Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/10/2023, 20:54

General

  • Target

    tmp.exe

  • Size

    12.5MB

  • MD5

    d9ebd26ee58f71cde091943042318e1e

  • SHA1

    dd769d691f1b937aa4db724c7d0686dfe09989d4

  • SHA256

    7b101e4c3f86d6b121d25c79d718af9b24ad1ba2bbf9ad83dc285b8ba2e4756a

  • SHA512

    c542bbac2afdc4371a42fc7a678a9f12855a0fa07bf9ea32403acdae7bc460da3b2d8990af6fb47ed82e74aaeaa4277ce8093e8fe9d75a8151a4e3493136c7ef

  • SSDEEP

    393216:Y3Jwzzz3BmMupONDnuc6zhVu2fX5xQnRh7UBlLKcOLyjM:4/zhNiEB9Kq

Malware Config

Extracted

Family

smokeloader

Botnet

up3

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32
rc4.i32

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 14 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 11 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 1 IoCs
  • Downloads MZ/PE file
  • Drops file in Drivers directory 2 IoCs
  • Modifies Windows Firewall 1 TTPs 1 IoCs
  • Stops running service(s) 3 TTPs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 17 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Unexpected DNS network traffic destination 1 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

  • Drops file in System32 directory 10 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Program Files directory 20 IoCs
  • Drops file in Windows directory 4 IoCs
  • Launches sc.exe 11 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 64 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of UnmapMainImage
    PID:3308
    • C:\Users\Admin\AppData\Local\Temp\tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:1764
      • C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe
        "C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2820
        • C:\Users\Admin\AppData\Local\Temp\Broom.exe
          C:\Users\Admin\AppData\Local\Temp\Broom.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:4420
      • C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
        "C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:3996
        • C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
          "C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
          4⤵
          • Executes dropped EXE
          • Checks SCSI registry key(s)
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          PID:3504
      • C:\Users\Admin\AppData\Local\Temp\e0cbefcb1af40c7d4aff4aca26621a98.exe
        "C:\Users\Admin\AppData\Local\Temp\e0cbefcb1af40c7d4aff4aca26621a98.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4904
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -nologo -noprofile
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4624
        • C:\Users\Admin\AppData\Local\Temp\e0cbefcb1af40c7d4aff4aca26621a98.exe
          "C:\Users\Admin\AppData\Local\Temp\e0cbefcb1af40c7d4aff4aca26621a98.exe"
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Checks for VirtualBox DLLs, possible anti-VM trick
          • Drops file in Windows directory
          • Modifies data under HKEY_USERS
          • Suspicious use of WriteProcessMemory
          PID:2392
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            5⤵
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            • Suspicious use of AdjustPrivilegeToken
            PID:2284
          • C:\Windows\system32\cmd.exe
            C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
            5⤵
              PID:3284
              • C:\Windows\system32\netsh.exe
                netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                6⤵
                • Modifies Windows Firewall
                PID:1760
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -nologo -noprofile
              5⤵
              • Drops file in System32 directory
              • Modifies data under HKEY_USERS
              • Suspicious use of AdjustPrivilegeToken
              PID:2056
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -nologo -noprofile
              5⤵
              • Drops file in System32 directory
              • Modifies data under HKEY_USERS
              • Suspicious use of AdjustPrivilegeToken
              PID:4412
            • C:\Windows\rss\csrss.exe
              C:\Windows\rss\csrss.exe
              5⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Manipulates WinMonFS driver.
              • Drops file in Windows directory
              PID:4732
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -nologo -noprofile
                6⤵
                • Drops file in System32 directory
                • Modifies data under HKEY_USERS
                PID:4616
              • C:\Windows\SYSTEM32\schtasks.exe
                schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                6⤵
                • Creates scheduled task(s)
                PID:2356
              • C:\Windows\SYSTEM32\schtasks.exe
                schtasks /delete /tn ScheduledUpdate /f
                6⤵
                  PID:2088
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -nologo -noprofile
                  6⤵
                  • Drops file in System32 directory
                  • Modifies data under HKEY_USERS
                  PID:1560
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -nologo -noprofile
                  6⤵
                  • Drops file in System32 directory
                  • Modifies data under HKEY_USERS
                  PID:1120
                • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                  C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                  6⤵
                  • Executes dropped EXE
                  PID:4316
                • C:\Windows\SYSTEM32\schtasks.exe
                  schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                  6⤵
                  • Creates scheduled task(s)
                  PID:4500
                • C:\Windows\windefender.exe
                  "C:\Windows\windefender.exe"
                  6⤵
                  • Executes dropped EXE
                  PID:3556
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                    7⤵
                      PID:1256
                      • C:\Windows\SysWOW64\sc.exe
                        sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                        8⤵
                        • Launches sc.exe
                        PID:2020
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4904 -s 648
                4⤵
                • Program crash
                PID:972
            • C:\Users\Admin\AppData\Local\Temp\kos4.exe
              "C:\Users\Admin\AppData\Local\Temp\kos4.exe"
              3⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:5060
              • C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
                "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
                4⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:4920
                • C:\Users\Admin\AppData\Local\Temp\is-L8HNH.tmp\LzmwAqmV.tmp
                  "C:\Users\Admin\AppData\Local\Temp\is-L8HNH.tmp\LzmwAqmV.tmp" /SL5="$501D4,2889973,140800,C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
                  5⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Drops file in Program Files directory
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of WriteProcessMemory
                  PID:4304
                  • C:\Windows\SysWOW64\net.exe
                    "C:\Windows\system32\net.exe" helpmsg 31
                    6⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2284
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 helpmsg 31
                      7⤵
                        PID:4632
                    • C:\Program Files (x86)\Radio Station 1.7.10.31\SRadioStation.exe
                      "C:\Program Files (x86)\Radio Station 1.7.10.31\SRadioStation.exe" -i
                      6⤵
                      • Executes dropped EXE
                      PID:4864
                    • C:\Program Files (x86)\Radio Station 1.7.10.31\SRadioStation.exe
                      "C:\Program Files (x86)\Radio Station 1.7.10.31\SRadioStation.exe" -s
                      6⤵
                      • Executes dropped EXE
                      PID:2776
              • C:\Users\Admin\AppData\Local\Temp\latestX.exe
                "C:\Users\Admin\AppData\Local\Temp\latestX.exe"
                3⤵
                • Suspicious use of NtCreateUserProcessOtherParentProcess
                • Drops file in Drivers directory
                • Executes dropped EXE
                • Drops file in Program Files directory
                PID:2260
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
              2⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:1928
            • C:\Windows\System32\cmd.exe
              C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:1716
              • C:\Windows\System32\sc.exe
                sc stop UsoSvc
                3⤵
                • Launches sc.exe
                PID:3480
              • C:\Windows\System32\sc.exe
                sc stop WaaSMedicSvc
                3⤵
                • Launches sc.exe
                PID:3040
              • C:\Windows\System32\sc.exe
                sc stop wuauserv
                3⤵
                • Launches sc.exe
                PID:4996
              • C:\Windows\System32\sc.exe
                sc stop bits
                3⤵
                • Launches sc.exe
                • Suspicious use of WriteProcessMemory
                PID:3284
              • C:\Windows\System32\sc.exe
                sc stop dosvc
                3⤵
                • Launches sc.exe
                PID:2384
            • C:\Windows\System32\cmd.exe
              C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
              2⤵
                PID:1768
                • C:\Windows\System32\powercfg.exe
                  powercfg /x -hibernate-timeout-ac 0
                  3⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4772
                • C:\Windows\System32\powercfg.exe
                  powercfg /x -hibernate-timeout-dc 0
                  3⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4884
                • C:\Windows\System32\powercfg.exe
                  powercfg /x -standby-timeout-ac 0
                  3⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2816
                • C:\Windows\System32\powercfg.exe
                  powercfg /x -standby-timeout-dc 0
                  3⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4840
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
                2⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:788
              • C:\Windows\System32\schtasks.exe
                C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
                2⤵
                  PID:4224
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
                  2⤵
                  • Drops file in System32 directory
                  • Modifies data under HKEY_USERS
                  PID:2660
                • C:\Windows\System32\cmd.exe
                  C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
                  2⤵
                    PID:4352
                    • C:\Windows\System32\sc.exe
                      sc stop UsoSvc
                      3⤵
                      • Launches sc.exe
                      PID:1048
                    • C:\Windows\System32\sc.exe
                      sc stop WaaSMedicSvc
                      3⤵
                      • Launches sc.exe
                      PID:3992
                    • C:\Windows\System32\sc.exe
                      sc stop wuauserv
                      3⤵
                      • Launches sc.exe
                      PID:2640
                    • C:\Windows\System32\sc.exe
                      sc stop bits
                      3⤵
                      • Launches sc.exe
                      PID:4652
                    • C:\Windows\System32\sc.exe
                      sc stop dosvc
                      3⤵
                      • Launches sc.exe
                      PID:4180
                  • C:\Windows\System32\cmd.exe
                    C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
                    2⤵
                      PID:3380
                      • C:\Windows\System32\powercfg.exe
                        powercfg /x -hibernate-timeout-ac 0
                        3⤵
                          PID:3040
                        • C:\Windows\System32\powercfg.exe
                          powercfg /x -hibernate-timeout-dc 0
                          3⤵
                            PID:836
                          • C:\Windows\System32\powercfg.exe
                            powercfg /x -standby-timeout-ac 0
                            3⤵
                              PID:2940
                            • C:\Windows\System32\powercfg.exe
                              powercfg /x -standby-timeout-dc 0
                              3⤵
                                PID:2696
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
                              2⤵
                              • Drops file in System32 directory
                              • Modifies data under HKEY_USERS
                              PID:3824
                            • C:\Windows\System32\conhost.exe
                              C:\Windows\System32\conhost.exe
                              2⤵
                                PID:2928
                              • C:\Windows\explorer.exe
                                C:\Windows\explorer.exe
                                2⤵
                                  PID:2988
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4904 -ip 4904
                                1⤵
                                  PID:2356
                                • C:\Program Files\Google\Chrome\updater.exe
                                  "C:\Program Files\Google\Chrome\updater.exe"
                                  1⤵
                                  • Suspicious use of NtCreateUserProcessOtherParentProcess
                                  • Drops file in Drivers directory
                                  • Executes dropped EXE
                                  • Suspicious use of SetThreadContext
                                  • Drops file in Program Files directory
                                  PID:2916
                                • C:\Windows\windefender.exe
                                  C:\Windows\windefender.exe
                                  1⤵
                                  • Executes dropped EXE
                                  • Modifies data under HKEY_USERS
                                  PID:4328

                                Network

                                MITRE ATT&CK Enterprise v15

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Program Files (x86)\Radio Station 1.7.10.31\SRadioStation.exe

                                  Filesize

                                  1.8MB

                                  MD5

                                  4af1e45b3a6e7f3528377bd11bd83a36

                                  SHA1

                                  67fa29d1119981ef8a0d935ad1f9e78dd87ad0ab

                                  SHA256

                                  3ee8b0739ee4fa15526c4e68cd473797f19df2fdd54c7b302b886869c7030b54

                                  SHA512

                                  6a25cd8eae614c4b8519098198dc0d2ea84fcde0bafaaa3ab0b043c4457c2b367ccbfe0831bfcb12cf2f7524b8fcbef90b47068572a11529c06fce21dba2a9ad

                                • C:\Program Files (x86)\Radio Station 1.7.10.31\SRadioStation.exe

                                  Filesize

                                  1.8MB

                                  MD5

                                  4af1e45b3a6e7f3528377bd11bd83a36

                                  SHA1

                                  67fa29d1119981ef8a0d935ad1f9e78dd87ad0ab

                                  SHA256

                                  3ee8b0739ee4fa15526c4e68cd473797f19df2fdd54c7b302b886869c7030b54

                                  SHA512

                                  6a25cd8eae614c4b8519098198dc0d2ea84fcde0bafaaa3ab0b043c4457c2b367ccbfe0831bfcb12cf2f7524b8fcbef90b47068572a11529c06fce21dba2a9ad

                                • C:\Program Files (x86)\Radio Station 1.7.10.31\SRadioStation.exe

                                  Filesize

                                  1.8MB

                                  MD5

                                  4af1e45b3a6e7f3528377bd11bd83a36

                                  SHA1

                                  67fa29d1119981ef8a0d935ad1f9e78dd87ad0ab

                                  SHA256

                                  3ee8b0739ee4fa15526c4e68cd473797f19df2fdd54c7b302b886869c7030b54

                                  SHA512

                                  6a25cd8eae614c4b8519098198dc0d2ea84fcde0bafaaa3ab0b043c4457c2b367ccbfe0831bfcb12cf2f7524b8fcbef90b47068572a11529c06fce21dba2a9ad

                                • C:\Program Files\Google\Chrome\updater.exe

                                  Filesize

                                  5.6MB

                                  MD5

                                  bae29e49e8190bfbbf0d77ffab8de59d

                                  SHA1

                                  4a6352bb47c7e1666a60c76f9b17ca4707872bd9

                                  SHA256

                                  f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87

                                  SHA512

                                  9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2

                                • C:\Program Files\Google\Chrome\updater.exe

                                  Filesize

                                  5.6MB

                                  MD5

                                  bae29e49e8190bfbbf0d77ffab8de59d

                                  SHA1

                                  4a6352bb47c7e1666a60c76f9b17ca4707872bd9

                                  SHA256

                                  f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87

                                  SHA512

                                  9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2

                                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                  Filesize

                                  2KB

                                  MD5

                                  d85ba6ff808d9e5444a4b369f5bc2730

                                  SHA1

                                  31aa9d96590fff6981b315e0b391b575e4c0804a

                                  SHA256

                                  84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                  SHA512

                                  8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                  Filesize

                                  944B

                                  MD5

                                  2e907f77659a6601fcc408274894da2e

                                  SHA1

                                  9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

                                  SHA256

                                  385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

                                  SHA512

                                  34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

                                • C:\Users\Admin\AppData\Local\Temp\Broom.exe

                                  Filesize

                                  5.3MB

                                  MD5

                                  00e93456aa5bcf9f60f84b0c0760a212

                                  SHA1

                                  6096890893116e75bd46fea0b8c3921ceb33f57d

                                  SHA256

                                  ff3025f9cf19323c5972d14f00f01296d6d7a71547eca7e4016bfd0e1f27b504

                                  SHA512

                                  abd2be819c7d93bd6097155cf84eaf803e3133a7e0ca71f9d9cbc3c65e4e4a26415d2523a36adafdd19b0751e25ea1a99b8d060cad61cdfd1f79adf9cd4b4eca

                                • C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe

                                  Filesize

                                  2.5MB

                                  MD5

                                  d04b3ad7f47bdbd80c23a91436096fc6

                                  SHA1

                                  dfe98b3bbcac34e4f55d8e1f30503f1caba7f099

                                  SHA256

                                  994a1ebecf6350718dc003473441d89bb493c8a79bbce8622b562fc2c0ca2757

                                  SHA512

                                  0777d9bb0448615e7f694b1c1e3f0a5aa2f84d8638e77f349167c2d6eb7ee27709d68b581b09c122182e85b1ccbbfd89767308457219c5c67fe613212ff47d58

                                • C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe

                                  Filesize

                                  2.5MB

                                  MD5

                                  d04b3ad7f47bdbd80c23a91436096fc6

                                  SHA1

                                  dfe98b3bbcac34e4f55d8e1f30503f1caba7f099

                                  SHA256

                                  994a1ebecf6350718dc003473441d89bb493c8a79bbce8622b562fc2c0ca2757

                                  SHA512

                                  0777d9bb0448615e7f694b1c1e3f0a5aa2f84d8638e77f349167c2d6eb7ee27709d68b581b09c122182e85b1ccbbfd89767308457219c5c67fe613212ff47d58

                                • C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe

                                  Filesize

                                  2.5MB

                                  MD5

                                  d04b3ad7f47bdbd80c23a91436096fc6

                                  SHA1

                                  dfe98b3bbcac34e4f55d8e1f30503f1caba7f099

                                  SHA256

                                  994a1ebecf6350718dc003473441d89bb493c8a79bbce8622b562fc2c0ca2757

                                  SHA512

                                  0777d9bb0448615e7f694b1c1e3f0a5aa2f84d8638e77f349167c2d6eb7ee27709d68b581b09c122182e85b1ccbbfd89767308457219c5c67fe613212ff47d58

                                • C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe

                                  Filesize

                                  3.1MB

                                  MD5

                                  ceb311f59f6a53c535dc69ee474f2d1d

                                  SHA1

                                  9b30cfb167003e07231cd9f5592b72fc8f6f7a73

                                  SHA256

                                  1b09fe297ab295025bcc7b84d085432e3feb0eafa06135f7b0fe0188a25d4360

                                  SHA512

                                  26db3a59e788f8dda848ae526a1c887198df80e2577015bd3279fe0f3251cf0842f7a46e7ea6e94be5f103ce4bd54386fe08db58825b3411f435af54e60edfeb

                                • C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe

                                  Filesize

                                  3.1MB

                                  MD5

                                  ceb311f59f6a53c535dc69ee474f2d1d

                                  SHA1

                                  9b30cfb167003e07231cd9f5592b72fc8f6f7a73

                                  SHA256

                                  1b09fe297ab295025bcc7b84d085432e3feb0eafa06135f7b0fe0188a25d4360

                                  SHA512

                                  26db3a59e788f8dda848ae526a1c887198df80e2577015bd3279fe0f3251cf0842f7a46e7ea6e94be5f103ce4bd54386fe08db58825b3411f435af54e60edfeb

                                • C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe

                                  Filesize

                                  3.1MB

                                  MD5

                                  ceb311f59f6a53c535dc69ee474f2d1d

                                  SHA1

                                  9b30cfb167003e07231cd9f5592b72fc8f6f7a73

                                  SHA256

                                  1b09fe297ab295025bcc7b84d085432e3feb0eafa06135f7b0fe0188a25d4360

                                  SHA512

                                  26db3a59e788f8dda848ae526a1c887198df80e2577015bd3279fe0f3251cf0842f7a46e7ea6e94be5f103ce4bd54386fe08db58825b3411f435af54e60edfeb

                                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rvkoyofe.4qt.ps1

                                  Filesize

                                  60B

                                  MD5

                                  d17fe0a3f47be24a6453e9ef58c94641

                                  SHA1

                                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                  SHA256

                                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                  SHA512

                                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

                                  Filesize

                                  281KB

                                  MD5

                                  d98e33b66343e7c96158444127a117f6

                                  SHA1

                                  bb716c5509a2bf345c6c1152f6e3e1452d39d50d

                                  SHA256

                                  5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

                                  SHA512

                                  705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

                                • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

                                  Filesize

                                  281KB

                                  MD5

                                  d98e33b66343e7c96158444127a117f6

                                  SHA1

                                  bb716c5509a2bf345c6c1152f6e3e1452d39d50d

                                  SHA256

                                  5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

                                  SHA512

                                  705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

                                • C:\Users\Admin\AppData\Local\Temp\e0cbefcb1af40c7d4aff4aca26621a98.exe

                                  Filesize

                                  4.1MB

                                  MD5

                                  6725367cdcecead21e3bb16f2c147fc5

                                  SHA1

                                  d9634b52918cae903ab33cf5e95cec4e2d68887a

                                  SHA256

                                  cb935fddf7319e8608578e21e898abc9b1638b4608b8865483e429350e208a80

                                  SHA512

                                  1583b53edceb75399bfd3a58cd1b6841ffbc4c6590ef1d6599a7f8e788ab96425871499d91c1cebe68bf3bb69c70636cb8f6acda8246aaa210c1ab110b4e39ef

                                • C:\Users\Admin\AppData\Local\Temp\e0cbefcb1af40c7d4aff4aca26621a98.exe

                                  Filesize

                                  4.1MB

                                  MD5

                                  6725367cdcecead21e3bb16f2c147fc5

                                  SHA1

                                  d9634b52918cae903ab33cf5e95cec4e2d68887a

                                  SHA256

                                  cb935fddf7319e8608578e21e898abc9b1638b4608b8865483e429350e208a80

                                  SHA512

                                  1583b53edceb75399bfd3a58cd1b6841ffbc4c6590ef1d6599a7f8e788ab96425871499d91c1cebe68bf3bb69c70636cb8f6acda8246aaa210c1ab110b4e39ef

                                • C:\Users\Admin\AppData\Local\Temp\e0cbefcb1af40c7d4aff4aca26621a98.exe

                                  Filesize

                                  4.1MB

                                  MD5

                                  6725367cdcecead21e3bb16f2c147fc5

                                  SHA1

                                  d9634b52918cae903ab33cf5e95cec4e2d68887a

                                  SHA256

                                  cb935fddf7319e8608578e21e898abc9b1638b4608b8865483e429350e208a80

                                  SHA512

                                  1583b53edceb75399bfd3a58cd1b6841ffbc4c6590ef1d6599a7f8e788ab96425871499d91c1cebe68bf3bb69c70636cb8f6acda8246aaa210c1ab110b4e39ef

                                • C:\Users\Admin\AppData\Local\Temp\e0cbefcb1af40c7d4aff4aca26621a98.exe

                                  Filesize

                                  4.1MB

                                  MD5

                                  6725367cdcecead21e3bb16f2c147fc5

                                  SHA1

                                  d9634b52918cae903ab33cf5e95cec4e2d68887a

                                  SHA256

                                  cb935fddf7319e8608578e21e898abc9b1638b4608b8865483e429350e208a80

                                  SHA512

                                  1583b53edceb75399bfd3a58cd1b6841ffbc4c6590ef1d6599a7f8e788ab96425871499d91c1cebe68bf3bb69c70636cb8f6acda8246aaa210c1ab110b4e39ef

                                • C:\Users\Admin\AppData\Local\Temp\is-5RA3P.tmp\_isetup\_iscrypt.dll

                                  Filesize

                                  2KB

                                  MD5

                                  a69559718ab506675e907fe49deb71e9

                                  SHA1

                                  bc8f404ffdb1960b50c12ff9413c893b56f2e36f

                                  SHA256

                                  2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

                                  SHA512

                                  e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

                                • C:\Users\Admin\AppData\Local\Temp\is-L8HNH.tmp\LzmwAqmV.tmp

                                  Filesize

                                  765KB

                                  MD5

                                  341906c92fadb3f43dfdbbf75672e2ad

                                  SHA1

                                  01e846f2371b38783213847406b65da7b578067f

                                  SHA256

                                  730df656be167f02b4e107bf2e0ceb3352b2c333c4212e6aef4feccd04d4e3c2

                                  SHA512

                                  b7a842a35b729e6efbae2c13e0bb055b0a34c395f23e115a9fc13f475cf3d505ea5274be6bb6ba81404b66e19f7c4eb60e010124f59ea44a5912c129bd18340e

                                • C:\Users\Admin\AppData\Local\Temp\is-L8HNH.tmp\LzmwAqmV.tmp

                                  Filesize

                                  765KB

                                  MD5

                                  341906c92fadb3f43dfdbbf75672e2ad

                                  SHA1

                                  01e846f2371b38783213847406b65da7b578067f

                                  SHA256

                                  730df656be167f02b4e107bf2e0ceb3352b2c333c4212e6aef4feccd04d4e3c2

                                  SHA512

                                  b7a842a35b729e6efbae2c13e0bb055b0a34c395f23e115a9fc13f475cf3d505ea5274be6bb6ba81404b66e19f7c4eb60e010124f59ea44a5912c129bd18340e

                                • C:\Users\Admin\AppData\Local\Temp\kos4.exe

                                  Filesize

                                  8KB

                                  MD5

                                  01707599b37b1216e43e84ae1f0d8c03

                                  SHA1

                                  521fe10ac55a1f89eba7b8e82e49407b02b0dcb2

                                  SHA256

                                  cc0dbc1d31ccd9488695b690bd7e7aa4a90ba4b2a5d23ef48b296465f5aa44dd

                                  SHA512

                                  9f9ff29a12d26a7d42656e0faf970c908f1ef428b14e5a5fe7acd06371b96b16eb984e8fbee4e2b906c6db7fb39c9d4a221e79fc3d5e9ca9b59e377875bc5642

                                • C:\Users\Admin\AppData\Local\Temp\kos4.exe

                                  Filesize

                                  8KB

                                  MD5

                                  01707599b37b1216e43e84ae1f0d8c03

                                  SHA1

                                  521fe10ac55a1f89eba7b8e82e49407b02b0dcb2

                                  SHA256

                                  cc0dbc1d31ccd9488695b690bd7e7aa4a90ba4b2a5d23ef48b296465f5aa44dd

                                  SHA512

                                  9f9ff29a12d26a7d42656e0faf970c908f1ef428b14e5a5fe7acd06371b96b16eb984e8fbee4e2b906c6db7fb39c9d4a221e79fc3d5e9ca9b59e377875bc5642

                                • C:\Users\Admin\AppData\Local\Temp\kos4.exe

                                  Filesize

                                  8KB

                                  MD5

                                  01707599b37b1216e43e84ae1f0d8c03

                                  SHA1

                                  521fe10ac55a1f89eba7b8e82e49407b02b0dcb2

                                  SHA256

                                  cc0dbc1d31ccd9488695b690bd7e7aa4a90ba4b2a5d23ef48b296465f5aa44dd

                                  SHA512

                                  9f9ff29a12d26a7d42656e0faf970c908f1ef428b14e5a5fe7acd06371b96b16eb984e8fbee4e2b906c6db7fb39c9d4a221e79fc3d5e9ca9b59e377875bc5642

                                • C:\Users\Admin\AppData\Local\Temp\latestX.exe

                                  Filesize

                                  5.6MB

                                  MD5

                                  bae29e49e8190bfbbf0d77ffab8de59d

                                  SHA1

                                  4a6352bb47c7e1666a60c76f9b17ca4707872bd9

                                  SHA256

                                  f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87

                                  SHA512

                                  9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2

                                • C:\Users\Admin\AppData\Local\Temp\latestX.exe

                                  Filesize

                                  5.6MB

                                  MD5

                                  bae29e49e8190bfbbf0d77ffab8de59d

                                  SHA1

                                  4a6352bb47c7e1666a60c76f9b17ca4707872bd9

                                  SHA256

                                  f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87

                                  SHA512

                                  9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2

                                • C:\Users\Admin\AppData\Local\Temp\latestX.exe

                                  Filesize

                                  5.6MB

                                  MD5

                                  bae29e49e8190bfbbf0d77ffab8de59d

                                  SHA1

                                  4a6352bb47c7e1666a60c76f9b17ca4707872bd9

                                  SHA256

                                  f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87

                                  SHA512

                                  9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2

                                • C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

                                  Filesize

                                  207KB

                                  MD5

                                  5ff398981d2edc3bca2e1ed053090c9a

                                  SHA1

                                  7c0b3b52bbeec3b6370c38f47eb85a75ee92be3b

                                  SHA256

                                  13c420fc4656cb4eff23d8901c1777434ee40157122f3941a92eef5b7aceefaf

                                  SHA512

                                  4609cf82ea7dbacff3fce41da8dc29467dc348f336998f1f79c85e82261947c686ba39a77c3a4a9321596d55fb73a7c5e6aab026748fb9b3be01d45099075de4

                                • C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

                                  Filesize

                                  207KB

                                  MD5

                                  5ff398981d2edc3bca2e1ed053090c9a

                                  SHA1

                                  7c0b3b52bbeec3b6370c38f47eb85a75ee92be3b

                                  SHA256

                                  13c420fc4656cb4eff23d8901c1777434ee40157122f3941a92eef5b7aceefaf

                                  SHA512

                                  4609cf82ea7dbacff3fce41da8dc29467dc348f336998f1f79c85e82261947c686ba39a77c3a4a9321596d55fb73a7c5e6aab026748fb9b3be01d45099075de4

                                • C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

                                  Filesize

                                  207KB

                                  MD5

                                  5ff398981d2edc3bca2e1ed053090c9a

                                  SHA1

                                  7c0b3b52bbeec3b6370c38f47eb85a75ee92be3b

                                  SHA256

                                  13c420fc4656cb4eff23d8901c1777434ee40157122f3941a92eef5b7aceefaf

                                  SHA512

                                  4609cf82ea7dbacff3fce41da8dc29467dc348f336998f1f79c85e82261947c686ba39a77c3a4a9321596d55fb73a7c5e6aab026748fb9b3be01d45099075de4

                                • C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

                                  Filesize

                                  207KB

                                  MD5

                                  5ff398981d2edc3bca2e1ed053090c9a

                                  SHA1

                                  7c0b3b52bbeec3b6370c38f47eb85a75ee92be3b

                                  SHA256

                                  13c420fc4656cb4eff23d8901c1777434ee40157122f3941a92eef5b7aceefaf

                                  SHA512

                                  4609cf82ea7dbacff3fce41da8dc29467dc348f336998f1f79c85e82261947c686ba39a77c3a4a9321596d55fb73a7c5e6aab026748fb9b3be01d45099075de4

                                • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                  Filesize

                                  2KB

                                  MD5

                                  968cb9309758126772781b83adb8a28f

                                  SHA1

                                  8da30e71accf186b2ba11da1797cf67f8f78b47c

                                  SHA256

                                  92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

                                  SHA512

                                  4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

                                • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                                  Filesize

                                  19KB

                                  MD5

                                  875d10d7cb37a9dbd8a9a9989e5016ea

                                  SHA1

                                  e47fd3014005bb28c63eeaf27c465defccaab5af

                                  SHA256

                                  1b6b99589d7710d91cc84f7ea8ba38eb4ab8b284936b5b39e4d025b4b403d816

                                  SHA512

                                  6a2ff9fe5416657e532b294c21a2e2f722c29096877c89f555d19137a564d6d8274be4c3c37bf3b40fb32330966a7c062f1fba71f4f05cc46e70331069160744

                                • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                                  Filesize

                                  19KB

                                  MD5

                                  80b95ac27d1505c6f1c152cdbb26d172

                                  SHA1

                                  7dd668b9aea5fb344c38a350782144b757e797b8

                                  SHA256

                                  5ccdd1dcb4e7c70f84afd2d1505bd1fa113f58f2f4b7cefe481dd12882421653

                                  SHA512

                                  4126981c368a40f4a9c3e6a7416567f89463a7236975b81aeb2962c05af3c1133d8842a409afe4f7d52ef81a02aad6c4e76852e6c6960adde6eea63fd5fb5841

                                • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                                  Filesize

                                  19KB

                                  MD5

                                  df57d9a149c6a4a5cd56cb918dccfb7d

                                  SHA1

                                  41d7e46fcbaef4e6f0c403b292ecb130c19158b7

                                  SHA256

                                  d81dcd9dff3a37187e3b3aee20ca51656be8d7615b05094055d2a210b77cdb5f

                                  SHA512

                                  96f4c0a0ef72bbd7f0374c1fd80ef5f11fb752d6c527d4e3a803e7c07c11e987f9a524a6055e250feb239f2f87dcea1bacf9caf4718301c3c1ced9516bbbe824

                                • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                                  Filesize

                                  19KB

                                  MD5

                                  b69f831a29cefe85cff2bd8703815eb8

                                  SHA1

                                  205e28844b5b0b2083d5e8aaa33c8d911d1f0112

                                  SHA256

                                  6b59ea1703e5ef15bbc5a3957a8b320ce7f4a3c68b8a89aba0b521569982671e

                                  SHA512

                                  b00885cddc5969bd7249e23458648504188ba302fc6cedb7703d86223e7b10178d37e013503043147d536f1eb587af1ed4e682706b5242c1eb9b4ebb2521be37

                                • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                                  Filesize

                                  19KB

                                  MD5

                                  95e094a64e4bba8ab9a025d2efe7774c

                                  SHA1

                                  fd27bd2429f0ed22c1f4f22b099b7ab88a2d9029

                                  SHA256

                                  9bc53698abd49f569e5554b981c1e23a1cc6ff8fc4865b5839cb36b208ee31f5

                                  SHA512

                                  0d7dca962a556c12ca3e3634d26edc829ea587e87b276b172c341f0815ab7461cff9d53108f367b7c8c02de798c500e61a74893730bbc5cb73ec80c4654ef9c8

                                • C:\Windows\System32\drivers\etc\hosts

                                  Filesize

                                  3KB

                                  MD5

                                  00930b40cba79465b7a38ed0449d1449

                                  SHA1

                                  4b25a89ee28b20ba162f23772ddaf017669092a5

                                  SHA256

                                  eda1aae2c8fce700e3bdbe0186cf3db88400cf0ac13ec736e84dacba61628a01

                                  SHA512

                                  cbe4760ec041e7da7ab86474d5c82969cfccb8ccc5dbdac9436862d5b1b86210ab90754d3c8da5724176570d8842e57a716a281acba8719e90098a6f61a17c62

                                • C:\Windows\rss\csrss.exe

                                  Filesize

                                  4.1MB

                                  MD5

                                  6725367cdcecead21e3bb16f2c147fc5

                                  SHA1

                                  d9634b52918cae903ab33cf5e95cec4e2d68887a

                                  SHA256

                                  cb935fddf7319e8608578e21e898abc9b1638b4608b8865483e429350e208a80

                                  SHA512

                                  1583b53edceb75399bfd3a58cd1b6841ffbc4c6590ef1d6599a7f8e788ab96425871499d91c1cebe68bf3bb69c70636cb8f6acda8246aaa210c1ab110b4e39ef

                                • C:\Windows\rss\csrss.exe

                                  Filesize

                                  4.1MB

                                  MD5

                                  6725367cdcecead21e3bb16f2c147fc5

                                  SHA1

                                  d9634b52918cae903ab33cf5e95cec4e2d68887a

                                  SHA256

                                  cb935fddf7319e8608578e21e898abc9b1638b4608b8865483e429350e208a80

                                  SHA512

                                  1583b53edceb75399bfd3a58cd1b6841ffbc4c6590ef1d6599a7f8e788ab96425871499d91c1cebe68bf3bb69c70636cb8f6acda8246aaa210c1ab110b4e39ef

                                • C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                  Filesize

                                  4KB

                                  MD5

                                  bdb25c22d14ec917e30faf353826c5de

                                  SHA1

                                  6c2feb9cea9237bc28842ebf2fea68b3bd7ad190

                                  SHA256

                                  e3274ce8296f2cd20e3189576fbadbfa0f1817cdf313487945c80e968589a495

                                  SHA512

                                  b5eddbfd4748298a302e2963cfd12d849130b6dcb8f0f85a2a623caed0ff9bd88f4ec726f646dbebfca4964adc35f882ec205113920cb546cc08193739d6728c

                                • C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                  Filesize

                                  1KB

                                  MD5

                                  b42c70c1dbf0d1d477ec86902db9e986

                                  SHA1

                                  1d1c0a670748b3d10bee8272e5d67a4fabefd31f

                                  SHA256

                                  8ed3b348989cdc967d1fc0e887b2a2f5a656680d8d14ebd3cb71a10c2f55867a

                                  SHA512

                                  57fb278a8b2e83d01fac2a031c90e0e2bd5e4c1a360cfa4308490eb07e1b9d265b1f28399d0f10b141a6438ba92dd5f9ce4f18530ec277fece0eb7678041cbc5

                                • C:\Windows\system32\drivers\etc\hosts

                                  Filesize

                                  3KB

                                  MD5

                                  00930b40cba79465b7a38ed0449d1449

                                  SHA1

                                  4b25a89ee28b20ba162f23772ddaf017669092a5

                                  SHA256

                                  eda1aae2c8fce700e3bdbe0186cf3db88400cf0ac13ec736e84dacba61628a01

                                  SHA512

                                  cbe4760ec041e7da7ab86474d5c82969cfccb8ccc5dbdac9436862d5b1b86210ab90754d3c8da5724176570d8842e57a716a281acba8719e90098a6f61a17c62

                                • C:\Windows\windefender.exe

                                  Filesize

                                  2.0MB

                                  MD5

                                  8e67f58837092385dcf01e8a2b4f5783

                                  SHA1

                                  012c49cfd8c5d06795a6f67ea2baf2a082cf8625

                                  SHA256

                                  166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

                                  SHA512

                                  40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

                                • C:\Windows\windefender.exe

                                  Filesize

                                  2.0MB

                                  MD5

                                  8e67f58837092385dcf01e8a2b4f5783

                                  SHA1

                                  012c49cfd8c5d06795a6f67ea2baf2a082cf8625

                                  SHA256

                                  166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

                                  SHA512

                                  40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

                                • C:\Windows\windefender.exe

                                  Filesize

                                  2.0MB

                                  MD5

                                  8e67f58837092385dcf01e8a2b4f5783

                                  SHA1

                                  012c49cfd8c5d06795a6f67ea2baf2a082cf8625

                                  SHA256

                                  166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

                                  SHA512

                                  40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

                                • memory/1764-0-0x0000000074630000-0x0000000074DE0000-memory.dmp

                                  Filesize

                                  7.7MB

                                • memory/1764-1-0x00000000004A0000-0x0000000001120000-memory.dmp

                                  Filesize

                                  12.5MB

                                • memory/1764-50-0x0000000074630000-0x0000000074DE0000-memory.dmp

                                  Filesize

                                  7.7MB

                                • memory/2260-162-0x00007FF77D550000-0x00007FF77DAF1000-memory.dmp

                                  Filesize

                                  5.6MB

                                • memory/2260-355-0x00007FF77D550000-0x00007FF77DAF1000-memory.dmp

                                  Filesize

                                  5.6MB

                                • memory/2284-212-0x0000000002400000-0x0000000002410000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/2284-213-0x00000000053F0000-0x0000000005744000-memory.dmp

                                  Filesize

                                  3.3MB

                                • memory/2284-211-0x0000000073060000-0x0000000073810000-memory.dmp

                                  Filesize

                                  7.7MB

                                • memory/2284-223-0x0000000005D50000-0x0000000005D9C000-memory.dmp

                                  Filesize

                                  304KB

                                • memory/2284-224-0x0000000002400000-0x0000000002410000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/2284-225-0x000000007EF00000-0x000000007EF10000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/2284-226-0x0000000072060000-0x00000000720AC000-memory.dmp

                                  Filesize

                                  304KB

                                • memory/2392-207-0x0000000002C50000-0x0000000003053000-memory.dmp

                                  Filesize

                                  4.0MB

                                • memory/2392-248-0x0000000000400000-0x0000000000D1B000-memory.dmp

                                  Filesize

                                  9.1MB

                                • memory/2392-208-0x0000000000400000-0x0000000000D1B000-memory.dmp

                                  Filesize

                                  9.1MB

                                • memory/2392-347-0x0000000000400000-0x0000000000D1B000-memory.dmp

                                  Filesize

                                  9.1MB

                                • memory/2776-246-0x0000000000400000-0x00000000005D4000-memory.dmp

                                  Filesize

                                  1.8MB

                                • memory/2776-567-0x0000000000400000-0x00000000005D4000-memory.dmp

                                  Filesize

                                  1.8MB

                                • memory/2776-165-0x0000000000400000-0x00000000005D4000-memory.dmp

                                  Filesize

                                  1.8MB

                                • memory/2776-430-0x0000000000400000-0x00000000005D4000-memory.dmp

                                  Filesize

                                  1.8MB

                                • memory/2776-356-0x0000000000400000-0x00000000005D4000-memory.dmp

                                  Filesize

                                  1.8MB

                                • memory/2776-130-0x0000000000400000-0x00000000005D4000-memory.dmp

                                  Filesize

                                  1.8MB

                                • memory/2776-487-0x0000000000910000-0x00000000009BD000-memory.dmp

                                  Filesize

                                  692KB

                                • memory/2776-485-0x0000000000400000-0x00000000005D4000-memory.dmp

                                  Filesize

                                  1.8MB

                                • memory/2776-203-0x0000000000400000-0x00000000005D4000-memory.dmp

                                  Filesize

                                  1.8MB

                                • memory/2776-471-0x0000000000400000-0x00000000005D4000-memory.dmp

                                  Filesize

                                  1.8MB

                                • memory/2916-431-0x00007FF7AF9C0000-0x00007FF7AFF61000-memory.dmp

                                  Filesize

                                  5.6MB

                                • memory/2916-565-0x00007FF7AF9C0000-0x00007FF7AFF61000-memory.dmp

                                  Filesize

                                  5.6MB

                                • memory/2988-566-0x0000000000EA0000-0x0000000000EC0000-memory.dmp

                                  Filesize

                                  128KB

                                • memory/3308-166-0x0000000002A00000-0x0000000002A16000-memory.dmp

                                  Filesize

                                  88KB

                                • memory/3504-135-0x0000000000400000-0x0000000000409000-memory.dmp

                                  Filesize

                                  36KB

                                • memory/3504-138-0x0000000000400000-0x0000000000409000-memory.dmp

                                  Filesize

                                  36KB

                                • memory/3504-167-0x0000000000400000-0x0000000000409000-memory.dmp

                                  Filesize

                                  36KB

                                • memory/3556-481-0x0000000000400000-0x00000000008DF000-memory.dmp

                                  Filesize

                                  4.9MB

                                • memory/3996-133-0x00000000008E0000-0x00000000009E0000-memory.dmp

                                  Filesize

                                  1024KB

                                • memory/3996-134-0x00000000023D0000-0x00000000023D9000-memory.dmp

                                  Filesize

                                  36KB

                                • memory/4304-177-0x0000000000400000-0x00000000004D0000-memory.dmp

                                  Filesize

                                  832KB

                                • memory/4304-85-0x0000000000640000-0x0000000000641000-memory.dmp

                                  Filesize

                                  4KB

                                • memory/4304-142-0x0000000000640000-0x0000000000641000-memory.dmp

                                  Filesize

                                  4KB

                                • memory/4420-125-0x0000000002730000-0x0000000002731000-memory.dmp

                                  Filesize

                                  4KB

                                • memory/4420-145-0x0000000000400000-0x0000000000965000-memory.dmp

                                  Filesize

                                  5.4MB

                                • memory/4420-51-0x0000000002730000-0x0000000002731000-memory.dmp

                                  Filesize

                                  4KB

                                • memory/4420-280-0x0000000000400000-0x0000000000965000-memory.dmp

                                  Filesize

                                  5.4MB

                                • memory/4420-517-0x0000000000400000-0x0000000000965000-memory.dmp

                                  Filesize

                                  5.4MB

                                • memory/4624-173-0x0000000007840000-0x00000000078B6000-memory.dmp

                                  Filesize

                                  472KB

                                • memory/4624-149-0x0000000005640000-0x0000000005662000-memory.dmp

                                  Filesize

                                  136KB

                                • memory/4624-202-0x0000000073060000-0x0000000073810000-memory.dmp

                                  Filesize

                                  7.7MB

                                • memory/4624-199-0x0000000007C60000-0x0000000007C68000-memory.dmp

                                  Filesize

                                  32KB

                                • memory/4624-198-0x0000000007D20000-0x0000000007D3A000-memory.dmp

                                  Filesize

                                  104KB

                                • memory/4624-197-0x0000000007C30000-0x0000000007C44000-memory.dmp

                                  Filesize

                                  80KB

                                • memory/4624-196-0x0000000007C20000-0x0000000007C2E000-memory.dmp

                                  Filesize

                                  56KB

                                • memory/4624-195-0x0000000007BE0000-0x0000000007BF1000-memory.dmp

                                  Filesize

                                  68KB

                                • memory/4624-194-0x0000000007C80000-0x0000000007D16000-memory.dmp

                                  Filesize

                                  600KB

                                • memory/4624-193-0x0000000007BC0000-0x0000000007BCA000-memory.dmp

                                  Filesize

                                  40KB

                                • memory/4624-192-0x0000000007AD0000-0x0000000007B73000-memory.dmp

                                  Filesize

                                  652KB

                                • memory/4624-191-0x0000000007A70000-0x0000000007A8E000-memory.dmp

                                  Filesize

                                  120KB

                                • memory/4624-181-0x0000000072170000-0x00000000724C4000-memory.dmp

                                  Filesize

                                  3.3MB

                                • memory/4624-180-0x0000000072010000-0x000000007205C000-memory.dmp

                                  Filesize

                                  304KB

                                • memory/4624-179-0x0000000007A90000-0x0000000007AC2000-memory.dmp

                                  Filesize

                                  200KB

                                • memory/4624-178-0x000000007F860000-0x000000007F870000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/4624-175-0x00000000078E0000-0x00000000078FA000-memory.dmp

                                  Filesize

                                  104KB

                                • memory/4624-174-0x0000000007F40000-0x00000000085BA000-memory.dmp

                                  Filesize

                                  6.5MB

                                • memory/4624-172-0x0000000002FD0000-0x0000000002FE0000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/4624-171-0x0000000006A80000-0x0000000006AC4000-memory.dmp

                                  Filesize

                                  272KB

                                • memory/4624-164-0x0000000006550000-0x000000000659C000-memory.dmp

                                  Filesize

                                  304KB

                                • memory/4624-163-0x0000000006520000-0x000000000653E000-memory.dmp

                                  Filesize

                                  120KB

                                • memory/4624-161-0x0000000006020000-0x0000000006374000-memory.dmp

                                  Filesize

                                  3.3MB

                                • memory/4624-156-0x0000000005EB0000-0x0000000005F16000-memory.dmp

                                  Filesize

                                  408KB

                                • memory/4624-150-0x0000000005E40000-0x0000000005EA6000-memory.dmp

                                  Filesize

                                  408KB

                                • memory/4624-143-0x0000000002F60000-0x0000000002F96000-memory.dmp

                                  Filesize

                                  216KB

                                • memory/4624-144-0x0000000073060000-0x0000000073810000-memory.dmp

                                  Filesize

                                  7.7MB

                                • memory/4624-148-0x0000000002FD0000-0x0000000002FE0000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/4624-147-0x0000000002FD0000-0x0000000002FE0000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/4624-146-0x0000000005670000-0x0000000005C98000-memory.dmp

                                  Filesize

                                  6.2MB

                                • memory/4732-484-0x0000000000400000-0x0000000000D1B000-memory.dmp

                                  Filesize

                                  9.1MB

                                • memory/4732-573-0x0000000000400000-0x0000000000D1B000-memory.dmp

                                  Filesize

                                  9.1MB

                                • memory/4732-470-0x0000000000400000-0x0000000000D1B000-memory.dmp

                                  Filesize

                                  9.1MB

                                • memory/4732-557-0x0000000000400000-0x0000000000D1B000-memory.dmp

                                  Filesize

                                  9.1MB

                                • memory/4732-413-0x0000000000400000-0x0000000000D1B000-memory.dmp

                                  Filesize

                                  9.1MB

                                • memory/4864-122-0x0000000000400000-0x00000000005D4000-memory.dmp

                                  Filesize

                                  1.8MB

                                • memory/4864-126-0x0000000000400000-0x00000000005D4000-memory.dmp

                                  Filesize

                                  1.8MB

                                • memory/4864-123-0x0000000000400000-0x00000000005D4000-memory.dmp

                                  Filesize

                                  1.8MB

                                • memory/4904-205-0x0000000000400000-0x0000000000D1B000-memory.dmp

                                  Filesize

                                  9.1MB

                                • memory/4904-132-0x0000000002A60000-0x0000000002E66000-memory.dmp

                                  Filesize

                                  4.0MB

                                • memory/4904-139-0x0000000000400000-0x0000000000D1B000-memory.dmp

                                  Filesize

                                  9.1MB

                                • memory/4904-69-0x0000000000400000-0x0000000000D1B000-memory.dmp

                                  Filesize

                                  9.1MB

                                • memory/4904-136-0x0000000002E70000-0x000000000375B000-memory.dmp

                                  Filesize

                                  8.9MB

                                • memory/4904-141-0x0000000000400000-0x0000000000D1B000-memory.dmp

                                  Filesize

                                  9.1MB

                                • memory/4904-63-0x0000000002E70000-0x000000000375B000-memory.dmp

                                  Filesize

                                  8.9MB

                                • memory/4904-62-0x0000000002A60000-0x0000000002E66000-memory.dmp

                                  Filesize

                                  4.0MB

                                • memory/4920-140-0x0000000000400000-0x0000000000429000-memory.dmp

                                  Filesize

                                  164KB

                                • memory/4920-68-0x0000000000400000-0x0000000000429000-memory.dmp

                                  Filesize

                                  164KB

                                • memory/5060-71-0x00007FFAAC230000-0x00007FFAACCF1000-memory.dmp

                                  Filesize

                                  10.8MB

                                • memory/5060-49-0x00007FFAAC230000-0x00007FFAACCF1000-memory.dmp

                                  Filesize

                                  10.8MB

                                • memory/5060-52-0x000000001B950000-0x000000001B960000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/5060-41-0x0000000000D20000-0x0000000000D28000-memory.dmp

                                  Filesize

                                  32KB