glupteba | 3481e519a886d3970e852d0513034efd0c9d71481b70533ca3c6b92ec83c1d50

Analysis

max time kernel
150s
max time network
155s
platform
windows10-1703_x64
resource
win10-20230915-en
resource tags

arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
submitted
09/10/2023, 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3481e519a886d3970e852d0513034efd0c9d71481b70533ca3c6b92ec83c1d50.exe
Size

13.3MB
MD5

5b93c5a39aa96f661dc53b4eda00e3fb
SHA1

ccc61ea8e58ed309c96ae19a3cdda3973168e128
SHA256

3481e519a886d3970e852d0513034efd0c9d71481b70533ca3c6b92ec83c1d50
SHA512

bb3b30bf62be5c3ab8c8fa041c503a888c47b33c7db11443459c85f6f6ac70eb3d3cff1faccc18b092fdcde5b44b937dfa08e9aaf7de57c3da31c4fc57437523
SSDEEP

196608:YJ53FaC5MGewrlcf7qE4C11FO4Pt651rdH1cfdSp3+JHmeNFSutuomP+3B:YJ5wWDewrGefCAKw5efdM3+EepupP8

Score

10^/10

glupteba smokeloader stealc up3 backdoor discovery dropper evasion loader persistence rootkit spyware stealer trojan upx

Malware Config

Extracted

Family

stealc

http://5.42.65.39

Attributes

url_path
/bed95ea4798a5204.php

rc4.plain

Extracted

Family

smokeloader

Botnet

up3

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 6 IoCs

resource	yara_rule
behavioral1/memory/2448-204-0x0000000005180000-0x0000000005A6B000-memory.dmp	family_glupteba
behavioral1/memory/2448-205-0x0000000000400000-0x0000000002FB3000-memory.dmp	family_glupteba
behavioral1/memory/2448-274-0x0000000000400000-0x0000000002FB3000-memory.dmp	family_glupteba
behavioral1/memory/2448-275-0x0000000005180000-0x0000000005A6B000-memory.dmp	family_glupteba
behavioral1/memory/2448-281-0x0000000000400000-0x0000000002FB3000-memory.dmp	family_glupteba
behavioral1/memory/2448-500-0x0000000000400000-0x0000000002FB3000-memory.dmp	family_glupteba

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Stealc
Stealc is an infostealer written in C++.
stealer stealc

Suspicious use of NtCreateUserProcessOtherParentProcess 11 IoCs

description	pid	Process	procid_target
PID 3692 created 3104	3692	latestX.exe	26
PID 3692 created 3104	3692	latestX.exe	26
PID 3692 created 3104	3692	latestX.exe	26
PID 3692 created 3104	3692	latestX.exe	26
PID 3692 created 3104	3692	latestX.exe	26
PID 4692 created 3104	4692	updater.exe	26
PID 4692 created 3104	4692	updater.exe	26
PID 4692 created 3104	4692	updater.exe	26
PID 4692 created 3104	4692	updater.exe	26
PID 4692 created 3104	4692	updater.exe	26
PID 4692 created 3104	4692	updater.exe	26

Windows security bypass 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\31839b57a4f11171d6abc8bbc4451ee4.exe = "0"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0"	31839b57a4f11171d6abc8bbc4451ee4.exe

Downloads MZ/PE file

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\drivers\etc\hosts	latestX.exe
File created	C:\Windows\System32\drivers\etc\hosts	updater.exe

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
4112	netsh.exe

Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Executes dropped EXE 16 IoCs

pid	Process
4376	toolspub2.exe
2448	31839b57a4f11171d6abc8bbc4451ee4.exe
1796	Setup.exe
2240	kos1.exe
3692	latestX.exe
2952	set16.exe
5116	kos.exe
2904	is-GLDTL.tmp
4988	previewer.exe
3120	previewer.exe
4692	updater.exe
1888	31839b57a4f11171d6abc8bbc4451ee4.exe
1872	csrss.exe
2376	injector.exe
4768	windefender.exe
3156	windefender.exe

Loads dropped DLL 5 IoCs

pid	Process
2904	is-GLDTL.tmp
2904	is-GLDTL.tmp
2904	is-GLDTL.tmp
2180	InstallUtil.exe
2180	InstallUtil.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000700000001afaa-2615.dat	upx
behavioral1/files/0x000700000001afaa-2617.dat	upx
behavioral1/files/0x000700000001afaa-2618.dat	upx

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	51.159.66.125

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\31839b57a4f11171d6abc8bbc4451ee4.exe = "0"	31839b57a4f11171d6abc8bbc4451ee4.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Manipulates WinMonFS driver. 1 IoCs

Roottkits write to WinMonFS to hide directories/files from being detected.

rootkit evasion

description	ioc	Process
File opened for modification	\??\WinMonFS	csrss.exe

Drops file in System32 directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1796 set thread context of 2180	1796	Setup.exe	84
PID 4692 set thread context of 1136	4692	updater.exe	150
PID 4692 set thread context of 512	4692	updater.exe	151

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	31839b57a4f11171d6abc8bbc4451ee4.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\updater.exe	latestX.exe
File created	C:\Program Files\Google\Libs\WR64.sys	updater.exe
File created	C:\Program Files (x86)\PA Previewer\is-HUE0T.tmp	is-GLDTL.tmp
File created	C:\Program Files (x86)\PA Previewer\is-AIICD.tmp	is-GLDTL.tmp
File created	C:\Program Files (x86)\PA Previewer\is-73O19.tmp	is-GLDTL.tmp
File opened for modification	C:\Program Files (x86)\PA Previewer\unins000.dat	is-GLDTL.tmp
File opened for modification	C:\Program Files (x86)\PA Previewer\previewer.exe	is-GLDTL.tmp
File created	C:\Program Files (x86)\PA Previewer\unins000.dat	is-GLDTL.tmp
File created	C:\Program Files (x86)\PA Previewer\is-M5US9.tmp	is-GLDTL.tmp

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rss	31839b57a4f11171d6abc8bbc4451ee4.exe
File created	C:\Windows\rss\csrss.exe	31839b57a4f11171d6abc8bbc4451ee4.exe
File created	C:\Windows\windefender.exe	csrss.exe
File opened for modification	C:\Windows\windefender.exe	csrss.exe

Launches sc.exe 11 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1308	sc.exe
4720	sc.exe
824	sc.exe
3456	sc.exe
5004	sc.exe
1496	sc.exe
4816	sc.exe
1400	sc.exe
4952	sc.exe
3368	sc.exe
320	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	InstallUtil.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	InstallUtil.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1564	schtasks.exe
1856	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2531 = "Chatham Islands Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-621 = "Korea Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1932 = "Russia TZ 11 Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-831 = "SA Eastern Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-2321 = "Sakhalin Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-562 = "SE Asia Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-2181 = "Astrakhan Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-261 = "GMT Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-332 = "E. Europe Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1841 = "Russia TZ 4 Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-542 = "Myanmar Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1911 = "Russia TZ 10 Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-331 = "E. Europe Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-441 = "Arabian Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-192 = "Mountain Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2062 = "North Korea Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-92 = "Pacific SA Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-752 = "Tonga Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2572 = "Turks and Caicos Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-841 = "Argentina Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-261 = "GMT Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-461 = "Afghanistan Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-962 = "Paraguay Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-401 = "Arabic Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-911 = "Mauritius Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-251 = "Dateline Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-361 = "GTB Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2041 = "Eastern Daylight Time (Mexico)"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1722 = "Libya Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-792 = "SA Western Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-661 = "Cen. Australia Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-41 = "E. South America Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-601 = "Taipei Daylight Time"	windefender.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-961 = "Paraguay Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-2182 = "Astrakhan Standard Time"	windefender.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2180	InstallUtil.exe
2180	InstallUtil.exe
4436	powershell.exe
4436	powershell.exe
4436	powershell.exe
3692	latestX.exe
3692	latestX.exe
2172	powershell.exe
2172	powershell.exe
2172	powershell.exe
3692	latestX.exe
3692	latestX.exe
3692	latestX.exe
3692	latestX.exe
3692	latestX.exe
3692	latestX.exe
4084	powershell.exe
4084	powershell.exe
4084	powershell.exe
3692	latestX.exe
3692	latestX.exe
2448	31839b57a4f11171d6abc8bbc4451ee4.exe
2448	31839b57a4f11171d6abc8bbc4451ee4.exe
4368	powershell.exe
4368	powershell.exe
4368	powershell.exe
1888	31839b57a4f11171d6abc8bbc4451ee4.exe
1888	31839b57a4f11171d6abc8bbc4451ee4.exe
1888	31839b57a4f11171d6abc8bbc4451ee4.exe
1888	31839b57a4f11171d6abc8bbc4451ee4.exe
1888	31839b57a4f11171d6abc8bbc4451ee4.exe
1888	31839b57a4f11171d6abc8bbc4451ee4.exe
1888	31839b57a4f11171d6abc8bbc4451ee4.exe
1888	31839b57a4f11171d6abc8bbc4451ee4.exe
1888	31839b57a4f11171d6abc8bbc4451ee4.exe
1888	31839b57a4f11171d6abc8bbc4451ee4.exe
2148	powershell.exe
2148	powershell.exe
2148	powershell.exe
312	powershell.exe
312	powershell.exe
312	powershell.exe
4692	updater.exe
4692	updater.exe
2236	powershell.exe
3152	powershell.exe
3152	powershell.exe
2236	powershell.exe
3152	powershell.exe
2236	powershell.exe
4692	updater.exe
4692	updater.exe
4692	updater.exe
4692	updater.exe
4692	updater.exe
4692	updater.exe
3744	powershell.exe
3744	powershell.exe
3744	powershell.exe
2532	powershell.exe
2532	powershell.exe
2532	powershell.exe
4488	powershell.exe
4488	powershell.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
632	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5116	kos.exe
Token: SeDebugPrivilege	4988	previewer.exe
Token: SeDebugPrivilege	3120	previewer.exe
Token: SeDebugPrivilege	1796	Setup.exe
Token: SeDebugPrivilege	4436	powershell.exe
Token: SeDebugPrivilege	2172	powershell.exe
Token: SeIncreaseQuotaPrivilege	2172	powershell.exe
Token: SeSecurityPrivilege	2172	powershell.exe
Token: SeTakeOwnershipPrivilege	2172	powershell.exe
Token: SeLoadDriverPrivilege	2172	powershell.exe
Token: SeSystemProfilePrivilege	2172	powershell.exe
Token: SeSystemtimePrivilege	2172	powershell.exe
Token: SeProfSingleProcessPrivilege	2172	powershell.exe
Token: SeIncBasePriorityPrivilege	2172	powershell.exe
Token: SeCreatePagefilePrivilege	2172	powershell.exe
Token: SeBackupPrivilege	2172	powershell.exe
Token: SeRestorePrivilege	2172	powershell.exe
Token: SeShutdownPrivilege	2172	powershell.exe
Token: SeDebugPrivilege	2172	powershell.exe
Token: SeSystemEnvironmentPrivilege	2172	powershell.exe
Token: SeRemoteShutdownPrivilege	2172	powershell.exe
Token: SeUndockPrivilege	2172	powershell.exe
Token: SeManageVolumePrivilege	2172	powershell.exe
Token: 33	2172	powershell.exe
Token: 34	2172	powershell.exe
Token: 35	2172	powershell.exe
Token: 36	2172	powershell.exe
Token: SeShutdownPrivilege	3988	powercfg.exe
Token: SeCreatePagefilePrivilege	3988	powercfg.exe
Token: SeDebugPrivilege	4084	powershell.exe
Token: SeShutdownPrivilege	428	powercfg.exe
Token: SeCreatePagefilePrivilege	428	powercfg.exe
Token: SeShutdownPrivilege	4076	powercfg.exe
Token: SeCreatePagefilePrivilege	4076	powercfg.exe
Token: SeShutdownPrivilege	5048	powercfg.exe
Token: SeCreatePagefilePrivilege	5048	powercfg.exe
Token: SeIncreaseQuotaPrivilege	4084	powershell.exe
Token: SeSecurityPrivilege	4084	powershell.exe
Token: SeTakeOwnershipPrivilege	4084	powershell.exe
Token: SeLoadDriverPrivilege	4084	powershell.exe
Token: SeSystemProfilePrivilege	4084	powershell.exe
Token: SeSystemtimePrivilege	4084	powershell.exe
Token: SeProfSingleProcessPrivilege	4084	powershell.exe
Token: SeIncBasePriorityPrivilege	4084	powershell.exe
Token: SeCreatePagefilePrivilege	4084	powershell.exe
Token: SeBackupPrivilege	4084	powershell.exe
Token: SeRestorePrivilege	4084	powershell.exe
Token: SeShutdownPrivilege	4084	powershell.exe
Token: SeDebugPrivilege	4084	powershell.exe
Token: SeSystemEnvironmentPrivilege	4084	powershell.exe
Token: SeRemoteShutdownPrivilege	4084	powershell.exe
Token: SeUndockPrivilege	4084	powershell.exe
Token: SeManageVolumePrivilege	4084	powershell.exe
Token: 33	4084	powershell.exe
Token: 34	4084	powershell.exe
Token: 35	4084	powershell.exe
Token: 36	4084	powershell.exe
Token: SeIncreaseQuotaPrivilege	4084	powershell.exe
Token: SeSecurityPrivilege	4084	powershell.exe
Token: SeTakeOwnershipPrivilege	4084	powershell.exe
Token: SeLoadDriverPrivilege	4084	powershell.exe
Token: SeSystemProfilePrivilege	4084	powershell.exe
Token: SeSystemtimePrivilege	4084	powershell.exe
Token: SeProfSingleProcessPrivilege	4084	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4864 wrote to memory of 4376	4864	3481e519a886d3970e852d0513034efd0c9d71481b70533ca3c6b92ec83c1d50.exe	69
PID 4864 wrote to memory of 4376	4864	3481e519a886d3970e852d0513034efd0c9d71481b70533ca3c6b92ec83c1d50.exe	69
PID 4864 wrote to memory of 4376	4864	3481e519a886d3970e852d0513034efd0c9d71481b70533ca3c6b92ec83c1d50.exe	69
PID 4864 wrote to memory of 2448	4864	3481e519a886d3970e852d0513034efd0c9d71481b70533ca3c6b92ec83c1d50.exe	70
PID 4864 wrote to memory of 2448	4864	3481e519a886d3970e852d0513034efd0c9d71481b70533ca3c6b92ec83c1d50.exe	70
PID 4864 wrote to memory of 2448	4864	3481e519a886d3970e852d0513034efd0c9d71481b70533ca3c6b92ec83c1d50.exe	70
PID 4864 wrote to memory of 1796	4864	3481e519a886d3970e852d0513034efd0c9d71481b70533ca3c6b92ec83c1d50.exe	71
PID 4864 wrote to memory of 1796	4864	3481e519a886d3970e852d0513034efd0c9d71481b70533ca3c6b92ec83c1d50.exe	71
PID 4864 wrote to memory of 1796	4864	3481e519a886d3970e852d0513034efd0c9d71481b70533ca3c6b92ec83c1d50.exe	71
PID 4864 wrote to memory of 2240	4864	3481e519a886d3970e852d0513034efd0c9d71481b70533ca3c6b92ec83c1d50.exe	72
PID 4864 wrote to memory of 2240	4864	3481e519a886d3970e852d0513034efd0c9d71481b70533ca3c6b92ec83c1d50.exe	72
PID 4864 wrote to memory of 2240	4864	3481e519a886d3970e852d0513034efd0c9d71481b70533ca3c6b92ec83c1d50.exe	72
PID 4864 wrote to memory of 3692	4864	3481e519a886d3970e852d0513034efd0c9d71481b70533ca3c6b92ec83c1d50.exe	73
PID 4864 wrote to memory of 3692	4864	3481e519a886d3970e852d0513034efd0c9d71481b70533ca3c6b92ec83c1d50.exe	73
PID 2240 wrote to memory of 2952	2240	kos1.exe	74
PID 2240 wrote to memory of 2952	2240	kos1.exe	74
PID 2240 wrote to memory of 2952	2240	kos1.exe	74
PID 2240 wrote to memory of 5116	2240	kos1.exe	75
PID 2240 wrote to memory of 5116	2240	kos1.exe	75
PID 2952 wrote to memory of 2904	2952	set16.exe	76
PID 2952 wrote to memory of 2904	2952	set16.exe	76
PID 2952 wrote to memory of 2904	2952	set16.exe	76
PID 2904 wrote to memory of 2440	2904	is-GLDTL.tmp	77
PID 2904 wrote to memory of 2440	2904	is-GLDTL.tmp	77
PID 2904 wrote to memory of 2440	2904	is-GLDTL.tmp	77
PID 2904 wrote to memory of 4988	2904	is-GLDTL.tmp	78
PID 2904 wrote to memory of 4988	2904	is-GLDTL.tmp	78
PID 2904 wrote to memory of 4988	2904	is-GLDTL.tmp	78
PID 2440 wrote to memory of 4804	2440	net.exe	80
PID 2440 wrote to memory of 4804	2440	net.exe	80
PID 2440 wrote to memory of 4804	2440	net.exe	80
PID 2904 wrote to memory of 3120	2904	is-GLDTL.tmp	81
PID 2904 wrote to memory of 3120	2904	is-GLDTL.tmp	81
PID 2904 wrote to memory of 3120	2904	is-GLDTL.tmp	81
PID 1796 wrote to memory of 2180	1796	Setup.exe	84
PID 1796 wrote to memory of 2180	1796	Setup.exe	84
PID 1796 wrote to memory of 2180	1796	Setup.exe	84
PID 1796 wrote to memory of 2180	1796	Setup.exe	84
PID 1796 wrote to memory of 2180	1796	Setup.exe	84
PID 1796 wrote to memory of 2180	1796	Setup.exe	84
PID 1796 wrote to memory of 2180	1796	Setup.exe	84
PID 1796 wrote to memory of 2180	1796	Setup.exe	84
PID 2448 wrote to memory of 4436	2448	31839b57a4f11171d6abc8bbc4451ee4.exe	86
PID 2448 wrote to memory of 4436	2448	31839b57a4f11171d6abc8bbc4451ee4.exe	86
PID 2448 wrote to memory of 4436	2448	31839b57a4f11171d6abc8bbc4451ee4.exe	86
PID 648 wrote to memory of 4952	648	cmd.exe	92
PID 648 wrote to memory of 4952	648	cmd.exe	92
PID 648 wrote to memory of 3368	648	cmd.exe	94
PID 648 wrote to memory of 3368	648	cmd.exe	94
PID 648 wrote to memory of 4720	648	cmd.exe	95
PID 648 wrote to memory of 4720	648	cmd.exe	95
PID 648 wrote to memory of 824	648	cmd.exe	96
PID 648 wrote to memory of 824	648	cmd.exe	96
PID 648 wrote to memory of 320	648	cmd.exe	97
PID 648 wrote to memory of 320	648	cmd.exe	97
PID 684 wrote to memory of 3988	684	cmd.exe	102
PID 684 wrote to memory of 3988	684	cmd.exe	102
PID 684 wrote to memory of 428	684	cmd.exe	103
PID 684 wrote to memory of 428	684	cmd.exe	103
PID 684 wrote to memory of 4076	684	cmd.exe	104
PID 684 wrote to memory of 4076	684	cmd.exe	104
PID 684 wrote to memory of 5048	684	cmd.exe	105
PID 684 wrote to memory of 5048	684	cmd.exe	105
PID 1888 wrote to memory of 4368	1888	31839b57a4f11171d6abc8bbc4451ee4.exe	112

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3104
- C:\Users\Admin\AppData\Local\Temp\3481e519a886d3970e852d0513034efd0c9d71481b70533ca3c6b92ec83c1d50.exe
  "C:\Users\Admin\AppData\Local\Temp\3481e519a886d3970e852d0513034efd0c9d71481b70533ca3c6b92ec83c1d50.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4864
- - C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
    "C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
    3⤵
    - Executes dropped EXE
    PID:4376
- - C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
    "C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2448
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4436
  - - C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
      "C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
      4⤵
      Windows security bypass
      Executes dropped EXE
      Windows security modification
      Adds Run key to start application
      Checks for VirtualBox DLLs, possible anti-VM trick
      Drops file in Windows directory
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1888
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        
        PID:4368
    - - C:\Windows\System32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        5⤵
        
        PID:2764
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        6⤵
        Modifies Windows Firewall
        
        PID:4112
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        
        PID:2148
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        
        PID:312
    - - C:\Windows\rss\csrss.exe
        
        C:\Windows\rss\csrss.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Manipulates WinMonFS driver.
        Drops file in Windows directory
        
        PID:1872
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        
        PID:2236
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        6⤵
        Creates scheduled task(s)
        
        PID:1564
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /delete /tn ScheduledUpdate /f
        6⤵
        
        PID:2116
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        
        PID:2532
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        
        PID:4488
      - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
        
        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
        6⤵
        Executes dropped EXE
        
        PID:2376
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        6⤵
        Creates scheduled task(s)
        
        PID:1856
      - C:\Windows\windefender.exe
        
        "C:\Windows\windefender.exe"
        6⤵
        Executes dropped EXE
        
        PID:4768
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        7⤵
        
        PID:4292
        
        C:\Windows\SysWOW64\sc.exe
        
        sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        8⤵
        Launches sc.exe
        
        PID:1400
- - C:\Users\Admin\AppData\Local\Temp\Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1796
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
      4⤵
      Loads dropped DLL
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      PID:2180
- - C:\Users\Admin\AppData\Local\Temp\kos1.exe
    "C:\Users\Admin\AppData\Local\Temp\kos1.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2240
  - - C:\Users\Admin\AppData\Local\Temp\set16.exe
      "C:\Users\Admin\AppData\Local\Temp\set16.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2952
    - - C:\Users\Admin\AppData\Local\Temp\is-H0E31.tmp\is-GLDTL.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-H0E31.tmp\is-GLDTL.tmp" /SL4 $901D8 "C:\Users\Admin\AppData\Local\Temp\set16.exe" 1232936 52224
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:2904
      - C:\Windows\SysWOW64\net.exe
        
        "C:\Windows\system32\net.exe" helpmsg 8
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2440
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 helpmsg 8
        7⤵
        
        PID:4804
      - C:\Program Files (x86)\PA Previewer\previewer.exe
        
        "C:\Program Files (x86)\PA Previewer\previewer.exe" -i
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4988
      - C:\Program Files (x86)\PA Previewer\previewer.exe
        
        "C:\Program Files (x86)\PA Previewer\previewer.exe" -s
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3120
  - - C:\Users\Admin\AppData\Local\Temp\kos.exe
      "C:\Users\Admin\AppData\Local\Temp\kos.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:5116
- - C:\Users\Admin\AppData\Local\Temp\latestX.exe
    "C:\Users\Admin\AppData\Local\Temp\latestX.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    PID:3692
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2172
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:648
- - C:\Windows\System32\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:3368
- - C:\Windows\System32\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:4720
- - C:\Windows\System32\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    PID:824
- - C:\Windows\System32\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    PID:320
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:684
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3988
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:428
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4076
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5048
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4084
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
  2⤵
  PID:1640
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3152
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
  2⤵
  PID:488
- - C:\Windows\System32\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:5004
- - C:\Windows\System32\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:3456
- - C:\Windows\System32\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:1496
- - C:\Windows\System32\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    PID:4816
- - C:\Windows\System32\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    PID:1308
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
  2⤵
  PID:4040
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-ac 0
    3⤵
    PID:168
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-dc 0
    3⤵
    PID:4932
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-ac 0
    3⤵
    PID:2888
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-dc 0
    3⤵
    PID:4708
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3744
- C:\Windows\System32\conhost.exe
  C:\Windows\System32\conhost.exe
  2⤵
  PID:1136
- C:\Windows\explorer.exe
  C:\Windows\explorer.exe
  2⤵
  PID:512

C:\Windows\System32\sc.exe
sc stop UsoSvc
1⤵
- Launches sc.exe
PID:4952

C:\Program Files\Google\Chrome\updater.exe
"C:\Program Files\Google\Chrome\updater.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:4692

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:3156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\PA Previewer\previewer.exe

Filesize
1.9MB

MD5
27b85a95804a760da4dbee7ca800c9b4

SHA1
f03136226bf3dd38ba0aa3aad1127ccab380197c

SHA256
f98b98404ecf3871a10a290ade21ad77d0b2633f47247debc53d094b9bdff245

SHA512
e760a15370272aa9541f1afceaaf4f5a8068dad21c6a8d50ebd01514e16bbc8f867c8af349080f3d1fa7a19eafe7cde74921d01716dea69ef801da1b74eae4a7

Download Submit
C:\Program Files (x86)\PA Previewer\previewer.exe

Filesize
1.9MB

MD5
27b85a95804a760da4dbee7ca800c9b4

SHA1
f03136226bf3dd38ba0aa3aad1127ccab380197c

SHA256
f98b98404ecf3871a10a290ade21ad77d0b2633f47247debc53d094b9bdff245

SHA512
e760a15370272aa9541f1afceaaf4f5a8068dad21c6a8d50ebd01514e16bbc8f867c8af349080f3d1fa7a19eafe7cde74921d01716dea69ef801da1b74eae4a7

Download Submit
C:\Program Files (x86)\PA Previewer\previewer.exe

Filesize
1.9MB

MD5
27b85a95804a760da4dbee7ca800c9b4

SHA1
f03136226bf3dd38ba0aa3aad1127ccab380197c

SHA256
f98b98404ecf3871a10a290ade21ad77d0b2633f47247debc53d094b9bdff245

SHA512
e760a15370272aa9541f1afceaaf4f5a8068dad21c6a8d50ebd01514e16bbc8f867c8af349080f3d1fa7a19eafe7cde74921d01716dea69ef801da1b74eae4a7

Download Submit
C:\Program Files\Google\Chrome\updater.exe

Filesize
5.6MB

MD5
bae29e49e8190bfbbf0d77ffab8de59d

SHA1
4a6352bb47c7e1666a60c76f9b17ca4707872bd9

SHA256
f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87

SHA512
9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2

Download Submit
C:\Program Files\Google\Chrome\updater.exe

Filesize
5.6MB

MD5
bae29e49e8190bfbbf0d77ffab8de59d

SHA1
4a6352bb47c7e1666a60c76f9b17ca4707872bd9

SHA256
f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87

SHA512
9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
ad5cd538ca58cb28ede39c108acb5785

SHA1
1ae910026f3dbe90ed025e9e96ead2b5399be877

SHA256
c9e6cb04d6c893458d5a7e12eb575cf97c3172f5e312b1f63a667cbbc5f0c033

SHA512
c066c5d9b276a68fa636647bb29aea05bfa2292217bc77f5324d9c1d93117772ee8277e1f7cff91ec8d6b7c05ca078f929cecfdbb09582522a9067f54740af13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
3df03b7292eeda72e97180e347b03cf3

SHA1
6dcf07eba6cbefa06b5ca7cc458e2e87d18fb750

SHA256
a3b2aa06d843fcb2399f1d529737e59b2beeb20519bd80035c2033dac646a52f

SHA512
1d458b231c87f3a70031284430a63553e2739e9bd406d8a04a4f9d9b19ab4f97b4e785b41e2e530321767e8d7f6c12c2299078335491dfb205669f749ab29cb6

Download Submit
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

Filesize
4.1MB

MD5
9066252ec48e20ddd82d2ec928cb7867

SHA1
222cbf0415a3166b1f55ff1ba293c4f8b5b840c8

SHA256
97501b83431f3b3f369d96c268ef1de99d588e74f0b28d7b853ff3ebf259f96c

SHA512
4be0962e8cfdb2e723b87a76c9b43c5d3bb5e432e7ef3f28146056ec0cb854256a0a67c44fd9fabfbb66e5f150047890b76bab3d5bf86175a94e33d9d6f4e7f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

Filesize
4.1MB

MD5
9066252ec48e20ddd82d2ec928cb7867

SHA1
222cbf0415a3166b1f55ff1ba293c4f8b5b840c8

SHA256
97501b83431f3b3f369d96c268ef1de99d588e74f0b28d7b853ff3ebf259f96c

SHA512
4be0962e8cfdb2e723b87a76c9b43c5d3bb5e432e7ef3f28146056ec0cb854256a0a67c44fd9fabfbb66e5f150047890b76bab3d5bf86175a94e33d9d6f4e7f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

Filesize
4.1MB

MD5
9066252ec48e20ddd82d2ec928cb7867

SHA1
222cbf0415a3166b1f55ff1ba293c4f8b5b840c8

SHA256
97501b83431f3b3f369d96c268ef1de99d588e74f0b28d7b853ff3ebf259f96c

SHA512
4be0962e8cfdb2e723b87a76c9b43c5d3bb5e432e7ef3f28146056ec0cb854256a0a67c44fd9fabfbb66e5f150047890b76bab3d5bf86175a94e33d9d6f4e7f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Setup.exe

Filesize
1.9MB

MD5
4c7efd165af03d720ce4a9d381bfb29a

SHA1
92b14564856155487a57db57b8a222b7f57a81e9

SHA256
f5bbe3fdc27074249c6860b8959a155e6c79571daa86e7a574656a3c5c6326b8

SHA512
38a26722e2669e7432b5a068b08ff852988a26ed875e8aa23156ea4bd0e852686ccabe6e685d5b0e888cb5755cbe424189fb8033ada37994417d3549b10637dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Setup.exe

Filesize
1.9MB

MD5
4c7efd165af03d720ce4a9d381bfb29a

SHA1
92b14564856155487a57db57b8a222b7f57a81e9

SHA256
f5bbe3fdc27074249c6860b8959a155e6c79571daa86e7a574656a3c5c6326b8

SHA512
38a26722e2669e7432b5a068b08ff852988a26ed875e8aa23156ea4bd0e852686ccabe6e685d5b0e888cb5755cbe424189fb8033ada37994417d3549b10637dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_51smi0yb.qgo.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

Filesize
281KB

MD5
d98e33b66343e7c96158444127a117f6

SHA1
bb716c5509a2bf345c6c1152f6e3e1452d39d50d

SHA256
5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

SHA512
705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

Filesize
281KB

MD5
d98e33b66343e7c96158444127a117f6

SHA1
bb716c5509a2bf345c6c1152f6e3e1452d39d50d

SHA256
5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

SHA512
705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-H0E31.tmp\is-GLDTL.tmp

Filesize
647KB

MD5
2fba5642cbcaa6857c3995ccb5d2ee2a

SHA1
91fe8cd860cba7551fbf78bc77cc34e34956e8cc

SHA256
ddec51f3741f3988b9cc792f6f8fc0dfa2098ef0eb84c6a2af7f8da5a72b40fa

SHA512
30613b43427d17115134798506f197c0f5f8b2b9f247668fa25b9dd4853bbd97ac1e27f4e3325dec4f6dfc0e448ebbddb2969ad1a1781aa59ebf522d436aed7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-H0E31.tmp\is-GLDTL.tmp

Filesize
647KB

MD5
2fba5642cbcaa6857c3995ccb5d2ee2a

SHA1
91fe8cd860cba7551fbf78bc77cc34e34956e8cc

SHA256
ddec51f3741f3988b9cc792f6f8fc0dfa2098ef0eb84c6a2af7f8da5a72b40fa

SHA512
30613b43427d17115134798506f197c0f5f8b2b9f247668fa25b9dd4853bbd97ac1e27f4e3325dec4f6dfc0e448ebbddb2969ad1a1781aa59ebf522d436aed7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\kos.exe

Filesize
8KB

MD5
076ab7d1cc5150a5e9f8745cc5f5fb6c

SHA1
7b40783a27a38106e2cc91414f2bc4d8b484c578

SHA256
d1b71081d7ba414b589338329f278ba51c6ccf542d74f131f96c2337ee0a4c90

SHA512
75e274a654e88feb0d66156f387bc5e420811f4f62939396a7455d12e835d7e134b2579ab59976c591b416d1ec1acdf05e9eb290c8f01383c6a50bf43854420b

Download Submit
C:\Users\Admin\AppData\Local\Temp\kos.exe

Filesize
8KB

MD5
076ab7d1cc5150a5e9f8745cc5f5fb6c

SHA1
7b40783a27a38106e2cc91414f2bc4d8b484c578

SHA256
d1b71081d7ba414b589338329f278ba51c6ccf542d74f131f96c2337ee0a4c90

SHA512
75e274a654e88feb0d66156f387bc5e420811f4f62939396a7455d12e835d7e134b2579ab59976c591b416d1ec1acdf05e9eb290c8f01383c6a50bf43854420b

Download Submit
C:\Users\Admin\AppData\Local\Temp\kos1.exe

Filesize
1.4MB

MD5
85b698363e74ba3c08fc16297ddc284e

SHA1
171cfea4a82a7365b241f16aebdb2aad29f4f7c0

SHA256
78efcbb0c6eb6a4c76c036adc65154b8ff028849f79d508e45babfb527cb7cfe

SHA512
7e4816c43e0addba088709948e8aedc9e39d6802c74a75cfbc2a0e739b44c5b5eef2bb2453b7032c758b0bdb38e4e7a598aa29be015796361b81d7f9e8027796

Download Submit
C:\Users\Admin\AppData\Local\Temp\kos1.exe

Filesize
1.4MB

MD5
85b698363e74ba3c08fc16297ddc284e

SHA1
171cfea4a82a7365b241f16aebdb2aad29f4f7c0

SHA256
78efcbb0c6eb6a4c76c036adc65154b8ff028849f79d508e45babfb527cb7cfe

SHA512
7e4816c43e0addba088709948e8aedc9e39d6802c74a75cfbc2a0e739b44c5b5eef2bb2453b7032c758b0bdb38e4e7a598aa29be015796361b81d7f9e8027796

Download Submit
C:\Users\Admin\AppData\Local\Temp\latestX.exe

Filesize
5.6MB

MD5
bae29e49e8190bfbbf0d77ffab8de59d

SHA1
4a6352bb47c7e1666a60c76f9b17ca4707872bd9

SHA256
f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87

SHA512
9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\latestX.exe

Filesize
5.6MB

MD5
bae29e49e8190bfbbf0d77ffab8de59d

SHA1
4a6352bb47c7e1666a60c76f9b17ca4707872bd9

SHA256
f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87

SHA512
9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\set16.exe

Filesize
1.4MB

MD5
22d5269955f256a444bd902847b04a3b

SHA1
41a83de3273270c3bd5b2bd6528bdc95766aa268

SHA256
ab16986253bd187e3134f27495ef0db4b648f769721bc8c84b708c7ba69156fd

SHA512
d85ada5d8c2c02932a79241a484b088ba70bda0497fd8ad638300935a16841d7cbc8258be93055907cb533bc534fdd48c7c91109fa22f87e65a6b374cd51055c

Download Submit
C:\Users\Admin\AppData\Local\Temp\set16.exe

Filesize
1.4MB

MD5
22d5269955f256a444bd902847b04a3b

SHA1
41a83de3273270c3bd5b2bd6528bdc95766aa268

SHA256
ab16986253bd187e3134f27495ef0db4b648f769721bc8c84b708c7ba69156fd

SHA512
d85ada5d8c2c02932a79241a484b088ba70bda0497fd8ad638300935a16841d7cbc8258be93055907cb533bc534fdd48c7c91109fa22f87e65a6b374cd51055c

Download Submit
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

Filesize
216KB

MD5
fd134e455dc6caf3b95e7f4dfefb1550

SHA1
bc7fef4d1e9bdb19e79b2d4f0b66ef627e977882

SHA256
aadebe52d66f6c135cdccbf672ba6e7797097c830bb6ee11d8523d5de169d82f

SHA512
a38dada18974648f2291bc08d6c32b8670a86b856e15a51d9836e832e7c4074ebc31e0f78778c65da49c4d91ac23a23c6a686179c82b6a76ed0096c5e1eb83c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

Filesize
216KB

MD5
fd134e455dc6caf3b95e7f4dfefb1550

SHA1
bc7fef4d1e9bdb19e79b2d4f0b66ef627e977882

SHA256
aadebe52d66f6c135cdccbf672ba6e7797097c830bb6ee11d8523d5de169d82f

SHA512
a38dada18974648f2291bc08d6c32b8670a86b856e15a51d9836e832e7c4074ebc31e0f78778c65da49c4d91ac23a23c6a686179c82b6a76ed0096c5e1eb83c4

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
1c19c16e21c97ed42d5beabc93391fc5

SHA1
8ad83f8e0b3acf8dfbbf87931e41f0d664c4df68

SHA256
1bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05

SHA512
7d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
dad72ac7594482ea9e8d18fb4d66c2c7

SHA1
d5c9cb28bc590ee6f4da85eb5299959671a847ba

SHA256
c69f4d44d37567af85673e746450d90a174bbd600e4f372e1c6a354bd89585b3

SHA512
78093d07cd2789da35d10bc1d38d59a873c0bacd00fe10aeaf388ee5d40f9199475200d700d0b5020a600fe2765c9ad3de1e45a33c0250c233ba7ce4b43a7b1e

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
4747bff866205e7c735050efb997d87a

SHA1
2bb36132cc026ba53cd4fce1b2aa1279eff031de

SHA256
711288c6859be7cecd3016a54e3cf879fa27045cd4c19ad5fb27e2d9dd8a220c

SHA512
5e89623afe58c051d0591c45a438a5be4c2d7f9e2575ab285dc7cf6ab8998f802108a34c9bc8f6a5b55a76ff95ac62ea0949c1c7f5456302d723f52e83a37481

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
7d06a759a07dbc0cc67dce7e9855e654

SHA1
d4d6c96aeb0ae90cfb02810f0a2ca2015322d437

SHA256
011af2e53cbd2f3e9598c0556fcca8943abe70667d9f864d8cc8f2e9a7f38162

SHA512
dc21ab2c159f4d452efe1943aa6884df76c2b0fcb7f2050b6f40dde95c90e27ef29152f7ce6c45572040e6aa1e5b9a82538d04208aea1a0c8aa32a98d62babbf

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
fcbb91eb4a6cf34645e5137280b091f6

SHA1
e30b5f10e6298acf47560816c32e3bf93248234f

SHA256
bc3846e06af746ad4da89cf68f899bacba60c333c5f09f7d8284a16f83fd9b7f

SHA512
bdb92c28a5ee373eb29eeca9b8902f098a10650a65312de3586a505dad3e5d4ef1c92037cdc7b47a8a90e290e276ecf433b1425625a7f141c21e9fdc4f8cad5f

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
9a9d3fe40be49039b8d3b68fcb511dc5

SHA1
ccacefe7439b25b266680f1f20a409d34a67a477

SHA256
431aa4980a900f659488b898f8e80fe105fbe179ca5816689a51b81edd24e637

SHA512
93fcc22417af844e2e58ca74f06f558e0c4b7dafeb8677b573df8b3b47da9d0cc1794ae46eed04c6dcc2db082da028b4e7daf1aa782b23ed01a9b1c475608759

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
3KB

MD5
00930b40cba79465b7a38ed0449d1449

SHA1
4b25a89ee28b20ba162f23772ddaf017669092a5

SHA256
eda1aae2c8fce700e3bdbe0186cf3db88400cf0ac13ec736e84dacba61628a01

SHA512
cbe4760ec041e7da7ab86474d5c82969cfccb8ccc5dbdac9436862d5b1b86210ab90754d3c8da5724176570d8842e57a716a281acba8719e90098a6f61a17c62

Download Submit
C:\Windows\rss\csrss.exe

Filesize
4.1MB

MD5
9066252ec48e20ddd82d2ec928cb7867

SHA1
222cbf0415a3166b1f55ff1ba293c4f8b5b840c8

SHA256
97501b83431f3b3f369d96c268ef1de99d588e74f0b28d7b853ff3ebf259f96c

SHA512
4be0962e8cfdb2e723b87a76c9b43c5d3bb5e432e7ef3f28146056ec0cb854256a0a67c44fd9fabfbb66e5f150047890b76bab3d5bf86175a94e33d9d6f4e7f2

Download Submit
C:\Windows\rss\csrss.exe

Filesize
4.1MB

MD5
9066252ec48e20ddd82d2ec928cb7867

SHA1
222cbf0415a3166b1f55ff1ba293c4f8b5b840c8

SHA256
97501b83431f3b3f369d96c268ef1de99d588e74f0b28d7b853ff3ebf259f96c

SHA512
4be0962e8cfdb2e723b87a76c9b43c5d3bb5e432e7ef3f28146056ec0cb854256a0a67c44fd9fabfbb66e5f150047890b76bab3d5bf86175a94e33d9d6f4e7f2

Download Submit
C:\Windows\rss\csrss.exe

Filesize
4.1MB

MD5
9066252ec48e20ddd82d2ec928cb7867

SHA1
222cbf0415a3166b1f55ff1ba293c4f8b5b840c8

SHA256
97501b83431f3b3f369d96c268ef1de99d588e74f0b28d7b853ff3ebf259f96c

SHA512
4be0962e8cfdb2e723b87a76c9b43c5d3bb5e432e7ef3f28146056ec0cb854256a0a67c44fd9fabfbb66e5f150047890b76bab3d5bf86175a94e33d9d6f4e7f2

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
573d77d4e77a445f5db769812a0be865

SHA1
7473d15ef2d3c6894edefd472f411c8e3209a99c

SHA256
5ec3f268845a50e309ae0d80bcee4f4dd4cd1b279ab1e64b523a057c11074f1c

SHA512
af2422a9790a91cdcbe39e6ef6d17899c2cbd4159b1b71ac56f633015068d3afc678fcef34892575bf59bdf7d5914ec6070864940d44130263fe84e28abba2dc

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
631f4b3792b263fdda6b265e93be4747

SHA1
1d6916097d419198bfdf78530d59d0d9f3e12d45

SHA256
4e68d2d067c5680a2e55853ac58b16f199b09f1b9e5f2174605fff18da828976

SHA512
e0280041c4ca63971ab2524f25d2047820f031c1b4aeb6021a3367297045ddf6616ffccafb54630eb07fd154571d844329ebcc34d6ce64834cb77cba373e4fbe

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
3KB

MD5
00930b40cba79465b7a38ed0449d1449

SHA1
4b25a89ee28b20ba162f23772ddaf017669092a5

SHA256
eda1aae2c8fce700e3bdbe0186cf3db88400cf0ac13ec736e84dacba61628a01

SHA512
cbe4760ec041e7da7ab86474d5c82969cfccb8ccc5dbdac9436862d5b1b86210ab90754d3c8da5724176570d8842e57a716a281acba8719e90098a6f61a17c62

Download Submit
C:\Windows\windefender.exe

Filesize
2.0MB

MD5
8e67f58837092385dcf01e8a2b4f5783

SHA1
012c49cfd8c5d06795a6f67ea2baf2a082cf8625

SHA256
166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

SHA512
40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

Download Submit
C:\Windows\windefender.exe

Filesize
2.0MB

MD5
8e67f58837092385dcf01e8a2b4f5783

SHA1
012c49cfd8c5d06795a6f67ea2baf2a082cf8625

SHA256
166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

SHA512
40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

Download Submit
C:\Windows\windefender.exe

Filesize
2.0MB

MD5
8e67f58837092385dcf01e8a2b4f5783

SHA1
012c49cfd8c5d06795a6f67ea2baf2a082cf8625

SHA256
166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

SHA512
40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

Download Submit
\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
\Users\Admin\AppData\Local\Temp\is-M1E4M.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
\Users\Admin\AppData\Local\Temp\is-M1E4M.tmp\_isetup\_isdecmp.dll

Filesize
32KB

MD5
b4786eb1e1a93633ad1b4c112514c893

SHA1
734750b771d0809c88508e4feb788d7701e6dada

SHA256
2ae4169f721beb389a661e6dbb18bc84ef38556af1f46807da9d87aec2a6f06f

SHA512
0882d2aa163ece22796f837111db0d55158098035005e57cd2e9b8d59dc2e582207840bf98bee534b81c368acf60ab5d8ecbe762209273bda067a215cdb2c0c6

Download Submit
\Users\Admin\AppData\Local\Temp\is-M1E4M.tmp\_isetup\_isdecmp.dll

Filesize
32KB

MD5
b4786eb1e1a93633ad1b4c112514c893

SHA1
734750b771d0809c88508e4feb788d7701e6dada

SHA256
2ae4169f721beb389a661e6dbb18bc84ef38556af1f46807da9d87aec2a6f06f

SHA512
0882d2aa163ece22796f837111db0d55158098035005e57cd2e9b8d59dc2e582207840bf98bee534b81c368acf60ab5d8ecbe762209273bda067a215cdb2c0c6

Download Submit
memory/1796-121-0x0000000005D70000-0x0000000005D85000-memory.dmp

Filesize
84KB

Download
memory/1796-29-0x0000000005A70000-0x0000000005B02000-memory.dmp

Filesize
584KB

Download
memory/1796-110-0x0000000005D70000-0x0000000005D85000-memory.dmp

Filesize
84KB

Download
memory/1796-111-0x0000000005D70000-0x0000000005D85000-memory.dmp

Filesize
84KB

Download
memory/1796-113-0x0000000005D70000-0x0000000005D85000-memory.dmp

Filesize
84KB

Download
memory/1796-115-0x0000000005D70000-0x0000000005D85000-memory.dmp

Filesize
84KB

Download
memory/1796-117-0x0000000005D70000-0x0000000005D85000-memory.dmp

Filesize
84KB

Download
memory/1796-119-0x0000000005D70000-0x0000000005D85000-memory.dmp

Filesize
84KB

Download
memory/1796-94-0x0000000073840000-0x0000000073F2E000-memory.dmp

Filesize
6.9MB

Download
memory/1796-123-0x0000000005D70000-0x0000000005D85000-memory.dmp

Filesize
84KB

Download
memory/1796-125-0x0000000005D70000-0x0000000005D85000-memory.dmp

Filesize
84KB

Download
memory/1796-127-0x0000000005D70000-0x0000000005D85000-memory.dmp

Filesize
84KB

Download
memory/1796-129-0x0000000005D70000-0x0000000005D85000-memory.dmp

Filesize
84KB

Download
memory/1796-131-0x0000000005D70000-0x0000000005D85000-memory.dmp

Filesize
84KB

Download
memory/1796-133-0x0000000005D70000-0x0000000005D85000-memory.dmp

Filesize
84KB

Download
memory/1796-109-0x0000000005D70000-0x0000000005D8C000-memory.dmp

Filesize
112KB

Download
memory/1796-33-0x0000000005C10000-0x0000000005CAC000-memory.dmp

Filesize
624KB

Download
memory/1796-138-0x0000000005DC0000-0x0000000005DC1000-memory.dmp

Filesize
4KB

Download
memory/1796-27-0x0000000005ED0000-0x00000000063CE000-memory.dmp

Filesize
5.0MB

Download
memory/1796-19-0x0000000073840000-0x0000000073F2E000-memory.dmp

Filesize
6.9MB

Download
memory/1796-140-0x0000000005EA0000-0x0000000005EB0000-memory.dmp

Filesize
64KB

Download
memory/1796-21-0x0000000000FB0000-0x00000000011A8000-memory.dmp

Filesize
2.0MB

Download
memory/1796-143-0x0000000073840000-0x0000000073F2E000-memory.dmp

Filesize
6.9MB

Download
memory/1796-34-0x0000000005EA0000-0x0000000005EB0000-memory.dmp

Filesize
64KB

Download
memory/1796-102-0x0000000005EA0000-0x0000000005EB0000-memory.dmp

Filesize
64KB

Download
memory/1796-48-0x0000000005A20000-0x0000000005A2A000-memory.dmp

Filesize
40KB

Download
memory/2172-303-0x000001FC065F0000-0x000001FC06600000-memory.dmp

Filesize
64KB

Download
memory/2172-302-0x000001FC065F0000-0x000001FC06600000-memory.dmp

Filesize
64KB

Download
memory/2172-300-0x00007FFA59CF0000-0x00007FFA5A6DC000-memory.dmp

Filesize
9.9MB

Download
memory/2180-136-0x0000000000400000-0x000000000062D000-memory.dmp

Filesize
2.2MB

Download
memory/2180-144-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/2180-142-0x0000000000400000-0x000000000062D000-memory.dmp

Filesize
2.2MB

Download
memory/2180-200-0x0000000000400000-0x000000000062D000-memory.dmp

Filesize
2.2MB

Download
memory/2180-139-0x0000000000400000-0x000000000062D000-memory.dmp

Filesize
2.2MB

Download
memory/2240-28-0x0000000073840000-0x0000000073F2E000-memory.dmp

Filesize
6.9MB

Download
memory/2240-26-0x0000000000BF0000-0x0000000000D64000-memory.dmp

Filesize
1.5MB

Download
memory/2240-55-0x0000000073840000-0x0000000073F2E000-memory.dmp

Filesize
6.9MB

Download
memory/2448-204-0x0000000005180000-0x0000000005A6B000-memory.dmp

Filesize
8.9MB

Download
memory/2448-205-0x0000000000400000-0x0000000002FB3000-memory.dmp

Filesize
43.7MB

Download
memory/2448-281-0x0000000000400000-0x0000000002FB3000-memory.dmp

Filesize
43.7MB

Download
memory/2448-275-0x0000000005180000-0x0000000005A6B000-memory.dmp

Filesize
8.9MB

Download
memory/2448-274-0x0000000000400000-0x0000000002FB3000-memory.dmp

Filesize
43.7MB

Download
memory/2448-500-0x0000000000400000-0x0000000002FB3000-memory.dmp

Filesize
43.7MB

Download
memory/2448-246-0x0000000004D70000-0x0000000005172000-memory.dmp

Filesize
4.0MB

Download
memory/2448-203-0x0000000004D70000-0x0000000005172000-memory.dmp

Filesize
4.0MB

Download
memory/2904-74-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/2904-135-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/2904-134-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/2952-103-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2952-44-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/3120-219-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/3120-101-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/3120-100-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/3120-413-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/3692-106-0x00007FF680230000-0x00007FF6807D1000-memory.dmp

Filesize
5.6MB

Download
memory/4376-201-0x0000000000640000-0x0000000000740000-memory.dmp

Filesize
1024KB

Download
memory/4376-202-0x0000000000610000-0x0000000000619000-memory.dmp

Filesize
36KB

Download
memory/4376-220-0x0000000000640000-0x0000000000740000-memory.dmp

Filesize
1024KB

Download
memory/4436-282-0x00000000735A0000-0x0000000073C8E000-memory.dmp

Filesize
6.9MB

Download
memory/4436-214-0x0000000007710000-0x0000000007D38000-memory.dmp

Filesize
6.2MB

Download
memory/4436-289-0x00000000711F0000-0x000000007123B000-memory.dmp

Filesize
300KB

Download
memory/4436-287-0x000000000A390000-0x000000000A3C3000-memory.dmp

Filesize
204KB

Download
memory/4436-286-0x000000007EEE0000-0x000000007EEF0000-memory.dmp

Filesize
64KB

Download
memory/4436-290-0x0000000071240000-0x0000000071590000-memory.dmp

Filesize
3.3MB

Download
memory/4436-273-0x00000000095A0000-0x0000000009616000-memory.dmp

Filesize
472KB

Download
memory/4436-241-0x00000000094E0000-0x000000000951C000-memory.dmp

Filesize
240KB

Download
memory/4436-211-0x00000000735A0000-0x0000000073C8E000-memory.dmp

Filesize
6.9MB

Download
memory/4436-222-0x0000000008920000-0x000000000896B000-memory.dmp

Filesize
300KB

Download
memory/4436-221-0x0000000007280000-0x000000000729C000-memory.dmp

Filesize
112KB

Download
memory/4436-213-0x00000000070D0000-0x00000000070E0000-memory.dmp

Filesize
64KB

Download
memory/4436-298-0x000000000A3D0000-0x000000000A475000-memory.dmp

Filesize
660KB

Download
memory/4436-212-0x0000000006F70000-0x0000000006FA6000-memory.dmp

Filesize
216KB

Download
memory/4436-291-0x0000000008400000-0x000000000841E000-memory.dmp

Filesize
120KB

Download
memory/4436-215-0x0000000007670000-0x0000000007692000-memory.dmp

Filesize
136KB

Download
memory/4436-218-0x0000000007FA0000-0x00000000082F0000-memory.dmp

Filesize
3.3MB

Download
memory/4436-216-0x0000000007F30000-0x0000000007F96000-memory.dmp

Filesize
408KB

Download
memory/4436-217-0x0000000007DB0000-0x0000000007E16000-memory.dmp

Filesize
408KB

Download
memory/4864-46-0x0000000073840000-0x0000000073F2E000-memory.dmp

Filesize
6.9MB

Download
memory/4864-0-0x0000000073840000-0x0000000073F2E000-memory.dmp

Filesize
6.9MB

Download
memory/4864-1-0x0000000000E00000-0x0000000001B50000-memory.dmp

Filesize
13.3MB

Download
memory/4988-92-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/4988-97-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/5116-60-0x0000000002380000-0x0000000002390000-memory.dmp

Filesize
64KB

Download
memory/5116-59-0x00007FFA59CF0000-0x00007FFA5A6DC000-memory.dmp

Filesize
9.9MB

Download
memory/5116-53-0x00000000002B0000-0x00000000002B8000-memory.dmp

Filesize
32KB

Download
memory/5116-105-0x00007FFA59CF0000-0x00007FFA5A6DC000-memory.dmp

Filesize
9.9MB

Download
memory/5116-107-0x0000000002380000-0x0000000002390000-memory.dmp

Filesize
64KB

Download