Analysis
-
max time kernel
81s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
15-10-2023 14:25
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.3aec0ad346af22c0b4de3b6ac3a5f685eb2be4be5d250e79b3c6fc0d188766d0exe_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.3aec0ad346af22c0b4de3b6ac3a5f685eb2be4be5d250e79b3c6fc0d188766d0exe_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
NEAS.3aec0ad346af22c0b4de3b6ac3a5f685eb2be4be5d250e79b3c6fc0d188766d0exe_JC.exe
-
Size
237KB
-
MD5
2dbb58de384e320b5d0e4c4536096ce8
-
SHA1
eeea2055cc885e2ba89f15cd0304fc35698e2998
-
SHA256
3aec0ad346af22c0b4de3b6ac3a5f685eb2be4be5d250e79b3c6fc0d188766d0
-
SHA512
c89117767521b478333e1a819a568a69fa1bcc1cdc1ba8aeb50f1a234515406602f68524e3e331ff06bda0cdb181c0ffe2f0011472eba075fd6f90b1fe72af08
-
SSDEEP
3072:2LLLaADrQczp8Qcr+4nHYIvwEaZyIZykAzz5Du+O497d7Q3pK:2jaAIcqQY44wrZokAxu+O4H5
Malware Config
Extracted
smokeloader
2022
http://onualituyrs.org/
http://sumagulituyo.org/
http://snukerukeutit.org/
http://lightseinsteniki.org/
http://liuliuoumumy.org/
http://stualialuyastrelia.net/
http://kumbuyartyty.net/
http://criogetikfenbut.org/
http://tonimiuyaytre.org/
http://tyiuiunuewqy.org/
http://wirtshauspost.at/tmp/
http://msktk.ru/tmp/
http://soetegem.com/tmp/
http://gromograd.ru/tmp/
http://talesofpirates.net/tmp/
Extracted
djvu
http://zexeq.com/raud/get.php
-
extension
.pthh
-
offline_id
43WPLl8Cnh3dZoiWhf8tP8Q9CrMBVUL2dwHB2Rt1
-
payload_url
http://colisumy.com/dl/build2.exe
http://zexeq.com/files/1/build3.exe
-
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-dHFDYXqlkk Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0808ASUDr
Extracted
redline
LogsDiller Cloud (TG: @logsdillabot)
146.59.161.13:39199
Extracted
amadey
3.87
http://79.137.192.18/9bDc8sQ/index.php
-
install_dir
577f58beff
-
install_file
yiueea.exe
-
strings_key
a5085075a537f09dec81cc154ec0af4d
Extracted
smokeloader
pub1
Signatures
-
Detected Djvu ransomware 9 IoCs
resource yara_rule behavioral2/memory/1184-55-0x0000000004900000-0x0000000004A1B000-memory.dmp family_djvu behavioral2/memory/5036-56-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/5036-58-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/5036-59-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/5036-60-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/5036-69-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/2180-79-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/2180-80-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/2180-82-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu -
Djvu Ransomware
Ransomware which is a variant of the STOP family.
-
Glupteba payload 6 IoCs
resource yara_rule behavioral2/memory/2232-148-0x0000000005100000-0x00000000059EB000-memory.dmp family_glupteba behavioral2/memory/1796-162-0x0000000005100000-0x00000000059EB000-memory.dmp family_glupteba behavioral2/memory/2232-169-0x0000000000400000-0x0000000002FB8000-memory.dmp family_glupteba behavioral2/memory/2232-202-0x0000000000400000-0x0000000002FB8000-memory.dmp family_glupteba behavioral2/memory/2232-211-0x0000000005100000-0x00000000059EB000-memory.dmp family_glupteba behavioral2/memory/2232-251-0x0000000000400000-0x0000000002FB8000-memory.dmp family_glupteba -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
resource yara_rule behavioral2/memory/2308-93-0x0000000000400000-0x000000000043E000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ mi.exe -
Downloads MZ/PE file
-
Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 4652 netsh.exe -
Stops running service(s) 3 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion mi.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion mi.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation 9A66.exe Key value queried \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation BAC4.exe Key value queried \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation yiueea.exe -
Executes dropped EXE 13 IoCs
pid Process 1184 9A66.exe 5036 9A66.exe 2784 9A66.exe 5088 ADC0.exe 2180 9A66.exe 4672 B39E.exe 2228 BAC4.exe 4900 BE20.exe 512 yiueea.exe 2232 C41C.exe 1336 mi.exe 3884 sc.exe 4788 C41C.exe -
Loads dropped DLL 2 IoCs
pid Process 4812 regsvr32.exe 4612 regsvr32.exe -
Modifies file permissions 1 TTPs 1 IoCs
pid Process 3216 icacls.exe -
resource yara_rule behavioral2/files/0x0013000000023242-247.dat themida behavioral2/files/0x0013000000023242-253.dat themida behavioral2/memory/1336-255-0x00007FF6E7F40000-0x00007FF6E9179000-memory.dmp themida behavioral2/memory/1336-263-0x00007FF6E7F40000-0x00007FF6E9179000-memory.dmp themida behavioral2/memory/1336-265-0x00007FF6E7F40000-0x00007FF6E9179000-memory.dmp themida behavioral2/files/0x0013000000023242-376.dat themida behavioral2/files/0x000a000000023254-395.dat themida behavioral2/files/0x000a000000023254-593.dat themida -
resource yara_rule behavioral2/files/0x0008000000023263-604.dat upx behavioral2/files/0x0008000000023263-606.dat upx behavioral2/files/0x0008000000023263-607.dat upx -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\3d7d816e-bc95-4f8e-821f-2113cd8e7517\\9A66.exe\" --AutoStart" 9A66.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mi.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 73 api.2ip.ua 74 api.2ip.ua -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 1336 mi.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 1184 set thread context of 5036 1184 9A66.exe 93 PID 2784 set thread context of 2180 2784 9A66.exe 98 PID 4672 set thread context of 2308 4672 B39E.exe 107 PID 5088 set thread context of 3564 5088 ADC0.exe 136 -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
description ioc Process File opened (read-only) \??\VBoxMiniRdrDN C41C.exe -
Launches sc.exe 11 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3188 sc.exe 396 sc.exe 316 sc.exe 4176 sc.exe 4792 sc.exe 4932 sc.exe 3884 sc.exe 3336 sc.exe 1700 sc.exe 2656 sc.exe 1140 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 2836 2180 WerFault.exe 98 3756 4672 WerFault.exe 103 -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI BE20.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI NEAS.3aec0ad346af22c0b4de3b6ac3a5f685eb2be4be5d250e79b3c6fc0d188766d0exe_JC.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI NEAS.3aec0ad346af22c0b4de3b6ac3a5f685eb2be4be5d250e79b3c6fc0d188766d0exe_JC.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI NEAS.3aec0ad346af22c0b4de3b6ac3a5f685eb2be4be5d250e79b3c6fc0d188766d0exe_JC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI BE20.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI BE20.exe -
Creates scheduled task(s) 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2284 schtasks.exe 3260 schtasks.exe 4268 schtasks.exe 5016 schtasks.exe 1248 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-841 = "Argentina Daylight Time" C41C.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-81 = "Atlantic Daylight Time" C41C.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2872 = "Magallanes Standard Time" C41C.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2062 = "North Korea Standard Time" C41C.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-871 = "Pakistan Daylight Time" C41C.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1502 = "Turkey Standard Time" C41C.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-621 = "Korea Daylight Time" C41C.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-771 = "Montevideo Daylight Time" C41C.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1932 = "Russia TZ 11 Standard Time" C41C.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-242 = "Samoa Standard Time" C41C.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2841 = "Saratov Daylight Time" C41C.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-462 = "Afghanistan Standard Time" C41C.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-401 = "Arabic Daylight Time" C41C.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-51 = "Greenland Daylight Time" C41C.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-301 = "Romance Daylight Time" C41C.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2142 = "Transbaikal Standard Time" C41C.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2161 = "Altai Daylight Time" C41C.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-251 = "Dateline Daylight Time" C41C.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-3051 = "Qyzylorda Daylight Time" C41C.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-72 = "Newfoundland Standard Time" C41C.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-71 = "Newfoundland Daylight Time" C41C.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1891 = "Russia TZ 3 Daylight Time" C41C.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-241 = "Samoa Daylight Time" C41C.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-449 = "Azerbaijan Standard Time" C41C.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-341 = "Egypt Daylight Time" C41C.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-352 = "FLE Standard Time" C41C.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2321 = "Sakhalin Daylight Time" C41C.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2591 = "Tocantins Daylight Time" C41C.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-541 = "Myanmar Daylight Time" C41C.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-661 = "Cen. Australia Daylight Time" C41C.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-572 = "China Standard Time" C41C.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-331 = "E. Europe Daylight Time" C41C.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-435 = "Georgian Standard Time" C41C.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-622 = "Korea Standard Time" C41C.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2512 = "Lord Howe Standard Time" C41C.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2002 = "Cabo Verde Standard Time" C41C.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-451 = "Caucasus Daylight Time" C41C.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-431 = "Iran Daylight Time" C41C.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-561 = "SE Asia Daylight Time" C41C.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-222 = "Alaskan Standard Time" C41C.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-282 = "Central Europe Standard Time" C41C.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-361 = "GTB Daylight Time" C41C.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-402 = "Arabic Standard Time" C41C.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-151 = "Central America Daylight Time" C41C.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-981 = "Kamchatka Daylight Time" C41C.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-364 = "Middle East Daylight Time" C41C.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-461 = "Afghanistan Daylight Time" C41C.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2182 = "Astrakhan Standard Time" C41C.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2772 = "Omsk Standard Time" C41C.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-791 = "SA Western Daylight Time" C41C.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3576 NEAS.3aec0ad346af22c0b4de3b6ac3a5f685eb2be4be5d250e79b3c6fc0d188766d0exe_JC.exe 3576 NEAS.3aec0ad346af22c0b4de3b6ac3a5f685eb2be4be5d250e79b3c6fc0d188766d0exe_JC.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3128 Process not Found -
Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 3576 NEAS.3aec0ad346af22c0b4de3b6ac3a5f685eb2be4be5d250e79b3c6fc0d188766d0exe_JC.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 4900 BE20.exe -
Suspicious use of AdjustPrivilegeToken 39 IoCs
description pid Process Token: SeShutdownPrivilege 3128 Process not Found Token: SeCreatePagefilePrivilege 3128 Process not Found Token: SeShutdownPrivilege 3128 Process not Found Token: SeCreatePagefilePrivilege 3128 Process not Found Token: SeShutdownPrivilege 3128 Process not Found Token: SeCreatePagefilePrivilege 3128 Process not Found Token: SeShutdownPrivilege 3128 Process not Found Token: SeCreatePagefilePrivilege 3128 Process not Found Token: SeShutdownPrivilege 3128 Process not Found Token: SeCreatePagefilePrivilege 3128 Process not Found Token: SeShutdownPrivilege 3128 Process not Found Token: SeCreatePagefilePrivilege 3128 Process not Found Token: SeShutdownPrivilege 3128 Process not Found Token: SeCreatePagefilePrivilege 3128 Process not Found Token: SeShutdownPrivilege 3128 Process not Found Token: SeCreatePagefilePrivilege 3128 Process not Found Token: SeShutdownPrivilege 3128 Process not Found Token: SeCreatePagefilePrivilege 3128 Process not Found Token: SeShutdownPrivilege 3128 Process not Found Token: SeCreatePagefilePrivilege 3128 Process not Found Token: SeShutdownPrivilege 3128 Process not Found Token: SeCreatePagefilePrivilege 3128 Process not Found Token: SeShutdownPrivilege 3128 Process not Found Token: SeCreatePagefilePrivilege 3128 Process not Found Token: SeDebugPrivilege 2328 powershell.exe Token: SeDebugPrivilege 2308 AppLaunch.exe Token: SeShutdownPrivilege 3128 Process not Found Token: SeCreatePagefilePrivilege 3128 Process not Found Token: SeShutdownPrivilege 3128 Process not Found Token: SeCreatePagefilePrivilege 3128 Process not Found Token: SeDebugPrivilege 2232 C41C.exe Token: SeImpersonatePrivilege 2232 C41C.exe Token: SeDebugPrivilege 4028 powershell.exe Token: SeDebugPrivilege 3564 jsc.exe Token: SeShutdownPrivilege 3128 Process not Found Token: SeCreatePagefilePrivilege 3128 Process not Found Token: SeShutdownPrivilege 3128 Process not Found Token: SeCreatePagefilePrivilege 3128 Process not Found Token: SeDebugPrivilege 2736 powershell.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3128 wrote to memory of 1184 3128 Process not Found 92 PID 3128 wrote to memory of 1184 3128 Process not Found 92 PID 3128 wrote to memory of 1184 3128 Process not Found 92 PID 1184 wrote to memory of 5036 1184 9A66.exe 93 PID 1184 wrote to memory of 5036 1184 9A66.exe 93 PID 1184 wrote to memory of 5036 1184 9A66.exe 93 PID 1184 wrote to memory of 5036 1184 9A66.exe 93 PID 1184 wrote to memory of 5036 1184 9A66.exe 93 PID 1184 wrote to memory of 5036 1184 9A66.exe 93 PID 1184 wrote to memory of 5036 1184 9A66.exe 93 PID 1184 wrote to memory of 5036 1184 9A66.exe 93 PID 1184 wrote to memory of 5036 1184 9A66.exe 93 PID 1184 wrote to memory of 5036 1184 9A66.exe 93 PID 5036 wrote to memory of 3216 5036 9A66.exe 94 PID 5036 wrote to memory of 3216 5036 9A66.exe 94 PID 5036 wrote to memory of 3216 5036 9A66.exe 94 PID 5036 wrote to memory of 2784 5036 9A66.exe 95 PID 5036 wrote to memory of 2784 5036 9A66.exe 95 PID 5036 wrote to memory of 2784 5036 9A66.exe 95 PID 3128 wrote to memory of 5088 3128 Process not Found 97 PID 3128 wrote to memory of 5088 3128 Process not Found 97 PID 2784 wrote to memory of 2180 2784 9A66.exe 98 PID 2784 wrote to memory of 2180 2784 9A66.exe 98 PID 2784 wrote to memory of 2180 2784 9A66.exe 98 PID 2784 wrote to memory of 2180 2784 9A66.exe 98 PID 2784 wrote to memory of 2180 2784 9A66.exe 98 PID 2784 wrote to memory of 2180 2784 9A66.exe 98 PID 2784 wrote to memory of 2180 2784 9A66.exe 98 PID 2784 wrote to memory of 2180 2784 9A66.exe 98 PID 2784 wrote to memory of 2180 2784 9A66.exe 98 PID 2784 wrote to memory of 2180 2784 9A66.exe 98 PID 3128 wrote to memory of 4148 3128 Process not Found 101 PID 3128 wrote to memory of 4148 3128 Process not Found 101 PID 4148 wrote to memory of 4812 4148 regsvr32.exe 102 PID 4148 wrote to memory of 4812 4148 regsvr32.exe 102 PID 4148 wrote to memory of 4812 4148 regsvr32.exe 102 PID 3128 wrote to memory of 4672 3128 Process not Found 103 PID 3128 wrote to memory of 4672 3128 Process not Found 103 PID 3128 wrote to memory of 4672 3128 Process not Found 103 PID 4672 wrote to memory of 336 4672 B39E.exe 106 PID 4672 wrote to memory of 336 4672 B39E.exe 106 PID 4672 wrote to memory of 336 4672 B39E.exe 106 PID 4672 wrote to memory of 2308 4672 B39E.exe 107 PID 4672 wrote to memory of 2308 4672 B39E.exe 107 PID 4672 wrote to memory of 2308 4672 B39E.exe 107 PID 4672 wrote to memory of 2308 4672 B39E.exe 107 PID 4672 wrote to memory of 2308 4672 B39E.exe 107 PID 4672 wrote to memory of 2308 4672 B39E.exe 107 PID 4672 wrote to memory of 2308 4672 B39E.exe 107 PID 4672 wrote to memory of 2308 4672 B39E.exe 107 PID 3128 wrote to memory of 2228 3128 Process not Found 109 PID 3128 wrote to memory of 2228 3128 Process not Found 109 PID 3128 wrote to memory of 2228 3128 Process not Found 109 PID 3128 wrote to memory of 4900 3128 Process not Found 111 PID 3128 wrote to memory of 4900 3128 Process not Found 111 PID 3128 wrote to memory of 4900 3128 Process not Found 111 PID 2228 wrote to memory of 512 2228 BAC4.exe 112 PID 2228 wrote to memory of 512 2228 BAC4.exe 112 PID 2228 wrote to memory of 512 2228 BAC4.exe 112 PID 3128 wrote to memory of 2232 3128 Process not Found 114 PID 3128 wrote to memory of 2232 3128 Process not Found 114 PID 3128 wrote to memory of 2232 3128 Process not Found 114 PID 512 wrote to memory of 4268 512 yiueea.exe 113 PID 512 wrote to memory of 4268 512 yiueea.exe 113 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.3aec0ad346af22c0b4de3b6ac3a5f685eb2be4be5d250e79b3c6fc0d188766d0exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.3aec0ad346af22c0b4de3b6ac3a5f685eb2be4be5d250e79b3c6fc0d188766d0exe_JC.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3576
-
C:\Users\Admin\AppData\Local\Temp\9A66.exeC:\Users\Admin\AppData\Local\Temp\9A66.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\9A66.exeC:\Users\Admin\AppData\Local\Temp\9A66.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\3d7d816e-bc95-4f8e-821f-2113cd8e7517" /deny *S-1-1-0:(OI)(CI)(DE,DC)3⤵
- Modifies file permissions
PID:3216
-
-
C:\Users\Admin\AppData\Local\Temp\9A66.exe"C:\Users\Admin\AppData\Local\Temp\9A66.exe" --Admin IsNotAutoStart IsNotTask3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\9A66.exe"C:\Users\Admin\AppData\Local\Temp\9A66.exe" --Admin IsNotAutoStart IsNotTask4⤵
- Executes dropped EXE
PID:2180 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2180 -s 5685⤵
- Program crash
PID:2836
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\ADC0.exeC:\Users\Admin\AppData\Local\Temp\ADC0.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5088 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3564
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2180 -ip 21801⤵PID:4052
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\B2A3.dll1⤵
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\B2A3.dll2⤵
- Loads dropped DLL
PID:4812
-
-
C:\Users\Admin\AppData\Local\Temp\B39E.exeC:\Users\Admin\AppData\Local\Temp\B39E.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵PID:336
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\mi.exe"C:\Users\Admin\AppData\Local\Temp\mi.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1336
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4672 -s 2642⤵
- Program crash
PID:3756
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4672 -ip 46721⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\BAC4.exeC:\Users\Admin\AppData\Local\Temp\BAC4.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe"C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:512 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN yiueea.exe /TR "C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe" /F3⤵
- Creates scheduled task(s)
PID:4268
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "yiueea.exe" /P "Admin:N"&&CACLS "yiueea.exe" /P "Admin:R" /E&&echo Y|CACLS "..\577f58beff" /P "Admin:N"&&CACLS "..\577f58beff" /P "Admin:R" /E&&Exit3⤵PID:3356
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵PID:3124
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "yiueea.exe" /P "Admin:N"4⤵PID:1984
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "yiueea.exe" /P "Admin:R" /E4⤵PID:4572
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\577f58beff" /P "Admin:N"4⤵PID:4368
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵PID:212
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\577f58beff" /P "Admin:R" /E4⤵PID:3184
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\BE20.exeC:\Users\Admin\AppData\Local\Temp\BE20.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:4900
-
C:\Users\Admin\AppData\Local\Temp\C41C.exeC:\Users\Admin\AppData\Local\Temp\C41C.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2232 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2328
-
-
C:\Users\Admin\AppData\Local\Temp\C41C.exe"C:\Users\Admin\AppData\Local\Temp\C41C.exe"2⤵
- Executes dropped EXE
- Checks for VirtualBox DLLs, possible anti-VM trick
- Modifies data under HKEY_USERS
PID:4788 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4028 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:1796
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵PID:2376
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
PID:4652
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2736
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵PID:3508
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵PID:3796
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵PID:5076
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:1248
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵PID:4152
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵PID:3684
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵PID:1868
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵PID:4548
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:3260
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵PID:3940
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵PID:2444
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
PID:3188
-
-
-
-
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\C7B7.dll1⤵PID:4448
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\C7B7.dll2⤵
- Loads dropped DLL
PID:4612
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
PID:1460
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exeC:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe1⤵PID:3884
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force1⤵PID:1584
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc1⤵PID:1604
-
C:\Windows\System32\sc.exesc stop UsoSvc2⤵
- Launches sc.exe
PID:396
-
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc2⤵
- Executes dropped EXE
- Launches sc.exe
PID:3884
-
-
C:\Windows\System32\sc.exesc stop wuauserv2⤵
- Launches sc.exe
PID:316
-
-
C:\Windows\System32\sc.exesc stop bits2⤵
- Launches sc.exe
PID:3336
-
-
C:\Windows\System32\sc.exesc stop dosvc2⤵
- Launches sc.exe
PID:1700
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 01⤵PID:3416
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 02⤵PID:4724
-
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 02⤵PID:2080
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 02⤵PID:3684
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 02⤵PID:2496
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /delete /f /tn "GoogleUpdateTaskMachineQC"1⤵PID:3352
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /create /f /ru "System" /tn "GoogleUpdateTaskMachineQC" /xml "C:\Users\Admin\AppData\Local\Temp\grrhfnlxagtw.xml"1⤵
- Creates scheduled task(s)
PID:5016
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"1⤵PID:2156
-
C:\Program Files\Google\Chrome\updater.exe"C:\Program Files\Google\Chrome\updater.exe"1⤵PID:1820
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force1⤵PID:1232
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc1⤵PID:3152
-
C:\Windows\System32\sc.exesc stop UsoSvc2⤵
- Launches sc.exe
PID:2656
-
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:1140
-
-
C:\Windows\System32\sc.exesc stop wuauserv2⤵
- Launches sc.exe
PID:4176
-
-
C:\Windows\System32\sc.exesc stop bits2⤵
- Launches sc.exe
PID:4792
-
-
C:\Windows\System32\sc.exesc stop dosvc2⤵
- Launches sc.exe
PID:4932
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 01⤵PID:4568
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 02⤵PID:1060
-
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 02⤵PID:2340
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 02⤵PID:1700
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 02⤵PID:732
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /create /f /ru "System" /tn "GoogleUpdateTaskMachineQC" /xml "C:\Windows\TEMP\grrhfnlxagtw.xml"1⤵
- Creates scheduled task(s)
PID:2284
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe1⤵PID:1904
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:3060
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exeC:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe1⤵PID:1992
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Defense Evasion
File and Directory Permissions Modification
1Impair Defenses
1Modify Registry
1Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9.9MB
MD50c5f3483a23c84f846ea7953c4bdd390
SHA1fa9d08eb946292f9e9578de5cac7d9ddad8eb49d
SHA2562dc47f48d34658df21546fc76a6983bd957423c01b22749ccd168b732ca0a42d
SHA5124a76a1cf27d8797ef84fb0dabc207b433fb9533f80d51d7c6f3b4e3e77d225fb79d47aee003a678df22c19dac8ef3ed34ee5cf82225fe262c466f9c5e5481b7f
-
Filesize
9.9MB
MD50c5f3483a23c84f846ea7953c4bdd390
SHA1fa9d08eb946292f9e9578de5cac7d9ddad8eb49d
SHA2562dc47f48d34658df21546fc76a6983bd957423c01b22749ccd168b732ca0a42d
SHA5124a76a1cf27d8797ef84fb0dabc207b433fb9533f80d51d7c6f3b4e3e77d225fb79d47aee003a678df22c19dac8ef3ed34ee5cf82225fe262c466f9c5e5481b7f
-
Filesize
738KB
MD57284de10c970ef4b23460ad9c8b125fe
SHA166c0712a8b92fdcf2a58951449828c70f7bdc1d9
SHA2567ac247d6c3ac3cd5ff3a51d526acac42f44ffa44a80c52cc5808be9713db51ca
SHA5120425bccda444e0283ad85be179a23883b4db07716248b165754fceb0e42ce3596bd0f48385f57f5009cb6c8616c3d41b741be2b92f8a28f5e5acba6295fea7b7
-
Filesize
307KB
MD555f845c433e637594aaf872e41fda207
SHA11188348ca7e52f075e7d1d0031918c2cea93362e
SHA256f9f9b154f928549c7a4b484909f41352048ce8148c678f4ec32c807c1d173a39
SHA5125a9b5e83b41041259060e3a29163cdd5ed271c5d476fa455b40ec9bc32bf4bcddaf3aa1ba23faacc2669be420acb905677ec4fcfb3d69e7b9f7908ae5cbd18a4
-
Filesize
307KB
MD555f845c433e637594aaf872e41fda207
SHA11188348ca7e52f075e7d1d0031918c2cea93362e
SHA256f9f9b154f928549c7a4b484909f41352048ce8148c678f4ec32c807c1d173a39
SHA5125a9b5e83b41041259060e3a29163cdd5ed271c5d476fa455b40ec9bc32bf4bcddaf3aa1ba23faacc2669be420acb905677ec4fcfb3d69e7b9f7908ae5cbd18a4
-
Filesize
307KB
MD555f845c433e637594aaf872e41fda207
SHA11188348ca7e52f075e7d1d0031918c2cea93362e
SHA256f9f9b154f928549c7a4b484909f41352048ce8148c678f4ec32c807c1d173a39
SHA5125a9b5e83b41041259060e3a29163cdd5ed271c5d476fa455b40ec9bc32bf4bcddaf3aa1ba23faacc2669be420acb905677ec4fcfb3d69e7b9f7908ae5cbd18a4
-
Filesize
307KB
MD555f845c433e637594aaf872e41fda207
SHA11188348ca7e52f075e7d1d0031918c2cea93362e
SHA256f9f9b154f928549c7a4b484909f41352048ce8148c678f4ec32c807c1d173a39
SHA5125a9b5e83b41041259060e3a29163cdd5ed271c5d476fa455b40ec9bc32bf4bcddaf3aa1ba23faacc2669be420acb905677ec4fcfb3d69e7b9f7908ae5cbd18a4
-
Filesize
307KB
MD555f845c433e637594aaf872e41fda207
SHA11188348ca7e52f075e7d1d0031918c2cea93362e
SHA256f9f9b154f928549c7a4b484909f41352048ce8148c678f4ec32c807c1d173a39
SHA5125a9b5e83b41041259060e3a29163cdd5ed271c5d476fa455b40ec9bc32bf4bcddaf3aa1ba23faacc2669be420acb905677ec4fcfb3d69e7b9f7908ae5cbd18a4
-
Filesize
738KB
MD57284de10c970ef4b23460ad9c8b125fe
SHA166c0712a8b92fdcf2a58951449828c70f7bdc1d9
SHA2567ac247d6c3ac3cd5ff3a51d526acac42f44ffa44a80c52cc5808be9713db51ca
SHA5120425bccda444e0283ad85be179a23883b4db07716248b165754fceb0e42ce3596bd0f48385f57f5009cb6c8616c3d41b741be2b92f8a28f5e5acba6295fea7b7
-
Filesize
738KB
MD57284de10c970ef4b23460ad9c8b125fe
SHA166c0712a8b92fdcf2a58951449828c70f7bdc1d9
SHA2567ac247d6c3ac3cd5ff3a51d526acac42f44ffa44a80c52cc5808be9713db51ca
SHA5120425bccda444e0283ad85be179a23883b4db07716248b165754fceb0e42ce3596bd0f48385f57f5009cb6c8616c3d41b741be2b92f8a28f5e5acba6295fea7b7
-
Filesize
738KB
MD57284de10c970ef4b23460ad9c8b125fe
SHA166c0712a8b92fdcf2a58951449828c70f7bdc1d9
SHA2567ac247d6c3ac3cd5ff3a51d526acac42f44ffa44a80c52cc5808be9713db51ca
SHA5120425bccda444e0283ad85be179a23883b4db07716248b165754fceb0e42ce3596bd0f48385f57f5009cb6c8616c3d41b741be2b92f8a28f5e5acba6295fea7b7
-
Filesize
738KB
MD57284de10c970ef4b23460ad9c8b125fe
SHA166c0712a8b92fdcf2a58951449828c70f7bdc1d9
SHA2567ac247d6c3ac3cd5ff3a51d526acac42f44ffa44a80c52cc5808be9713db51ca
SHA5120425bccda444e0283ad85be179a23883b4db07716248b165754fceb0e42ce3596bd0f48385f57f5009cb6c8616c3d41b741be2b92f8a28f5e5acba6295fea7b7
-
Filesize
738KB
MD57284de10c970ef4b23460ad9c8b125fe
SHA166c0712a8b92fdcf2a58951449828c70f7bdc1d9
SHA2567ac247d6c3ac3cd5ff3a51d526acac42f44ffa44a80c52cc5808be9713db51ca
SHA5120425bccda444e0283ad85be179a23883b4db07716248b165754fceb0e42ce3596bd0f48385f57f5009cb6c8616c3d41b741be2b92f8a28f5e5acba6295fea7b7
-
Filesize
8.9MB
MD522b5ba8e29ad46aea74520369763650a
SHA15477b1f2384bc99e50cf8414c6adfe2e9c0ab2ec
SHA256ebd8083f3e802cac490686d05a3fe08e2305a6657a9af5ef38fe772496f621ec
SHA51238cb42bbb50a3aca19c3af8af01bf5d46e27841f50df2fc421183550daad6b65f91c3e454705a9e3ad9706a198c7bd928d6e2d1487a369cd7d3788e547e6eead
-
Filesize
2.3MB
MD555f1c499b31e58a29f6dacea7580fb69
SHA1c6e5c6a4bb84374a6b172e8eb0c43aaab5423e1a
SHA256b2fadb2f33351919a782043b2898b201b7420fd1d57800a1d144710156640854
SHA5129c2f2189e686e05585c6afef0cb4608b5c81ec89f48b992c600fa95ede32a51dc1ee53df518f97b3fb1c8c096adbc3534562f3d6af921bd9b1781fa9dd7786e1
-
Filesize
2.3MB
MD555f1c499b31e58a29f6dacea7580fb69
SHA1c6e5c6a4bb84374a6b172e8eb0c43aaab5423e1a
SHA256b2fadb2f33351919a782043b2898b201b7420fd1d57800a1d144710156640854
SHA5129c2f2189e686e05585c6afef0cb4608b5c81ec89f48b992c600fa95ede32a51dc1ee53df518f97b3fb1c8c096adbc3534562f3d6af921bd9b1781fa9dd7786e1
-
Filesize
337KB
MD523aca9b594e0ec61e744a486c34ed0ef
SHA144d7b53c310732634fbf48c2f313505cdb62c6a8
SHA25659f7cff19dc1dbd16f7cf67fec46beab356e111b64c0d968d5bcd35dee1f6f61
SHA512dbd56536231acfe82af1ae7fabf1f25419c9f62c8e5191d6f48d5c3a1c22161fc05aa1bbc2bc0c9b9d58574109a8f7db4d6a927915d9d8cdcc7f0f3b3c58ba33
-
Filesize
337KB
MD523aca9b594e0ec61e744a486c34ed0ef
SHA144d7b53c310732634fbf48c2f313505cdb62c6a8
SHA25659f7cff19dc1dbd16f7cf67fec46beab356e111b64c0d968d5bcd35dee1f6f61
SHA512dbd56536231acfe82af1ae7fabf1f25419c9f62c8e5191d6f48d5c3a1c22161fc05aa1bbc2bc0c9b9d58574109a8f7db4d6a927915d9d8cdcc7f0f3b3c58ba33
-
Filesize
307KB
MD555f845c433e637594aaf872e41fda207
SHA11188348ca7e52f075e7d1d0031918c2cea93362e
SHA256f9f9b154f928549c7a4b484909f41352048ce8148c678f4ec32c807c1d173a39
SHA5125a9b5e83b41041259060e3a29163cdd5ed271c5d476fa455b40ec9bc32bf4bcddaf3aa1ba23faacc2669be420acb905677ec4fcfb3d69e7b9f7908ae5cbd18a4
-
Filesize
307KB
MD555f845c433e637594aaf872e41fda207
SHA11188348ca7e52f075e7d1d0031918c2cea93362e
SHA256f9f9b154f928549c7a4b484909f41352048ce8148c678f4ec32c807c1d173a39
SHA5125a9b5e83b41041259060e3a29163cdd5ed271c5d476fa455b40ec9bc32bf4bcddaf3aa1ba23faacc2669be420acb905677ec4fcfb3d69e7b9f7908ae5cbd18a4
-
Filesize
249KB
MD5a9991493e536d974f42a70843dae6209
SHA19f209dc03fbca602985e9f599732ebfc4b2a0cc3
SHA256f1d980607c0be60b816ea70efaf0439323463f29ab6b56c4055a171461e31288
SHA5123d8d8dd9c485e19a4009fb62af94c250d28eaa56f15a3adc189bf9299308ff16c2bff397074b219f9075093df75349062ad860f65957a1c336b0421ff5157b0a
-
Filesize
249KB
MD5a9991493e536d974f42a70843dae6209
SHA19f209dc03fbca602985e9f599732ebfc4b2a0cc3
SHA256f1d980607c0be60b816ea70efaf0439323463f29ab6b56c4055a171461e31288
SHA5123d8d8dd9c485e19a4009fb62af94c250d28eaa56f15a3adc189bf9299308ff16c2bff397074b219f9075093df75349062ad860f65957a1c336b0421ff5157b0a
-
Filesize
4.1MB
MD5f0118fdfcadf8262c58b3638c0edc6a9
SHA1a10b96bfc56711c9d605a0b61cca01b4ba6b6658
SHA2568e380777da39ad7a588f4d9b703adc18b4ba935c21b17f215a3da5792672f205
SHA51299ac5c4de20e47e8c355e9852061cb1ef25a44a5ef20cc0dd6187d13676a1cd7dd8a44cffa9462715bff3c7c7268814afe9fffb9b664f3e2cef3595a6b148837
-
Filesize
4.1MB
MD5f0118fdfcadf8262c58b3638c0edc6a9
SHA1a10b96bfc56711c9d605a0b61cca01b4ba6b6658
SHA2568e380777da39ad7a588f4d9b703adc18b4ba935c21b17f215a3da5792672f205
SHA51299ac5c4de20e47e8c355e9852061cb1ef25a44a5ef20cc0dd6187d13676a1cd7dd8a44cffa9462715bff3c7c7268814afe9fffb9b664f3e2cef3595a6b148837
-
Filesize
4.1MB
MD5f0118fdfcadf8262c58b3638c0edc6a9
SHA1a10b96bfc56711c9d605a0b61cca01b4ba6b6658
SHA2568e380777da39ad7a588f4d9b703adc18b4ba935c21b17f215a3da5792672f205
SHA51299ac5c4de20e47e8c355e9852061cb1ef25a44a5ef20cc0dd6187d13676a1cd7dd8a44cffa9462715bff3c7c7268814afe9fffb9b664f3e2cef3595a6b148837
-
Filesize
2.3MB
MD555f1c499b31e58a29f6dacea7580fb69
SHA1c6e5c6a4bb84374a6b172e8eb0c43aaab5423e1a
SHA256b2fadb2f33351919a782043b2898b201b7420fd1d57800a1d144710156640854
SHA5129c2f2189e686e05585c6afef0cb4608b5c81ec89f48b992c600fa95ede32a51dc1ee53df518f97b3fb1c8c096adbc3534562f3d6af921bd9b1781fa9dd7786e1
-
Filesize
2.3MB
MD555f1c499b31e58a29f6dacea7580fb69
SHA1c6e5c6a4bb84374a6b172e8eb0c43aaab5423e1a
SHA256b2fadb2f33351919a782043b2898b201b7420fd1d57800a1d144710156640854
SHA5129c2f2189e686e05585c6afef0cb4608b5c81ec89f48b992c600fa95ede32a51dc1ee53df518f97b3fb1c8c096adbc3534562f3d6af921bd9b1781fa9dd7786e1
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
Filesize
1KB
MD5546d67a48ff2bf7682cea9fac07b942e
SHA1a2cb3a9a97fd935b5e62d4c29b3e2c5ab7d5fc90
SHA256eff7edc19e6c430aaeca7ea8a77251c74d1e9abb79b183a9ee1f58c2934b4b6a
SHA51210d90edf31c0955bcec52219d854952fd38768bd97e8e50d32a1237bccaf1a5eb9f824da0f81a7812e0ce62c0464168dd0201d1c0eb61b9fe253fe7c89de05fe
-
Filesize
9.9MB
MD50c5f3483a23c84f846ea7953c4bdd390
SHA1fa9d08eb946292f9e9578de5cac7d9ddad8eb49d
SHA2562dc47f48d34658df21546fc76a6983bd957423c01b22749ccd168b732ca0a42d
SHA5124a76a1cf27d8797ef84fb0dabc207b433fb9533f80d51d7c6f3b4e3e77d225fb79d47aee003a678df22c19dac8ef3ed34ee5cf82225fe262c466f9c5e5481b7f
-
Filesize
9.9MB
MD50c5f3483a23c84f846ea7953c4bdd390
SHA1fa9d08eb946292f9e9578de5cac7d9ddad8eb49d
SHA2562dc47f48d34658df21546fc76a6983bd957423c01b22749ccd168b732ca0a42d
SHA5124a76a1cf27d8797ef84fb0dabc207b433fb9533f80d51d7c6f3b4e3e77d225fb79d47aee003a678df22c19dac8ef3ed34ee5cf82225fe262c466f9c5e5481b7f
-
Filesize
9.9MB
MD50c5f3483a23c84f846ea7953c4bdd390
SHA1fa9d08eb946292f9e9578de5cac7d9ddad8eb49d
SHA2562dc47f48d34658df21546fc76a6983bd957423c01b22749ccd168b732ca0a42d
SHA5124a76a1cf27d8797ef84fb0dabc207b433fb9533f80d51d7c6f3b4e3e77d225fb79d47aee003a678df22c19dac8ef3ed34ee5cf82225fe262c466f9c5e5481b7f
-
Filesize
249KB
MD5a9991493e536d974f42a70843dae6209
SHA19f209dc03fbca602985e9f599732ebfc4b2a0cc3
SHA256f1d980607c0be60b816ea70efaf0439323463f29ab6b56c4055a171461e31288
SHA5123d8d8dd9c485e19a4009fb62af94c250d28eaa56f15a3adc189bf9299308ff16c2bff397074b219f9075093df75349062ad860f65957a1c336b0421ff5157b0a
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5787733a9f9e883cdad571a8a6c1cc006
SHA1efc2ca6ff47d0481ba0506196d4b46602ec3fea3
SHA2561dddf6a66bd78bfbc9dfc06d474070f2b44c51cf0693e8c4207fb148b5a30451
SHA512c7e0011735bd5dee186cacda0ae81c5613946d56c662a5fab7311b1296fb26a3a77d0b76aadda155d9d684eceafa18ec6736a1dab7cf81c9368a2c0d41d8d44c
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD59fff5a7a54676eb9ef805ba055346e13
SHA11d9580b8c6224003ed7fd739f6e05e715d9f2911
SHA25628e1bc42bc91fe9377c8f6a8888affe17eab13284ce524dae2c8eeb4a5f15f48
SHA512e81dd4a3ae6b4f14cd85ef33ebf34429bbb4a2c90535366270a272bedc19cd074db28940943dc677ed442bfdfb86b6f94cf6a25972d8bcee771bcc87f2470c22
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5682096c94c2f452f7ef4bd008b2430fa
SHA1003e5c32b9d020df871198321b03f4240694126c
SHA2561d5666bb77fac24ddb90d8f6128ea3ec533ce987d2c44eb3e7c7ce058a12bb5d
SHA5120a10fb204d78f2bba689fe0c06d4784716c5c257d8ab534769c801c69f4f8417207f371ec923b9f3a919c76a8b9c077a49af5325e1ff895bb849edd1eaedcd6d
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5b7f13dd2a946fc03692e3a9d19868bf2
SHA173d5dcc2ce9ede0bb89a108e5bbd972de228717d
SHA256c94fdb7254ae1b5c3e9a4c8f73f9b0b9ea1e419cf000ed34dd30febdbd7d52f2
SHA512e9e9065d3687fb516ab6817203098ec9adaa36542f9549665369aa06fb97d25c31b8c70575cb0f24079b3356e4452ce0740283d0c3cfc32275492db4a50889ba
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5776818c08f21ccf964ff682aa584282a
SHA1edb3b06b52d4ab5b7dd7be3fff768e016627cf9e
SHA2560edc696a348dfabd9f389e680ed3b88b05ed6bad68d17158eb8e0f35cd1fa9c1
SHA512efcdbd4fe6a5b125d9246410ca6366dc812b23e82a34e586300a9708e7b375f0bc8c8d3d8d95d6b53f64b08b24956d123b8f2b64432f62362a066eaaba9e4169
-
Filesize
3KB
MD52d29fd3ae57f422e2b2121141dc82253
SHA1c2464c857779c0ab4f5e766f5028fcc651a6c6b7
SHA25680a60d7ec533d820de20bcedeb41319e7b1def548b6ea73ddbd69455bac4e7a4
SHA512077a5c554663be7b71f181d961f5c98c732bc296dc015ffee30768a648bee3aad62c39c352cf2947432be19519906aeac7dfaf2557d309bb460732abb7fdbc68
-
Filesize
1KB
MD5546d67a48ff2bf7682cea9fac07b942e
SHA1a2cb3a9a97fd935b5e62d4c29b3e2c5ab7d5fc90
SHA256eff7edc19e6c430aaeca7ea8a77251c74d1e9abb79b183a9ee1f58c2934b4b6a
SHA51210d90edf31c0955bcec52219d854952fd38768bd97e8e50d32a1237bccaf1a5eb9f824da0f81a7812e0ce62c0464168dd0201d1c0eb61b9fe253fe7c89de05fe
-
Filesize
4.1MB
MD5f0118fdfcadf8262c58b3638c0edc6a9
SHA1a10b96bfc56711c9d605a0b61cca01b4ba6b6658
SHA2568e380777da39ad7a588f4d9b703adc18b4ba935c21b17f215a3da5792672f205
SHA51299ac5c4de20e47e8c355e9852061cb1ef25a44a5ef20cc0dd6187d13676a1cd7dd8a44cffa9462715bff3c7c7268814afe9fffb9b664f3e2cef3595a6b148837
-
Filesize
4.1MB
MD5f0118fdfcadf8262c58b3638c0edc6a9
SHA1a10b96bfc56711c9d605a0b61cca01b4ba6b6658
SHA2568e380777da39ad7a588f4d9b703adc18b4ba935c21b17f215a3da5792672f205
SHA51299ac5c4de20e47e8c355e9852061cb1ef25a44a5ef20cc0dd6187d13676a1cd7dd8a44cffa9462715bff3c7c7268814afe9fffb9b664f3e2cef3595a6b148837
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec