Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
153s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
10/10/2023, 01:24
Static task
static1
General
-
Target
b115ad95814af3c46b71fd230d3b2a224c8a8f356b27e0367b0f98d4948b2b60.exe
-
Size
13.4MB
-
MD5
39888d8c3490d982398d136e9e0a4581
-
SHA1
737a7f7e308cb3a2152f296cc3a7d44d14a675d7
-
SHA256
b115ad95814af3c46b71fd230d3b2a224c8a8f356b27e0367b0f98d4948b2b60
-
SHA512
0e463ccd5e9e98a62426a0eba604fc0664de7b5fc87ad04fef8041c983c4b1d53e024be69c9c8a22354f9b6dae7cfcfa7f2e8e7be6d192240842c09b0ffccf14
-
SSDEEP
196608:JOmSIaIgCXUXYGU2MYWZ3mpejjiAN8Y/IuHB+q9LOKd/VT7cRRbYc:Jl7JgCkX1SZ3pniI9hZLOKd/Wz
Malware Config
Extracted
smokeloader
up3
Extracted
smokeloader
2020
http://host-file-host6.com/
http://host-host-file8.com/
Extracted
stealc
http://5.42.65.39
-
url_path
/bed95ea4798a5204.php
Signatures
-
Glupteba payload 5 IoCs
resource yara_rule behavioral2/memory/4936-129-0x00000000047B0000-0x000000000509B000-memory.dmp family_glupteba behavioral2/memory/4936-143-0x0000000000400000-0x0000000002668000-memory.dmp family_glupteba behavioral2/memory/4936-145-0x0000000000400000-0x0000000002668000-memory.dmp family_glupteba behavioral2/memory/4936-212-0x0000000000400000-0x0000000002668000-memory.dmp family_glupteba behavioral2/memory/4936-232-0x00000000047B0000-0x000000000509B000-memory.dmp family_glupteba -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 11 IoCs
description pid Process procid_target PID 4772 created 3144 4772 latestX.exe 43 PID 4772 created 3144 4772 latestX.exe 43 PID 4772 created 3144 4772 latestX.exe 43 PID 4772 created 3144 4772 latestX.exe 43 PID 4772 created 3144 4772 latestX.exe 43 PID 400 created 3144 400 updater.exe 43 PID 400 created 3144 400 updater.exe 43 PID 400 created 3144 400 updater.exe 43 PID 400 created 3144 400 updater.exe 43 PID 400 created 3144 400 updater.exe 43 PID 400 created 3144 400 updater.exe 43 -
Downloads MZ/PE file
-
Drops file in Drivers directory 2 IoCs
description ioc Process File created C:\Windows\System32\drivers\etc\hosts latestX.exe File created C:\Windows\System32\drivers\etc\hosts updater.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 2716 netsh.exe -
Stops running service(s) 3 TTPs
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation b115ad95814af3c46b71fd230d3b2a224c8a8f356b27e0367b0f98d4948b2b60.exe Key value queried \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation kos1.exe Key value queried \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation kos.exe -
Executes dropped EXE 17 IoCs
pid Process 568 toolspub2.exe 4936 e0cbefcb1af40c7d4aff4aca26621a98.exe 1872 kos1.exe 2368 Setup.exe 4772 latestX.exe 2360 set16.exe 3856 kos.exe 3216 is-TQJGV.tmp 3276 toolspub2.exe 4916 previewer.exe 640 previewer.exe 4360 e0cbefcb1af40c7d4aff4aca26621a98.exe 400 updater.exe 2800 csrss.exe 4252 injector.exe 1920 windefender.exe 1732 windefender.exe -
Loads dropped DLL 5 IoCs
pid Process 3216 is-TQJGV.tmp 3216 is-TQJGV.tmp 3216 is-TQJGV.tmp 3360 InstallUtil.exe 3360 InstallUtil.exe -
resource yara_rule behavioral2/files/0x0007000000023107-671.dat upx behavioral2/files/0x0007000000023107-673.dat upx behavioral2/files/0x0007000000023107-674.dat upx -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" e0cbefcb1af40c7d4aff4aca26621a98.exe Set value (str) \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
description ioc Process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 10 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 568 set thread context of 3276 568 toolspub2.exe 96 PID 2368 set thread context of 3360 2368 Setup.exe 108 PID 400 set thread context of 3856 400 updater.exe 178 PID 400 set thread context of 1188 400 updater.exe 179 -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
description ioc Process File opened (read-only) \??\VBoxMiniRdrDN e0cbefcb1af40c7d4aff4aca26621a98.exe -
Drops file in Program Files directory 9 IoCs
description ioc Process File created C:\Program Files (x86)\PA Previewer\is-RH9TM.tmp is-TQJGV.tmp File created C:\Program Files (x86)\PA Previewer\is-99QRM.tmp is-TQJGV.tmp File created C:\Program Files\Google\Chrome\updater.exe latestX.exe File created C:\Program Files\Google\Libs\WR64.sys updater.exe File created C:\Program Files (x86)\PA Previewer\unins000.dat is-TQJGV.tmp File created C:\Program Files (x86)\PA Previewer\is-8V5PK.tmp is-TQJGV.tmp File created C:\Program Files (x86)\PA Previewer\is-KQFRO.tmp is-TQJGV.tmp File opened for modification C:\Program Files (x86)\PA Previewer\unins000.dat is-TQJGV.tmp File opened for modification C:\Program Files (x86)\PA Previewer\previewer.exe is-TQJGV.tmp -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rss\csrss.exe e0cbefcb1af40c7d4aff4aca26621a98.exe File created C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\rss e0cbefcb1af40c7d4aff4aca26621a98.exe -
Launches sc.exe 11 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1432 sc.exe 1860 sc.exe 2044 sc.exe 3884 sc.exe 4364 sc.exe 4336 sc.exe 1260 sc.exe 3332 sc.exe 4104 sc.exe 1276 sc.exe 4192 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspub2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspub2.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspub2.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 InstallUtil.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString InstallUtil.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4628 schtasks.exe 4672 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-92 = "Pacific SA Standard Time" e0cbefcb1af40c7d4aff4aca26621a98.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-152 = "Central America Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-372 = "Jerusalem Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-82 = "Atlantic Standard Time" e0cbefcb1af40c7d4aff4aca26621a98.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-452 = "Caucasus Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-281 = "Central Europe Daylight Time" e0cbefcb1af40c7d4aff4aca26621a98.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1931 = "Russia TZ 11 Daylight Time" e0cbefcb1af40c7d4aff4aca26621a98.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2452 = "Saint Pierre Standard Time" e0cbefcb1af40c7d4aff4aca26621a98.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2342 = "Haiti Standard Time" e0cbefcb1af40c7d4aff4aca26621a98.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-212 = "Pacific Standard Time" e0cbefcb1af40c7d4aff4aca26621a98.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2892 = "Sudan Standard Time" e0cbefcb1af40c7d4aff4aca26621a98.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-2062 = "North Korea Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2491 = "Aus Central W. Daylight Time" e0cbefcb1af40c7d4aff4aca26621a98.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-262 = "GMT Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-962 = "Paraguay Standard Time" e0cbefcb1af40c7d4aff4aca26621a98.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-561 = "SE Asia Daylight Time" e0cbefcb1af40c7d4aff4aca26621a98.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-302 = "Romance Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-541 = "Myanmar Daylight Time" e0cbefcb1af40c7d4aff4aca26621a98.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-385 = "Namibia Standard Time" e0cbefcb1af40c7d4aff4aca26621a98.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-772 = "Montevideo Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-211 = "Pacific Daylight Time" e0cbefcb1af40c7d4aff4aca26621a98.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-1822 = "Russia TZ 1 Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-449 = "Azerbaijan Standard Time" e0cbefcb1af40c7d4aff4aca26621a98.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1891 = "Russia TZ 3 Daylight Time" e0cbefcb1af40c7d4aff4aca26621a98.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-111 = "Eastern Daylight Time" e0cbefcb1af40c7d4aff4aca26621a98.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-1842 = "Russia TZ 4 Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-432 = "Iran Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-71 = "Newfoundland Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-842 = "Argentina Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-112 = "Eastern Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-352 = "FLE Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-681 = "E. Australia Daylight Time" e0cbefcb1af40c7d4aff4aca26621a98.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2372 = "Easter Island Standard Time" e0cbefcb1af40c7d4aff4aca26621a98.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-81 = "Atlantic Daylight Time" e0cbefcb1af40c7d4aff4aca26621a98.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1021 = "Bangladesh Daylight Time" e0cbefcb1af40c7d4aff4aca26621a98.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-402 = "Arabic Standard Time" e0cbefcb1af40c7d4aff4aca26621a98.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-912 = "Mauritius Standard Time" e0cbefcb1af40c7d4aff4aca26621a98.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3276 toolspub2.exe 3276 toolspub2.exe 3144 Explorer.EXE 3144 Explorer.EXE 3144 Explorer.EXE 3144 Explorer.EXE 3144 Explorer.EXE 3144 Explorer.EXE 3144 Explorer.EXE 3144 Explorer.EXE 3144 Explorer.EXE 3144 Explorer.EXE 3144 Explorer.EXE 3144 Explorer.EXE 3144 Explorer.EXE 3144 Explorer.EXE 3144 Explorer.EXE 3144 Explorer.EXE 3144 Explorer.EXE 3144 Explorer.EXE 3144 Explorer.EXE 3144 Explorer.EXE 3144 Explorer.EXE 3144 Explorer.EXE 3144 Explorer.EXE 3144 Explorer.EXE 3144 Explorer.EXE 3144 Explorer.EXE 3144 Explorer.EXE 3144 Explorer.EXE 3144 Explorer.EXE 3144 Explorer.EXE 3144 Explorer.EXE 3144 Explorer.EXE 3144 Explorer.EXE 3144 Explorer.EXE 3144 Explorer.EXE 3144 Explorer.EXE 3144 Explorer.EXE 3144 Explorer.EXE 3144 Explorer.EXE 3144 Explorer.EXE 3144 Explorer.EXE 3144 Explorer.EXE 3144 Explorer.EXE 3144 Explorer.EXE 3144 Explorer.EXE 3144 Explorer.EXE 2368 Setup.exe 2368 Setup.exe 2368 Setup.exe 2368 Setup.exe 3144 Explorer.EXE 3144 Explorer.EXE 3144 Explorer.EXE 3144 Explorer.EXE 3144 Explorer.EXE 3144 Explorer.EXE 3144 Explorer.EXE 3144 Explorer.EXE 3144 Explorer.EXE 3144 Explorer.EXE 3144 Explorer.EXE 3144 Explorer.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3144 Explorer.EXE -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 680 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 3276 toolspub2.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3856 kos.exe Token: SeDebugPrivilege 4916 previewer.exe Token: SeDebugPrivilege 640 previewer.exe Token: SeShutdownPrivilege 3144 Explorer.EXE Token: SeCreatePagefilePrivilege 3144 Explorer.EXE Token: SeShutdownPrivilege 3144 Explorer.EXE Token: SeCreatePagefilePrivilege 3144 Explorer.EXE Token: SeShutdownPrivilege 3144 Explorer.EXE Token: SeCreatePagefilePrivilege 3144 Explorer.EXE Token: SeShutdownPrivilege 3144 Explorer.EXE Token: SeCreatePagefilePrivilege 3144 Explorer.EXE Token: SeShutdownPrivilege 3144 Explorer.EXE Token: SeCreatePagefilePrivilege 3144 Explorer.EXE Token: SeDebugPrivilege 2368 Setup.exe Token: SeShutdownPrivilege 3144 Explorer.EXE Token: SeCreatePagefilePrivilege 3144 Explorer.EXE Token: SeShutdownPrivilege 3144 Explorer.EXE Token: SeCreatePagefilePrivilege 3144 Explorer.EXE Token: SeDebugPrivilege 3524 powershell.exe Token: SeShutdownPrivilege 3144 Explorer.EXE Token: SeCreatePagefilePrivilege 3144 Explorer.EXE Token: SeShutdownPrivilege 3144 Explorer.EXE Token: SeCreatePagefilePrivilege 3144 Explorer.EXE Token: SeShutdownPrivilege 3144 Explorer.EXE Token: SeCreatePagefilePrivilege 3144 Explorer.EXE Token: SeDebugPrivilege 3552 powershell.exe Token: SeDebugPrivilege 1488 powershell.exe Token: SeShutdownPrivilege 4128 powercfg.exe Token: SeCreatePagefilePrivilege 4128 powercfg.exe Token: SeShutdownPrivilege 792 powercfg.exe Token: SeCreatePagefilePrivilege 792 powercfg.exe Token: SeShutdownPrivilege 3784 powercfg.exe Token: SeCreatePagefilePrivilege 3784 powercfg.exe Token: SeShutdownPrivilege 4180 powercfg.exe Token: SeCreatePagefilePrivilege 4180 powercfg.exe Token: SeIncreaseQuotaPrivilege 1488 powershell.exe Token: SeSecurityPrivilege 1488 powershell.exe Token: SeTakeOwnershipPrivilege 1488 powershell.exe Token: SeLoadDriverPrivilege 1488 powershell.exe Token: SeSystemProfilePrivilege 1488 powershell.exe Token: SeSystemtimePrivilege 1488 powershell.exe Token: SeProfSingleProcessPrivilege 1488 powershell.exe Token: SeIncBasePriorityPrivilege 1488 powershell.exe Token: SeCreatePagefilePrivilege 1488 powershell.exe Token: SeBackupPrivilege 1488 powershell.exe Token: SeRestorePrivilege 1488 powershell.exe Token: SeShutdownPrivilege 1488 powershell.exe Token: SeDebugPrivilege 1488 powershell.exe Token: SeSystemEnvironmentPrivilege 1488 powershell.exe Token: SeRemoteShutdownPrivilege 1488 powershell.exe Token: SeUndockPrivilege 1488 powershell.exe Token: SeManageVolumePrivilege 1488 powershell.exe Token: 33 1488 powershell.exe Token: 34 1488 powershell.exe Token: 35 1488 powershell.exe Token: 36 1488 powershell.exe Token: SeIncreaseQuotaPrivilege 1488 powershell.exe Token: SeSecurityPrivilege 1488 powershell.exe Token: SeTakeOwnershipPrivilege 1488 powershell.exe Token: SeLoadDriverPrivilege 1488 powershell.exe Token: SeSystemProfilePrivilege 1488 powershell.exe Token: SeSystemtimePrivilege 1488 powershell.exe Token: SeProfSingleProcessPrivilege 1488 powershell.exe Token: SeIncBasePriorityPrivilege 1488 powershell.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1424 wrote to memory of 568 1424 b115ad95814af3c46b71fd230d3b2a224c8a8f356b27e0367b0f98d4948b2b60.exe 88 PID 1424 wrote to memory of 568 1424 b115ad95814af3c46b71fd230d3b2a224c8a8f356b27e0367b0f98d4948b2b60.exe 88 PID 1424 wrote to memory of 568 1424 b115ad95814af3c46b71fd230d3b2a224c8a8f356b27e0367b0f98d4948b2b60.exe 88 PID 1424 wrote to memory of 4936 1424 b115ad95814af3c46b71fd230d3b2a224c8a8f356b27e0367b0f98d4948b2b60.exe 89 PID 1424 wrote to memory of 4936 1424 b115ad95814af3c46b71fd230d3b2a224c8a8f356b27e0367b0f98d4948b2b60.exe 89 PID 1424 wrote to memory of 4936 1424 b115ad95814af3c46b71fd230d3b2a224c8a8f356b27e0367b0f98d4948b2b60.exe 89 PID 1424 wrote to memory of 1872 1424 b115ad95814af3c46b71fd230d3b2a224c8a8f356b27e0367b0f98d4948b2b60.exe 90 PID 1424 wrote to memory of 1872 1424 b115ad95814af3c46b71fd230d3b2a224c8a8f356b27e0367b0f98d4948b2b60.exe 90 PID 1424 wrote to memory of 1872 1424 b115ad95814af3c46b71fd230d3b2a224c8a8f356b27e0367b0f98d4948b2b60.exe 90 PID 1424 wrote to memory of 2368 1424 b115ad95814af3c46b71fd230d3b2a224c8a8f356b27e0367b0f98d4948b2b60.exe 91 PID 1424 wrote to memory of 2368 1424 b115ad95814af3c46b71fd230d3b2a224c8a8f356b27e0367b0f98d4948b2b60.exe 91 PID 1424 wrote to memory of 2368 1424 b115ad95814af3c46b71fd230d3b2a224c8a8f356b27e0367b0f98d4948b2b60.exe 91 PID 1424 wrote to memory of 4772 1424 b115ad95814af3c46b71fd230d3b2a224c8a8f356b27e0367b0f98d4948b2b60.exe 92 PID 1424 wrote to memory of 4772 1424 b115ad95814af3c46b71fd230d3b2a224c8a8f356b27e0367b0f98d4948b2b60.exe 92 PID 1872 wrote to memory of 2360 1872 kos1.exe 93 PID 1872 wrote to memory of 2360 1872 kos1.exe 93 PID 1872 wrote to memory of 2360 1872 kos1.exe 93 PID 1872 wrote to memory of 3856 1872 kos1.exe 94 PID 1872 wrote to memory of 3856 1872 kos1.exe 94 PID 2360 wrote to memory of 3216 2360 set16.exe 95 PID 2360 wrote to memory of 3216 2360 set16.exe 95 PID 2360 wrote to memory of 3216 2360 set16.exe 95 PID 568 wrote to memory of 3276 568 toolspub2.exe 96 PID 568 wrote to memory of 3276 568 toolspub2.exe 96 PID 568 wrote to memory of 3276 568 toolspub2.exe 96 PID 568 wrote to memory of 3276 568 toolspub2.exe 96 PID 568 wrote to memory of 3276 568 toolspub2.exe 96 PID 568 wrote to memory of 3276 568 toolspub2.exe 96 PID 3216 wrote to memory of 792 3216 is-TQJGV.tmp 129 PID 3216 wrote to memory of 792 3216 is-TQJGV.tmp 129 PID 3216 wrote to memory of 792 3216 is-TQJGV.tmp 129 PID 3216 wrote to memory of 4916 3216 is-TQJGV.tmp 97 PID 3216 wrote to memory of 4916 3216 is-TQJGV.tmp 97 PID 3216 wrote to memory of 4916 3216 is-TQJGV.tmp 97 PID 792 wrote to memory of 3688 792 powercfg.exe 100 PID 792 wrote to memory of 3688 792 powercfg.exe 100 PID 792 wrote to memory of 3688 792 powercfg.exe 100 PID 3216 wrote to memory of 640 3216 is-TQJGV.tmp 101 PID 3216 wrote to memory of 640 3216 is-TQJGV.tmp 101 PID 3216 wrote to memory of 640 3216 is-TQJGV.tmp 101 PID 4936 wrote to memory of 3524 4936 e0cbefcb1af40c7d4aff4aca26621a98.exe 105 PID 4936 wrote to memory of 3524 4936 e0cbefcb1af40c7d4aff4aca26621a98.exe 105 PID 4936 wrote to memory of 3524 4936 e0cbefcb1af40c7d4aff4aca26621a98.exe 105 PID 2368 wrote to memory of 1264 2368 Setup.exe 107 PID 2368 wrote to memory of 1264 2368 Setup.exe 107 PID 2368 wrote to memory of 1264 2368 Setup.exe 107 PID 2368 wrote to memory of 3796 2368 Setup.exe 109 PID 2368 wrote to memory of 3796 2368 Setup.exe 109 PID 2368 wrote to memory of 3796 2368 Setup.exe 109 PID 2368 wrote to memory of 3360 2368 Setup.exe 108 PID 2368 wrote to memory of 3360 2368 Setup.exe 108 PID 2368 wrote to memory of 3360 2368 Setup.exe 108 PID 2368 wrote to memory of 3360 2368 Setup.exe 108 PID 2368 wrote to memory of 3360 2368 Setup.exe 108 PID 2368 wrote to memory of 3360 2368 Setup.exe 108 PID 2368 wrote to memory of 3360 2368 Setup.exe 108 PID 2368 wrote to memory of 3360 2368 Setup.exe 108 PID 4400 wrote to memory of 1260 4400 cmd.exe 119 PID 4400 wrote to memory of 1260 4400 cmd.exe 119 PID 4400 wrote to memory of 1432 4400 cmd.exe 120 PID 4400 wrote to memory of 1432 4400 cmd.exe 120 PID 4400 wrote to memory of 1860 4400 cmd.exe 121 PID 4400 wrote to memory of 1860 4400 cmd.exe 121 PID 4400 wrote to memory of 3332 4400 cmd.exe 122 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\b115ad95814af3c46b71fd230d3b2a224c8a8f356b27e0367b0f98d4948b2b60.exe"C:\Users\Admin\AppData\Local\Temp\b115ad95814af3c46b71fd230d3b2a224c8a8f356b27e0367b0f98d4948b2b60.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:568 -
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"4⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3276
-
-
-
C:\Users\Admin\AppData\Local\Temp\e0cbefcb1af40c7d4aff4aca26621a98.exe"C:\Users\Admin\AppData\Local\Temp\e0cbefcb1af40c7d4aff4aca26621a98.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3524
-
-
C:\Users\Admin\AppData\Local\Temp\e0cbefcb1af40c7d4aff4aca26621a98.exe"C:\Users\Admin\AppData\Local\Temp\e0cbefcb1af40c7d4aff4aca26621a98.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:4360 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1500
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"5⤵PID:996
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes6⤵
- Modifies Windows Firewall
PID:2716
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1756
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4060
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
PID:2800 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2848
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F6⤵
- Creates scheduled task(s)
PID:4628
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f6⤵PID:4312
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:268
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:5000
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll6⤵
- Executes dropped EXE
PID:4252
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F6⤵
- Creates scheduled task(s)
PID:4672
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"6⤵
- Executes dropped EXE
PID:1920 -
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)7⤵PID:5036
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)8⤵
- Launches sc.exe
PID:3884
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\kos1.exe"C:\Users\Admin\AppData\Local\Temp\kos1.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\set16.exe"C:\Users\Admin\AppData\Local\Temp\set16.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\is-1GT3J.tmp\is-TQJGV.tmp"C:\Users\Admin\AppData\Local\Temp\is-1GT3J.tmp\is-TQJGV.tmp" /SL4 $6017C "C:\Users\Admin\AppData\Local\Temp\set16.exe" 1232936 522245⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Program Files (x86)\PA Previewer\previewer.exe"C:\Program Files (x86)\PA Previewer\previewer.exe" -i6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4916
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 86⤵PID:792
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 87⤵PID:3688
-
-
-
C:\Program Files (x86)\PA Previewer\previewer.exe"C:\Program Files (x86)\PA Previewer\previewer.exe" -s6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:640
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\kos.exe"C:\Users\Admin\AppData\Local\Temp\kos.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3856
-
-
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"4⤵PID:1264
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"4⤵
- Loads dropped DLL
- Checks processor information in registry
PID:3360
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"4⤵PID:3796
-
-
-
C:\Users\Admin\AppData\Local\Temp\latestX.exe"C:\Users\Admin\AppData\Local\Temp\latestX.exe"3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in Program Files directory
PID:4772
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3552
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc2⤵
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Windows\System32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
PID:1260
-
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
PID:1432
-
-
C:\Windows\System32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
PID:1860
-
-
C:\Windows\System32\sc.exesc stop bits3⤵
- Launches sc.exe
PID:3332
-
-
C:\Windows\System32\sc.exesc stop dosvc3⤵
- Launches sc.exe
PID:2044
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵PID:2540
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
PID:4128
-
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:792
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
PID:3784
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
PID:4180
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1488
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"2⤵PID:3860
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2176
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc2⤵PID:3976
-
C:\Windows\System32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
PID:4104
-
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
PID:1276
-
-
C:\Windows\System32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
PID:4192
-
-
C:\Windows\System32\sc.exesc stop bits3⤵
- Launches sc.exe
PID:4364
-
-
C:\Windows\System32\sc.exesc stop dosvc3⤵
- Launches sc.exe
PID:4336
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵PID:3296
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵PID:4788
-
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵PID:3896
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵PID:748
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵PID:4468
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1672
-
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe2⤵PID:3856
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe2⤵PID:1188
-
-
C:\Program Files\Google\Chrome\updater.exe"C:\Program Files\Google\Chrome\updater.exe"1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
PID:400
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:1732
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.9MB
MD527b85a95804a760da4dbee7ca800c9b4
SHA1f03136226bf3dd38ba0aa3aad1127ccab380197c
SHA256f98b98404ecf3871a10a290ade21ad77d0b2633f47247debc53d094b9bdff245
SHA512e760a15370272aa9541f1afceaaf4f5a8068dad21c6a8d50ebd01514e16bbc8f867c8af349080f3d1fa7a19eafe7cde74921d01716dea69ef801da1b74eae4a7
-
Filesize
1.9MB
MD527b85a95804a760da4dbee7ca800c9b4
SHA1f03136226bf3dd38ba0aa3aad1127ccab380197c
SHA256f98b98404ecf3871a10a290ade21ad77d0b2633f47247debc53d094b9bdff245
SHA512e760a15370272aa9541f1afceaaf4f5a8068dad21c6a8d50ebd01514e16bbc8f867c8af349080f3d1fa7a19eafe7cde74921d01716dea69ef801da1b74eae4a7
-
Filesize
1.9MB
MD527b85a95804a760da4dbee7ca800c9b4
SHA1f03136226bf3dd38ba0aa3aad1127ccab380197c
SHA256f98b98404ecf3871a10a290ade21ad77d0b2633f47247debc53d094b9bdff245
SHA512e760a15370272aa9541f1afceaaf4f5a8068dad21c6a8d50ebd01514e16bbc8f867c8af349080f3d1fa7a19eafe7cde74921d01716dea69ef801da1b74eae4a7
-
Filesize
5.6MB
MD5bae29e49e8190bfbbf0d77ffab8de59d
SHA14a6352bb47c7e1666a60c76f9b17ca4707872bd9
SHA256f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87
SHA5129e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2
-
Filesize
5.6MB
MD5bae29e49e8190bfbbf0d77ffab8de59d
SHA14a6352bb47c7e1666a60c76f9b17ca4707872bd9
SHA256f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87
SHA5129e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2
-
Filesize
1.9MB
MD527b85a95804a760da4dbee7ca800c9b4
SHA1f03136226bf3dd38ba0aa3aad1127ccab380197c
SHA256f98b98404ecf3871a10a290ade21ad77d0b2633f47247debc53d094b9bdff245
SHA512e760a15370272aa9541f1afceaaf4f5a8068dad21c6a8d50ebd01514e16bbc8f867c8af349080f3d1fa7a19eafe7cde74921d01716dea69ef801da1b74eae4a7
-
Filesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
Filesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD5bd5940f08d0be56e65e5f2aaf47c538e
SHA1d7e31b87866e5e383ab5499da64aba50f03e8443
SHA2562d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6
SHA512c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406
-
Filesize
116B
MD5ec6aae2bb7d8781226ea61adca8f0586
SHA1d82b3bad240f263c1b887c7c0cc4c2ff0e86dfe3
SHA256b02fffaba9e664ff7840c82b102d6851ec0bb148cec462cef40999545309e599
SHA512aa62a8cd02a03e4f462f76ae6ff2e43849052ce77cca3a2ccf593f6669425830d0910afac3cf2c46dd385454a6fb3b4bd604ae13b9586087d6f22de644f9dfc7
-
Filesize
1.9MB
MD54c7efd165af03d720ce4a9d381bfb29a
SHA192b14564856155487a57db57b8a222b7f57a81e9
SHA256f5bbe3fdc27074249c6860b8959a155e6c79571daa86e7a574656a3c5c6326b8
SHA51238a26722e2669e7432b5a068b08ff852988a26ed875e8aa23156ea4bd0e852686ccabe6e685d5b0e888cb5755cbe424189fb8033ada37994417d3549b10637dd
-
Filesize
1.9MB
MD54c7efd165af03d720ce4a9d381bfb29a
SHA192b14564856155487a57db57b8a222b7f57a81e9
SHA256f5bbe3fdc27074249c6860b8959a155e6c79571daa86e7a574656a3c5c6326b8
SHA51238a26722e2669e7432b5a068b08ff852988a26ed875e8aa23156ea4bd0e852686ccabe6e685d5b0e888cb5755cbe424189fb8033ada37994417d3549b10637dd
-
Filesize
1.9MB
MD54c7efd165af03d720ce4a9d381bfb29a
SHA192b14564856155487a57db57b8a222b7f57a81e9
SHA256f5bbe3fdc27074249c6860b8959a155e6c79571daa86e7a574656a3c5c6326b8
SHA51238a26722e2669e7432b5a068b08ff852988a26ed875e8aa23156ea4bd0e852686ccabe6e685d5b0e888cb5755cbe424189fb8033ada37994417d3549b10637dd
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
Filesize
4.2MB
MD541e1611e1d7ec85f611c4717b9f38599
SHA1dea6d2e9f3797770e562e72b18647f9fb794caf2
SHA256309b3d7db8a0ec9faae6c2a89f72e94b8465b393b3f8729e9d87fcdff765e813
SHA5124e3ac50dd50403b1094d68906ebdcb744bfc21eb8286f813a7bdfbeb6ac32224f9ea8dcaf3cbda395260f108759249620cda53185d4b55847bd58c184b04d5b8
-
Filesize
4.2MB
MD541e1611e1d7ec85f611c4717b9f38599
SHA1dea6d2e9f3797770e562e72b18647f9fb794caf2
SHA256309b3d7db8a0ec9faae6c2a89f72e94b8465b393b3f8729e9d87fcdff765e813
SHA5124e3ac50dd50403b1094d68906ebdcb744bfc21eb8286f813a7bdfbeb6ac32224f9ea8dcaf3cbda395260f108759249620cda53185d4b55847bd58c184b04d5b8
-
Filesize
4.2MB
MD541e1611e1d7ec85f611c4717b9f38599
SHA1dea6d2e9f3797770e562e72b18647f9fb794caf2
SHA256309b3d7db8a0ec9faae6c2a89f72e94b8465b393b3f8729e9d87fcdff765e813
SHA5124e3ac50dd50403b1094d68906ebdcb744bfc21eb8286f813a7bdfbeb6ac32224f9ea8dcaf3cbda395260f108759249620cda53185d4b55847bd58c184b04d5b8
-
Filesize
4.2MB
MD541e1611e1d7ec85f611c4717b9f38599
SHA1dea6d2e9f3797770e562e72b18647f9fb794caf2
SHA256309b3d7db8a0ec9faae6c2a89f72e94b8465b393b3f8729e9d87fcdff765e813
SHA5124e3ac50dd50403b1094d68906ebdcb744bfc21eb8286f813a7bdfbeb6ac32224f9ea8dcaf3cbda395260f108759249620cda53185d4b55847bd58c184b04d5b8
-
Filesize
647KB
MD52fba5642cbcaa6857c3995ccb5d2ee2a
SHA191fe8cd860cba7551fbf78bc77cc34e34956e8cc
SHA256ddec51f3741f3988b9cc792f6f8fc0dfa2098ef0eb84c6a2af7f8da5a72b40fa
SHA51230613b43427d17115134798506f197c0f5f8b2b9f247668fa25b9dd4853bbd97ac1e27f4e3325dec4f6dfc0e448ebbddb2969ad1a1781aa59ebf522d436aed7c
-
Filesize
647KB
MD52fba5642cbcaa6857c3995ccb5d2ee2a
SHA191fe8cd860cba7551fbf78bc77cc34e34956e8cc
SHA256ddec51f3741f3988b9cc792f6f8fc0dfa2098ef0eb84c6a2af7f8da5a72b40fa
SHA51230613b43427d17115134798506f197c0f5f8b2b9f247668fa25b9dd4853bbd97ac1e27f4e3325dec4f6dfc0e448ebbddb2969ad1a1781aa59ebf522d436aed7c
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
32KB
MD5b4786eb1e1a93633ad1b4c112514c893
SHA1734750b771d0809c88508e4feb788d7701e6dada
SHA2562ae4169f721beb389a661e6dbb18bc84ef38556af1f46807da9d87aec2a6f06f
SHA5120882d2aa163ece22796f837111db0d55158098035005e57cd2e9b8d59dc2e582207840bf98bee534b81c368acf60ab5d8ecbe762209273bda067a215cdb2c0c6
-
Filesize
32KB
MD5b4786eb1e1a93633ad1b4c112514c893
SHA1734750b771d0809c88508e4feb788d7701e6dada
SHA2562ae4169f721beb389a661e6dbb18bc84ef38556af1f46807da9d87aec2a6f06f
SHA5120882d2aa163ece22796f837111db0d55158098035005e57cd2e9b8d59dc2e582207840bf98bee534b81c368acf60ab5d8ecbe762209273bda067a215cdb2c0c6
-
Filesize
8KB
MD5076ab7d1cc5150a5e9f8745cc5f5fb6c
SHA17b40783a27a38106e2cc91414f2bc4d8b484c578
SHA256d1b71081d7ba414b589338329f278ba51c6ccf542d74f131f96c2337ee0a4c90
SHA51275e274a654e88feb0d66156f387bc5e420811f4f62939396a7455d12e835d7e134b2579ab59976c591b416d1ec1acdf05e9eb290c8f01383c6a50bf43854420b
-
Filesize
8KB
MD5076ab7d1cc5150a5e9f8745cc5f5fb6c
SHA17b40783a27a38106e2cc91414f2bc4d8b484c578
SHA256d1b71081d7ba414b589338329f278ba51c6ccf542d74f131f96c2337ee0a4c90
SHA51275e274a654e88feb0d66156f387bc5e420811f4f62939396a7455d12e835d7e134b2579ab59976c591b416d1ec1acdf05e9eb290c8f01383c6a50bf43854420b
-
Filesize
8KB
MD5076ab7d1cc5150a5e9f8745cc5f5fb6c
SHA17b40783a27a38106e2cc91414f2bc4d8b484c578
SHA256d1b71081d7ba414b589338329f278ba51c6ccf542d74f131f96c2337ee0a4c90
SHA51275e274a654e88feb0d66156f387bc5e420811f4f62939396a7455d12e835d7e134b2579ab59976c591b416d1ec1acdf05e9eb290c8f01383c6a50bf43854420b
-
Filesize
1.4MB
MD585b698363e74ba3c08fc16297ddc284e
SHA1171cfea4a82a7365b241f16aebdb2aad29f4f7c0
SHA25678efcbb0c6eb6a4c76c036adc65154b8ff028849f79d508e45babfb527cb7cfe
SHA5127e4816c43e0addba088709948e8aedc9e39d6802c74a75cfbc2a0e739b44c5b5eef2bb2453b7032c758b0bdb38e4e7a598aa29be015796361b81d7f9e8027796
-
Filesize
1.4MB
MD585b698363e74ba3c08fc16297ddc284e
SHA1171cfea4a82a7365b241f16aebdb2aad29f4f7c0
SHA25678efcbb0c6eb6a4c76c036adc65154b8ff028849f79d508e45babfb527cb7cfe
SHA5127e4816c43e0addba088709948e8aedc9e39d6802c74a75cfbc2a0e739b44c5b5eef2bb2453b7032c758b0bdb38e4e7a598aa29be015796361b81d7f9e8027796
-
Filesize
1.4MB
MD585b698363e74ba3c08fc16297ddc284e
SHA1171cfea4a82a7365b241f16aebdb2aad29f4f7c0
SHA25678efcbb0c6eb6a4c76c036adc65154b8ff028849f79d508e45babfb527cb7cfe
SHA5127e4816c43e0addba088709948e8aedc9e39d6802c74a75cfbc2a0e739b44c5b5eef2bb2453b7032c758b0bdb38e4e7a598aa29be015796361b81d7f9e8027796
-
Filesize
5.6MB
MD5bae29e49e8190bfbbf0d77ffab8de59d
SHA14a6352bb47c7e1666a60c76f9b17ca4707872bd9
SHA256f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87
SHA5129e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2
-
Filesize
5.6MB
MD5bae29e49e8190bfbbf0d77ffab8de59d
SHA14a6352bb47c7e1666a60c76f9b17ca4707872bd9
SHA256f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87
SHA5129e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2
-
Filesize
5.6MB
MD5bae29e49e8190bfbbf0d77ffab8de59d
SHA14a6352bb47c7e1666a60c76f9b17ca4707872bd9
SHA256f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87
SHA5129e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2
-
Filesize
1.4MB
MD522d5269955f256a444bd902847b04a3b
SHA141a83de3273270c3bd5b2bd6528bdc95766aa268
SHA256ab16986253bd187e3134f27495ef0db4b648f769721bc8c84b708c7ba69156fd
SHA512d85ada5d8c2c02932a79241a484b088ba70bda0497fd8ad638300935a16841d7cbc8258be93055907cb533bc534fdd48c7c91109fa22f87e65a6b374cd51055c
-
Filesize
1.4MB
MD522d5269955f256a444bd902847b04a3b
SHA141a83de3273270c3bd5b2bd6528bdc95766aa268
SHA256ab16986253bd187e3134f27495ef0db4b648f769721bc8c84b708c7ba69156fd
SHA512d85ada5d8c2c02932a79241a484b088ba70bda0497fd8ad638300935a16841d7cbc8258be93055907cb533bc534fdd48c7c91109fa22f87e65a6b374cd51055c
-
Filesize
1.4MB
MD522d5269955f256a444bd902847b04a3b
SHA141a83de3273270c3bd5b2bd6528bdc95766aa268
SHA256ab16986253bd187e3134f27495ef0db4b648f769721bc8c84b708c7ba69156fd
SHA512d85ada5d8c2c02932a79241a484b088ba70bda0497fd8ad638300935a16841d7cbc8258be93055907cb533bc534fdd48c7c91109fa22f87e65a6b374cd51055c
-
Filesize
278KB
MD5d2ff6b5f2b7469fe3f6dc12c573735d1
SHA162a82a6d1a68eecdbbff34026a7fc9f6af78f2ef
SHA25604969e573fe6dc8e69b1733c56164f9c53b0c33a823b940ee7a08167ff067252
SHA512560715d7c861c218d21d21d6cd15b1150adf9e94f744d6f721eb02209c701fb87e296081d64844f574c7531045220c8ebe789c0be67dd3980043a203976a2259
-
Filesize
278KB
MD5d2ff6b5f2b7469fe3f6dc12c573735d1
SHA162a82a6d1a68eecdbbff34026a7fc9f6af78f2ef
SHA25604969e573fe6dc8e69b1733c56164f9c53b0c33a823b940ee7a08167ff067252
SHA512560715d7c861c218d21d21d6cd15b1150adf9e94f744d6f721eb02209c701fb87e296081d64844f574c7531045220c8ebe789c0be67dd3980043a203976a2259
-
Filesize
278KB
MD5d2ff6b5f2b7469fe3f6dc12c573735d1
SHA162a82a6d1a68eecdbbff34026a7fc9f6af78f2ef
SHA25604969e573fe6dc8e69b1733c56164f9c53b0c33a823b940ee7a08167ff067252
SHA512560715d7c861c218d21d21d6cd15b1150adf9e94f744d6f721eb02209c701fb87e296081d64844f574c7531045220c8ebe789c0be67dd3980043a203976a2259
-
Filesize
278KB
MD5d2ff6b5f2b7469fe3f6dc12c573735d1
SHA162a82a6d1a68eecdbbff34026a7fc9f6af78f2ef
SHA25604969e573fe6dc8e69b1733c56164f9c53b0c33a823b940ee7a08167ff067252
SHA512560715d7c861c218d21d21d6cd15b1150adf9e94f744d6f721eb02209c701fb87e296081d64844f574c7531045220c8ebe789c0be67dd3980043a203976a2259
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5e63f99304e6cd75624082a1bf574957f
SHA1d5963537317e9ade37e060bf6cb9654c6131a2aa
SHA25639d5383e382cb6ad15270110f3d86a56e93e0e8e28b37e92db44a025972a9844
SHA512f982d87344289829f79a40e6509478912d6f97c748ff14e829b44e023c7469dff022067552a8efb205a4f21b738eec73676cb4145862b0df64712f5ac2cdc1a5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5d774968275504f835897e09a4b62fb55
SHA184630b0ac350e555a686a81e0b61f221af685eca
SHA256127b6e81d3492f3dd100d84bed681dcef29a65f19c33062850decda9f8485799
SHA512f3bdd3f87b539faa667254f8176f53f9920d3fc78b11ede9ef768bc0888a794715c9a61e48a9fb5971e3088721fd41f5423dde79e9d24565e907ab6be270b381
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD54ac804f4c9bf80ffe1c3918fba1d629e
SHA1b47a76e7eab4dfc376c61f49cde89a153be7f2d5
SHA256bc4a2a54569a4dd7572bfde121f42f4187a3497fb9615ebe1676b81c8ab11a50
SHA512316a5416b9906fc4e2b79c0ada162158649d784f3f77fbcf7a0af18bca321d55c898ca35731791760f75318ed6e267e0da93b0baf3bd14600f4b144a7cf1ec46
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD57a76beec7c8f0d2a2cef354864f6b241
SHA13952a23966cb11025f1465bff02534cab101a2be
SHA256b35862a14fc1625752961ec9129d734c7791170e522d76bab9cf37ae26212afc
SHA512a881f5b25356bb8d8312202218fd95776be41a546d679832fa90d6c0bf9643f675270e6f99d4f8c715c6ae05d5fa5925cc45153cc5df6c01e593fddb9ce81653
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD599e97c19763a81b68adc0754c1433300
SHA16d65f2e277cd7316120df4bf08d666f82bae1529
SHA256f7a79d48004d29575a9ca9542b8d6fbbce82e83182b2191ce0ee6ef54bb233b8
SHA5129b618f875a096841cdde57e175df4971d1c1e87baf917390c719145269fde3afd3b7e2539fc760e8e653031f6ed014158a4fbe89f6510afbdea933657d882e25
-
Filesize
3KB
MD500930b40cba79465b7a38ed0449d1449
SHA14b25a89ee28b20ba162f23772ddaf017669092a5
SHA256eda1aae2c8fce700e3bdbe0186cf3db88400cf0ac13ec736e84dacba61628a01
SHA512cbe4760ec041e7da7ab86474d5c82969cfccb8ccc5dbdac9436862d5b1b86210ab90754d3c8da5724176570d8842e57a716a281acba8719e90098a6f61a17c62
-
Filesize
4.2MB
MD541e1611e1d7ec85f611c4717b9f38599
SHA1dea6d2e9f3797770e562e72b18647f9fb794caf2
SHA256309b3d7db8a0ec9faae6c2a89f72e94b8465b393b3f8729e9d87fcdff765e813
SHA5124e3ac50dd50403b1094d68906ebdcb744bfc21eb8286f813a7bdfbeb6ac32224f9ea8dcaf3cbda395260f108759249620cda53185d4b55847bd58c184b04d5b8
-
Filesize
4.2MB
MD541e1611e1d7ec85f611c4717b9f38599
SHA1dea6d2e9f3797770e562e72b18647f9fb794caf2
SHA256309b3d7db8a0ec9faae6c2a89f72e94b8465b393b3f8729e9d87fcdff765e813
SHA5124e3ac50dd50403b1094d68906ebdcb744bfc21eb8286f813a7bdfbeb6ac32224f9ea8dcaf3cbda395260f108759249620cda53185d4b55847bd58c184b04d5b8
-
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize4KB
MD5bdb25c22d14ec917e30faf353826c5de
SHA16c2feb9cea9237bc28842ebf2fea68b3bd7ad190
SHA256e3274ce8296f2cd20e3189576fbadbfa0f1817cdf313487945c80e968589a495
SHA512b5eddbfd4748298a302e2963cfd12d849130b6dcb8f0f85a2a623caed0ff9bd88f4ec726f646dbebfca4964adc35f882ec205113920cb546cc08193739d6728c
-
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize1KB
MD5b42c70c1dbf0d1d477ec86902db9e986
SHA11d1c0a670748b3d10bee8272e5d67a4fabefd31f
SHA2568ed3b348989cdc967d1fc0e887b2a2f5a656680d8d14ebd3cb71a10c2f55867a
SHA51257fb278a8b2e83d01fac2a031c90e0e2bd5e4c1a360cfa4308490eb07e1b9d265b1f28399d0f10b141a6438ba92dd5f9ce4f18530ec277fece0eb7678041cbc5
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec