Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
110s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
23/10/2023, 02:59
Static task
static1
Behavioral task
behavioral1
Sample
72a5def78f48f17d443f43fae9f619ba4c15db5ed32d3c956a2b7e2c8be9657f.exe
Resource
win10v2004-20231020-en
General
-
Target
72a5def78f48f17d443f43fae9f619ba4c15db5ed32d3c956a2b7e2c8be9657f.exe
-
Size
1.5MB
-
MD5
7c4a860a6380a2944342873837647e9e
-
SHA1
72bd8781409132c15120e551a04f691c067611e0
-
SHA256
72a5def78f48f17d443f43fae9f619ba4c15db5ed32d3c956a2b7e2c8be9657f
-
SHA512
7f9ee6bd9c900265d389a76a53a0dee993a6eda3471974f4c71f4a536aa723ac9fbc9bae828a735ef68a52214d27ddf1c10892b9f840ffe9b271c3c5a11f9ac0
-
SSDEEP
24576:AyyYSJhgCDHO3LDjM2uE/1e5UwIPAyhVvq1W9mUh2Ebuw9IfR6J/DVmOsvv/:HOJhgCDu7Do29t+a0w9VnaaIsB
Malware Config
Extracted
redline
homed
109.107.182.133:19084
Extracted
smokeloader
2022
http://77.91.68.29/fks/
Extracted
amadey
3.89
http://77.91.124.1/theme/index.php
-
install_dir
fefffe8cea
-
install_file
explothe.exe
-
strings_key
36a96139c1118a354edf72b1080d4b2f
Extracted
redline
kinder
109.107.182.133:19084
Extracted
redline
5141679758_99
https://pastebin.com/raw/8baCJyMF
Extracted
redline
YT&TEAM CLOUD
185.216.70.238:37515
Extracted
smokeloader
up3
Extracted
asyncrat
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Default
89.23.100.93:4449
oonrejgwedvxwse
-
delay
1
-
install
true
-
install_file
calc.exe
-
install_folder
%AppData%
Extracted
smokeloader
2020
http://host-file-host6.com/
http://host-host-file8.com/
Signatures
-
DcRat 6 IoCs
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
description ioc pid Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 72a5def78f48f17d443f43fae9f619ba4c15db5ed32d3c956a2b7e2c8be9657f.exe 2596 schtasks.exe 5920 schtasks.exe 5532 schtasks.exe 5696 schtasks.exe 5464 schtasks.exe -
Glupteba payload 5 IoCs
resource yara_rule behavioral1/memory/6120-1034-0x0000000002EF0000-0x00000000037DB000-memory.dmp family_glupteba behavioral1/memory/6120-1124-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/6120-1199-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/6120-1203-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/6280-1274-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" F3BA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" F3BA.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" F3BA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" F3BA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" F3BA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" AppLaunch.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 6 IoCs
resource yara_rule behavioral1/memory/3980-48-0x0000000000400000-0x000000000043E000-memory.dmp family_redline behavioral1/memory/3456-795-0x00000000020E0000-0x000000000213A000-memory.dmp family_redline behavioral1/memory/4664-863-0x00000000004F0000-0x000000000052E000-memory.dmp family_redline behavioral1/memory/3456-928-0x0000000000400000-0x000000000047E000-memory.dmp family_redline behavioral1/memory/6024-983-0x0000000000A70000-0x0000000000AAE000-memory.dmp family_redline behavioral1/memory/5680-1065-0x0000000002080000-0x00000000020DA000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 9 IoCs
description pid Process procid_target PID 6692 created 3288 6692 sc.exe 43 PID 6692 created 3288 6692 sc.exe 43 PID 6692 created 3288 6692 sc.exe 43 PID 5944 created 3288 5944 latestX.exe 43 PID 5944 created 3288 5944 latestX.exe 43 PID 5944 created 3288 5944 latestX.exe 43 PID 5944 created 3288 5944 latestX.exe 43 PID 5944 created 3288 5944 latestX.exe 43 PID 3224 created 3288 3224 updater.exe 43 -
Async RAT payload 1 IoCs
resource yara_rule behavioral1/memory/5260-1090-0x00000000006A0000-0x00000000006B8000-memory.dmp asyncrat -
Blocklisted process makes network request 36 IoCs
flow pid Process 216 6160 rundll32.exe 219 6160 rundll32.exe 220 6160 rundll32.exe 221 6160 rundll32.exe 222 6160 rundll32.exe 223 6160 rundll32.exe 224 6160 rundll32.exe 225 6160 rundll32.exe 226 6160 rundll32.exe 227 6160 rundll32.exe 228 6160 rundll32.exe 229 6160 rundll32.exe 230 6160 rundll32.exe 231 6160 rundll32.exe 232 6160 rundll32.exe 233 6160 rundll32.exe 234 6160 rundll32.exe 235 6160 rundll32.exe 236 6160 rundll32.exe 237 6160 rundll32.exe 238 6160 rundll32.exe 239 6160 rundll32.exe 240 6160 rundll32.exe 241 6160 rundll32.exe 242 6160 rundll32.exe 243 6160 rundll32.exe 244 6160 rundll32.exe 245 6160 rundll32.exe 246 6160 rundll32.exe 247 6160 rundll32.exe 250 6160 rundll32.exe 254 6160 rundll32.exe 260 6160 rundll32.exe 261 6160 rundll32.exe 265 6160 rundll32.exe 266 6160 rundll32.exe -
Downloads MZ/PE file
-
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\System32\drivers\etc\hosts latestX.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 2756 netsh.exe -
Stops running service(s) 3 TTPs
-
Checks computer location settings 2 TTPs 6 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\Geo\Nation 5yn4vA9.exe Key value queried \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\Geo\Nation explothe.exe Key value queried \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\Geo\Nation 6wS3RR7.exe Key value queried \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\Geo\Nation 2EE2.exe Key value queried \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\Geo\Nation kos2.exe Key value queried \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\Geo\Nation K.exe -
Executes dropped EXE 50 IoCs
pid Process 4776 id0Gh30.exe 1148 nN0My75.exe 3948 mc2tZ56.exe 904 hP2hA71.exe 2512 1Sp50nj0.exe 2436 2nc7392.exe 2488 3GW56sB.exe 1496 4nG896WI.exe 528 5yn4vA9.exe 1936 explothe.exe 1492 6wS3RR7.exe 3848 explothe.exe 5376 E753.exe 3492 E957.exe 1532 uo5QF4ht.exe 5480 Yb5OT8sG.exe 5620 ru7EM9AP.exe 5768 fi0hc7xq.exe 5512 1WT40rz4.exe 2060 F010.exe 3216 F3BA.exe 2752 AppLaunch.exe 3456 FAB2.exe 4664 2Sz928Vg.exe 5536 2EE2.exe 5076 3377.exe 5240 3462.exe 1492 TrustedInstaller.exe 6120 31839b57a4f11171d6abc8bbc4451ee4.exe 4560 36D4.exe 1832 kos2.exe 5944 latestX.exe 6024 3A60.exe 4164 set16.exe 688 K.exe 5680 401D.exe 5664 is-NR5QA.tmp 1256 toolspub2.exe 5864 MyBurn.exe 5964 MyBurn.exe 5260 4E18.exe 4116 53E6.exe 6192 powercfg.exe 6692 6647.exe 6280 31839b57a4f11171d6abc8bbc4451ee4.exe 3224 updater.exe 7016 csrss.exe 6844 explothe.exe 6452 injector.exe 5928 windefender.exe -
Loads dropped DLL 7 IoCs
pid Process 5664 is-NR5QA.tmp 5664 is-NR5QA.tmp 5664 is-NR5QA.tmp 6160 rundll32.exe 5260 4E18.exe 5260 4E18.exe 6632 rundll32.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/files/0x0007000000022e2e-70.dat upx behavioral1/files/0x0007000000022e2e-71.dat upx behavioral1/memory/1492-75-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/1492-83-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/files/0x0006000000022f6b-644.dat upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" F3BA.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 13 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" mc2tZ56.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" uo5QF4ht.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" ru7EM9AP.exe Set value (str) \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP005.TMP\\\"" fi0hc7xq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 72a5def78f48f17d443f43fae9f619ba4c15db5ed32d3c956a2b7e2c8be9657f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" id0Gh30.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" nN0My75.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" E753.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" hP2hA71.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" Yb5OT8sG.exe Set value (str) \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\socks5 = "powershell.exe -windowstyle hidden -Command \"& 'C:\\Users\\Admin\\AppData\\Local\\Temp\\3462.exe'\"" 3462.exe Set value (str) \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
description ioc Process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 7 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Suspicious use of SetThreadContext 5 IoCs
description pid Process procid_target PID 2512 set thread context of 1344 2512 1Sp50nj0.exe 92 PID 2488 set thread context of 684 2488 3GW56sB.exe 95 PID 1496 set thread context of 3980 1496 4nG896WI.exe 97 PID 5512 set thread context of 2752 5512 1WT40rz4.exe 175 PID 1492 set thread context of 1256 1492 TrustedInstaller.exe 193 -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
description ioc Process File opened (read-only) \??\VBoxMiniRdrDN 31839b57a4f11171d6abc8bbc4451ee4.exe -
Drops file in Program Files directory 13 IoCs
description ioc Process File created C:\Program Files (x86)\MyBurn\unins000.dat is-NR5QA.tmp File opened for modification C:\Program Files (x86)\MyBurn\unins000.dat is-NR5QA.tmp File created C:\Program Files (x86)\MyBurn\is-I0AGO.tmp is-NR5QA.tmp File created C:\Program Files (x86)\MyBurn\is-1PFRS.tmp is-NR5QA.tmp File created C:\Program Files (x86)\MyBurn\is-O73SO.tmp is-NR5QA.tmp File created C:\Program Files (x86)\MyBurn\is-4BEFD.tmp is-NR5QA.tmp File opened for modification C:\Program Files (x86)\MyBurn\MyBurn.exe is-NR5QA.tmp File created C:\Program Files (x86)\MyBurn\is-5OBJU.tmp is-NR5QA.tmp File created C:\Program Files (x86)\MyBurn\Sounds\is-JEQAG.tmp is-NR5QA.tmp File created C:\Program Files (x86)\MyBurn\is-ONTPU.tmp is-NR5QA.tmp File created C:\Program Files (x86)\MyBurn\is-7SEEQ.tmp is-NR5QA.tmp File created C:\Program Files (x86)\MyBurn\Sounds\is-OTHV6.tmp is-NR5QA.tmp File created C:\Program Files\Google\Chrome\updater.exe latestX.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\rss 31839b57a4f11171d6abc8bbc4451ee4.exe File created C:\Windows\rss\csrss.exe 31839b57a4f11171d6abc8bbc4451ee4.exe -
Launches sc.exe 6 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3456 sc.exe 7080 sc.exe 7092 sc.exe 7144 sc.exe 6692 sc.exe 7032 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 60 2752 WerFault.exe 175 6292 5260 WerFault.exe 204 -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspub2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspub2.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspub2.exe -
Creates scheduled task(s) 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2596 schtasks.exe 5920 schtasks.exe 5532 schtasks.exe 5696 schtasks.exe 5464 schtasks.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-682 = "E. Australia Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-681 = "E. Australia Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-571 = "China Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1832 = "Russia TZ 2 Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-452 = "Caucasus Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2041 = "Eastern Daylight Time (Mexico)" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-622 = "Korea Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1862 = "Russia TZ 6 Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2572 = "Turks and Caicos Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2001 = "Cabo Verde Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-202 = "US Mountain Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-652 = "AUS Central Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-592 = "Malay Peninsula Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2592 = "Tocantins Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-241 = "Samoa Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1661 = "Bahia Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-3142 = "South Sudan Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1502 = "Turkey Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-449 = "Azerbaijan Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-831 = "SA Eastern Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-261 = "GMT Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-161 = "Central Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2371 = "Easter Island Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-731 = "Fiji Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-432 = "Iran Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1871 = "Russia TZ 7 Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-92 = "Pacific SA Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-462 = "Afghanistan Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-281 = "Central Europe Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-442 = "Arabian Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-632 = "Tokyo Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1932 = "Russia TZ 11 Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-341 = "Egypt Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1721 = "Libya Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2871 = "Magallanes Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2431 = "Cuba Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-742 = "New Zealand Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-601 = "Taipei Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-301 = "Romance Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 684 AppLaunch.exe 684 AppLaunch.exe 1344 AppLaunch.exe 1344 AppLaunch.exe 3288 Explorer.EXE 3288 Explorer.EXE 3288 Explorer.EXE 3288 Explorer.EXE 3288 Explorer.EXE 3288 Explorer.EXE 3288 Explorer.EXE 3288 Explorer.EXE 3288 Explorer.EXE 3288 Explorer.EXE 3288 Explorer.EXE 3288 Explorer.EXE 3288 Explorer.EXE 3288 Explorer.EXE 3288 Explorer.EXE 3288 Explorer.EXE 3288 Explorer.EXE 3288 Explorer.EXE 3288 Explorer.EXE 3288 Explorer.EXE 3288 Explorer.EXE 3288 Explorer.EXE 3288 Explorer.EXE 3288 Explorer.EXE 3288 Explorer.EXE 3288 Explorer.EXE 3288 Explorer.EXE 3288 Explorer.EXE 3288 Explorer.EXE 3288 Explorer.EXE 3288 Explorer.EXE 3288 Explorer.EXE 3288 Explorer.EXE 3288 Explorer.EXE 3288 Explorer.EXE 3288 Explorer.EXE 3288 Explorer.EXE 3288 Explorer.EXE 3288 Explorer.EXE 3288 Explorer.EXE 3288 Explorer.EXE 3288 Explorer.EXE 3288 Explorer.EXE 3288 Explorer.EXE 3288 Explorer.EXE 3288 Explorer.EXE 3288 Explorer.EXE 3288 Explorer.EXE 3288 Explorer.EXE 3288 Explorer.EXE 3288 Explorer.EXE 3288 Explorer.EXE 1120 msedge.exe 1120 msedge.exe 892 msedge.exe 892 msedge.exe 3288 Explorer.EXE 3288 Explorer.EXE 3136 msedge.exe 3136 msedge.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3288 Explorer.EXE -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 684 AppLaunch.exe 1256 toolspub2.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
pid Process 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1344 AppLaunch.exe Token: SeShutdownPrivilege 3288 Explorer.EXE Token: SeCreatePagefilePrivilege 3288 Explorer.EXE Token: SeShutdownPrivilege 3288 Explorer.EXE Token: SeCreatePagefilePrivilege 3288 Explorer.EXE Token: SeShutdownPrivilege 3288 Explorer.EXE Token: SeCreatePagefilePrivilege 3288 Explorer.EXE Token: SeShutdownPrivilege 3288 Explorer.EXE Token: SeCreatePagefilePrivilege 3288 Explorer.EXE Token: SeShutdownPrivilege 3288 Explorer.EXE Token: SeCreatePagefilePrivilege 3288 Explorer.EXE Token: SeShutdownPrivilege 3288 Explorer.EXE Token: SeCreatePagefilePrivilege 3288 Explorer.EXE Token: SeShutdownPrivilege 3288 Explorer.EXE Token: SeCreatePagefilePrivilege 3288 Explorer.EXE Token: SeShutdownPrivilege 3288 Explorer.EXE Token: SeCreatePagefilePrivilege 3288 Explorer.EXE Token: SeShutdownPrivilege 3288 Explorer.EXE Token: SeCreatePagefilePrivilege 3288 Explorer.EXE Token: SeShutdownPrivilege 3288 Explorer.EXE Token: SeCreatePagefilePrivilege 3288 Explorer.EXE Token: SeShutdownPrivilege 3288 Explorer.EXE Token: SeCreatePagefilePrivilege 3288 Explorer.EXE Token: 33 5984 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 5984 AUDIODG.EXE Token: SeShutdownPrivilege 3288 Explorer.EXE Token: SeCreatePagefilePrivilege 3288 Explorer.EXE Token: SeShutdownPrivilege 3288 Explorer.EXE Token: SeCreatePagefilePrivilege 3288 Explorer.EXE Token: SeDebugPrivilege 3216 F3BA.exe Token: SeShutdownPrivilege 3288 Explorer.EXE Token: SeCreatePagefilePrivilege 3288 Explorer.EXE Token: SeShutdownPrivilege 3288 Explorer.EXE Token: SeCreatePagefilePrivilege 3288 Explorer.EXE Token: SeShutdownPrivilege 3288 Explorer.EXE Token: SeCreatePagefilePrivilege 3288 Explorer.EXE Token: SeShutdownPrivilege 3288 Explorer.EXE Token: SeCreatePagefilePrivilege 3288 Explorer.EXE Token: SeShutdownPrivilege 3288 Explorer.EXE Token: SeCreatePagefilePrivilege 3288 Explorer.EXE Token: SeShutdownPrivilege 3288 Explorer.EXE Token: SeCreatePagefilePrivilege 3288 Explorer.EXE Token: SeDebugPrivilege 3456 sc.exe Token: SeShutdownPrivilege 3288 Explorer.EXE Token: SeCreatePagefilePrivilege 3288 Explorer.EXE Token: SeShutdownPrivilege 3288 Explorer.EXE Token: SeCreatePagefilePrivilege 3288 Explorer.EXE Token: SeShutdownPrivilege 3288 Explorer.EXE Token: SeCreatePagefilePrivilege 3288 Explorer.EXE Token: SeShutdownPrivilege 3288 Explorer.EXE Token: SeCreatePagefilePrivilege 3288 Explorer.EXE Token: SeShutdownPrivilege 3288 Explorer.EXE Token: SeCreatePagefilePrivilege 3288 Explorer.EXE Token: SeShutdownPrivilege 3288 Explorer.EXE Token: SeCreatePagefilePrivilege 3288 Explorer.EXE Token: SeShutdownPrivilege 3288 Explorer.EXE Token: SeCreatePagefilePrivilege 3288 Explorer.EXE Token: SeDebugPrivilege 5076 3377.exe Token: SeDebugPrivilege 688 K.exe Token: SeShutdownPrivilege 3288 Explorer.EXE Token: SeCreatePagefilePrivilege 3288 Explorer.EXE Token: SeShutdownPrivilege 3288 Explorer.EXE Token: SeCreatePagefilePrivilege 3288 Explorer.EXE Token: SeShutdownPrivilege 3288 Explorer.EXE -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4904 wrote to memory of 4776 4904 72a5def78f48f17d443f43fae9f619ba4c15db5ed32d3c956a2b7e2c8be9657f.exe 87 PID 4904 wrote to memory of 4776 4904 72a5def78f48f17d443f43fae9f619ba4c15db5ed32d3c956a2b7e2c8be9657f.exe 87 PID 4904 wrote to memory of 4776 4904 72a5def78f48f17d443f43fae9f619ba4c15db5ed32d3c956a2b7e2c8be9657f.exe 87 PID 4776 wrote to memory of 1148 4776 id0Gh30.exe 88 PID 4776 wrote to memory of 1148 4776 id0Gh30.exe 88 PID 4776 wrote to memory of 1148 4776 id0Gh30.exe 88 PID 1148 wrote to memory of 3948 1148 nN0My75.exe 89 PID 1148 wrote to memory of 3948 1148 nN0My75.exe 89 PID 1148 wrote to memory of 3948 1148 nN0My75.exe 89 PID 3948 wrote to memory of 904 3948 mc2tZ56.exe 90 PID 3948 wrote to memory of 904 3948 mc2tZ56.exe 90 PID 3948 wrote to memory of 904 3948 mc2tZ56.exe 90 PID 904 wrote to memory of 2512 904 hP2hA71.exe 91 PID 904 wrote to memory of 2512 904 hP2hA71.exe 91 PID 904 wrote to memory of 2512 904 hP2hA71.exe 91 PID 2512 wrote to memory of 1344 2512 1Sp50nj0.exe 92 PID 2512 wrote to memory of 1344 2512 1Sp50nj0.exe 92 PID 2512 wrote to memory of 1344 2512 1Sp50nj0.exe 92 PID 2512 wrote to memory of 1344 2512 1Sp50nj0.exe 92 PID 2512 wrote to memory of 1344 2512 1Sp50nj0.exe 92 PID 2512 wrote to memory of 1344 2512 1Sp50nj0.exe 92 PID 2512 wrote to memory of 1344 2512 1Sp50nj0.exe 92 PID 2512 wrote to memory of 1344 2512 1Sp50nj0.exe 92 PID 904 wrote to memory of 2436 904 hP2hA71.exe 93 PID 904 wrote to memory of 2436 904 hP2hA71.exe 93 PID 904 wrote to memory of 2436 904 hP2hA71.exe 93 PID 3948 wrote to memory of 2488 3948 mc2tZ56.exe 94 PID 3948 wrote to memory of 2488 3948 mc2tZ56.exe 94 PID 3948 wrote to memory of 2488 3948 mc2tZ56.exe 94 PID 2488 wrote to memory of 684 2488 3GW56sB.exe 95 PID 2488 wrote to memory of 684 2488 3GW56sB.exe 95 PID 2488 wrote to memory of 684 2488 3GW56sB.exe 95 PID 2488 wrote to memory of 684 2488 3GW56sB.exe 95 PID 2488 wrote to memory of 684 2488 3GW56sB.exe 95 PID 2488 wrote to memory of 684 2488 3GW56sB.exe 95 PID 1148 wrote to memory of 1496 1148 nN0My75.exe 96 PID 1148 wrote to memory of 1496 1148 nN0My75.exe 96 PID 1148 wrote to memory of 1496 1148 nN0My75.exe 96 PID 1496 wrote to memory of 3980 1496 4nG896WI.exe 97 PID 1496 wrote to memory of 3980 1496 4nG896WI.exe 97 PID 1496 wrote to memory of 3980 1496 4nG896WI.exe 97 PID 1496 wrote to memory of 3980 1496 4nG896WI.exe 97 PID 1496 wrote to memory of 3980 1496 4nG896WI.exe 97 PID 1496 wrote to memory of 3980 1496 4nG896WI.exe 97 PID 1496 wrote to memory of 3980 1496 4nG896WI.exe 97 PID 1496 wrote to memory of 3980 1496 4nG896WI.exe 97 PID 4776 wrote to memory of 528 4776 id0Gh30.exe 98 PID 4776 wrote to memory of 528 4776 id0Gh30.exe 98 PID 4776 wrote to memory of 528 4776 id0Gh30.exe 98 PID 528 wrote to memory of 1936 528 5yn4vA9.exe 99 PID 528 wrote to memory of 1936 528 5yn4vA9.exe 99 PID 528 wrote to memory of 1936 528 5yn4vA9.exe 99 PID 4904 wrote to memory of 1492 4904 72a5def78f48f17d443f43fae9f619ba4c15db5ed32d3c956a2b7e2c8be9657f.exe 100 PID 4904 wrote to memory of 1492 4904 72a5def78f48f17d443f43fae9f619ba4c15db5ed32d3c956a2b7e2c8be9657f.exe 100 PID 4904 wrote to memory of 1492 4904 72a5def78f48f17d443f43fae9f619ba4c15db5ed32d3c956a2b7e2c8be9657f.exe 100 PID 1936 wrote to memory of 2596 1936 explothe.exe 101 PID 1936 wrote to memory of 2596 1936 explothe.exe 101 PID 1936 wrote to memory of 2596 1936 explothe.exe 101 PID 1492 wrote to memory of 116 1492 6wS3RR7.exe 102 PID 1492 wrote to memory of 116 1492 6wS3RR7.exe 102 PID 1936 wrote to memory of 1624 1936 explothe.exe 105 PID 1936 wrote to memory of 1624 1936 explothe.exe 105 PID 1936 wrote to memory of 1624 1936 explothe.exe 105 PID 1624 wrote to memory of 5024 1624 cmd.exe 108 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\72a5def78f48f17d443f43fae9f619ba4c15db5ed32d3c956a2b7e2c8be9657f.exe"C:\Users\Admin\AppData\Local\Temp\72a5def78f48f17d443f43fae9f619ba4c15db5ed32d3c956a2b7e2c8be9657f.exe"2⤵
- DcRat
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\id0Gh30.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\id0Gh30.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nN0My75.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nN0My75.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\mc2tZ56.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\mc2tZ56.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\hP2hA71.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\hP2hA71.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:904 -
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1Sp50nj0.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1Sp50nj0.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"8⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1344
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2nc7392.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2nc7392.exe7⤵
- Executes dropped EXE
PID:2436
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\3GW56sB.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\3GW56sB.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:684
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\4nG896WI.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\4nG896WI.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵PID:3980
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\5yn4vA9.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\5yn4vA9.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:528 -
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F6⤵
- DcRat
- Creates scheduled task(s)
PID:2596
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit6⤵
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:5024
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "explothe.exe" /P "Admin:N"7⤵PID:1800
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "explothe.exe" /P "Admin:R" /E7⤵PID:1040
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:N"7⤵PID:4620
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:1228
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:R" /E7⤵PID:4956
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main6⤵
- Loads dropped DLL
PID:6632
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6wS3RR7.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6wS3RR7.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\97AC.tmp\97AD.tmp\97AE.bat C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6wS3RR7.exe"4⤵PID:116
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login5⤵PID:992
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ff94f0c46f8,0x7ff94f0c4708,0x7ff94f0c47186⤵PID:3308
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,15077617174495541834,11180592799044569102,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:36⤵
- Suspicious behavior: EnumeratesProcesses
PID:892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,15077617174495541834,11180592799044569102,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:26⤵PID:4404
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/5⤵PID:3896
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ff94f0c46f8,0x7ff94f0c4708,0x7ff94f0c47186⤵PID:1356
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,4363673387626127760,12434818210902079340,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:36⤵
- Suspicious behavior: EnumeratesProcesses
PID:1120
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,4363673387626127760,12434818210902079340,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:26⤵PID:4164
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/5⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4924 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ff94f0c46f8,0x7ff94f0c4708,0x7ff94f0c47186⤵PID:1732
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1940,13099113535493564887,10959035229674250983,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:36⤵
- Suspicious behavior: EnumeratesProcesses
PID:3136
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1940,13099113535493564887,10959035229674250983,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2000 /prefetch:26⤵PID:3924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1940,13099113535493564887,10959035229674250983,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2628 /prefetch:86⤵PID:3312
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13099113535493564887,10959035229674250983,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:16⤵PID:4460
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13099113535493564887,10959035229674250983,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:16⤵PID:4588
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13099113535493564887,10959035229674250983,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3784 /prefetch:16⤵PID:4724
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13099113535493564887,10959035229674250983,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4112 /prefetch:16⤵PID:232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13099113535493564887,10959035229674250983,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:16⤵PID:5264
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1940,13099113535493564887,10959035229674250983,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5540 /prefetch:86⤵PID:5800
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1940,13099113535493564887,10959035229674250983,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5600 /prefetch:86⤵PID:5896
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1940,13099113535493564887,10959035229674250983,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6280 /prefetch:86⤵PID:3640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1940,13099113535493564887,10959035229674250983,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6280 /prefetch:86⤵PID:5736
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13099113535493564887,10959035229674250983,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4064 /prefetch:16⤵PID:5868
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13099113535493564887,10959035229674250983,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:16⤵PID:5880
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13099113535493564887,10959035229674250983,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4268 /prefetch:16⤵PID:6132
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13099113535493564887,10959035229674250983,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:16⤵PID:2464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13099113535493564887,10959035229674250983,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:16⤵PID:848
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13099113535493564887,10959035229674250983,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6340 /prefetch:16⤵PID:5448
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\E753.exeC:\Users\Admin\AppData\Local\Temp\E753.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:5376 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\uo5QF4ht.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\uo5QF4ht.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yb5OT8sG.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yb5OT8sG.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
PID:5480 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ru7EM9AP.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ru7EM9AP.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
PID:5620 -
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\fi0hc7xq.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\fi0hc7xq.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
PID:5768 -
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1WT40rz4.exeC:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1WT40rz4.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5512 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"8⤵PID:4800
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"8⤵PID:5152
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"8⤵PID:5080
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"8⤵
- Executes dropped EXE
PID:2752 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2752 -s 5409⤵
- Program crash
PID:60
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2Sz928Vg.exeC:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2Sz928Vg.exe7⤵
- Executes dropped EXE
PID:4664
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\E957.exeC:\Users\Admin\AppData\Local\Temp\E957.exe2⤵
- Executes dropped EXE
PID:3492
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EB5C.bat" "2⤵PID:5696
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login3⤵PID:6124
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff94f0c46f8,0x7ff94f0c4708,0x7ff94f0c47184⤵PID:3384
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/3⤵PID:6044
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff94f0c46f8,0x7ff94f0c4708,0x7ff94f0c47184⤵PID:4440
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\F010.exeC:\Users\Admin\AppData\Local\Temp\F010.exe2⤵
- Executes dropped EXE
PID:2060
-
-
C:\Users\Admin\AppData\Local\Temp\F3BA.exeC:\Users\Admin\AppData\Local\Temp\F3BA.exe2⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious use of AdjustPrivilegeToken
PID:3216
-
-
C:\Users\Admin\AppData\Local\Temp\F67B.exeC:\Users\Admin\AppData\Local\Temp\F67B.exe2⤵PID:2752
-
-
C:\Users\Admin\AppData\Local\Temp\FAB2.exeC:\Users\Admin\AppData\Local\Temp\FAB2.exe2⤵
- Executes dropped EXE
PID:3456
-
-
C:\Users\Admin\AppData\Local\Temp\2EE2.exeC:\Users\Admin\AppData\Local\Temp\2EE2.exe2⤵
- Checks computer location settings
- Executes dropped EXE
PID:5536 -
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"3⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"4⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:1256
-
-
-
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"3⤵
- Executes dropped EXE
PID:6120 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵PID:6804
-
-
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:6280 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:5220
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"5⤵PID:6096
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes6⤵
- Modifies Windows Firewall
PID:2756
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2860
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:6976
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
PID:7016 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4632
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F6⤵
- DcRat
- Creates scheduled task(s)
PID:5532
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f6⤵PID:744
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:5196
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4896
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll6⤵
- Executes dropped EXE
PID:6452
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F6⤵
- DcRat
- Creates scheduled task(s)
PID:5464
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"6⤵
- Executes dropped EXE
PID:5928 -
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)7⤵PID:4092
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)8⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Launches sc.exe
PID:6692
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\kos2.exe"C:\Users\Admin\AppData\Local\Temp\kos2.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\set16.exe"C:\Users\Admin\AppData\Local\Temp\set16.exe"4⤵
- Executes dropped EXE
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\is-3U9QA.tmp\is-NR5QA.tmp"C:\Users\Admin\AppData\Local\Temp\is-3U9QA.tmp\is-NR5QA.tmp" /SL4 $A01E6 "C:\Users\Admin\AppData\Local\Temp\set16.exe" 1281875 522245⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
PID:5664 -
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 206⤵PID:5692
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 207⤵PID:5260
-
-
-
C:\Program Files (x86)\MyBurn\MyBurn.exe"C:\Program Files (x86)\MyBurn\MyBurn.exe" -i6⤵
- Executes dropped EXE
PID:5864
-
-
C:\Program Files (x86)\MyBurn\MyBurn.exe"C:\Program Files (x86)\MyBurn\MyBurn.exe" -s6⤵
- Executes dropped EXE
PID:5964
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query6⤵PID:6040
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\K.exe"C:\Users\Admin\AppData\Local\Temp\K.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:688
-
-
-
C:\Users\Admin\AppData\Local\Temp\latestX.exe"C:\Users\Admin\AppData\Local\Temp\latestX.exe"3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in Program Files directory
PID:5944
-
-
-
C:\Users\Admin\AppData\Local\Temp\3377.exeC:\Users\Admin\AppData\Local\Temp\3377.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5076
-
-
C:\Users\Admin\AppData\Local\Temp\3462.exeC:\Users\Admin\AppData\Local\Temp\3462.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:5240
-
-
C:\Users\Admin\AppData\Local\Temp\36D4.exeC:\Users\Admin\AppData\Local\Temp\36D4.exe2⤵
- Executes dropped EXE
PID:4560
-
-
C:\Users\Admin\AppData\Local\Temp\3A60.exeC:\Users\Admin\AppData\Local\Temp\3A60.exe2⤵
- Executes dropped EXE
PID:6024
-
-
C:\Users\Admin\AppData\Local\Temp\401D.exeC:\Users\Admin\AppData\Local\Temp\401D.exe2⤵
- Executes dropped EXE
PID:5680
-
-
C:\Users\Admin\AppData\Local\Temp\4E18.exeC:\Users\Admin\AppData\Local\Temp\4E18.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5260 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5260 -s 7923⤵
- Program crash
PID:6292
-
-
-
C:\Users\Admin\AppData\Local\Temp\53E6.exeC:\Users\Admin\AppData\Local\Temp\53E6.exe2⤵
- Executes dropped EXE
PID:4116 -
C:\Windows\system32\rundll32.exeC:\Windows\system32\rundll32.exe aeecabffcf.sys,#13⤵PID:5208
-
-
-
C:\Users\Admin\AppData\Local\Temp\5713.exeC:\Users\Admin\AppData\Local\Temp\5713.exe2⤵PID:6192
-
-
C:\Users\Admin\AppData\Local\Temp\6647.exeC:\Users\Admin\AppData\Local\Temp\6647.exe2⤵
- Executes dropped EXE
PID:6692
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /delete /f /tn "GoogleUpdateTaskMachineQC"2⤵PID:4092
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /create /f /tn "GoogleUpdateTaskMachineQC" /xml "C:\Users\Admin\AppData\Local\Temp\xhoymdsniflw.xml"2⤵
- DcRat
- Creates scheduled task(s)
PID:5920
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"2⤵PID:3824
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵PID:6776
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc2⤵PID:4580
-
C:\Windows\System32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
PID:7032
-
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
PID:3456
-
-
C:\Windows\System32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
PID:7080
-
-
C:\Windows\System32\sc.exesc stop bits3⤵
- Launches sc.exe
PID:7092
-
-
C:\Windows\System32\sc.exesc stop dosvc3⤵
- Launches sc.exe
PID:7144
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }2⤵PID:6300
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵PID:2460
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵PID:6672
-
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵PID:6736
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵
- Executes dropped EXE
PID:6192
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵PID:6872
-
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"2⤵PID:4392
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /create /f /tn "GoogleUpdateTaskMachineQC" /xml "C:\Users\Admin\AppData\Local\Temp\xhoymdsniflw.xml"2⤵
- DcRat
- Creates scheduled task(s)
PID:5696
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4180
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3224
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4a4 0x4a81⤵
- Suspicious use of AdjustPrivilegeToken
PID:5984
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe1⤵
- Executes dropped EXE
PID:3848
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2752 -ip 27521⤵PID:5668
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe aeecabffcf.sys,#11⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:6160
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 5260 -ip 52601⤵PID:6256
-
C:\Windows\servicing\TrustedInstaller.exeC:\Windows\servicing\TrustedInstaller.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1492
-
C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exeC:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
PID:3224
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe1⤵
- Executes dropped EXE
PID:6844
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵PID:5396
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe1⤵PID:6868
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
3Windows Service
3Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
3Windows Service
3Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD50629525c94f6548880f5f3a67846755e
SHA140ef667fc04bb1c0ae4bf2c17ded88594f0f4423
SHA256812576f4a24f399abbd54b83ba7f404f021d4a7d2ec0fd2f988ebf4cbf8477ee
SHA512f74d2e4a65a152f46852eb78dd70a958fdfb8c14e060ca41ffa783b7362e44659cc5fc73f59f3edb1f1d817000b85de7c1860512aa65d937eb5a0a8d9e5890fa
-
Filesize
152B
MD50629525c94f6548880f5f3a67846755e
SHA140ef667fc04bb1c0ae4bf2c17ded88594f0f4423
SHA256812576f4a24f399abbd54b83ba7f404f021d4a7d2ec0fd2f988ebf4cbf8477ee
SHA512f74d2e4a65a152f46852eb78dd70a958fdfb8c14e060ca41ffa783b7362e44659cc5fc73f59f3edb1f1d817000b85de7c1860512aa65d937eb5a0a8d9e5890fa
-
Filesize
152B
MD50629525c94f6548880f5f3a67846755e
SHA140ef667fc04bb1c0ae4bf2c17ded88594f0f4423
SHA256812576f4a24f399abbd54b83ba7f404f021d4a7d2ec0fd2f988ebf4cbf8477ee
SHA512f74d2e4a65a152f46852eb78dd70a958fdfb8c14e060ca41ffa783b7362e44659cc5fc73f59f3edb1f1d817000b85de7c1860512aa65d937eb5a0a8d9e5890fa
-
Filesize
152B
MD50629525c94f6548880f5f3a67846755e
SHA140ef667fc04bb1c0ae4bf2c17ded88594f0f4423
SHA256812576f4a24f399abbd54b83ba7f404f021d4a7d2ec0fd2f988ebf4cbf8477ee
SHA512f74d2e4a65a152f46852eb78dd70a958fdfb8c14e060ca41ffa783b7362e44659cc5fc73f59f3edb1f1d817000b85de7c1860512aa65d937eb5a0a8d9e5890fa
-
Filesize
152B
MD516e56f576d6ace85337e8c07ec00c0bf
SHA15c9579bb4975c93a69d1336eed5f05013dc35b9c
SHA2567796a7ba79148fc3cb46e4bbca48094376371ca9dd66f0810f7797c5e24158f5
SHA51269e89f39fa6438a74a48985387cd2e3e003858b0855ee6cd03abf6967674503b98b90573c784b4cf785b9cca594d3c8762f92def24e2bf51374ef5a00921e5e2
-
Filesize
152B
MD50629525c94f6548880f5f3a67846755e
SHA140ef667fc04bb1c0ae4bf2c17ded88594f0f4423
SHA256812576f4a24f399abbd54b83ba7f404f021d4a7d2ec0fd2f988ebf4cbf8477ee
SHA512f74d2e4a65a152f46852eb78dd70a958fdfb8c14e060ca41ffa783b7362e44659cc5fc73f59f3edb1f1d817000b85de7c1860512aa65d937eb5a0a8d9e5890fa
-
Filesize
152B
MD50629525c94f6548880f5f3a67846755e
SHA140ef667fc04bb1c0ae4bf2c17ded88594f0f4423
SHA256812576f4a24f399abbd54b83ba7f404f021d4a7d2ec0fd2f988ebf4cbf8477ee
SHA512f74d2e4a65a152f46852eb78dd70a958fdfb8c14e060ca41ffa783b7362e44659cc5fc73f59f3edb1f1d817000b85de7c1860512aa65d937eb5a0a8d9e5890fa
-
Filesize
152B
MD50629525c94f6548880f5f3a67846755e
SHA140ef667fc04bb1c0ae4bf2c17ded88594f0f4423
SHA256812576f4a24f399abbd54b83ba7f404f021d4a7d2ec0fd2f988ebf4cbf8477ee
SHA512f74d2e4a65a152f46852eb78dd70a958fdfb8c14e060ca41ffa783b7362e44659cc5fc73f59f3edb1f1d817000b85de7c1860512aa65d937eb5a0a8d9e5890fa
-
Filesize
152B
MD50629525c94f6548880f5f3a67846755e
SHA140ef667fc04bb1c0ae4bf2c17ded88594f0f4423
SHA256812576f4a24f399abbd54b83ba7f404f021d4a7d2ec0fd2f988ebf4cbf8477ee
SHA512f74d2e4a65a152f46852eb78dd70a958fdfb8c14e060ca41ffa783b7362e44659cc5fc73f59f3edb1f1d817000b85de7c1860512aa65d937eb5a0a8d9e5890fa
-
Filesize
152B
MD50629525c94f6548880f5f3a67846755e
SHA140ef667fc04bb1c0ae4bf2c17ded88594f0f4423
SHA256812576f4a24f399abbd54b83ba7f404f021d4a7d2ec0fd2f988ebf4cbf8477ee
SHA512f74d2e4a65a152f46852eb78dd70a958fdfb8c14e060ca41ffa783b7362e44659cc5fc73f59f3edb1f1d817000b85de7c1860512aa65d937eb5a0a8d9e5890fa
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize1KB
MD5cf1b77b805e53d65544027765ebebb91
SHA1a38a66b69f348e5d44f6208b8ffd6c6fcb1d9394
SHA2560e2421249d6d6a75016bac4c0d80d9f8fb0dc63827b79b3e29e9922225a3e2d4
SHA512c7562760dd224e5e1278102bd6c090802bc8644bb7a6bb2739817fd8fbe187b0fbe57ad7851d0dd7b5ab3ef94b3a4527317f60cc9a051f08fcd7ee2e7e075595
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
7KB
MD508f247b428c03572493166aa3bf75d99
SHA1e5644edfe2fa56fbb29c6f016ac1a5ecc7444eba
SHA256e6530af7c8722a13ae99919010b99acea6f89e2dee29e28db61241e9be6e222a
SHA512c77612878291eae7e03af663a8ea08d145cd702e6f6f8811d28378175c8914ce9164019dcf8f2f1f69217109b87427bdd9bbd67f5d59a5bb22f071d2b61d01cd
-
Filesize
7KB
MD59aa7400a2b9152ad6dcd4c3b0b5eda9c
SHA1252ac6de26963664202050dc23154c451c8e75d2
SHA25606caf52d98c8c7d45912b91cc655c386ebf770cd4a5add4d0048c07926fd9f21
SHA5129fdc38065f986504d285ae485eb6d93945fb3f780d1489d9157b6fb6d9817a1369b6164576d78ea98a19f0a467efbcde20486bdb83b714fa3899d2cc085bc484
-
Filesize
7KB
MD56d3dc34322e42905d8398caa49bfdd9b
SHA11746d5f9e99a85ddc5846f64cf0b551753133aea
SHA256061d364eade6cb3e32f7ffaaaee6735259abe2a2e97f5712f39fcaf6e97193bd
SHA512b5badff2542a89566e1e6e18e2b744fdd09060cf82783bbbd5fbb17f9b7753e37ddd8cdfbd4b06c949e73dc5d56054a2a150f6c8d87b13c2f410f0a39f6270fe
-
Filesize
5KB
MD5cad17ede051e265eaf0644360610fb46
SHA190d89af7f83a9f114980b784aaaccedf5052a72c
SHA25608f2508810bec922b9f5488ce9e5c6231e77d93ae5ba7ce1926d987d215c3067
SHA512a5e16f1ca0d6b43ab589b1bc9dab610ba0465d7b8bd8d9801aa1f46d4ba9a69cd1fc4b09fc46beb02f073f728c3ec43182acf7aeba94e5f42e4db8803714b2cc
-
Filesize
24KB
MD5fd20981c7184673929dfcab50885629b
SHA114c2437aad662b119689008273844bac535f946c
SHA25628b7a1e7b492fff3e5268a6cd480721f211ceb6f2f999f3698b3b8cbd304bb22
SHA512b99520bbca4d2b39f8bedb59944ad97714a3c9b8a87393719f1cbc40ed63c5834979f49346d31072c4d354c612ab4db9bf7f16e7c15d6802c9ea507d8c46af75
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\57a5c7d0-0dce-44ed-96cf-61ff2ff48617\index-dir\the-real-index
Filesize624B
MD50b5b8da381aeab74e3e3832a539f00ff
SHA16df453c81866b248003ad5f9981b6151fa23a1e3
SHA2569bfa48d846ab41fa6a8a7926513793491f142b8e112a93c35feb07bb879a2b7c
SHA512fbc232b349c64210fb356e5c41a0f3c200996d6376973af9af7d951fd0d0bfa802c5b11048fa2f6fcad4a0825a0a5d2718a42c267013cde8ba6a669759778d37
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\57a5c7d0-0dce-44ed-96cf-61ff2ff48617\index-dir\the-real-index~RFe58143f.TMP
Filesize48B
MD5b7b3610e766e0cb7b3198b5ce002c5b1
SHA187bf340de43ffb7749dd4a6d22fe126ee1fe5a13
SHA2563c4d6a1e18914f2bf3610706906bd4d4faee5891378cbc046454b97d172c3873
SHA512b45c911332ff6449121419c8b6b5d1089ee4e4989e145a9ed188a6e1b61097a0926079a7c2d02a0768247289c5a4124d4ca5139448e11c2da65d4f6db98acd5b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\b5298244-2157-4077-9686-b1bd2a6a8f0a\index-dir\the-real-index
Filesize2KB
MD57587d30c977430c5b69928acb03911b6
SHA1c48868c4e50b73b2fa0e06a6628b09218030171e
SHA256d44bafe972585bd92e9658bc6bd60a70a626565d542ff2909d76f9f0ceeb297e
SHA512656ef14da847ca8479b9597ff8461a97ada6726e54bf28e68fca4287d7c7ac75f31babe0fbd1d1e243b6f080bf508152a1e629919faa153a02a397f135b5a80d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\b5298244-2157-4077-9686-b1bd2a6a8f0a\index-dir\the-real-index~RFe580fda.TMP
Filesize48B
MD563fb84c6a726f09589760fc28764e49f
SHA1a84c87325e7b1b51e332eee1395b200767c74675
SHA2569a224be61e47412f7ee7aa11473991e00671623db0d17d1dd39dfd430cf9c049
SHA512b74e4ee51c6d619c9b0ef363b16aa860c3960abd6eb5824cf157d23728a533eb19211d4f84108437abf2f399e810c7e3c60758909fb19257b99fd420ab022197
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize89B
MD5085f1041898c1d4830715b05cb309d1b
SHA19191b81ef4dfb710bd5d4362c81c3b1d759f562a
SHA25692db303ab1607abf96159bfb8bc3d2138f78fc1c93520e011872fb88919a5745
SHA512e6a813d43b1f5e2ffcaa25335eff637b1d7e21ee1de17c2670630d3cf0270169f74f64973ba20a3ff0817464b0372d18b101076c30726a1c511e76f0ce9afc3e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize146B
MD5c87bb55750f939f02b77a8e0cf64c421
SHA1fa121d1967505b65d3c74ef89587d5872e575d7d
SHA2560c769f7bba4df6a4d2c1a8c26cc44fa7a8d2c8fdf29d4c47f09a7bc1ed6d36df
SHA512b3d07f2f33dd735cf8c6c6c6b2031393e9272ab87ee232f6a569cb246b6b30e3ac0fd66d770ba06529560b37e58adf6dd19204fa448c0b2a2bbb84f9e60175bd
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize155B
MD5a10a5ae6c89dabec579bfac68daf1bfa
SHA16c1c1693c7198a91e71796a6149f8944d295ac78
SHA256077268fc3703a9f00242052886301c32251f031e8d32cb0ee407d1b807a3ab75
SHA512b7d79ea977b17a2e94c6bd6db4915b8412d256f46a566ef22ea5eeb33f727b7005e38a028cf7e3aba02466b95452cf54bebf99a94c1a0da62599fe8de21d7923
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize82B
MD570667d7d403ee858b3e30a067cf3d989
SHA185c420efc444d5f7890d67e09d6e037a544bf126
SHA256977aec414d6617c0c3b33f0152abbb36c8facd314751669ac7216a9c2c0ae544
SHA512b4e9a206c8050cc197e9835f2b6c375a44da20f03e0c4c3274e91182da965f70587444714ff257c4baebb7f56eb827e5a3bca83f0c05bd904002dd4f64613476
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize153B
MD5209623308ebbc38e41161317b954d225
SHA151dd4d4b68cbb725d702e9859e12cfc4e30a18e3
SHA25680bc8583ef288cf9a2f3540fc85075655320b6320defb04c0f96030bd9313469
SHA512400199ebfc6c9a3503e2ae05e44e17cebc1b54e4aafa87f4a0fbf0d3a65d54586581d2ba25255fbe7dc682a58b3786a0fef78a1757abcdd7ff90efc9f79e83af
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize96B
MD58e8d386af0f91d8aa76176b7c2687c0a
SHA19f5fc523b02847186ad26782e12ff0c0b7b642fd
SHA2566960fb50e6aff2bd75284ff0ff2dfb97f9abbfc6ba82857286eeef892c80fcd2
SHA5121d2775a4de58ddce372a18799461cc2569c8361c500241da08061484c132d76483e48ef47660d0044a4797ffa6aec26a8db7623f708000cf3350e57b1def7592
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5808c5.TMP
Filesize48B
MD5162d094a15765e31a1d6d2424949ee84
SHA1583feaab2679a6c26ecd837db544669fbae9ddb2
SHA25683588d7a4f0ff2fb2d62a896e1e88397abe24a4db6d2400dd9c71e37949dae47
SHA51227bfa8192bb9863517588bba4d86702d8d1be319f43360d4fbb74b400c7fba88d7bbbe83109395cf960d24e79dde66365eb633f7f0f38942ce5358c7ce735c20
-
Filesize
1KB
MD5deee7cf9ffc883f7b61498a0051edf19
SHA1f681d4b38da4f0bbcd4e5dfbed79bd8ce890c22b
SHA2569c62e292b74abf091b1d2877b929e3ee10819f0f368ad6abb572adbee2f571e7
SHA512d15c74c0b52e5368fc6f607d142d000b1a0a64e41f0c23ee34fba8ab46bffc7b5d9964b43f4536087435d4b66b881703912508838672ae2cd76294ff1acfa646
-
Filesize
1KB
MD58f1148f0a946fa962f13dd0a2bb89085
SHA1a2aa3854a5d3bc29fc757653768e773b423300c1
SHA2568bd4d3a43f1e4a48e2acba6dd956e43c3ad5e0fa061dbb6fb2cdde3ca7843788
SHA5127eb3d51938bb1278701126ec9073f25ee02ee52ea89f72be0ce6dde14ff33a8147084c65310f85a73f21c6766267bd92b39c561181c398bc09f1d4ba61a2316a
-
Filesize
1KB
MD5a6c98c4d91adaee8d1fa58b74a9a4cf2
SHA12ae23a80cae666b13b068aeee857b46eed190b0f
SHA25617bf9d5f0ff0f2f3edb5629b4581f066d0bfb3da30c9128dbb1d19ecf6448b22
SHA512dc56dd689eeb127ae0cdae7d41e129af66e3c773a02c3c7d2e57a6ba72ad5922aa0180c4374612292764a6bb331cc29b222c004aa1f07b8a3ab3ab6cd671040c
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD59cb6f3764153b5e4bbd9425b55c65059
SHA1e6457829e72b5ff7bda5a259a0c7d05e3b031fc4
SHA2563fa39c61cba511bf733fe9d78aa8ce1ab4c905e215f5060f54a5583d9981c6f2
SHA5121a16f658b053df75682bd55ed454bb8b0ce943118c5da9c95bb4457343c4e4f7132579a39f4085abb565e8eb5d3fe25c80846925a9409ac38f6e29bd7244f4da
-
Filesize
2KB
MD58b6f8941ce69b263fc5567192abc4a6f
SHA1fc625150a629e9bed96bca9075589bee6ec87943
SHA256ce318c39558d24053080cbcc3b4adcf5d73dd32c0826c6d6b6fbee05c2f59b01
SHA512e5a574106dcd442b7bc2fea112885e0e6c6ca39f4ec28bc866059f5a7db8a3922aa104a765a319818ee28bf5cc3802b70e5c1d94afe3b7598ab6fb63257f45b6
-
Filesize
2KB
MD58b6f8941ce69b263fc5567192abc4a6f
SHA1fc625150a629e9bed96bca9075589bee6ec87943
SHA256ce318c39558d24053080cbcc3b4adcf5d73dd32c0826c6d6b6fbee05c2f59b01
SHA512e5a574106dcd442b7bc2fea112885e0e6c6ca39f4ec28bc866059f5a7db8a3922aa104a765a319818ee28bf5cc3802b70e5c1d94afe3b7598ab6fb63257f45b6
-
Filesize
2KB
MD5604d876530897910d256a08d6ed39927
SHA1bbe7dd5c4364bc6ec4aa5a1a3d0c68e19773e023
SHA25699b770ebf0dc6e2d47a4f6383848749ffeb1c8222661c4d2348b1178a673576c
SHA51285bb91e89c364c1ca18ecb280696cfc6cf4ab807795017d6951d3057ff357274c2113db6f050ae72b0e6b3de078109d992a9c51c9ba78e1f089a2d74729f6774
-
Filesize
2KB
MD5604d876530897910d256a08d6ed39927
SHA1bbe7dd5c4364bc6ec4aa5a1a3d0c68e19773e023
SHA25699b770ebf0dc6e2d47a4f6383848749ffeb1c8222661c4d2348b1178a673576c
SHA51285bb91e89c364c1ca18ecb280696cfc6cf4ab807795017d6951d3057ff357274c2113db6f050ae72b0e6b3de078109d992a9c51c9ba78e1f089a2d74729f6774
-
Filesize
2KB
MD5604d876530897910d256a08d6ed39927
SHA1bbe7dd5c4364bc6ec4aa5a1a3d0c68e19773e023
SHA25699b770ebf0dc6e2d47a4f6383848749ffeb1c8222661c4d2348b1178a673576c
SHA51285bb91e89c364c1ca18ecb280696cfc6cf4ab807795017d6951d3057ff357274c2113db6f050ae72b0e6b3de078109d992a9c51c9ba78e1f089a2d74729f6774
-
Filesize
2KB
MD58b6f8941ce69b263fc5567192abc4a6f
SHA1fc625150a629e9bed96bca9075589bee6ec87943
SHA256ce318c39558d24053080cbcc3b4adcf5d73dd32c0826c6d6b6fbee05c2f59b01
SHA512e5a574106dcd442b7bc2fea112885e0e6c6ca39f4ec28bc866059f5a7db8a3922aa104a765a319818ee28bf5cc3802b70e5c1d94afe3b7598ab6fb63257f45b6
-
Filesize
4.2MB
MD5ea6cb5dbc7d10b59c3e1e386b2dbbab5
SHA1578a5b046c316ccb2ce6f4571a1a6f531f41f89c
SHA256443d03b8d3a782b2020740dc49c5cc97eb98ca4543b94427a0886df3f2a71132
SHA512590355ea716bac8372d0fac1e878819f2e67d279e32ef787ff11cbe8a870e04d1a77233e7f9f29d303ff11a90096ebae6c5a41f1ab94abb82c0710357fc23200
-
Filesize
124B
MD5dec89e5682445d71376896eac0d62d8b
SHA1c5ae3197d3c2faf3dea137719c804ab215022ea6
SHA256c3dea90ca98985007f0de66bf0197fdcd2d4a35e365135bf37a18a4895d81668
SHA512b746b79120d2ff8a9f3327b0bed99c70339155ea831c1eb9f412056fc8de36a0e3005378ba9102bd25ce6cc24fe1171f1a9c8453f33a9bcd6dd59e9ad0f8e186
-
Filesize
1.5MB
MD5e212a53febd75c4cd5c1b161ea15ace2
SHA185ed6698b8e494e2adbab8d31e3914cf4743fcee
SHA256de5428166945b4b0c6d59162f2151f763384322ab9d7f6f6affc02eaf9b751d3
SHA5128f5d72f379b1133319619041175956f5e6da1979311c8e287127d5259d25607e53ff9c55f71b45c58869a4e01425e47a826d650ed70b22d249f6ba435767e839
-
Filesize
1.5MB
MD5e212a53febd75c4cd5c1b161ea15ace2
SHA185ed6698b8e494e2adbab8d31e3914cf4743fcee
SHA256de5428166945b4b0c6d59162f2151f763384322ab9d7f6f6affc02eaf9b751d3
SHA5128f5d72f379b1133319619041175956f5e6da1979311c8e287127d5259d25607e53ff9c55f71b45c58869a4e01425e47a826d650ed70b22d249f6ba435767e839
-
Filesize
180KB
MD50635bc911c5748d71a4aed170173481e
SHA16d92ff8b519e4a10759f75f3b3d9e1459ed4ff1b
SHA256a0330d75df7075206cf68d358e3acfc621062f35db43c2521b8ef5e7c9f317f1
SHA51250ea5d41497884b8aee43d6d7940186d6095055c4cd301ffa88407caf9935853dcfd852e81ab4671da21505ba284b0bae71a59fa50dd55dfa4c3ea7d0251651a
-
Filesize
180KB
MD50635bc911c5748d71a4aed170173481e
SHA16d92ff8b519e4a10759f75f3b3d9e1459ed4ff1b
SHA256a0330d75df7075206cf68d358e3acfc621062f35db43c2521b8ef5e7c9f317f1
SHA51250ea5d41497884b8aee43d6d7940186d6095055c4cd301ffa88407caf9935853dcfd852e81ab4671da21505ba284b0bae71a59fa50dd55dfa4c3ea7d0251651a
-
Filesize
180KB
MD50635bc911c5748d71a4aed170173481e
SHA16d92ff8b519e4a10759f75f3b3d9e1459ed4ff1b
SHA256a0330d75df7075206cf68d358e3acfc621062f35db43c2521b8ef5e7c9f317f1
SHA51250ea5d41497884b8aee43d6d7940186d6095055c4cd301ffa88407caf9935853dcfd852e81ab4671da21505ba284b0bae71a59fa50dd55dfa4c3ea7d0251651a
-
Filesize
45KB
MD518320d82c594081e8e504a3f101a522d
SHA177b1662f7b9896b42e80a662e865be2cb16e3151
SHA25698c5d8321f30d68ad6169ef0920f758c49280c9c98e835b36a4897c8fd00a7a2
SHA5120b9e23af9359a6f6642395d834a6a391cf260b047a5b877e2aa2071982924fbba1deb334e9360a765140b1e397021fb42d8164ad5f334dd75f814ab521f04990
-
Filesize
45KB
MD518320d82c594081e8e504a3f101a522d
SHA177b1662f7b9896b42e80a662e865be2cb16e3151
SHA25698c5d8321f30d68ad6169ef0920f758c49280c9c98e835b36a4897c8fd00a7a2
SHA5120b9e23af9359a6f6642395d834a6a391cf260b047a5b877e2aa2071982924fbba1deb334e9360a765140b1e397021fb42d8164ad5f334dd75f814ab521f04990
-
Filesize
45KB
MD50c4a95c6f0ed53f41f35e873600c4cca
SHA19d358cea6e1ee38497bc00102e15fce50aa24733
SHA256acd2d7b7b5543b80964cb809ce55b82d7453eb1aef1db4c413fd6c1df17121af
SHA5126589081de3764ec51c419ef3eb00c9e895c3d847aca5d129ba329eb583ec968f390e8396be73b9ee39ad4eef5604fc12bac664530e795d45438695846c4e2c9b
-
Filesize
1.4MB
MD5f78de8a1aaf98ba20a8e8e02ca8efc02
SHA13406f88fe7c63f77b66f3f2b8a5d0b70dbf42321
SHA25687e6a08599f2e73df5afe132e40c74d2f5117d7a0a83136893a2e8075ebc5db9
SHA5129b3a9a460475df203aa1691585e89b28b196811ab7b102a46d05735d02470dd47b1b605838b1f82842d30f792a3475e44b97c2a8577ccca3e437b6502529b496
-
Filesize
1.4MB
MD5f78de8a1aaf98ba20a8e8e02ca8efc02
SHA13406f88fe7c63f77b66f3f2b8a5d0b70dbf42321
SHA25687e6a08599f2e73df5afe132e40c74d2f5117d7a0a83136893a2e8075ebc5db9
SHA5129b3a9a460475df203aa1691585e89b28b196811ab7b102a46d05735d02470dd47b1b605838b1f82842d30f792a3475e44b97c2a8577ccca3e437b6502529b496
-
Filesize
1.3MB
MD5dc08bc1f92b3f99bc847a914f2c80b5d
SHA161202023ba03b95b85a10573f67fbbf09ce59044
SHA25607b6eb1f64a6b9d88f2caec6d4b2f967ffcf20aea7faba384f92b151fe7b30ad
SHA51230825a05d3a1f447fca67f4b7b3026dd2047cda105c2d8858cc98d6f3aa8f7a58228c5ac244f5620b88275ac4adb48f010f54f357b86dc19903e28d1d36bb6a0
-
Filesize
1.3MB
MD5dc08bc1f92b3f99bc847a914f2c80b5d
SHA161202023ba03b95b85a10573f67fbbf09ce59044
SHA25607b6eb1f64a6b9d88f2caec6d4b2f967ffcf20aea7faba384f92b151fe7b30ad
SHA51230825a05d3a1f447fca67f4b7b3026dd2047cda105c2d8858cc98d6f3aa8f7a58228c5ac244f5620b88275ac4adb48f010f54f357b86dc19903e28d1d36bb6a0
-
Filesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
Filesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
Filesize
1.1MB
MD57a2c46a7566a131002ecf160d818e0be
SHA18b5e6d47715a7289d9334721f94b6e7c6be744e6
SHA256c8ab4fef6818111cbcdc7d1f5bcd50f81daabbcb55698566021b209678a28f2b
SHA51252fc3171d87ad0529281ae1fff987594ddc2a1fb41c4f2ec6e2c7e994f3d92867fe75d93b3198bf5b106d29d72a14ce77b3e0e0e395c1c9c9f8a7b92ca8867bd
-
Filesize
1.1MB
MD57a2c46a7566a131002ecf160d818e0be
SHA18b5e6d47715a7289d9334721f94b6e7c6be744e6
SHA256c8ab4fef6818111cbcdc7d1f5bcd50f81daabbcb55698566021b209678a28f2b
SHA51252fc3171d87ad0529281ae1fff987594ddc2a1fb41c4f2ec6e2c7e994f3d92867fe75d93b3198bf5b106d29d72a14ce77b3e0e0e395c1c9c9f8a7b92ca8867bd
-
Filesize
1.2MB
MD5919c8ffd853d3b6e9f1339087db7e6c8
SHA130eea8146a06cdb35230e437fb0e1dcac6162d70
SHA256e48517ee43fcc263c4bd8a29582a9ebaed0a5a28697ad850402a8c32a39c5ef6
SHA5128b754dbd282046788dca02f4dbd35607bf4e65ec325d246c4b5ef1ccebd761bc478eb81de9f28a5bf32ac57e28d07e56b3b69ebd99c86b7521ebb18530a6dab6
-
Filesize
1.2MB
MD5919c8ffd853d3b6e9f1339087db7e6c8
SHA130eea8146a06cdb35230e437fb0e1dcac6162d70
SHA256e48517ee43fcc263c4bd8a29582a9ebaed0a5a28697ad850402a8c32a39c5ef6
SHA5128b754dbd282046788dca02f4dbd35607bf4e65ec325d246c4b5ef1ccebd761bc478eb81de9f28a5bf32ac57e28d07e56b3b69ebd99c86b7521ebb18530a6dab6
-
Filesize
1.1MB
MD5408142150615ac9ec9fffa52a667cab7
SHA158e136f41fc5b754b0372e34679f41b4ca931fd9
SHA256693bede9cea5901b6b60bbf4d78c08d00bc9b3a3c06a431f86a3f96f569260a8
SHA5125e28bdbbacc34bcddf37df672fcbfc85f7b165e4eabf2b63fbb0b3eeaf923b6819c9272962835d0af8c6b83ebff9263ecdfc2a42b27624a2c1097fdd323396da
-
Filesize
1.1MB
MD5408142150615ac9ec9fffa52a667cab7
SHA158e136f41fc5b754b0372e34679f41b4ca931fd9
SHA256693bede9cea5901b6b60bbf4d78c08d00bc9b3a3c06a431f86a3f96f569260a8
SHA5125e28bdbbacc34bcddf37df672fcbfc85f7b165e4eabf2b63fbb0b3eeaf923b6819c9272962835d0af8c6b83ebff9263ecdfc2a42b27624a2c1097fdd323396da
-
Filesize
820KB
MD50132beba97259fb80cbf7b95b8869a80
SHA17c2b4e3bfe434a4aa279dee292d8682736bec0d8
SHA256abab873d77697a422ec972a717485d218ce523687ebc82afc4388fb6db270145
SHA512be03be846aa09a49d805fdab9685f00db35c1790264386214a92c9b383d97d3bda08418ee5fd048345e64e2526d5841623d4df2b585839c91f5bfbb4e9154b81
-
Filesize
820KB
MD50132beba97259fb80cbf7b95b8869a80
SHA17c2b4e3bfe434a4aa279dee292d8682736bec0d8
SHA256abab873d77697a422ec972a717485d218ce523687ebc82afc4388fb6db270145
SHA512be03be846aa09a49d805fdab9685f00db35c1790264386214a92c9b383d97d3bda08418ee5fd048345e64e2526d5841623d4df2b585839c91f5bfbb4e9154b81
-
Filesize
897KB
MD52e3f17e7e9001ff7b7cf8ab412462a48
SHA12a49c0e715ecd73ccd9d0fcfb21de36cc3ee03ba
SHA256674e07c8188ea9be50a002c9850c7704541b44b35adc7528216dc73dd4a531b8
SHA512d42e8a4801f1c73733b37efb5ae17f321bd5463829ab9283566f38882624e284ff4c7c53b212c35ca53f9de825625a455393012ffbdc0e4caebd178fc716ee27
-
Filesize
897KB
MD52e3f17e7e9001ff7b7cf8ab412462a48
SHA12a49c0e715ecd73ccd9d0fcfb21de36cc3ee03ba
SHA256674e07c8188ea9be50a002c9850c7704541b44b35adc7528216dc73dd4a531b8
SHA512d42e8a4801f1c73733b37efb5ae17f321bd5463829ab9283566f38882624e284ff4c7c53b212c35ca53f9de825625a455393012ffbdc0e4caebd178fc716ee27
-
Filesize
1.1MB
MD5408142150615ac9ec9fffa52a667cab7
SHA158e136f41fc5b754b0372e34679f41b4ca931fd9
SHA256693bede9cea5901b6b60bbf4d78c08d00bc9b3a3c06a431f86a3f96f569260a8
SHA5125e28bdbbacc34bcddf37df672fcbfc85f7b165e4eabf2b63fbb0b3eeaf923b6819c9272962835d0af8c6b83ebff9263ecdfc2a42b27624a2c1097fdd323396da
-
Filesize
458KB
MD5cf5a5cd361219a80aaeb2d9ed616f438
SHA1528277684a5c3317cefd2505fae3e58e842cb00a
SHA256c4085bddf28cfa1c59bfcc986c044cef688814ec7ee6f0d23d1c7c909c569df6
SHA5125fc70e823622eaf6add2bb6489bc2e3e7c73cbe2e9f424df99f65d7df8163782433ce5f17252470a70a55584b8fc8915ee000d69568c7c4532c8ac30eb60223c
-
Filesize
458KB
MD5cf5a5cd361219a80aaeb2d9ed616f438
SHA1528277684a5c3317cefd2505fae3e58e842cb00a
SHA256c4085bddf28cfa1c59bfcc986c044cef688814ec7ee6f0d23d1c7c909c569df6
SHA5125fc70e823622eaf6add2bb6489bc2e3e7c73cbe2e9f424df99f65d7df8163782433ce5f17252470a70a55584b8fc8915ee000d69568c7c4532c8ac30eb60223c
-
Filesize
754KB
MD571c35117c0a37192277d4313036f973b
SHA176bdd922b52d9f19e4dceded462027d69187d223
SHA256c60d3cae842a3c04ae9790d95d5fe89d983f4ff03cba5339343450c38063ca0d
SHA5124370eea1c6a55a7261447a2dd0da3630c1adc27a8da2a004fe1068ccbfa08a1e19b50ab284d7792739faad968d5d61d3a20c5ea0de693b2d406172ee268138dd
-
Filesize
875KB
MD573d86751a127f28504b4239773c328be
SHA1a7b5a37edc0841e9a269b827bb0bf28ae0d8c330
SHA256e0923f519bbf0f9c43922d26954359eed1c352db6deda6e655f838a44d655030
SHA512464df937ab7ed3a7af81f18d5238019b4268a78dfd8b9d0df6a459c5fd19dfa480c441ce2f20f8b63dcba806e6fc646beaa6b778b52fedee7077739634bad3e0
-
Filesize
875KB
MD573d86751a127f28504b4239773c328be
SHA1a7b5a37edc0841e9a269b827bb0bf28ae0d8c330
SHA256e0923f519bbf0f9c43922d26954359eed1c352db6deda6e655f838a44d655030
SHA512464df937ab7ed3a7af81f18d5238019b4268a78dfd8b9d0df6a459c5fd19dfa480c441ce2f20f8b63dcba806e6fc646beaa6b778b52fedee7077739634bad3e0
-
Filesize
180KB
MD50635bc911c5748d71a4aed170173481e
SHA16d92ff8b519e4a10759f75f3b3d9e1459ed4ff1b
SHA256a0330d75df7075206cf68d358e3acfc621062f35db43c2521b8ef5e7c9f317f1
SHA51250ea5d41497884b8aee43d6d7940186d6095055c4cd301ffa88407caf9935853dcfd852e81ab4671da21505ba284b0bae71a59fa50dd55dfa4c3ea7d0251651a
-
Filesize
180KB
MD50635bc911c5748d71a4aed170173481e
SHA16d92ff8b519e4a10759f75f3b3d9e1459ed4ff1b
SHA256a0330d75df7075206cf68d358e3acfc621062f35db43c2521b8ef5e7c9f317f1
SHA51250ea5d41497884b8aee43d6d7940186d6095055c4cd301ffa88407caf9935853dcfd852e81ab4671da21505ba284b0bae71a59fa50dd55dfa4c3ea7d0251651a
-
Filesize
8KB
MD5ac65407254780025e8a71da7b925c4f3
SHA15c7ae625586c1c00ec9d35caa4f71b020425a6ba
SHA25626cd9cc9a0dd688411a4f0e2fa099b694b88cab6e9ed10827a175f7b5486e42e
SHA51227d87730230d9f594908f904bf298a28e255dced8d515eb0d97e1701078c4405f9f428513c2574d349a7517bd23a3558fb09599a01499ea54590945b981b17ab
-
Filesize
116B
MD5ec6aae2bb7d8781226ea61adca8f0586
SHA1d82b3bad240f263c1b887c7c0cc4c2ff0e86dfe3
SHA256b02fffaba9e664ff7840c82b102d6851ec0bb148cec462cef40999545309e599
SHA512aa62a8cd02a03e4f462f76ae6ff2e43849052ce77cca3a2ccf593f6669425830d0910afac3cf2c46dd385454a6fb3b4bd604ae13b9586087d6f22de644f9dfc7
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
Filesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
Filesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
Filesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
Filesize
1.5MB
MD5665db9794d6e6e7052e7c469f48de771
SHA1ed9a3f9262f675a03a9f1f70856e3532b095c89f
SHA256c1b31186d170a2a5755f15682860b3cdc60eac7f97a2db9462dee7ca6fcbc196
SHA51269585560e8ac4a2472621dd4da4bf0e636688fc5d710521b0177461f773fcf2a4c7ddb86bc812ecb316985729013212ccfa4992cd1c98f166a4a510e17fcae74
-
Filesize
5.6MB
MD5bae29e49e8190bfbbf0d77ffab8de59d
SHA14a6352bb47c7e1666a60c76f9b17ca4707872bd9
SHA256f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87
SHA5129e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2
-
Filesize
1.5MB
MD5b224196c88f09b615527b2df0e860e49
SHA1f9ae161836a34264458d8c0b2a083c98093f1dec
SHA2562a11969fcc1df03533ad694a68d56f0e3a67ce359663c3cf228040ab5baa5ed8
SHA512d74376c5bd3ba19b8454a17f2f38ab64ad1005b6372c7e162230c822c38f6f8c7d87aef47ef04cb6dceedc731046c30efa6720098cc39b15addd17c809b8296d
-
Filesize
260KB
MD5f39a0110a564f4a1c6b96c03982906ec
SHA108e66c93b575c9ac0a18f06741dabcabc88a358b
SHA256f794a557ad952ff155b4bfe5665b3f448453c3a50c766478d070368cab69f481
SHA512c6659f926f95a8bed1ff779c8445470c3089823abe8c1199f591c313ecee0bd793478cdaab95905c0e8ae2a2b18737daabe887263b7cde1eaaa9ee6976ff7d00
-
Filesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
Filesize
273B
MD5a5b509a3fb95cc3c8d89cd39fc2a30fb
SHA15aff4266a9c0f2af440f28aa865cebc5ddb9cd5c
SHA2565f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529
SHA5123cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9