00000000005F1000-memory.dmpFilesize
1.9MB
-
memory/4768-208-0x00007FF72D660000-0x00007FF72DC01000-memory.dmpFilesize
5.6MB
-
memory/4768-308-0x00007FF72D660000-0x00007FF72DC01000-memory.dmpFilesize
5.6MB
-
memory/4768-159-0x00007FF72D660000-0x00007FF72DC01000-memory.dmpFilesize
5.6MB
-
memory/4768-239-0x00007FF72D660000-0x00007FF72DC01000-memory.dmpFilesize
5.6MB
-
memory/5040-209-0x00000000062E0000-0x000000000632C000-memory.dmpFilesize
304KB
-
memory/5040-173-0x0000000004CC0000-0x0000000004CF6000-memory.dmpFilesize
216KB
-
memory/5040-230-0x0000000004DC0000-0x0000000004DD0000-memory.dmpFilesize
64KB
-
memory/5040-176-0x00000000052C0000-0x00000000052E2000-memory.dmpFilesize
136KB
-
memory/5040-178-0x0000000073740000-0x0000000073EF0000-memory.dmpFilesize
7.7MB
-
memory/5040-180-0x0000000004DC0000-0x0000000004DD0000-memory.dmpFilesize
64KB
-
memory/5040-182-0x0000000004DC0000-0x0000000004DD0000-memory.dmpFilesize
64KB
-
memory/5040-244-0x0000000073740000-0x0000000073EF0000-memory.dmpFilesize
7.7MB
-
memory/5040-246-0x0000000004DC0000-0x0000000004DD0000-memory.dmpFilesize
64KB
-
memory/5040-248-0x0000000004DC0000-0x0000000004DD0000-memory.dmpFilesize
64KB
-
memory/5040-183-0x0000000005BA0000-0x0000000005C06000-memory.dmpFilesize
408KB